Port Cyber AlliancePort Cyber Alliance
Maritime Cybersecurity Alliance
Report an Incident
Connect your SIEM
Swagger
Github
Start
Who we protect

Cyber security for oil and gas terminals

Your industrial control systems can stop supply far beyond the port. Here are the documented risks.

Take the 2-minute test
See the launch offer
Your cyber risks

What public sources say about oil and gas terminals

Each card links to its source. We kept only what the sources say.

Ransomware and fuel supply
On 7 May 2021 a ransomware attack on Colonial Pipeline, in the United States, led to long lines at fuel stations across the eastern seaboard, as CISA recalled two years later.
Named in NIS2
NIS2 Annex I lists operators of oil transmission pipelines and of oil production, refining and treatment facilities, storage and transmission.
Offshore and port facilities
The U.S. Coast Guard rule of 17 January 2025 covers Outer Continental Shelf facilities and facilities regulated under the Maritime Transportation Security Act.
Buy OT that is secure by default
CISA and partner agencies list what OT owners should ask before buying: no default passwords, logging, MFA, patches you can trust.

Sources: CISA, The attack on Colonial Pipeline, two years on · EUR-Lex: Directive (EU) 2022/2555, Annex I · Federal Register, U.S. Coast Guard final rule, 17 January 2025 · CISA, Secure by Demand for OT owners and operators, 13 January 2025

Port terminal with gantry cranes at night
What PCA gives you

What Port Cyber Alliance gives you

Launch offer
Ten one-hour video calls of engineering advice and two site visits a year, for every member.
Engineer self-test
Twelve questions on access, network, detection and recovery. About two minutes, answers kept in your browser.
Team self-test
For whoever leads IT or operations: people, visibility, exercises and the logistics chain.
NIS2 in plain words
Who is covered, the ten Article 21 measures and the 24 h, 72 h and one-month deadlines, with the article numbers.
Choosing security tools
Questions to ask a vendor before you buy an OT product, from public guidance. No rankings.
Report an incident in confidence
Tell us what you see. We answer within one working day and help you prepare the next steps.
Open source

Open-source packages for oil and gas terminals

Free tools we build for port and terminal engineers. Some are public, the others we send on request. Open a card for the details.

  • Isometric illustration: Open detection rules (Sigma)

    AvailableCyber security

    Open detection rules (Sigma)

    Sigma rules that spot abnormal access to a terminal operating system, convertible for most SIEMs.

    Sigma · Windows Security log · pySigma · sigma-cli

    Details about Open detection rules (Sigma)
  • Isometric illustration: Vendor cyber questionnaire

    AvailableCyber security

    Vendor cyber questionnaire

    The cyber questions a terminal sends a software vendor, with an online form that sends nothing.

    YAML · JSON · PDF · HTML form

    Details about Vendor cyber questionnaire
  • Isometric illustration: Security advisories

    ComingCyber security

    Security advisories

    Advisories on port and container-logistics software, under coordinated disclosure, machine-readable.

    CVE JSON 5 · CVSS · CSAF 2.0 · OSV

    Details about Security advisories
  • Isometric illustration: CVE sync for WordPress

    ComingCyber security

    CVE sync for WordPress

    Mirror the CVE list into a WordPress site, filtered for port and terminal software.

    PHP · WordPress · WP-CLI · NVD API 2.0

    Details about CVE sync for WordPress
  • Isometric illustration: Error reporting

    ComingCyber security

    Error reporting

    Send errors and security events from your own port systems to a receiver you control, without personal data.

    JSON Schema · WordPress agent · HTTP receiver

    Details about Error reporting

See every package and how to get them

Isometric illustration: Maritime cyber toolkit

PublicCyber security

Maritime cyber toolkit

Copy-paste snippets that send your security events to the Port Cyber Alliance API.

For
SIEM, SOC and integration engineers, and their coding agents
Stack
curl · Python · JavaScript · PHP · Go · OpenAPI
Licence
See the repository
State
The code is on our public GitHub. Use it today.

What is in it today

  • One snippet per language reports an incident to POST /incidents and prints 201 on success
  • Generated from the PCA OpenAPI description, never hand-written
  • AGENTS.md: instructions an AI coding agent can follow to wire your SIEM unattended
  • Error table: 401 bad key, 422 bad schema, 429 over quota
View on GitHubTalk to us about itGet an API key
Isometric illustration: Open detection rules (Sigma)

AvailableCyber security

Open detection rules (Sigma)

Sigma rules that spot abnormal access to a terminal operating system, convertible for most SIEMs.

For
SOC teams and security officers of ports and terminals
Stack
Sigma · Windows Security log · pySigma · sigma-cli
Licence
DRL-1.1
State
Free to download from this site, with its tests. Use it today.

What is in it today

  • A remote desktop logon (event 4624, type 10) on a TOS server from outside the approved admin network
  • An account added to the local Administrators group (event 4732) of a TOS server
  • Validated with sigma-cli; sample events that must and must not match, with a test script

What it will never do

  • Carry a real host name, address or customer name: every value is an example you replace
Download the rules (zip)Talk to us about itRead how to deploy them
Isometric illustration: Vendor cyber questionnaire

AvailableCyber security

Vendor cyber questionnaire

The cyber questions a terminal sends a software vendor, with an online form that sends nothing.

For
IT and security teams of ports and terminals, and the software vendors who answer them
Stack
YAML · JSON · PDF · HTML form · JavaScript
Licence
CC-BY-4.0
State
Free to download from this site, with its tests. Use it today.

What is in it today

  • 34 questions in eight families (access, data, logs, backups, incidents, subcontractors, penetration tests, end of contract), one id each
  • An online form that runs in the browser only: answers stay on the device until exported as JSON or CSV
  • The same questionnaire in YAML, JSON and PDF, with the dated public sources behind each family
  • Questionnaire under CC BY 4.0, form script under MIT, README in the zip

What it will never do

  • Send your answers anywhere: the form has no server and blocks every network call
  • Certify a vendor
Download the questionnaire (zip)Talk to us about itRead how to use it
Isometric illustration: Post-deployment pentest regression scripts

AvailableCyber security

Post-deployment pentest regression scripts

Five shell probes that check, after every deployment, that fixed web findings have not come back.

For
Security and DevOps engineers who deploy web applications and APIs
Stack
bash · curl · GitHub Actions · GitLab CI
Licence
MIT
State
Free to download from this site, with its tests. Use it today.

What is in it today

  • Five probes: CORS origin reflection, WordPress login enumeration, hidden webhook route, health endpoint, build and commit endpoint
  • One request each, exit code 0 (holds), 1 (regressed) or 2 (usage error or unreachable, never a pass)
  • A runner for all five, GitHub Actions and GitLab CI examples
  • A self-test against a local test server: 13 cases, hardened and regressed

What it will never do

  • Replace a penetration test: they re-check five known fixes and find nothing new
  • Run against a system you do not own or are not authorised in writing to test
Download the scripts (zip)Talk to us about itRead how to run them
Isometric illustration: Port SIEM rules and cyber governance

ComingCyber security

Port SIEM rules and cyber governance

The Wazuh detection rules and decoders we write, with the written rules behind them.

For
Security officers and SOC teams of ports and terminals
Stack
Wazuh rules · Wazuh decoders · Markdown
Licence
To be decided
State
Specified, being built. Ask us to be told first.

What it will contain

  • Wazuh detection rules and decoders
  • Security policy and risk analysis templates
  • Patch delays by severity
  • Incident notification procedure, 24 h and 72 h (NIS2 article 23), and an incident register

What it will never do

  • Carry a secret, an IP address, a host name or a customer name
Get the package and talk to usSIEM and AI agents for ports
Isometric illustration: Security advisories

ComingCyber security

Security advisories

Advisories on port and container-logistics software, under coordinated disclosure, machine-readable.

For
Security teams of ports and terminals, and the software vendors they rely on
Stack
CVE JSON 5 · CVSS · CSAF 2.0 · OSV · RSS / JSON feeds
Licence
CC-BY-4.0
State
Specified, being built. Ask us to be told first.

What it will contain

  • A disclosure policy
  • Advisory ids PCA-YYYY-NNNN, linked to a CVE id when one is assigned
  • Machine-readable records and RSS / JSON feeds

What it will never do

  • Publish a vendor's vulnerability without coordinating with the vendor
Get the package and talk to usRead the advisories
Isometric illustration: CVE sync for WordPress

ComingCyber security

CVE sync for WordPress

Mirror the CVE list into a WordPress site, filtered for port and terminal software.

For
Teams that run a security or community website on WordPress
Stack
PHP · WordPress · WP-CLI · NVD API 2.0 · CVE JSON 5
Licence
GPL-2.0-or-later
State
Specified, being built. Ask us to be told first.

What it will contain

  • Tables for CVEs, products, watchlists, sync log and advisories
  • Full and delta sync run by the system cron, resumable and idempotent
  • Admin filters (vendors, keywords, severity) and public pages with structured data

What it will never do

  • Scan your WordPress for vulnerabilities: other plugins do that
Get the package and talk to us
Isometric illustration: Error reporting

ComingCyber security

Error reporting

Send errors and security events from your own port systems to a receiver you control, without personal data.

For
Engineers who run port web systems, WordPress first
Stack
JSON Schema · WordPress agent · HTTP receiver
Licence
To be decided
State
Specified, being built. Ask us to be told first.

What it will contain

  • An event envelope (JSON Schema)
  • A WordPress agent
  • A receiver: HTTP endpoint, grouping, alerts
  • Scrubbing: no IP address, no secret, no personal data leaves

What it will never do

  • Send personal data
  • Phone home to anyone you did not configure
Get the package and talk to us
Questions

Oil and gas: questions

Click a question to read the answer.

Yes. Any organization in the port chain can join: terminals, port authorities, marinas, oil and gas ports, shipping lines, hauliers, freight forwarders and the industrial shippers that depend on them. Start with the launch offer.

Very likely, if it is in the EU and not small. Annex I of Directive (EU) 2022/2555 lists, under energy, operators of oil transmission pipelines, operators of oil production, refining and treatment facilities, storage and transmission, and central stockholding entities. Read our NIS2 page.

To look at the port side: the gate, the berth, the vessels and the companies that connect to your site. The best practices page sums up the maritime guidance.

Yes. What you share with us stays between us, and we never name a member without its written agreement.

Launch offer

Talk to engineers who work inside ports

Ten hours of engineering advice and two site visits a year, on the systems that link your site to the port.

Want to know where you stand?

Take the 2-minute test

Send this page to a colleague

Someone in your team should read this? Add their e-mail, we send them the page from you.

Your colleagues' addresses are used for this mail only and are not kept.

Contact the alliance

Use our contact form: every message is read by the team.

Contact form
Report an incident

Port operators can report a cyber incident to the alliance at any time.

Incident reporting