Back to News

Ten cyber checks a terminal can run in one week, without a budget

admin

Published on November 9, 2026

Share on

Most terminals do not need a new product to be safer next Friday. They need a week, a short list, and someone who owns it.

Below are ten checks we see recommended across public guidance for ports and critical infrastructure (sources at the end). None of them requires a purchase. Each fits in an afternoon for an IT team that knows its network, and each leaves something you can show: a list, a log, a tested restore.

Monday: know what is exposed

1. List everything reachable from the internet. Start from your firewall rules, DNS records and public IP ranges. Write down every service that answers from outside: VPN, webmail, appointment portal, remote access for vendors, camera systems. You cannot protect what is not on the list.

2. Cross that list with known exploited vulnerabilities. The US agency CISA publishes a free catalog of vulnerabilities that are actively exploited. Compare it with the products and versions on your list. Anything that matches goes to the top of the patch queue, before anything else.

Tuesday: close the easy doors

3. Turn on multi-factor authentication for remote access and admin accounts. VPN, email administration, cloud consoles, the remote access your vendors use. Most of these tools already include it; it is a setting, not a project.

4. Disable dormant accounts. Export the accounts that have not logged in for 90 days, including vendor and former staff accounts. Disable them (do not delete yet). If someone complains, you have learned who still needed it.

5. Find the remote access tools nobody remembers. Gate PCs, OCR stations and crane workstations sometimes carry a remote control tool installed years ago for a support call. List them, decide which ones stay, and put the remaining ones behind your VPN.

Wednesday: make sure you can recover

6. Test one restore. Pick the system you would need first after an incident, often the operating system database or its configuration. Restore yesterday’s backup on a spare machine and check it opens. A backup that has never been restored is a hope, not a backup.

7. Keep one copy offline. At least one recent backup should be unreachable from the network that runs daily operations, so that ransomware on the network cannot encrypt it too.

Ship-to-shore cranes lit at night on a container terminal — Cranes, gate and TOS all leave traces. Thursday is about seeing them in one place.

Thursday: see what happens

8. Send key logs to one place. VPN logins, directory authentications and firewall events, forwarded to one server and kept for at least a few months. A plain syslog server works; open source platforms such as Wazuh go further. The goal is simple: if something happened three weeks ago, you can still find out.

9. Check the wall between office and operations. From an office laptop on the corporate Wi-Fi, try to reach a gate, crane or OCR system. If you can, so could an attacker who phished that laptop. Write down every path you find; closing them can be next month’s project.

Friday: prepare the bad day

10. Write a one-page incident sheet. Who decides to isolate a system, who calls the national CERT, who informs the port authority and customers, which phone numbers to use if email is down. Print it. Put it where the night shift can find it.

What you have at the end of the week

A list of exposed services, a short patch queue, MFA on the doors that matter, a tested restore, logs you can search, a map of office-to-operations paths, and a printed incident sheet. None of it is spectacular. All of it is what responders ask for first when something goes wrong.

Why share it

Port Cyber Alliance exists because terminals face the same attackers, and each one learning alone is slow. If you run this week, tell us which check was the hardest in your context. We collect these lessons, without naming anyone, so that the next terminal starts further ahead.