Cyber security for terminal operators

PublicCyber security

Maritime cyber toolkit

Copy-paste snippets that send your security events to the Port Cyber Alliance API.

For

SIEM, SOC and integration engineers, and their coding agents

Stack

curl · Python · JavaScript · PHP · Go · OpenAPI

Licence

See the repository

State

The code is on our public GitHub. Use it today.

What is in it today

• One snippet per language reports an incident to POST /incidents and prints 201 on success
• Generated from the PCA OpenAPI description, never hand-written
• AGENTS.md: instructions an AI coding agent can follow to wire your SIEM unattended
• Error table: 401 bad key, 422 bad schema, 429 over quota

AvailableCyber security

Open detection rules (Sigma)

Sigma rules that spot abnormal access to a terminal operating system, convertible for most SIEMs.

For

SOC teams and security officers of ports and terminals

Stack

Sigma · Windows Security log · pySigma · sigma-cli

Licence

DRL-1.1

State

Free to download from this site, with its tests. Use it today.

What is in it today

• A remote desktop logon (event 4624, type 10) on a TOS server from outside the approved admin network
• An account added to the local Administrators group (event 4732) of a TOS server
• Validated with sigma-cli; sample events that must and must not match, with a test script

What it will never do

• Carry a real host name, address or customer name: every value is an example you replace

AvailableCyber security

Vendor cyber questionnaire

The cyber questions a terminal sends a software vendor, with an online form that sends nothing.

For

IT and security teams of ports and terminals, and the software vendors who answer them

Stack

YAML · JSON · PDF · HTML form · JavaScript

Licence

CC-BY-4.0

State

Free to download from this site, with its tests. Use it today.

What is in it today

• 34 questions in eight families (access, data, logs, backups, incidents, subcontractors, penetration tests, end of contract), one id each
• An online form that runs in the browser only: answers stay on the device until exported as JSON or CSV
• The same questionnaire in YAML, JSON and PDF, with the dated public sources behind each family
• Questionnaire under CC BY 4.0, form script under MIT, README in the zip

What it will never do

• Send your answers anywhere: the form has no server and blocks every network call
• Certify a vendor

AvailableCyber security

Post-deployment pentest regression scripts

Five shell probes that check, after every deployment, that fixed web findings have not come back.

For

Security and DevOps engineers who deploy web applications and APIs

Stack

bash · curl · GitHub Actions · GitLab CI

Licence

MIT

State

Free to download from this site, with its tests. Use it today.

What is in it today

• Five probes: CORS origin reflection, WordPress login enumeration, hidden webhook route, health endpoint, build and commit endpoint
• One request each, exit code 0 (holds), 1 (regressed) or 2 (usage error or unreachable, never a pass)
• A runner for all five, GitHub Actions and GitLab CI examples
• A self-test against a local test server: 13 cases, hardened and regressed

What it will never do

• Replace a penetration test: they re-check five known fixes and find nothing new
• Run against a system you do not own or are not authorised in writing to test

ComingCyber security

Port SIEM rules and cyber governance

The Wazuh detection rules and decoders we write, with the written rules behind them.

For

Security officers and SOC teams of ports and terminals

Stack

Wazuh rules · Wazuh decoders · Markdown

Licence

To be decided

State

Specified, being built. Ask us to be told first.

What it will contain

• Wazuh detection rules and decoders
• Security policy and risk analysis templates
• Patch delays by severity
• Incident notification procedure, 24 h and 72 h (NIS2 article 23), and an incident register

What it will never do

• Carry a secret, an IP address, a host name or a customer name

ComingCyber security

Security advisories

Advisories on port and container-logistics software, under coordinated disclosure, machine-readable.

For

Security teams of ports and terminals, and the software vendors they rely on

Stack

CVE JSON 5 · CVSS · CSAF 2.0 · OSV · RSS / JSON feeds

Licence

CC-BY-4.0

State

Specified, being built. Ask us to be told first.

What it will contain

• A disclosure policy
• Advisory ids PCA-YYYY-NNNN, linked to a CVE id when one is assigned
• Machine-readable records and RSS / JSON feeds

What it will never do

• Publish a vendor's vulnerability without coordinating with the vendor

ComingCyber security

CVE sync for WordPress

Mirror the CVE list into a WordPress site, filtered for port and terminal software.

For

Teams that run a security or community website on WordPress

Stack

PHP · WordPress · WP-CLI · NVD API 2.0 · CVE JSON 5

Licence

GPL-2.0-or-later

State

Specified, being built. Ask us to be told first.

What it will contain

• Tables for CVEs, products, watchlists, sync log and advisories
• Full and delta sync run by the system cron, resumable and idempotent
• Admin filters (vendors, keywords, severity) and public pages with structured data

What it will never do

• Scan your WordPress for vulnerabilities: other plugins do that

ComingCyber security

Error reporting

Send errors and security events from your own port systems to a receiver you control, without personal data.

For

Engineers who run port web systems, WordPress first

Stack

JSON Schema · WordPress agent · HTTP receiver

Licence

To be decided

State

Specified, being built. Ask us to be told first.

What it will contain

• An event envelope (JSON Schema)
• A WordPress agent
• A receiver: HTTP endpoint, grouping, alerts
• Scrubbing: no IP address, no secret, no personal data leaves

What it will never do

• Send personal data
• Phone home to anyone you did not configure

PublicTerminal integration

VBS API

Connect a transport management system to a terminal's truck appointment system.

For

Developers of hauliers and transport management systems (TMS)

Stack

REST · JSON · API key · UML sequence diagram · Code examples

Licence

Apache-2.0

State

The code is on our public GitHub. Use it today.

What is in it today

• The five-step workflow: prevalidate an operation, create it, read the slots of a day, prevalidate an appointment, create it
• Authentication by x-api-key and a portId header
• One error shape: status 400 and an error field
• Examples folder and a sequence diagram

On requestTerminal integration

Terminal data contracts

Language-neutral contracts for container-terminal data, with fixtures and a conformance runner.

For

Engineers who connect a terminal operating system (TOS) to anything else

Stack

JSON Schema 2020-12 · OpenAPI 3.1 · Python · DCSA Track & Trace

Licence

To be decided (Apache-2.0 proposed)

State

The code exists and is tested, not public yet. We send it to you.

What is in it today

• Schemas: container tracking answer, structured not-found, one error shape, booking lookup, bill of lading
• Six reference fixtures (fictitious containers, valid ISO 6346 check digits)
• OpenAPI 3.1 of the tracking facade: GET /v0/tracking/{container_number} and by booking
• A conformance runner (exit 0 / 1 / 2) and a mapping to DCSA Track & Trace 2.2.0

Next

• OpenAPI 3.1 of the read-only terminal data API

What it will never do

• Invent data: no data means the field is absent, never « unknown », never a default

On requestTerminal integration

Terminal integration kit

A small core and plugins to connect a TOS, a gate, a booking system or your back office.

For

Integration engineers of terminals, ports and logistics platforms

Stack

Python 3.10+ · Standard library only · plugin.json · Standard Webhooks

Licence

To be decided (Apache-2.0 proposed)

State

The code exists and is tested, not public yet. We send it to you.

What is in it today

• The core and two reference plugins, tested
• A mock terminal shaped like Navis N4
• A read-only N4 connector
• Health is green, red or undetermined: « could not check » is never « all good »

Next

• The other connectors are specified, not written yet

On requestTerminal integration

TOS Groovy recipes

Read-only recipes for terminal operating systems: answer tracking questions, push gate events anywhere.

For

Terminal IT teams running Navis N4 with the extension option

Stack

Groovy · Navis N4 extensions · PHP relay

Licence

MIT

State

The code exists and is tested, not public yet. We send it to you.

What is in it today

• n4-gate-event-push: every N4 gate passage pushed to an HTTPS receiver, PHP relay with queue and retries (relay tested, Groovy to run on a real N4)

Next

• Container status, customs holds, charges, booking lookup, free time and demurrage
• A read-only guard (a write attempt is refused, tested), rate limit and cache
• Tideworks after N4, same facade

What it will never do

• Write into a TOS, ever
• Ship a recipe that never ran on a real TOS

On requestTerminal integration

Terminal devtools

Small tools every terminal developer rewrites: ISO 6346 check digit and a fake TOS for tests.

For

Developers who write terminal software or test against a TOS

Stack

Python · PHP · ISO 6346 · UN/EDIFACT · UN/LOCODE

Licence

To be decided (Apache-2.0 proposed)

State

The code exists and is tested, not public yet. We send it to you.

What is in it today

• ISO 6346 check digit in Python and PHP, tested against one shared set of test vectors
• tos-mock: a fake TOS that serves the tracking facade on six fictitious containers

Next

• ISO 6346 in TypeScript
• An EDIFACT pretty-printer (COPARN, CODECO, BAPLIE, COARRI)
• Offline UN/LOCODE

On requestTerminal integration

Container tracking core

Where a container is and whether a truck can pick it up, the same answer whatever TOS is behind.

For

Terminals and port communities that publish container status

Stack

Python 3.11+ · PHP 8.1+ · HTTP facade

Licence

To be decided (Apache-2.0 proposed)

State

The code exists and is tested, not public yet. We send it to you.

What is in it today

• One library, two bindings (Python and PHP) that give identical answers
• An HTTP facade that passes the conformance runner
• Works before any API, on six fictitious demonstration containers

What it will never do

• Serve an answer it cannot vouch for

On requestTerminal integration

Container tracking and history for WordPress

Two plugins for a terminal's website: find a container, or a bill of lading and all its containers.

For

Terminals whose public website runs on WordPress

Stack

PHP 8.1+ · WordPress 6.4+ · Shortcodes and block

Licence

GPL-2.0-or-later

State

The code exists and is tested, not public yet. We send it to you.

What is in it today

• Container search: where it is, whether a truck can pick it up, and each hold with its reason
• Bill of lading search: every container of a B/L; a container alone is refused, so nobody sees another customer's cycle
• ISO 6346 check digit on every container number
• Works at activation on demonstration data

Next

• Drupal and Joomla versions

ComingTerminal integration

Terminal integration map

Where to plug what at a container terminal, and what costs three weeks when you ignore it.

For

Integrators starting a project at a container terminal

Stack

Markdown · Sequence diagrams · ISO 6346 · UN/LOCODE · UN/EDIFACT · SMDG MIGs

Licence

To be decided

State

Specified, being built. Ask us to be told first.

What it will contain

• Layers: operations, customs holds, billing, gate and booking, EDI
• « Am I allowed? » in 30 seconds, per TOS licence
• Paths that work without the TOS extension licence

What it will never do

• Republish vendor manuals
• Quote licence prices
• Advise bypassing a licence