Industry overview
What is shaping shipbuilding
Shipbuilding and maritime services depend on a deep supplier ecosystem, skilled workforce and port infrastructure, with long project cycles and strict standards.
- Supplier capability limits how fast yards can scale
- Skilled trades are scarce and ageing
- Port users judge performance on turnaround and reliability
Client background
A shipyard design office in Japan, working in Japan. Client identity is withheld to protect confidentiality.
- Organisation
- A shipyard design office in Japan
- Sector
- Shipbuilding
- Team engaged
- IT & Development
- Services
- Cybersecurity services, Cloud & DevOps services, IT consulting
Client challenge
Ship designs and client documents were stored on shared servers with broad access, and backups had never been tested. A ransomware incident at a supplier raised concerns.
Research objectives
- Deliver on the brief: strengthening cybersecurity in a shipyard’s design office.
- Define requirements and success criteria the solution would be tested against.
- Deliver a reliable, secure solution the team can run and extend.
Target audience
Scope: Design office systems and file servers.
Audiences we typically reach in shipbuilding
Shipyards and project managersMarine equipment suppliersSkilled workers and traineesPort users and shipping linesMaritime regulators
Geographic coverage
Coverage: Japan. Market: Japan.
- Japan
Research methodology
An iterative delivery approach: discovery, design, build and test in short cycles, with the client reviewing each step.
- 1Brief
- 2Security assessment
- 3Access controls
- 4Backup redesign
- 5Insight
We assessed systems, access rights and backup practices, introduced role-based access, multi-factor authentication and encrypted, offline backups with restore tests, and trained staff on phishing and secure file sharing. We worked during low-activity periods so that design schedules were not disrupted, and documented every change for the IT team to maintain afterwards.
Cybersecurity servicesCloud & DevOps servicesIT consulting
Sampling strategy
- Users and stakeholders from every affected team took part in discovery workshops and acceptance testing.
Data collection
- Requirements were gathered through workshops, process walk-throughs and a review of existing systems and data.
Data quality & validation
- Peer code review on every change
- Automated and manual testing
- User-acceptance testing with the client
- Release checklist and rollback plan
Data analysis
- Usage and performance monitoring after launch
- Defect and support-ticket trends
- Process time before and after
Key findings
- Access to sensitive designs was restricted to the right teams, backups were proven restorable, and the shipyard could answer client security questionnaires confidently.
Basic controls dramatically reduced risk without slowing design work.
Recommendations
- Build on the core insight: basic controls dramatically reduced risk without slowing design work.
- Track adoption and support tickets, and plan the next release from real usage.
Business impact
- A simple incident response plan was written and rehearsed, so staff knew exactly what to do if they suspected an attack.
Impact is described qualitatively.
Deliverables & next steps
- Deployed solution with documentation and handover
- Support and maintenance plan
- Repeat the measure after changes are in place to track progress.
- A natural follow-on question: what would attract more skilled workers?
Client identity is withheld to protect confidentiality.