Entry & progression
The vessel is a network now. Machinery, navigation, entertainment and the guest wifi all run on cable that looks identical. The ETO is the person who has to know which is which — and why they must never meet.
What runs on the cable
| Layer | Typically carries | Failure looks like |
|---|---|---|
| Fieldbus / serial | Sensors, drives, PLC I/O | One device silent; the whole segment down if a termination is wrong |
| Ethernet — machinery | Alarm and monitoring, PMS, drives, HMI | Screens freeze, data goes stale — the plant keeps running |
| Ethernet — navigation | Bridge systems, integrated bridge data | Displays disagree with each other |
| Ethernet — guest / crew | Wifi, AV, internet, business systems | Somebody complains, loudly |
Read the third column of the machinery row again. Data goes stale, and the plant keeps running. A frozen screen is the most dangerous thing on this list, because a screen showing 45 degrees that stopped updating an hour ago is indistinguishable from a screen showing 45 degrees right now. Learn to distrust a value that has not moved.
Segregation
The essential principle is that these networks are separate, and that data crosses between them only where it must, only in one direction where possible, and only through a controlled boundary. The guest network must never be able to reach the power management system. Not because a guest is malicious, but because a guest's laptop may be.
WARNING — The USB stick is the boundary you cannot see Every carefully segregated network aboard is defeated the moment a service engineer plugs a laptop or a memory stick into the machinery network to load a firmware update. That laptop has been on a dozen other vessels and every hotel wifi between them.
Air gaps do not survive contact with maintenance. Control the media, scan it, and keep dedicated equipment for the machinery side.
Cyber hygiene that actually holds
- Default passwords changed — on switches, drives, HMIs, cameras and every device with a web page you did not know it had
- An inventory — you cannot protect what you cannot list, and half the devices on a yacht's networks are not on any drawing
- Remote access controlled — vendors who dial in should do so when you say, through a route you control, and not by a permanently open tunnel
- Backups held offline — ransomware that reaches your backup has reached everything
- Change control — a firmware update on a live vessel is a planned event, not a favour to a passing technician
- Patching, with judgement — the vendor's latest release is not always the one that keeps your stabilisers working; test where you can
Why this is the ETO's
Because nobody else can do it. The captain cannot tell a managed switch from an unmanaged one. The engineers own the machinery, not the network it now depends on. The AV contractor is not aboard. The person who understands both the plant and the cable is the ETO, and on most yachts that is one person.
Which means that when a control network degrades quietly and the plant is still running on stale data, you are the only one who is going to notice. That is the job.