November 2025
By John Haney, Marine Operations Manager
Fishers Island Ferry
During our annual Coast Guard site inspection, the Fishers Island Ferry District (FIFD) team (Geb Cook, Jon Haney, Dave McCall, Mike Fiora, and Jesse Marshall) was asked by our local U.S. Coast Guard Marine Transportation System Cybersecurity Specialist, Maureen Johnson, about our computer and server infrastructure. We had a brief discussion about our network system: size, type, users, etc., to help identify vulnerabilities. She then commented on several instances that occurred over the last few years, specifically one in 2021 that targeted the Massachusetts Steamship Authority. After our conversation, Maureen passed along some information regarding a Cyber Protection Team (CPT) that could come do an assessment of our network, free of charge.
After nearly a year of planning, a team of eleven USCG cyber protection specialists (CPT) arrived on site early this month. They set up shop at our New London, CT, terminal and went into action. Over the course of five days, the CPT worked closely with our IT support team to assess our operating system. The team performed a penetration test that would determine susceptibility to a real-world incident by identifying weaknesses in security through internal or remote emulation of cyber threat actors. They performed a configuration review that analyzed our operating system and database settings, comparing them to industry standards, guidelines, and best practices. Lastly, they provided a threat hunting mission to illuminate known or unknown adversaries on the network to determine the scope and impact of a potential compromise.
On the fifth day, Fishers Island Ferry Management and the Company Security Officer (CSO) sat down for a post-execution out-brief. The CPT provided its initial findings and provided recommendations. The initial results: Fishers Island Ferry District (FIFD) maintains a strong cybersecurity posture, including phishing protection. FIFD has proactive monitoring and support through local third-party defense, which includes Endpoint Detection and Response (EDR) tools. And lastly, FIFD has robust external network defenses. A full technical report will be forthcoming.
Why did we chose to do this? Because it was the right thing to do. To see where we fall within industry standards. To secure our network from possible threats. So our critical system doesn’t become compromised and to keep our passengers’ information safe. This was our initial step toward formulating an Incident Response Plan (IRP) for FIFD in the event of future cyber threats or attacks.
