\section{Introduction}

 Cataclysmic variables (CVs) are close binary systems in which a white dwarf
 (WD) primary accretes material from a late-type secondary star via Roche-lobe
 overflow (see \citealt{warner95a} for a review). Non-magnetic CVs are
 classified into 3 main sub-types -- the classical novae, the dwarf novae and
 the nova-likes. The {\em classical novae} (CNe) are defined as systems in which
 only a single nova eruption has been observed. Nova eruptions have typical
 amplitudes of 10 magnitudes and are believed to be due to the thermonuclear
 runaway of hydrogen-rich material accreted onto the surface of the white dwarf.
 The {\em dwarf novae} (DNe) are defined as systems which undergo quasi-regular
 (on timescales of weeks--months) outbursts of much smaller amplitude (typically
 6 magnitudes). Dwarf novae outbursts are believed to be due to instabilities in
 the accretion disc causing it to collapse onto the white dwarf \citep{osaki74}.
 The {\em nova-like} variables (NLs) are the non-eruptive CVs, i.e. objects
 which have never been observed to show novae or dwarf novae outbursts. The
 absence of dwarf novae outbursts in NLs is believed to be due to their high
 mass-transfer rates, producing ionised accretion discs in which the
 disc-instability mechanism that causes DNe outbursts is suppressed; the mass
 transfer rates in NLs are $\dot{M} \sim 10^{-9}$ M$_{\odot}$ yr$^{-1}$ whereas
 DNe have rates of $\dot{M} \sim 10^{-11}$ M$_{\odot}$ yr$^{-1}$
 \citep{warner95a}.

 Mass transfer is believed to be driven by angular momentum loss, which in turn
 is driven by two main processes, mass loss from magnetically-coupled winds from
 the secondary star (commonly referred to as \textit{magnetic braking}), and
 gravitational wave emission. At periods longer than about 3 hours, both
 mechanisms operate, leading to high $ \dot{M}$ as seen in NLs. At orbital
 periods below two hours, only gravitational wave emission occurs, and $\dot{M}$
 is lower, as in DNe. However, the orbital period distribution of CVs shows both
 high and low $\dot{M}$ systems co-existing at the same orbital periods
 \citep{knigge11}.

One explanation for the coexistence of systems at the same orbital period with
high and low $\dot{M}$ is a nova-induced cycle. Some fraction of the energy
released in the nova event will heat up the WD, leading to irradiation and
subsequent bloating of the secondary. Following the nova event, the system would
have a high $\dot{M}$ and appear as a NL. As the WD cools, $\dot{M}$ reduces and
the system changes to a DN, or even possibly $\dot{M}$ ceases altogether and the
system goes into hibernation.  Hence CVs are expected to cycle between nova, NL
and DN states, on timescales of $10^4-10^5$ yrs (\citealt{shara86},
\citealt{bode08}). This nova-induced cycle theory became known as hibernation
theory

Hibernation theory was originally invoked to explain the disparity between the
observed space density of CVs compared to models. Recent surveys using Gaia DR2
data \citep{pala19} compared to more sophisticated models \citep{belloni18} have
shown that the space density of CVs is broadly in agreement with theoretical
predictions. However, we still need to understand the impact of the nova
eruption on the evolution of CVs. Recent modelling by \citet{hillman20} predicts
that some systems are expected to cease mass transfer after a nova eruption and
go into hibernation, though far fewer systems that exhibit this behaviour are
predicted than were first proposed in the original version of the theory
\citep{shara86}. Recently however, \citet{schaefer20} reported measurements the
orbital period changes of six of CNe, using a long term monitoring campaign and
archival data. He found that five of them showed a period decrease  across the
nova eruption. This is exactly the opposite of the model predictions, which
suggest that the orbital period should increase as the two stars are driven
apart during the nova eruption.

The cyclical evolution of CVs through CN, NL and DN phases has received
observational support from the discovery that BK Lyn appears to have evolved
through all three phases since its likely nova outburst in the year AD 101
\citep{patterson13}. A second piece of evidence has come from the discovery of
nova shells associated with the dwarf novae Z Cam, AT Cnc and Nova Sco 1437
(\citealt{shara07}, \citealt{shara13}, \citealt{shara17}). However, the
association of these CVs with the historical Chinese and Korean records has been
reviewed by \citet{hoffmann19}, who found that all three are doubtful.

A more obvious place than DNe to find nova shells is around NLs, as the nova-
induced cycle theory suggests that the high $\dot{M}$ in NLs is due to a recent
nova outburst. This was the motivation behind our first campaign to search for
nova shells around CVs, reported in \citeauthor{sahman15} (2015, hereafter S15).
We discovered a nebula around the nova-like V1315 Aql, which was subsequently
confirmed as a nova shell using Keck DEIMOS spectroscopy \citep{sahman18}.
Other shells have since been discovered around other nova-likes. IPHASX
J210204.7+471015 is a NL at the centre of a shell originally thought to be a
planetary nebula \citep{guerrero18}. V341 Ara is another NL at the centre of a
shell originally thought to be a planetary nebula \citep{castro20}. BZ Cam is
located in a bow-shock nebula with faint circular filaments, and is possibly
associated with the ancient nova in AD 369 \citep{hoffmann20}.

Our first campaign, which relied on H$ \alpha$ images obtained with both the
Auxiliary Port Camera on the 4.2m William Herschel Telescope (WHT) and the 2.5m
Isaac Newton Telescope (INT) Photometric H$ \alpha$ Survey of the Northern
Galactic Plane (IPHAS), suffered from two drawbacks. First, the field of view of
the WHT was too small to detect the large shells which have been discovered
around DNe (\citealt{shara07}, \citealt{shara13}), and also contained too few
field stars to derive a reliable stellar point spread function (PSF) which
allows one to detect shells close to the CVs. The second problem was that the
wide--field IPHAS survey was too shallow, and was targeted at the Galactic plane
which has large background H$\alpha$ nebulosity, making it difficult to detect
faint nova shells.

In this paper, we report on our second, much deeper and wider--field campaign to
identify old nova shells around CVs, and use our results, combined with other
searches, to estimate the lifetime of the nova-like phase following a nova
eruption.

\section{Target selection, Observations, and Data Reduction}

\subsection{Target selection}
\label{inttarget}

This second campaign was motivated by the shortcomings of our original campaign
in S15. We had estimated the age of the faintest shell we could detect with the
WHT by simulating images using the old nova DQ~Her. The simulations showed that
we could expect to detect shells at $\sim180$ yr after outburst. This detection
threshold can be pushed fainter, and hence older by $\sim{40}$ years, by
computing the mean radial profile of the PSF of the central object and
inspecting the wings for evidence of a shell, a technique pioneered by
\citet{gill98}.

However, using DQ~Her led us to underestimate the optimal field of view for
hunting for nova shells.  This is because DQ~Her has relatively slow-moving
ejecta (350\,km\,s$^{-1}$; \citealt{warner95a}). The angular size of a nova
shell is determined by the time since the nova eruption, the distance to the CV,
and the speed of the ejecta, and is given by the following scaling relation:

\begin{equation}
 \qquad \qquad \qquad R\sim 20\arcsec \,\, \frac{ t/100\,\mathrm{yr}
   \times v/1000\,\mathrm{km \,s}^{-1}}{d/\mathrm{kpc}},
     \end{equation}
where $R$ is the angular radius of the shell in arcseconds, $t$ is the time
elapsed since the nova eruption, $v$ is the shell expansion velocity, and $d$ is
the distance to the CV. Hence a recent, distant nova with slow-moving ejecta
($t=100\,$yr$, v=500\,$km\,s$^{-1}, d=2\,$kpc) would have a small shell of
radius $\sim5\arcsec$, whereas an older, nearby nova with fast moving ejecta
($t=200\,$yr$, v=2000\,$km\,s$^{-1}, d=0.5\,$kpc) would have expanded to a
radius of $\sim 2.7\arcmin$.  The field of view of the Auxiliary Port Camera on
the WHT ($\sim1\arcmin$ radius) used for S15, was too small to detect such large
shells. This is borne out by the size of the shell that we discovered around
V1315 Aql \citep{sahman18}, which is $\sim2.5\arcmin$ in radius, the shell
around IPHASX J210204.7+471015 which has a radius of $\sim 2.0\arcmin$
\citep{guerrero18}, and the shells discovered by \citeauthor{shara07} (2007,
2012) of radii $1.5\arcmin$ (AT~Cnc) and $15\arcmin$ (Z~Cam). A further problem
with having such a small field of view is the paucity of field stars that are
available to compare radial profiles (see Section \ref{im}).

Whilst the IPHAS survey had a sufficiently large field of view ($\sim17\arcmin$
radius per pointing) to discover nova shells, it suffered from very short
exposure times (120\,s). Furthermore, IPHAS was constrained to the Galactic
plane, making it difficult to pick out faint nova shells from the bright
background H$\alpha$ nebulosity. We concluded that a more optimal survey for
nova shells would have approximately the same field of view as an IPHAS
pointing, avoid the Galactic plane and be of similar depth to our WHT survey
($\sim{25}$~mags/arcsec$^2$).

To ensure we only targeted relatively well-studied systems with reliable periods
and CV classifications, we made our selection from version 7.20 of the catalogue
of \citet{ritter03}\footnote{http://www.mpa-garching.mpg.de/RKcat/} (hereafter
RK catalogue). We deliberately selected a substantial number of the systems in
the 3--4\,hr orbital period range, which is where most NLs appear, as shown in
Fig.~18 of \citet{knigge11}.

We included a number of asynchronous polars in the target list. Asynchronous
polars are CVs with a highly magnetic WD, in which the WD spin period is not
synchronous with the orbital period. One possible cause of the asynchronicity is
believed to be a nova eruption \citep{campbell99}. The target list also included
a few DNe as a control sample and to ensure that we had sufficient targets
visible on each night. All targets were outside the central galactic plane, with
a galactic latitude \textit{b} $> \pm 5^{o}$.

\subsection{Observations}
\label{obs}

We were allocated three nights on the INT in August 2014 and three nights in
January 2015.  We were also allocated time from the service observing programme
which resulted in an additional 10 targets being observed. We observed 47
targets in total, primarily NLs, including 16 systems that we had previously
examined in S15 using the WHT. The targets comprised one old nova (which is also
an intermediate polar), three asynchronous polars, 39 NLs, and four DNe.

We used the WFC mounted at the prime focus of the INT. The WFC consists of 4
thinned e2v 2kx4k CCDs and has a platescale of 0.33$\arcsec$ per pixel, with a
field of view of $\sim$~34$\arcmin$ x 34$\arcmin$. In order to cover the gaps in
the CCD array, we took sets of four images dithered by 20\arcsec \,up and down,
and right and left.

We used the H$\alpha$ filter no. 197, which is centred on H$\alpha$ and has a
FWHM of 95\AA. Note that this filter also includes a contribution from N[{\sc
ii}] 6584\AA \,emission, which may dominate the spectra of nova shells with
strong shock interaction of the ejecta with any pre-existing circumstellar
medium, e.g. T Pyx \citep{shara89}. We also used the Sloan $r$ band filter no.
214 (centred on 6240\AA \,with FWHM 1347\AA).

A full list of the 47 objects and a journal of observations is given in
Table1~\ref{tab:journal}. The observing conditions were generally good, with
seeing below $2$\arcsec. There was some cloud on the nights of 15 December 2014,
and 22 February 2015, and on those nights the seeing also worsened to 3\arcsec\,
and 4\arcsec\,, respectively.

\subsection{Data reduction}

The images were processed using the data reduction pipeline THELI
\citep{schirmer13}.  Bias correction was carried out using bias frames taken at
the start and the end of the night.  Flat-fielding was performed using twilight
flats. The astrometry was performed using SCAMP \citep{bertin06}, with standard
astrometric catalogues (eg. PPMXL, USNO, 2MASS). The processed images were
co--added by taking the median. No sky subtraction was performed to avoid the
accidental removal of faint nova shells.

\section{Results}
\label{sec:res}

\subsection{INT Images and Radial Profiles}
\label{im}

In order to detect shells in the images, we adopted two strategies. First, we
visually examined each image to determine if a shell is visible. This technique
reveals shells with diameters of more than a few arcseconds. Second, we
calculated the radial profile (PSF) of each CV and compared it to the radial
profiles of a number of field stars in the same image. Any nebulosity around the
CV due to a nova shell would cause the radial profile of the CV to lie above the
average profile of the field stars. This technique can reveal shells with
diameters of less than a few arcseconds, and was successfully used by
\citet{gill98} to discover four new nova shells. We also used this technique in
S15. A key assumption in this technique is that the radial profile of the PSF is
uniform across the field of view. Fig \ref{fig:psftest1} shows the PSFs for
various field stars (circled) in the image of V1432 Aql. The PSFs show identical
radial profiles irrespective of field position, giving confidence that the PSFs
are uniform across the field of view of the CCD, as expected.

\begin{figure}
\centering
  \vspace{10pt} \includegraphics[width=80mm,angle=0]{chip1-4-crop2.pdf}
\caption{PSF Test for one of the CCDs in the WFC. The PSFs of the circled stars
in the upper frame are plotted in the lower frame. Due to nearby stars, the
maximum radial distance plotted varies for each star.}
\label{fig:psftest1}
\end{figure}

The images and radial profiles of our 47 targets are shown in Appendix A, except
for the image of V1315 Aql which is presented in \citet{sahman18}. Note that
the contrast in the images has been optimised. The background sky level appears
white and any emission brighter than a few percent above the background,
including the stars, appears black. This emphasises any faint nebular emission.
As a result, the background levels of each of the four chips appears slightly
different in some of the images.

\begin{figure}
\centering
  \vspace{10pt} \includegraphics[width=80mm,angle=0]{v1315.pdf}
\caption{INT WFC H$\alpha$ image of the nova shell around V1315
  Aql. The binary is located at the centre of the image. North is up
  and East is left.}
\label{fig:v1315aql}
\end{figure}

 \begin{table*}
   \begin{minipage}{160mm}
     \begin{center}
\caption[]{Journal of observations (in alphabetical order of
  constellation). The classifications and orbital periods of the CVs
  have been taken from the RK catalogue \citep{ritter03}. The date
  refers to the start time of the first exposure.}
\begin{tabular}{llccccccc}
  \hline \hline & & & & & & & & \\
 \multicolumn{1}{l}{Object} &
\multicolumn{1}{l}{Classification} & \multicolumn{1}{c}{Orbital} &
\multicolumn{1}{c}{Date} & \multicolumn{1}{c}{UTC} &
\multicolumn{1}{c}{UTC} & \multicolumn{1}{c}{Number of} &
\multicolumn{1}{c}{Total exposure} & \multicolumn{1}{c}{Visible} \\ &
& \multicolumn{1}{c}{period (hrs)} & & \multicolumn{1}{c}{start} &
\multicolumn{1}{c}{end} & \multicolumn{1}{c}{exposures} &
 \multicolumn{1}{c}{time (secs)} & \multicolumn{1}{c}{shell?} \\
 & & & & & & & & \\ \hline
PX And & NL SW NS SH & 3.51 & 01/08/14 & 04:43 & 05:16 &
2 & 1800 & N \\ & & & 04/08/14 & 03:18 & 03:42 & 4 & 1080 & N \\ HL
Aqr & NL UX SW & 3.25 & 04/08/14 & 00:27 & 02:10 & 8 & 3840 & N \\ UU
Aqr & NL UX SW SH & 3.93 & 01/08/14 & 03:16 & 04:36 & 7 & 3780 & N
\\ V794 Aql & NL VY & 3.68 & 03/08/14 & 22:39 & 23:37 & 6 & 2880 & N
\\ V1315 Aql & NL UX SW & 3.35 & 01/08/14 & 22:45 & 01:55 & 13 & 8700
& Y \\ V1432 Aql & NL AM AS & 3.37 & 02/08/14 & 21:43 & 23:16 & 32 &
3840 & N \\ WX Ari & NL UX SW & 3.34 & 15/01/15 & 20:37 & 22:01 & 8 &
3840 & N\\ KR Aur & NL VY NS & 3.91 & 18/01/15 & 01:26 & 02:45 & 8 &
3840 & N \\ BY Cam & NL AM AS & 3.35 & 15/01/15 & 23:48 & 01:26 & 8 &
3840 & N \\ BZ Cam & NL VY SH & 3.69 & 16/12/14 & 05:19 & 05:34 & 1 &
900 & N \\ & & & 17/01/15 & 00:20 & 01:40 & 8 & 3840 & N \\ V482 Cam &
NL SW & 3.21 & 18/01/15 & 02:49 & 04:06 & 8 & 3840 & N \\ V425 Cas &
NL VY & 3.59 & 04/08/14 & 02:15 & 03:14 & 6 & 2880 & N \\ & & &
27/10/15 & 22:43 & 23:29 & 3 & 2700 & N \\ CH Crb & NL UX SW & 3.49 &
23/02/15 & 06:09 & 06:24 & 1 & 900 & N \\ V1500 Cyg & Na NL AM AS & 3.35
& 01/08/14 & 02:23 & 02:57 & 3 & 2100 & N \\ V2275 Cyg & Na IP & 7.55
& 02/08/14 & 03:28 & 04:07 & 2 & 1800 & N \\ & & & 03/08/14 & 23:43 &
00:22 & 4 & 1920 & N \\ CM Del & NL UX VY & 3.89 & 02/08/14 & 01:12 &
02:37 & 8 & 3840 & N \\ MN Dra & DN SU ER & 2.40 & 02/08/14 & 23:20 &
01:03 & 8 & 3840 & N \\ OZ Dra & NL UX SW & 3.28 & 18/01/15 & 05:16 &
06:17 & 6 & 2880 & N \\ & & & 02/03/15 & 02:25 & 03:27 & 4 & 3600 & N
\\ V1084 Her & NL SW NS & 2.89 & 02/03/15 & 03:31 & 04:34 & 4 & 3600 &
N \\ BH Lyn & NL SW SH NS & 3.74 & 16/01/15 & 01:11 & 02:39 & 8 & 3840
& N \\ & & & 29/01/15 & 01:27 & 01:42 & 1 & 900 & N \\ BP Lyn & NL UX
SW & 3.67 & 17/01/15 & 02:20 & 03:39 & 8 & 3840 & N \\ & & & 29/01/15
& 01:45 & 02:00 & 8 & 3840 & N \\ HQ Mon & NL UX & 7.58 & 16/12/14 &
04:15 & 04:30 & 1 & 900 & N \\ V380 Oph & NL VY SW NS & 3.70 & 28/05/15
& 23:58 & 01:00 & 4 & 3600 & N \\ V1193 Ori & NL UX SW NS & 3.96 &
17/01/15 & 21:32 & 23:10 & 8 & 3840 & N \\ LQ Peg & NL VY SH NS & 2.99
& 02/08/14 & 02:44 & 03:22 & 4 & 1920 & N \\ FY Per & NL VY & 6.20 &
15/01/15 & 22:05 & 23:36 & 8 & 3840 & N \\ LX Ser & NL VY SW & 3.80 &
03/08/14 & 21:12 & 22:33 & 8 & 3840 & N \\ & & & 17/01/15 & 06:03 &
06:55 & 3 & 2700 & N \\ & & & 18/01/15 & 06:19 & 06:24 & 3 & 180 & N
\\ & & & 02/03/15 & 04:38 & 05:40 & 4 & 3600 & N \\ RW Sex & NL UX &
5.88 & 17/01/15 & 03:44 & 05:05 & 8 & 3840 & N \\ & & & 29/01/15 &
03:18 & 03:33 & 8 & 3840 & N \\ SW Sex & NL UX SW & 3.24 & 16/01/15 &
04:50 & 06:10 & 8 & 3840 & N \\ V1294 Tau & NL VY SW & 3.59 & 16/01/15
& 21:26 & 22:51 & 8 & 3840 & N \\ & & & 13/10/15 & 02:07 & 02:58 & 3 &
2700 & N \\ RW Tri & NL UX SW & 5.57 & 04/08/14 & 03:46 & 04:46 & 6 &
2880 & N \\ DW UMa & NL SW SH NS & 3.28 & 16/01/15 & 03:28 & 04:46 & 8
& 3840 & N \\ & & & 29/01/15 & 03:37 & 03:52 & 1 & 900 & N \\ & & &
23/02/15 & 04:12 & 04:59 & 3 & 2700 & N \\ LN UMa & NL VY SW & 3.47 &
18/01/15 & 04:11 & 05:08 & 6 & 2880 & N \\ UX UMa & NL UX & 4.72 &
16/01/15 & 06:15 & 06:59 & 6 & 2880 & N \\ & & & 17/01/15 & 05:09 &
05:57 & 6 & 2880 & N \\ & & & 01/03/15 & 03:15 & 04:16 & 6 & 3600 & N
\\ SS UMi & DN SU ER & 1.63 & 01/08/14 & 21:32 & 22:35 & 4 & 3600 & N
\\ & & & 02/08/14 & 21:16 & 21:29 & 1 & 240 & N \\ HS0220+0603 & NL UX
SW & 3.58 & 17/01/15 & 19:55 & 21:19 & 8 & 3840 & N \\ HS0229+8016 &
NL UX VY & 3.88 & 16/01/15 & 19:59 & 21:22 & 8 & 3840 & N
\\ HS0455+8315 & NL VY SW & 3.57 & 18/01/15 & 00:03 & 01:23 & 8 & 3840
& N \\ HS1813+6122 & NL UX SW NS & 3.55 & 13/10/15 & 21:37 & 22:24 & 3
                            & 2700 & N \\
 & & & 27/10/15 & 21:14 &  21:29 & 1 & 900 & N \\
\hline
  \label{tab:journal}
\end{tabular}
\end{center}
\end{minipage}
\end{table*}

\begin{table*}
  \contcaption{}
   \begin{minipage}{160mm}
     \begin{center}
\begin{tabular}{llccccccc}
  \hline \hline & & & & & & & & \\
 \multicolumn{1}{l}{Object} &
\multicolumn{1}{l}{Classification} & \multicolumn{1}{c}{Orbital} &
\multicolumn{1}{c}{Date} & \multicolumn{1}{c}{UTC} &
\multicolumn{1}{c}{UTC} & \multicolumn{1}{c}{Number of} &
\multicolumn{1}{c}{Total exposure} & \multicolumn{1}{c}{Visible} \\ &
& \multicolumn{1}{c}{period (hrs)} & & \multicolumn{1}{c}{start} &
\multicolumn{1}{c}{end} & \multicolumn{1}{c}{exposures} &
 \multicolumn{1}{c}{time (secs)} & \multicolumn{1}{c}{shell?} \\
 & & & & & & & & \\ \hline
 J0506+7725 & DN SU & 1.62 & 28/10/15 & 03:11 & 04:13 & 4 & 3600 & N
\\ J0809+3814 & NL SW & 3.21 & 29/01/15 & 01:07 & 01:22 & 1 & 900 & N
\\ J0928+5004 & NL UX & 10.04 & 29/01/15 & 02:04 & 02:19 & 1 & 900 & N
\\ J1429+4145 & NL & 1.64 & 23/02/15 & 05:03 & 06:05 & 4 & 3600 & N
\\ J1924+4459 & NL SW SH NS & 2.75 & 27/10/15 & 21:36 & 22:38 & 4 &
3600 & N \\ Leo5 & DN ZC & 3.51 & 28/05/15 & 22:44 & 23:46 & 4 & 3600
& N \\ LSIV-083 & NL UX & 4.69 & 29/05/15 & 01:11 & 02:13 & 4 & 3600 &
N \\ RXJ0524+4244 & NL AM AS & 2.62 & 16/01/15 & 23:17 & 00:17 & 8 & 3840 & N \\ \hline
\hline
\end{tabular}
\end{center}
\end{minipage}
\end{table*}

\subsection{Notes on Individual Targets}

There are some noteworthy features in the images and radial profiles of
individual targets that we discuss below:

\begin{itemize}
\item BZ Cam has a radial profile above the field stars because of emission from
  the pre-existing bow-shock nebula. \citet{hoffmann20} proposed that this
  system could be a recurrent nova instead of a NL.
\item The asynchronous polar V1500 Cyg has a pronounced peak in its radial
  profile at around 5$\arcsec$, from the nova event in 1975 \citep{lindegren75}.
\item V2275 Cyg was discussed extensively in S15, where we discovered a number
  of H$\alpha$ blobs in IPHAS images that appeared to move over time. We
  attributed this apparent motion to a light echo from the 2001 nova eruption.
  The blobs are not discernible in our image, which was taken six years after
  the last IPHAS image used in S15.
 \item CM Del lies in a crowded field, and is blended with a nearby star. Hence
   its radial profile is artificially enlarged.
\item FY Per has a number of nearby stars and hence the radial profile has an
  unreliable shape.
\item J1429+4145 is extremely faint in our image and we were unable to derive a
  radial profile.
\end{itemize}

A number of the brighter targets were over--exposed, which leads to the
saturation of the central pixels and gives the radial profile a flat--top
profile. The targets affected were HL Aqr, UU Aqr, V1084 Her, RW Tri and
LSIV-083. Despite being saturated, the wings of the radial profiles are still
useful for detecting small shells. None of the other radial profiles of
our targets showed any significant deviation from the field stars, implying that
there were no small shells around any of the targets.

\subsection{Combined results of our two campaigns and other recent work}

In Table \ref{tab:tottab} we summarise the combined results from S15 and our
second campaign reported in this paper, which shows that we have examined a
total of 132 CVs, including 51 NLs. Table \ref{tab:tottab} also shows the
results from two other similar campaigns by \citet{schmidtobreick15} and
\citet{pagnotta16}, neither of whom found shells around the CVs they examined.

\begin{table*}
\caption[]{Summary of our search for nova shells.}
\begin{center}
\begin{tabular}{lrrrrrr}
\hline\hline \multicolumn{1}{l}{ } & \multicolumn{1}{r}{Nova-like} &
\multicolumn{1}{r}{Polars \&} & \multicolumn{1}{r}{Asynchronous} &
\multicolumn{1}{r}{Dwarf} & \multicolumn{1}{r}{Old} &
\multicolumn{1}{r}{Total} \\ \multicolumn{1}{l}{ } &
\multicolumn{1}{r}{Variables} & \multicolumn{1}{r}{Intermediate} &
\multicolumn{1}{r}{Polars} & \multicolumn{1}{r}{Novae} &
\multicolumn{1}{r}{Novae} & \multicolumn{1}{r}{}
\\ \multicolumn{1}{l}{ } & \multicolumn{1}{r}{} &
\multicolumn{1}{r}{Polars} & \multicolumn{1}{r}{} &
\multicolumn{1}{r}{} & \multicolumn{1}{r}{} & \multicolumn{1}{r}{}
\\ \hline Original paper \citep{sahman15} & & & & & & \\ WHT Targets &
22 & 1 & 2 & 2 & 4 & 31 \\ IPHAS Targets & 5 & 10 & 2 & 34 & 23 & 74
\\ \multicolumn{1}{l}{less: Duplicated objects}& --3 & & & & --1 & --4
\\ \hline \multicolumn{1}{l}{Total} & 24 & 11 & 4 & 36 & 26 & 101
\\ \hline This Paper & 39 &1 & 3 & 3 & 1 & 47 \\ less: Duplicated
objects & --12 &--1 & --3 & & & --16 \\ \hline
\multicolumn{1}{l}{Total} & 51 & 11 & 4 & 39 & 27 & 132 \\ { } & & & &
& & \\ \citet{schmidtobreick15} & 5 & & & 10 & & 15
\\ \citet{pagnotta16} & & 1 & 3 & &  & 4 \\ less: Duplicated objects
& & & --3 & & & --3 \\ \hline \multicolumn{1}{l}{Grand total} & 56 &
12 & 4 & 49 & 27 & 148 \\ \hline\hline
\end{tabular}
\end{center}
\label{tab:tottab}
\end{table*}

\section{Discussion}
\label{sec:disc}

Our new survey brings the total number of NLs that have been observed to 56 (see
Table \ref{tab:tottab}), with one nova shell discovered around the nova-like
V1315 Aql \citep{sahman18}. What can we deduce from this? Given the much
increased rate of nova detection in the last century, let us assume that any
novae eruptions in these NLs that occurred in the last $\sim$100 years would
have been observed. These would now be classified as old novae in the RK
catalogue and hence would not appear in our sample of NLs. We also know from our
simulations (see Section 2.1) that our observations are not sensitive to shells
older than $\sim$200 yrs. Hence our search for nova shells around NLs is only
likely to find shells between $\sim$100 and $\sim$200 years old. We found one
shell in this $\sim$100-year window, out of 56 NLs surveyed, indicating that the
lifetime of the NL phase lasts approximately $\sim$5,600\,yrs.

If we include the discovery of the nova shell around IPHASX J210204.7+471015 by
\citet{guerrero18}, who used a similar setup, in our calculation then we have
two NLs with shells from a total of 57 NLs. Assuming the $\sim$100-year
visibility window as discussed in the previous paragraph, this would imply a NL
lifetime of $\sim$3,000 yrs. This result is broadly consistent with the
order-of-magnitude estimate of 1,000 years derived by \citet{patterson13} for
the NL phase of CVs.

\citet{schmidtobreick15} found no shells around the 15 CVs they examined. They
derived a lower limit of 13,000 years for the overall nova recurrence time. This
is consistent with the lifetime of the NL phase of $\sim$3,000 yrs that we have
derived, as one would expect that the NL phase should be shorter than the overall
nova recurrence time, assuming that the cyclical evolution theory is correct.

The latest models by \citet{hillman20} show that the behaviour of a CV during a
nova cycle is largely determined by the masses of the two component stars. They
modelled four CVs, with WDs of mass 0.7 M$_{\sun}$ and 1.0 M$_{\sun}$ and
secondaries of mass 0.45 M$_{\sun}$ and 0.7 M$_{\sun}$. They found that the high
mass pair were most likely to exhibit high mass transfer rates, and hence appear
as NLs, whereas the low mass pair only achieved NL mass transfer rates just
prior to a nova eruption, and only during the phase when both magnetic braking
and gravitational wave radiation were operating. This suggests that both V1315
Aql and IPHASX J210204.7+471015 are more likely to harbour high mass components.

The search by \citet{pagnotta16} for nova shells around three asynchronous
polars and one intermediate polar found no shells. Their aim was to test the
theory that the asynchronicity of the WD spin was caused by past nova eruptions
\citep{campbell99}. Our search included three asynchronous polars, V1432 Aql, BY
Cam, and V1500 Cyg. Two of these, V1432 Aql and BY Cam, were observed by
\citet{pagnotta16}. Our observations were not as deep as theirs, and we had a
smaller field of view so, unsurprisingly, we also found no shells.

\section{Conclusions}

We performed a second H$\alpha$-imaging survey to search for old nova shells
around CVs. We imaged 47 CVs with the INT and found no new shells. Assuming that
the nova-induced cycle theory is correct, our results, when combined with our
previous campaign and other recent similar surveys, imply that the nova-like
phase for CVs lasts $\sim$3{,}000 years.

\section*{Acknowledgements}

VSD is supported by the Science and Technology Facilities Council (STFC). The
INT and its service programme are operated on the island of La Palma by the
Isaac Newton Group in the Spanish Observatorio del Roque de los Muchachos of the
Instituto de Astrof\'{i}sica de Canarias.

\section{Data Availability}

Data available on request.

\newpage

\bibliographystyle{mn2e}


\section{Motivation}
A large part of the global trade in goods is transported by sea. Thereby most cargo handling takes place in a few large ports world-wide.
Composed of participants like logistic companies consisting of shipping companies and dockyards, ports are part of the maritime sector, which is part of the transportation sector.
While providing opportunities for fast communication between distant participants, interconnectivity also offers new attack vectors for criminals to steal goods and data, sabotage systems and commit further crimes.
For criminals, targets are particularly lucrative where they can get money or attract media attention, for example with critical infrastructure.
Depending on size and sub-sector, companies are considered critical infrastructure. This includes, for example, ports and port logistics companies above a certain size~\cite{EU2008CriticalInfra,Homeland2015SectorPlan}.
However, the outage of smaller companies should not be neglected, as the failure of many smaller participants can have the same severe consequences as well.

Cyber attacks go through the media, such as the one on the Port of Antwerp~\cite{2013-BBC-Police_war} from a gang of smugglers or the big outtage of Maersk infrastructure in 2017~\cite{2018-Safety_4_S-Maersk_Lin}.
The cyber incidents targeting the maritime sector reflect the diverse motivations of the attackers:
\begin{itemize}
\item weakening the economy of a country,
\item protesting against political decisions,
\item sabotaging opposition,
\item spying out information,
\item stealing money or cargo and
\item smuggling.
\end{itemize}
Cyber incidents will come to light under certain circumstances. German laws, for example, oblige critical infrastructure to report incidents to the authorities~\cite{BSIGesetz}.
According to EU's General Data Protection Regulation, organizations must communicate data breaches to supervisory authorities.
Ad hoc and other capital market notifications may also lead to publication of incidents.
Other reasons include that the impact is unconcealable or publication through third-parties including the attackers themselves, researchers or security companies.
However, through personal experience and discussions with insiders, we assume that only a small subset of attacks on the maritime sector are publicly known. Companies could benefit from the incident knowledge of other players from the same sector. Nevertheless, most companies don't want to share or publish incidents, likely due to fear of bad publicity.

To illustrate the threats to the maritime sector and give an incentive to share threat information, we show our threat taxonomy in section \ref{methodology}, present an overview about the publicly known cyber incidents from the past 20 years in section \ref{attacks} and evaluate our findings by conclude the results from expert interviews with insiders in section \ref{interview}. We complement this part with the related work in section \ref{relWork} and end with our conclusion in section \ref{conclusion}.

\section{Related Work}
\label{relWork}
Security incidents in critical infrastructures are perceived more by the public than than attacks on non-critical infrastructure. This happens not least because of governmental reporting requirements for incidents in critical infrastructures. There are surveys and investigations targeting cyber incidents in the critical infrastructure~\cite{ogie2017cyber,al2018cyber, miller2012survey}. Others target cyber security in the maritime sector~\cite{mrakovic2019maritime}.

\label{Shen}
The damage, that can occur in a scenario where more than one actor from the maritime sector is affected, was examined 2019: The so called Shen attack scenario~\cite{2019-CyRiM_Repo-Shen_attac} describes the impact of a computer virus infection of Asia-Pacific ports.
In the scenario, a cargo management system is infected with a virus that spreads via traveling ships to other ports and their cargo management systems. As a result of the infection, these ports have to shut down their computer systems. Depending on the number of closed ports, 6 to 15, the estimated damage range between 80 billion USD and 219 billion USD.

Miller et. al~\cite{miller2012survey} classified SCADA incidents from the Repository of Industrial Security Incidents (RISI) according to the following classification factors: source sector, operation method, impact and target sector. They attempted to give a standardized and comparable terminology to determine incident severity levels.

Ogie~\cite{ogie2017cyber} also investigated SCADA and critical infrastructure related cyber incidents until 2014 using RISI data. He categorized the attacks according to the parameters intent, method of operation and perpetrator of the attack. By analysing 242 incidents, he gave a good overview of their distribution in different countries.

Al-Mhiqani et. al~\cite{al2018cyber} targeted cyber incidents in cyber-physical systems in organization of Islamic cooperation countries until 2018. They showed the main intentions in the attacks according to the taxonomy: type of attack, target sector, intention, impact and incident categories.

Mrakovic et. al~\cite{mrakovic2019maritime} gave an overview of the IT structure in vessels and international regulations and guidelines. Based on selected attacks, they showed digital risks that are specific to the maritime sector and presented maritime cyber risk management.
There are case studies on maritime security in general. For example the Centre for Strategy \& Evaluation Services examined political context and security challenges of the maritime sector in a field study~\cite{csesCaseStudy11}. In 2011, D. Cimpean et. al analysed cyber security aspects in the maritime sector. They used different
interviews and workshops to evaluate security and security measures in the maritime sector. They concluded, that the awareness of cyber security, the consideration of cyber security in regulations and a structured governance context are insufficient~\cite{cimpean2011analysis}.

In~\cite{alcaide2020critical} participants of the maritime sector were interviewd by researchers to find out their involvement in cyber security and cyber incidents. Additionally, they included the maritime infrastructure, cyber threats, cyber attacks on board and international regulations into their analysis.\\
To the best of our knowledge, our study is the first that makes a summary of all currently published cyber incidents in the maritime sector and qualifies them through insider interviews.

\section{Threat Model and Methodology}
\label{methodology}

We have analysed publicly available data to find the most common types of attacks on the maritime sector in recent years. We considered common published successful attacks, prevented attacks and published Proof-of-Concepts (PoC) which are related to the maritime sector. Prevented attacks and PoCs are included in our statistic, because we wanted to create an overall picture of possible attacks. An unknown number of incidents stays unpublished. To estimate a real world distribution of attack vectors, we have to take potential attacks, i.e. PoCs and prevented attacks, into consideration. In order to organize the attacks, we divided them into categories described in section~\ref{threats}.
These categories might still provide an incomplete view of the threat landscape, which is why we summarize our findings from this research in section~\ref{attacks} and compare them later to information from non-public sources \ref{interview}. In total, we gathered information on 90 different attacks and 15 PoCs.

\subsection{Digital Infrastructure}
The maritime sector can be divided into different types of infrastructure.
Roughly summarized, there are ports that consist of the land part, which includes logistic companies and maritime service providers
and the sea part which includes ship owners with supply industry and vessels. Looking at these participants' infrastructure, it consist of the following components:
\begin{itemize}
\item off-the-shelf components for everyday business (e.g. operating systems),
\item network infrastructure components,
\item custom made operational technology (OT) like cargo bridges,
\item mixed information technology (IT) and OT systems like ships.
\end{itemize}
The IT and OT systems in the land infrastructure are usually more or less intertwined.
Ships, the most IT-isolated group among the sea component, used to have separate IT and OT on board and received new data only by rare manual updates. Nowadays, ships have on-board Internet and load new data like container information in every port via USB flash drives. The shipping crew may bring their own devices which connect with the ship's intranet which opens up to the internet.
The IT and OT on ships and in the maritime sector in general are merging with each other, which means that more and more standard malware potentially can be found in every component.

\subsection{Threats}
\label{threats}
To bring the attacks analyzed in this paper into an order, we have used the
threat taxonomy introduced by the European Union Agency for Cybersecurity (ENISA) in 2019
~\cite{enisa2019}. They derived sub-categories of threats out of port hazards.
Even though attack goal, source of infection and other possible consequences may be linked back to different threats, we use main threats to group the attacks. The main threat categories are:
\begin{itemize}
\item abuse and theft of data,
\item data manipulation,
\item denial of service,
\item geo-localisation signal spoofing and jamming,
\item interception of emission,
\item different malware-categories,
\item man-in-the-middle,
\item social engineering, phishing and identity theft,
\item targeted attacks,
\item unknown attack vectors and
\item vulnerabilities exploitation of systems or devices.
\end{itemize}

The threat categories may not always match completely with the threats caused by the attacks showed later on, as some of our sources may be inaccurate, incomplete or incorrect. In some cases, the threat category describes the attack itself and in others the effect because we often only know one of the two clearly from the reports. We never distinguish between the causes of infection because in most cases we do not know it.
For every attack, we create a profile with the following information about the details, as far as we know them: victim, perpetrator, year, threat category, threat name, state, damage sum, impact and source. All online sources are archived using the Internet Archive's Wayback Machine.

\newcommand{\attackYear}[1]{\par\sffamily #1:\rmfamily~}
\newcommand{$^\dagger$}{$^\dagger$}

\section{Threat Categories}
\label{attacks}
In total, we gathered 90 attacks and 15 PoCs from different public sources. In the following we give a short description and one source per event, grouped by threat category and ordered by year. We categorized the attacks according to the main threat, although this is sometimes not clearly possible due to the fact that we do not know the way of intrusion, cause and impact about them. We marked all PoCs with the follwing symbol: $\dagger$.

\subsection{Abuse and Theft of Data}
\label{abuseTheft}
For various reasons data from maritime participants can be valuable for attackers. When hackers steal sensitive data or abuse certificates used in port operations like customs, the availability and integrity of these operations can be violated. In most cases, it was not clear how the attackers got the data, whether by malware, credential theft or by other attack vectors.
\attackYear{2012}Attackers gained access to systems operated by the Australian Customs and Border protection which allowed the attackers to check whether their shipping containers were regarded suspicious by police or customs~\cite{2018-Yachting_P-Could_you}.
\attackYear{2013}Designs of the Littoral Combat Ship from the US Navy and other weapon systems have been stolen. Chinese hackers were suspected of having committed the crime~\cite{2013-The_Washin-Confidenti}.
\attackYear{2014}A person onboard a vessel had been uploading images on Facebook, which provided a detailed look into the safety measures in place. This information leak could have led to attackers gaining information about the ship, which would make it easier to attack. This was discovered prior to entering the Gulf of Aden and the vessel changed its course because they feared an attack from pirates~\cite{2014-Cyberkeel-MARITIME_C}.
\attackYear{2016} The ISC-CERT warned about a SQL injection vulnerability under active exploitation affecting web applications used by multiple US organizations that could lead to data loss~\cite{2016-ICS-CERT-Navis_WebA}.
South Korea suspects North Korea of having hacked Daewoo Shipbuilding Maritime Engineering (DSME) and stealing blueprints of warships~\cite{2017-Reuters-North_Kore}. DSME may be victim of another data theft in 2020, but the hack is not further described and still unconfirmed~\cite{2020-Twitter-Threat_act}.
Also, the personal data of thousands of US Navy soldiers were stolen by infiltrating a service employee's notebook~\cite{2016-Reuters-Personal_d}.
Information on the details of six submarines designed for the Indian Navy was stolen from the Naval Group, a french defence contractor formerly known as DCNS. In total they lost over 22,000 pages containing confidential material~\cite{2016-Reuters-Frances_D}.
Pirates infected the content management system of an unnamed company to gather information about which container on a vessel is valuable and could be robbed~\cite{2016-businessin-High-tech}.
\attackYear{2017}Svitzer Australia detected that they leaked data through the email accounts of three employees. The stolen data contained personal information about the company's employees~\cite{2018-ABC_News-Svitzer_em}.
Clarkson was the target of a cyber security incident, where an unknown attacker accessed internal systems and stole data. The attacker demanded ransom for the return of the stolen data~\cite{2018-Clarksons-Update_on}.
An Australian Defence subcontractor lost several gigabyte of sensitive documents, related to allied defence projects like jet fighters and ship plans~\cite{2017-iTnews-Hacked_Aus}.
\attackYear{2018}Early in the year, a US Navy subcontractor was attacked and 64 gigabyrte of data including confidential plans for supersonic missile projects were stolen. The USA suspected the Chinese government of the hack~\cite{2018-The_Telegr-Chinese_ha}.
Attackers attempted to sell material of defence ship builder Austal on the Internet. Austal said they do not intend to respond to that kind of ransom and thereby risked the leak of the stolen data~\cite{2018-The_Guardi-Defence_sh}.
\attackYear{2019}Holland America Line noticed unauthorized third-party access to email accounts containing personal information including social security numbers, health-related information and financial account information. The attackers likely got acces via phishing emails~\cite{2020-prnewswire-Holland_Am}.
A group named ``Maze'' hacked London Offshore Consultants and asked them for ransom after a small selection of the stolen files were leaked online. The hackers claimed that they stole 300 GB of information but LOC confirmed, that only a small number of clients were affected~\cite{2020-Splash-London_Off}.
\attackYear{2020}Unconfirmed sources described that South Korea's shipbuilder DSME was hacked by unknown hackers that sold access to DSME's network~\cite{2020-Twitter-Threat_act}.
\attackYear{2021}Attackers gained access to some of the internal systems from Carnival Corporation and accessed data relating to employees and guests of the company~\cite{2021-Bleeping_C-Carnival_C}.

\subsection{Data Manipulation}
Shipping companies rely on their data sources about vessels and customer information. Ships need reliable nautical data to navigate. Manipulating data unnoticed or even visibly is attractive for attackers to achieve goals including: finding valuable goods, sabotage companies, or deface companies.

\attackYear{2014}The website of the Massachusetts Maritime Academy was presumably hacked by an Islamist group. They replaced the content of the website with Islamic messages. It is presumed that the Moroccan Electronic Islamic Union group is responsible for hacking the website~\cite{2014-CyberKeel-Marine_Cyb}.

\subsection{Denial of Service} 4
\label{DDoS}
The aim of Denial of Service (DoS) attacks is to affect the availability of a system. Several sources can be involved in the same DoS attack which then can be called a distributed DoS (DDoS) attack. DDoS attacks are used for blackmailing but also as a political weapon~\cite{mansfield2015growth}.

\attackYear{2001}The Port of Huston was attacked twice~\cite{2003-The_Regist-UK_teenage}: The first attack in August was a DDoS attack from a US citizen. The second attack was distributed ping flood attack, conducted in September by a US teenager who used the Port of Houston as an instrument in a personal revenge plan.
\attackYear{2013}The Port of Long Beach was a target of large scaled DDoS attacks~\cite{2018-cytegic-Managing_t}.
\attackYear{2017}The Port of Vancouver became a target. When asked for details, Vancouver port's spokeswoman said: \textit{``We cannot answer this, as it could pose a security risk for the port''}~\cite{2017-Columbian-Port_of_Va}.

\subsection{Geo-localisation Signals Spoofing and Jamming}
\label{spoofing}
Geo-localisation signals (GPS) and navigation systems can be spoofed or jammed in order to hinder navigation and change the trajectory of a vessel~\cite{enisa2019}. In the following, GPS spoofing attacks related to the maritime sector are listed.
\attackYear{2001}A vulnerability assesment of the U.S. transportation infrastructure discusses attacks on GPS related to the maritime sector~\cite{carroll2003vulnerability}.$^\dagger$
\attackYear{2009}To identifying the full effects of GPS jamming on safe navigation at sea, researchers from the General Lighthouse Authorities of the United Kingdom and Ireland examined the effects from unintentional interferences and jamming onto GPS~\cite{2009-Journal-GPS_jammin}.$^\dagger$
\attackYear{2010}South Korea reported GPS jamming by North Korea~\cite{GPSVuln13}.
\attackYear{2012}South Korean officals said that 254 ships experienced GPS interruptions over 16 days of jamming by North Korea~\cite{2013-Reuters-Government}.
\attackYear{2013}Researchers from the University of Texas at Austin successfully demonstrated GPS spoofing for a super yacht at sea. With small custom-made GPS devices, they tricked the yacht onto a track hundreds of meters from its intended one. They also showed, that this attack could be performed silently~\cite{2013-Cockrell_s-UT_Austin}.$^\dagger$
Trend Micro researchers showed multiple ways to disturb and spoof ships' AIS systems. They achieved modification of ship details, creating nonexistent vessels, trigger collision warnings, create nonexistent search and rescue helicopters, spoof the weather data and impersonate maritime authorities to trick the vessel~\cite{2014-Cyberkeel-MARITIME_C}.$^\dagger$
Targeting more than GPS, a research team from IOActive described attacks on satellite communication hardware on ships. They examined devices from different vendors and found vulnerabilities in each of them. In result, they could cause a manipulation of communication structure between ships~\cite{2014-Technical_-A_wake-up}.$^\dagger$
\attackYear{2016}More than 700 ships were affected of GPS jamming over a period of five weeks. The signals originated from five North Korean locations along the border to South Korea~\cite{2016-Reuters-South_Kore}.
\attackYear{2017}All at once, the GPS navigation of more than 20 vessels was spoofed at the same time in the Black Sea near Russia. The effect lasted for a few days with different phenomena like loss of position and wrong display of positions.~\cite{2017-The_Mariti-Mass_GPS_S}.
\attackYear{2018}Another far reaching GPS spoofing was recorded between 2018 and 2019 in the Central and the Eastern Mediterranean Sea. The loss of GPS signal obstructed the functions of (GPS-based) navigation devices~\cite{2019-US_Depar-MSCI_Advis}.
A proof of concept attack showed how specially crafted malware can be used through various channels such as USB-drives to alter data and attack the ECDIS navigation system in Ships~\cite{2018-Riviera-Bridge_sys}.$^\dagger$
Researchers from the German police targeted both, the ECDIS and GPS Systems of Ships, to show how vulnerable the navigation is. The GPS is spoofed with cheap technical material and the ECDIS maps are faked and shared to alter the position of objects and the terrain information~\cite{2018-Wilfried_H-Polizei-In}.$^\dagger$
\attackYear{2019}At the Port of Shanghai, ships Automatic identification systems (AIS) and GPS systems were spoofed. The AIS showed other ships on wrong positions and they appeared to congregate in large circles. The origin of these dissruptions is still unclear~\cite{2019-MIT_Techno-Ghost_ship}.

\subsection{Interception of Emission}
\label{interception}
For many reasons, hackers would like to intercept the communication between stakeholders like port and vessels. Often such interceptions are used to trick victims into sending money to the wrong target.
\attackYear{2014}The World Fuel Services (WFS) fell victim to a scam attack where they lost 18 million USD. The attackers tricked WFS to buy and deliver 17\,000 metric tons of gas to alledged buyers~\cite{2014-Ship_and_B-WFS_In_Cou}.

\subsection{Malware}
\label{malware}
Since electronic components with common operating systems are part of ships and harbour control infrastructure, they can be infected with malware that also infects company systems in other sectors. The abilities and damage skills of malware vary and are therefore divided into different sub-categories. Ransomware will have its own part as its relevance has increased significantly in recent years.

Also a lot of malware infections are part of the attack vectors from targeted attacks in section \ref{targeted}
therefore we do not mention them again here. Most of the malware incidents we found were caused by ransomware. In some other cases, too little information is known to be able to say whether ransomware or other malware was the cause.

Ransomware encrypts the targeted system and promises a decryption in exchange for a ransom fee. Some offshoots additionally extract data or only encrypt, without the opportunity to decrypt the data.

\attackYear{2013} A smartphone was connected to the network of a drilling unit, resulting in a not further described malware infection and a shut down of the machine~\cite{2015-Maritime_C-Coast_Guar}.
\attackYear{2017}A famous victim of the ransomware-like, destructive malware NotPetya is the Maersk Group. The destructive infection was probably not targeted but cost the company over 300 million USD~\cite{2018-Safety_4_S-Maersk_Lin,wired2018NotPetya}.
Other NotPetya victims are the Port of Rotterdam~\cite{2017-NL_Times-Rotterdam}, Jawaharlal Nehru Port, Indias largest container port~\cite{2017-Healthcare-Nuance_kno}.
\attackYear{2018}Cosco Shipping fell victim to NotPetya as well~\cite{2018-Safety_4_S-Cyber_atta}.
The Port of San Diego was hit with the SamSam ransomware and lost more than 30\,000 USD as they refused to pay the ransom~\cite{2019-San_Diego_-What_happe}. An email campaign spreading multiplatform Java Remote Access Tool (RAT) took place~\cite{2019-Yoroi-The_Story}. This attack is simmilar to the MartyMcFly campaign, see section~\ref{Marty}.
\attackYear{2019}Early that year, a vessel near the Port of New York was infected with Emotet that rendered much of its network unusable~\cite{2019-James_Rund-Coast_Guar}. A not further named MTSA (Maritim Transportation Security Act) regulated facility was infected with Ryuk ransomware. The ransomware most likely entered the company's network via phishing email~\cite{2019-US_Coast-Marine_Saf}. Ryuk also infected Pitney Bowes~\cite{2019-Security_W-Pitney_Bow,2019-Pitney_Bow-System_Upd}. A research team created and studied the Shen attack scenario~\cite{2019-CyRiM_Repo-Shen_attac} that we described in section~\ref{Shen}.$^\dagger$
\attackYear{2020}The ship management company Anglo-Eastern partly prevented a ransomware attack. According to an Anglo-Eastern manager, only 20 percent of the workstations and 10 percent of the servers had been encrypted~\cite{2020-Splash-Anglo-East}. Toll Group was targeted by two attacks: The first was a large scaled attack with Mailto/NetWalker and the second occured with Nefilim. While there is no statement, how NetWalker infected the companies IT, Nefilim malware was most likely distributed via Remote Desktop Service~\cite{2020-CISOMAG-Mailto_Ran,2020-IT_News-Toll_Group,2020-IT_News-Toll_Group2}.
The Blue Water Shipping Company achieved to stop a ransomware attack taking place in September before the ransomware could encrypt major parts of the IT infrastructure~\cite{2020-ShippingWa-Blue_Water}.
MSC Cargo was hit by an unnamed malware that caused the company to shut down servers and stop part of their operation for a few days~\cite{2020-Security_W-Shipping_G}.
The cruiser line operator Carnival was infected with a not further specified ransomware. The infection could have happened through vulnerable end devices and accessed certain files~\cite{2020-Carnival-Substitute,2020-Bleeping_C-Worlds_la}. The Ragnar Locker ransomware hit CMA CGM. Distributed via email attachments the malware encrypted and exfiltrated data~\cite{2020-SWZ_Mariti-CMA_CGM_su}.
The Norwegian shipping company Hurtiguren has been affected by a ransomware that has infected and paralysed some of its systems that are part of its global infrastructure~\cite{2020-Security_W-Norwegian}.
\attackYear{2021}Through a prepared fake email, attackers delivered the so called PortDoor backdoor to the submarine defence contractor Rubin Design Bureau. According to researchers~\cite{2021-The_Hacker-New_Chines}, the attack is Chinese state-sponsored.

\subsection{Man-in-the-Middle}
In a Man-in-the-Middle (MitM) attack, an attacker inserts himself into a communication and pretends to one or both communication partners that they are talking directly to the other. Thereby the attacker can normally read and modify the communication.
\attackYear{2013}Clearsky analysts in cooperation with CyberKeel examined a bunkering scam attack from 2013 and 2014. They found that more participants of the maritime industry are vulnerable to MitM attacks in their business communication and could therefore fall for bunkering scam attacks~\cite{2014-Cyberkeel-MARITIME_C}.$^\dagger$
\attackYear{2015}CyberKeel researchers found that websites of carriers are vulnerable to a faked-website spoofing. With a perfect copy an attacker could trick shipper into entering their sensitive information into the faked website and then pretend to be the shipper~\cite{2015-Lloyds_Loa-Top_contai}.$^\dagger$

\subsection{Social Engineering, Phishing and Identity Theft}
\label{phishing}
Through social engineering, attackers may trick people into giving away confidential information. This includes phishing where attackers use email or websites to pretend to be someone else. So called spear phishing attacks are tailored to the victims by imitating familiar or trustworthy addresses and names.
\attackYear{2013}Messages with remittances where sent from a Singapore shipping company to its bank from the companies managing director's email account but without his knowledge. There were four transactions of in total 1.8 million USD~\cite{2018-Kennedys-Whaling}.
\attackYear{2014}The maritime cyber security company CyberKeel tested the eCommerce applications of different shipping carriers and found weaknesses in the password policies what may allow them to bruteforce and access customers accounts~\cite{2014-Cyberkeel-Maritime_C2}.$^\dagger$
\attackYear{2015}Hackers tricked a shipping company based in Cyprus to pay the money for a legitimate ongoing supply to a wrong banking account and stole around 645\,000 USD~\cite{2016-American_a-MARITIME_C}.
The Nautilus Minerals company lost 10 million USD to an unknown party while thinking they paid a charterer's guarantee to the Marine Assets Corporation. The exact reason for this failure is unpublished~\cite{2015-Insurance_-Cyber_hack}.
\attackYear{2016}A seaman fell victim to a honey trapping attack: A blackmailer lured him into taking suggestive pictures of himself and sent them to the attacker over a period of six weeks. Later the attacker demanded a deposit of 10\,000 USD to not show the pictures to his family. Researchers warned that it seems like this kind of attack happens more often in the Gulf of Guinea region~\cite{2016-Paul_Berri-Honeytraps}.
A broad email fraud campaign spotted by Clearsky Security targeted VersaCold and Toll Group amongst others with real-looking and targeted fake domains~\cite{2016-ClearSky-Business_E,2016-American_a-MARITIME_C}.
\attackYear{2017}A Malaysian bunker fuel owner became victim of a fraud where he lost 4.5 million Malaysian Ringgit to an unknown attacker. To make the scam as credible as possible, the attacker obtained copies of the victim's email communication via spyware to masquerade a fake email~\cite{2017-The_Sun_Da-Kedah_bunk}.
Between 2017 an 2018, the business email spoofing group Gold Galleon, likely from Nigeria, targeted maritime actors and stole a minimum of 3.9 million USD. They used among others tools for keylogging and password-stealing to gain access to email accounts from where they carried out their attacks~\cite{2018-Securework-Gold_Galle}.
\attackYear{2019}The US Coast Guard warned about phishing emails and malware intrusion attacks targeting commercial vessels. The attackers tried to gain sensitive information by disguising themselves as official Port State Control~\cite{2019-US_Coast-Marine_Saf2}.
\attackYear{2020}The Maritime Transportation System (MTS) and the Information Sharing and Analysis Center (ISAC) warned Tug owners about phising emails containing fake voicemail attachments~\cite{2020-Cybersecur-Cyber_Thre}.
The US Coast Guard warned in September about sophisticated email spoofing attacks which lead to at least one network compromise. The campaign used among others a faked Cost Guard address~\cite{2020-US_Coast-Marine_Saf}.
\attackYear{2021} During payment of a contract from the subsidiary Hammonia Tanker Holding to the parent company Hammonia Schiffsholding, the email traffic between the companies was manipulated in such way that the payments in the amount 1 million USD went to the attackers~\cite{2021-HAMMONIA_S-Finanziell}.
The International Transport Intermediaries Club (ITIC) warned of an increased incidence of email fraud, citing a recent incident as an example. In this case a shipbroker contacted his usual bunker supplier but emails with faked payment details were sent by attackers, whereupon the 300.000 USD were transferred to the wrong account~\cite{2021-ITIC_Press-Counterfei}. ITIC also presented another case where a ship manager had arranged repairs with a shipyard. After a fake email, the payment of 500.000 USD was sent to the attackers instead of the shipyard~\cite{2021-ITIC_Press-The_phone}. The Red Sky Alliance warned of email frauds in which the attackers are impersonating the Mediterranean Shipping Company (MSC) to spread faked emails with dridex malware~\cite{2021-SAFETY4SEA-Recent_mar}.

\subsection{Targeted Attacks}
\label{targeted}
Targeted attacks use infection strategies and attack vectors tailored to one specific target and are usually scheduled over a longer period of time. Often a combination of social engineering, phishing and public knowledge about the target is used for infection with a broad amount of tools ranging from data theft tools and remote-access Trojans to destructive malware.
\attackYear{2011}The Iranian Shipping Line IRISL fell victim to a huge hacking attack where its cargo data systems were damaged. Israel was accoused of having committed this attack. The motivation of the attacker was to discourage all people transporting material for the Iran atom program~\cite{2012-Reuters-Irans_top}.
Icefog is an Advanced Persistent Threat (APT) targeting maritime and shipbuilding groups and other industries in Japan and South Korea since at least 2011. The attackers relied on spear-phishing emails that attempt to trick the victim into opening malicious attachments or websites~\cite{2013-Kaspersky-The_ICEFOG}. From 2011 to 2013, the Port of Antwerp was target of a persistent targeted attack from drug smugglers, where they gained remote access to a terminal system that gave them the opportunity to access, steal and erase containers out of the shipping companies system~\cite{2013-BBC-Police_war}.
\attackYear{2012}Danish maritime shipping authorites fell victim to a possible Chinese state sponsored attack with unnamed methods, possibly a virus infected pdf file. The goal seemed to be espionage~\cite{2014-ShippingWa-Kina_hacke}. The operation Cleaver, a probably Iranian worldwide cyberwarfare operation between 2012 and 2014 targeted different unnamed transportation companies. The infection contained compromising of active directory domains, Cisco Edge switches and routers and networking infrastructure~\cite{2014-Cylance-Operation}.
\attackYear{2013}The so called Kimsuky APT group targeted mostly South Korean organisations, among them the Hyundai Merchant Marine, with malware. A dynamic link library was used as dropper for further infection and espionage on the infected system~\cite{2013-Kaspersky_-The_Kimsu}.
\attackYear{2014}The so called Zombie Zero Attack was a broad ranged targeted attack onto shipping companies. It was a supply chain attack, barcode readers were delivered with embedded malware that was able to open a backdoor for further attacks in which finance data was stolen~\cite{2014-TrapX_Secu-Anatomy_of}.
The hacker group named Leviathan, also known as TEMP.Pericsope, launched first attacks onto the maritime sector. One campaign was seen between November and January of the following year. The group faked emails with malicious Microsoft Office documents to US universities with military interests~\cite{2017-Proofpoint-Leviathan}.
\attackYear{2015} More malware campaigns by the threat actor Leviathan were reported. Some victims were connected to South Chinese Sea issues~\cite{2015-Spiceworks-Stealthy_C, 2017-Proofpoint-Leviathan}.
\attackYear{2017}Early 2017, a German container ship between Cyprus to Djibouti was hacked, most likely by pirates. They took full control over the navigation system to enter the ship~\cite{2017-Safety_at_-Shipping_m}.
\label{Marty}%
\attackYear{2018}Different enterprises, among them Italian naval industries, where targeted by an unknown group that deployed the remote-access Trojan MartyMcFly and the remote access tool QuasaRAT through specially crafted and targeted phishing emails~\cite{2018-Yoroi-Cyber-Espi}.
End of 2018, Russia seized Ukrainian ships. Before the attack, there were multiple coordinated cyber attacks on Ukrainian government agencies tied to Russia. One of these attacks was a phishing campaign, with the aim of installing malware, exfiltrating data and taking control over computer functions. In another attack in November 2018, Russian-linked Gamaredon Group delivered the windows tailored backdoor Pterodo to Ukrainian government agencies. Presumably the malware should have gathered information for the further attack where Russia seizured the Ukrainian ships~\cite{2018-Nextgov-Russia_Lau}.
Once more, attacks by Leviathan were noticed. Amongst others, victims were an US shipbuilding company and, again, maritime entities connected to South China Sea issues. The threat actor spread their malware through spearphishing emails with Microsoft Office documents and installed multiple backdoors and spyware tools to gather data from the infected systems~\cite{2018-FireEye-Suspected}.
\attackYear{2019}In Kuwait, at least one transportation and shipping organization was victim of the xHunt Campaign. The attackers installed a backdoor called Hisoka that gave them the opportunity to load other exploitation tools onto the infected system~\cite{2019-Paloalto_N-xHunt_Camp}.
\attackYear{2020}Iran claimed that a large scale targeted attack was carried out on the infrastructure of the country's ports. No further details have been published so far~\cite{2020-Reuters-Iran_says}.
Similar to the famous case in Antwerp, in Hamburg a South American drug cartel smuggled containers of cocaine. For this, an attacker with insider knowledge hacked into the IT systems of a container company and caused the containers to be delivered unnoticed~\cite{2020-Spiegel_on-Polizei_un}.

\subsection{Unknown Threats}

In some cases, only the damage of the attack or the fact that an attack took place are known. This can be triggered by the fact that the attackers removed all evidence, the attack was not an attack but an incident, the system monitoring is too incomplete to reconstruct an attack or the company hides the investigation results for some reasons. In most cases, the minimal damage is a temporary shut-down of servers and other IT infrastructure.
\attackYear{2015}During the process of finding a new submarine shipbuilder for Australia, the three competitors Germany’s TKMS and builders from Japan and France received massive hacking attempts. That forced them to carry out the deliveries of sensitive information by hand~\cite{2015-Business_I-Foreign_bu}.
\attackYear{2017}After an attack with unpublished attack vector, in which the attacker had access to intranet systems, the BW Group had to shut down multiple servers~\cite{2017-SP_Global-Shipping}.
\attackYear{2018}An attack hit the Port of Barcelona but was repelled by internal security meassurements~\cite{2018-Ara-El_port_de}.
\attackYear{2019}An unknown intrusion forced the UK-based marine services provider James Fisher and Sons to shut down affected systems after recognizing unauthorized access~\cite{2019-The_Mariti-James_Fish}.
\attackYear{2020}The Shahid Rajaee Port of Bandar Abbas in Iran was the target of an unspecified attack. Local authorities told that they could repell most of the attack~\cite{2020-Washington-Officials}.
The U.N. International Maritime Organization urged that they became the victim of an not further specified attack~\cite{2020-Reuters-UN_shippin}.
\attackYear{2021}The offshore vessel owner Bourbon was victim of an unspecified attack that affected and disabled parts of its internal computer network~\cite{2021-Splash247-Bourbon_co}. Hyundai Merchant Marine (HMM) confirmed an unidentified security breach, impacting some of the company's email server. HMM stated that no data had been leaked through the attack~\cite{2021-Splash247-HMM_confir}.

\subsection{Vulnerabilities Exploitation of Systems or Devices}

Unpatched security vulnerabilities, weak passwords and
wrongly configured systems offer a broad attack surface. A lot of systems have known vulnerabilities, although patches for these have often been available for a long time. If an attacker knows about these vulnerabilities, all he has to do is find systems that are affected by them. Shodan is one of the tools to simplify the search for vulnerable systems worldwide.
\attackYear{2013}A US Navy team found vulnerabilities in the USS Freedom while pentesting the vessels network~\cite{2013-Reuters-Cyber_vuln}.$^\dagger$
\attackYear{2014}The US Naval Sea Systems Command warned that parts of vessel control systems, like a submarine's Caterpillar-build backup diesel  engine, running outdated and vulnerable Windows XP versions with known vulnerabilities that could be abused to break into the system~\cite{2014-Cyberkeel-Maritime_C2}.$^\dagger$
\attackYear{2015}Microsoft patched a vulnerability that could allow attackers to take control of webservers. CyberKeel tested 50 different maritime websites against this vulnerability. 37 percent of the tested websites were vulnerable, beneath them websites from MSC, Happag Lloyd and Hamburg Süd~\cite{2015-Splash-Lack_of_pa}.$^\dagger$
\attackYear{2017}A researcher from Pen Test Partners showed the take over of control over a ship's network by means of a vessel heading from Malacca Strait to Tubarao in Brazil. With the help of Shodan he found access to a VSAT modem that gave him information about the crew on board and the network configuration. This got him further into the ship's network~\cite{2017-Pen_Test_P-OSINT_from}. Another security researcher named x0rz told that they had hacked into a ship and gained control of the ship's VSAT systems. He said that they could see the call history, change system setting and upload new firmware. In addition, as in the previous attack, the access to the VSAT system leaks information about the ship's position~\cite{2017-Mfame-Remote_Att}.
\attackYear{2020}Researchers from Yangosat gained access to a vessel's VSAT system near a European capital city. They had access to information about the system and would have been able to break the vessel's  system completely~\cite{2020-Ewan_Robin-Hacked_-_a}.

\subsection{Conclusion of Attacks}
\label{targetConclusion}
The most common detected attacks onto the maritime sector in the last years are ransomware-based infections. The software used is similar to the software used in attacks on other sectors and also the path of infection is most common, via email. A lot of other malware infections, affecting shipping companies and systems on vessels, are standard malware infections with non-specialized software. There are also examples of detected per-attack-cropped software in the last years. One example for these targeted campaigns is email fraud, with shipping-company specific fraud email addresses and content.
In addition, participants of the maritime sector were repeatedly affected as collateral damage by broad targeted malware attacks on system-relevant infrastructure.
By comparison with figure~\ref{fig:threats} which shows the number of incidents for the periods 2001 to 2016 and 2017 to 2021 per threat category, and figure~\ref{fig:years} which shows the distribution of attacks over the years, we see a clear trend towards an increase in numbers of incidents, especially in ransomware. A list of all incidents can be seen in the appendix table~\ref{tab:incidents}.

\begin{figure}[ht]
\centering
\includegraphics[width=\columnwidth]{graphs/jahre.pdf}%
\caption{Number of publicly reported incidents per year.}
\label{fig:years}
\Description{The figure shows the number of publicly reported incidents per year. 2 inicidents were reported in 2001. Since 2010, the number of incidents is increasing.}
\end{figure}

\begin{figure}[ht]
\centering
\includegraphics[width=\columnwidth]{graphs/threats.pdf}%
\caption{Number of publicly reported incidents per threat category for the periods 2001-2017 and 2018-2021.}
\label{fig:threats}
\Description{The figure shows the number of incidents in different threat categories for two periods. In recent years, most incidents were malware incidents.}
\end{figure}

If one looks at the accused attackers, we find that global conflicts between states~\cite{globalconflicttracker2020} are reflected there: North Korea was accused of being behind cyberattacks on South Korean companies~\cite{2013-Reuters-Government,2017-Reuters-North_Kore}, Russia was accused of attacking Ukrainian targets~\cite{2018-Nextgov-Russia_Lau} and China allegedly attacked various targets in the conflict over the South China Sea~\cite{2018-Bloomberg-Chinese_Ha}.

\subsection{Recommended Sources for Further Information}
During our research, we looked through more than a hundred references. In this section, we want to highlight references that are particularly detailed, entertaining or educational and well worth reading.
Some of them are summaries from IT security companies that regularly present their research and working experience. Others are reports from security researchers or (former) employees.

We would like to recommend two sources about the NotPetya incident at Maersk. First, the Wired article describing the incident in detail~\cite{wired2018NotPetya} is worth mentioning. Second, a report by Gavin Ashton, former Maersk employee, is remarkable. His report also covers a period prior to the incident~\cite{2020-Gavin_Asht-Maersk_me}.
The Center for Advanced Defense Studies published a detailed and nicely prepared report on exposing GPS spoofing in Russia and Syria~\cite{2020-C4ADS-Above_Us_O}.
There are a lot of extensive reports about APTs and specific campaigns. The APTnotes repository~\cite{APTnotes} collected more than 500 publicly available reports related to APTs. The repository is not specific to the maritime sector. As an example, we mention the reports on the likely Nigerian threat group Gold Galleon by Secureworks~\cite{2018-Securework-Gold_Galle} and on the Kimsuky operation by Kaspersky~\cite{2013-Kaspersky_-The_Kimsu} because of their length and level of detail.

\section{Expert Interviews}
\label{interview}
The set of cyber incidents that we collected shows only a fraction of all incidents that occured, as some incidents have not been detected at all~\cite{fireeye2020report} and neither the affected company, nor the attacker or a third party has disclosed the incident to the public
~\cite{rsm2019report,bsi2019report}. Furthermore, we might have missed publicly reported attacks.

To set our results in relation, we conducted five interviews with experts from the maritime sector. Moreover, we use the interviews to determine the level of coverage of the ENISA scenarios and to gain insight in the role of threat information sharing.

\subsection{Method}
The interviews are based on a semi-structured questionnaire with questions in four different categories:
\begin{enumerate}
\item general context of the interviewee and their employer,
\item incident disclosure strategies and threat information sharing,
\item cyber incidents in the maritime sector in general,
\item the interviewees' perspective on the results presented in section~\ref{attacks}.
\end{enumerate}

\subsection{General Context}
We interviewed representatives from five European companies from the maritime sector. Among them were logistic companies, shipyards and suppliers with a few hundred up to thousands of employees. Some of them are part of critical infrastructure. The interviewees were required to have insight in their company's IT security processes. Most have a full technical IT security position, some have to deal with organizational aspects of IT security and IT in general as well.
In order to guarantee the anonymity of the individual participants and companies, we will not release any more precise data.

All interviewees report that the number of cybersecurity full-time positions is small (one to ten employees). The number of employees who have insight into the cyber attacks the company is confronted with is always strictly limited and ranges from three up to 45 people. Most of the interview partners stated, that their companies see IT security as a relevant topic and have advanced attack detection methods that go beyond firewalls.
Two companies have dedicated teams for OT security, which closely work together with the IT security teams.

\subsection{Thread Information Sharing}
Only the critical infrastructure companies report incidents in order to comply with reporting obligations under law. They don't have additional internal rules for reporting. Two of the interviewees know unpublished cyber incidents from other companies.

The main reason for not publishing incidents are fear of image loss and economic damage. Two companies participate in Threat Information Sharing (TIS) platforms and gained useful information in the past. The other three agree that it could be useful to participate in TIS groups.

Reasons for not-participating are the inability to contribute own incidents or distrust against the other TIS participants.
Additionally, the information gain from TIS groups may be bigger, when the group is small, non-official and communicates verbally and informal.
To increase the efficiency of TIS groups, one interviewee proposed that all incidents should be reported anonymously. This would help to prevent image losses. Another suggestion was to filter and categorize the threat information to allow a more targeted and customized stream of information.

\subsection{Cyber Attacks on the Maritime Sector}
The interviewees state that from an attacker's persepective the most interesting attacks are media-effective or mass attacks like email campaigns. The NotPetya attack on Maersk~\cite{2018-Safety_4_S-Maersk_Lin} was seen as the worst incident in the maritime sector. In line with this, the most serious type of attacks in the last years are ransomware attacks.

For defence, the companies take measures to protect endpoints but also sensitize their employees because they are a key entry point for malware.
Only two of the companies keep statistics on IT security incidents.

\subsection{Comparison of Experience with our Results}
The interviews put the results of our research in perspective. The first point of criticism against our statistic is the differentiation between the threats malware, targeted attacks, ransomware and DDoS attacks because the transitions are fluent and not clear at first glance. This emerged from the fact, that the public sources are often vague and do not describe all the causes and consequences exactly. Therefore it is hard to decide, in which threat category they belong. Another point of criticism is, that we may have overseen the threats CEO-fraud and malware infections via USB flash drive. We don't have examples for real world incidents like this, but they occur in the wild. We covered CEO-fraud under the threat category social engineering in section \ref{phishing} and the USB-attack under different categories, mostly malware, because first and foremost this is an infection method and we do not distinguish according to this. Additionally we cover attacks like AIS-spoofing under the category geo-localisation signals spoofing and jamming in section \ref{spoofing}.
For a comprehensive analyses of attacks, we include proof of concepts in our work, as they are possible attacks and should therefore be taken into account, even though we have not yet observed any matching real world attacks.
According to the statement of two interviewees, we may cover maximum ten percent of all cyber incidents in the maritime sector. Nevertheless, all participants agree, that the distribution may be correct taking into account, that the attack distribution has changed in recent years. It should also be emphasized that reporting an incident to an authority or a security company doesn't imply that they occur in public statistics. On the contrary, they are mostly confidential. However for informational and advertising purposes, these institutions sometimes publish anonymized statistics about cyber security incidents, that they handled. And so they found there way into our evaluation.
Lastly, most of our participants agree that it would help a lot if more incidents were published. Not least by increasing the awareness against cyber attacks, that is currently low.

\section{Conclusion}
\label{conclusion}
Our survey shows that more and more information security incidents are reported publicly, which also correspondents to a general trend in any other industry. But in absolute terms, considering the size of the maritime sector and estimates of unreported incidents, still very few incidents are reported. The experts we interviewed suspect that the number of successful attacks we found covers 10 percent at maximum.

Nowadays major malware campaigns delivered through email can hit a maritime supplier in the same way as they affect any other industry.
This is amplified by the fact that there are more opportunities for malware to spread because even systems that used to be OT-based, such as ships, now have enough common IT infrastructure on board to be infected by standard malware.
We can see this trend in the distribution of threats seen in the maritime sector over the last twenty years.
More untargeted and simple malware attacks took place then, whereas more ransomware and targeted attacks take place nowadays.

Most incidents we found belong to one of two kinds of attacks: First, there are attacks that target companies and vulnerable systems in general, and not specifically the maritime sector, for example to make money via ransomware. Second, there are targeted attacks in which specific maritime companies, such as shipyards, are targeted for presumably espionage purposes or other political reasons. In most of these cases it is suspected that state sponsored actors may be involved, but in most cases there are no concrete public available evidences.

In general the attribution for cyber attacks is difficult because real evidence is rarely presented. There may be political reasons to present a specific actor as attacker or there may be a desire to disguise a configuration error. For this survey, we have taken the information about the presumed attackers from the respective sources. These information should be taken with a grain of salt.

There are few incidents where companies proactively publish information voluntary or under duress. Often, the information is not detailed. Rarely do companies themselves or insiders report in particular detail on the cause and consequences of attacks.
This is among other things because the companies concerned are afraid of bad publicity and competitive disadvantages.
Detailed reports are particularly valuable because everyone can learn from them: the reports show what can happen, what went poorly and what went well in responding to incidents.

All public information about incidents can be used by all companies to improve their IT security. There are concerns, that attackers could also use these reports to attack other companies in the described way, which can increase an already existing attack vector. We argue that such report are more important in combating an attack than in exacerbating it because a successful attacker could already potentially attack anyone that uses similar infrastructure if the attack vectors remain unfixed.
We have highlighted particularly noteworthy reports in this paper and believe that it is very important that companies continue to publish both prevented and successful attacks in order to help other companies, independent of their industry, to avoid the same kind of attacks and to increase the overall awareness.

Our interviews suggest that the awareness of attacks has already increased in large companies today whereas small companies tend to consider themselves unattractive to attackers. Yet, for many companies, regardless of their size, there is a tough trade-off between IT security and cost. Policy makers in various countries support this decision with requirements laid down in legislation. Also, while some of our interviewees see the possibility of Thread Information Sharing (TIS) as potentially helpful for attack prevention, there are several reasons not to use this tool. These include distrust of other TIS participants and fear of bad publicity. However, there are also ideas to make TIS more attractive, for example by making the participants anonymous.

Overall, the threats for participants of the maritime sector are rising and therefore the individual parties should cooperate to hold out against these threats. The attackers learned already how to cooperate and the attack vectors are growing constantly.

\begin{acks}
The authors would like to thank all experts who were available for interviews.
This work is partly funded by the German Federal Ministry of Transport and Digital Infrastructure as part of the IHATEC program for the development of innovative port
technologies.
\end{acks}

\bibliographystyle{ACM-Reference-Format}