Separate networks, control the crossings
Crew Internet, office IT and operational systems need deliberate boundaries. A different Wi-Fi name alone does not create one.
In 30 seconds
- Group systems by function and consequence of failure.
- Permit only required flows between zones, using enforced firewall or access-control rules.
- VLANs help separate traffic, but routing rules, administration and monitoring determine which crossings are possible.
Make it concrete
Sketch crew Wi-Fi → Internet as allowed, and crew Wi-Fi → engine control as blocked. List any approved maintenance path separately.
- 01Crew / IT
- 02Controlled boundary
- 03OT
Check your understanding
Is changing an SSID enough to isolate an operational network?
- Group systems by function and consequence of failure.
- Permit only required flows between zones, using enforced firewall or access-control rules.
- VLANs help separate traffic, but routing rules, administration and monitoring determine which crossings are possible.
Go to the source
- Course notes · ThS. Nguyễn Duy Hiếu · An ninh mạng trên tàu biển cho thuyền viên ↗
- NIST SP 800-82 Rev.3 · Guide to Operational Technology Security ↗
Sources reviewed: 13.09.2026