Moody's Says Cybersecurity a High Priority for Oil, Gas

Cybersecurity is a high priority for the oil and gas industry, Moody’s Ratings stated in a new report sent to Rigzone by the Moody’s team recently.

“Cyber commitments among oil and gas companies we rate exceed the cross-sector corporate average in our 2023 survey,” the report said.

“The focus on cyber within the industry reflects the particular risks that security breaches carry for oil and gas companies given their critical role in national energy security,” it added.

“Production, refining, and especially transport processes are all vulnerable because of their dependence on automation and digital control systems,” the report warned.

The Moody’s report noted that 93 percent of oil and gas respondents have employees whose primary responsibility is cybersecurity and stated that 26 percent have their chief executive's compensation linked to cybersecurity performance.

“Both rates exceed the global corporate average and are particularly marked among large integrated oil companies,” the report highlighted.

“However, there are some segment and regional disparities in commitments. Also, chains of reporting do not automatically escalate to C-suite level in most cases, suggesting there are further opportunities to enhance top-level engagement and oversight,” it added.

The report also stated that cautious attitudes to cloud storage prevail across the sector.

“Only 10 percent of oil and gas respondents’ IT infrastructure on average is hosted by private or public cloud currently, with an anticipated increase to 14 percent within the next year,” it highlighted.

“Larger corporations very strongly favor a hybrid approach using private cloud solutions situated on-premise and integrated with legacy systems,” it added.

In addition, the Moody’s report said industry wide take-up of cyber insurance is low.

“Only 51 percent of oil and gas issuers reported having standalone cyber insurance,” Moody’s noted in the report.

“The substantial escalation in the cost of cyber insurance premiums, for example exceeding 300 percent in the oilfield services segment, is one likely deterrent. Others include limits to the cover offered by insurers,” it added.

In a separate report sent to Rigzone last month by the Morningstar team, Morningstar DBRS said increased interconnection of systems has increased cyber security risks for all industries, “particularly for the O&G sector because of the geopolitical uncertainty”.

“According to Bloomberg, hackers targeted 21 U.S. LNG producers in mid-February 2022 in the run up to the conflict in Ukraine,” the Morningstar DBRS report stated.

“O&G companies will have to invest in advanced cybersecurity technologies and continue to develop training programs for employees to safeguard against emerging threats,” it added.

“As witnessed during the Colonial pipeline ransomware attack in 2021, cyberattacks can lead to system shutdowns lasting for several days. We believe that such risks potentially have a material impact on a company’s cash flow generation and overall financial condition,” the report warned.

Back in May 2021, Colonial Pipeline Company revealed that the business learned it was the victim of a cybersecurity attack. The company said that, in response, it proactively took certain systems offline to contain the threat, which temporarily halted all pipeline operations and affected some of its IT systems.

A fact sheet posted on the White House site in May 2021 revealed that the administration launched an “all of government effort” to address a cyberattack on the Colonial Pipeline.

Moody’s Ratings publishes credit ratings and provides assessment services on a wide range of debt obligations, programs, and facilities, and the entities that issue such obligations in markets worldwide, including various corporate, financial institution and governmental obligations, and structured finance securities, Moody’s website states.

In its report, Moody’s said its 90-question survey of more than 1,900 respondents gauged cybersecurity practices among global debt issuers and collected data on an emerging risk that carries the potential to influence the credit profile of all debt issuers.

Morningstar DBRS describes itself as a full-service global credit ratings business with approximately 700 employees around the world.

To contact the author, email andreas.exarheas@rigzone.com