Cyber Risk to Help Shape Industry Trends in 2014

Trombetti noted that cyber risk management must be an integrated component of a corporate risk management strategy that addresses key business processes and assets.

“A good example would be a risk management strategy for an oil pipeline. These are hard assets that the oil flows through, but there are also cyber assets that control and monitor that oil flow. A risk management strategy for that key business process would include both the hard assets and cyber assets because they are all part of the business process.”

The third trend identified by Booz Allen is that future competitive advantage of oil and gas companies will depend upon technological innovation. In the past, companies did not innovate beyond what was needed for to ensure the reasonably successful production of oil and gas. However, Booz Allen reported it has seen a shift in the industry’s point of view towards technology as a new frontier for competitive advantage. 

As part of this shift, oil and gas companies are integrating mobility, cloud computing and knowledge management into their current work processes to improve operations. But companies are finding they need to implement another layer of security into their operations to protect the research and development that goes into creating intellectual property.

“Companies need to make sure that they set up collaborative environments and that they address the security aspects of such an environment,” Trombetti commented. “This can be difficult as the desire for easy and efficient methods to collaborate and share data must be balanced with the control of how information is transmitted and stored.”

Booz Allen recommends using a consistentreference model to set up these environments and monitor usage.

Booz Allen anticipates that the oil and gas industry’s efforts to find the right balance between regulation and strong cyber risk management will become more challenging in 2014. While regulation will help, they apply a one-size-fits-all method to security that does not take into account each company’s unique vulnerabilities in its specific business processes, or “attack surface”.