The State of Cybersecurity in Today's Oil, Gas Industry

The State of Cybersecurity in Today's Oil, Gas Industry
Industry insiders talk with Rigzone about the ongoing cybersecurity issues facing the oil and gas industry.

The convergence of digital technology with existing supervisory control and data acquisition (SCADA) infrastructure has increased the oil and gas industry’s risk to cyberattacks, industry insiders say.

Oil and gas companies are lucrative targets for cyberattackers motivated to perform industrial espionage, steal intellectual property or cause critical infrastructure disruptions, Todd O’Boyle, co-founder and chief technology officer of Percipient Networks, told Rigzone. Attacks are typically part of an ongoing attempt by individuals and interest groups worldwide – in some cases, government agencies and nation-states – to disrupt the oil and gas market and damage the financial standing of these companies, said Jessica Cooper, lead marketing manager for Check Point Software.

The oil and gas industry not only faces cyberthreats that are commercial in nature, but cyberthreats from activists such as environmental groups. These threats, if successful, “could have severe threats not just on the industry but also on the environment, public health and safety and even national security,” according to March 2016 report by The Boston Consulting Group.

The oil and gas industry’s value chain not only offers many potential points for entry of attack, but leaves the industry vulnerable to multiple types of attacks. The Boston Consulting Group found that upstream data was the most vulnerable to cyberattacks. This is due to data often being transmitted from old or unsecured equipment and without standard protocols or security precautions.

While malware has been a common tactic used by cyberattackers, the types of threats continue to grow, such as ransomware. Malware has posed a threat to small and mid-size oil and gas companies that don’t have the skills or budget to deploy complex solutions to protect prime targets, O’Boyle said. The number of phishing attacks against industries, including oil and gas, is also growing. Between October 2015 and March 2016, the number of attacks grew by 250 percent, Eyal Benishti, founder and CEO of Ironscales, said. If successfully completed, these attacks can cost a company up to $4 million.

O’Boyle quoted a recent report by ICS-CERT that found, of the 295 breaches reported in 2015, 98 percent could have been prevented if certain basic security protocols had been in place.

“Small and midsize oil and gas companies, who previously were unable to implement proper protections based on budget or deployment complexities, now have resources to draw on to help educate and protect their operations,” O’Boyle commented.

The primary challenge that oil and gas companies face in preventing and mitigating cyberattacks is the convergence of the informational technology (IT) and operational technology (OT) environments, said Cooper. Oil and gas critical infrastructure is increasingly fusing these two different technologies together using open IT protocols: OT with SCADA and enterprise IT systems, Cooper explained.

“The problem is that SCADA environments in OT are running legacy systems that often go unpatched, making them extremely vulnerable to external cyberattacks,” Cooper stated. “The second problem is that there is an increase in connecting these OT environments to the external Internet, which is even worse. The solution lies in technology that can protect, monitor and manage this convergence, thereby keeping the OT environment safe against attack.”

Greater flexibility in the control and monitoring of infrastructure systems is behind the recent push to enable digital technology, said Christopher Walcutt, business development principal with Black & Veatch’s Security, Risk & Resilience. However, this move is a double-edged sword.

“Until recently, hackers have predominantly limited their actions against industrial control systems to probing and data collection,” Walcutt explained. “Sooner or later, they will want to use the information they have collected in more destructive ways.”

For critical infrastructure, particularly oil and gas, the most important step in protecting critical operational assets is to understand the very real threat that operational technology networks actually face, Cooper stated.

“Whatever the reasons, oil and gas environments are lucrative targets and sophisticated cyberattacks can cause serious economic and physical damage,” Cooper said.


View Full Article


Generated by readers, the comments included herein do not reflect the views and opinions of Rigzone. All comments are subject to editorial review. Off-topic, inappropriate or insulting comments will be removed.