Oil & Gas (O&G) enterprises today are increasingly witnessing convergence between their Operational Technology (OT) and Information Technology (IT) setups. Processes that operated in silos earlier, are now suddenly digitally connected, giving firms a massive advantage in terms of productivity and costs. However, increased convergence also means that industrial automation and control systems are now ‘more hackable’, giving many a CIOs a sleepless night.
According to the CIO magazine’s ‘2015 State of the CIO’ survey, cyber security related issues consume about a third of the time of Chief Information Officers. And CIOs of O&G companies are perhaps the most concerned, as globally, the sector remains vulnerable to cyber attacks.
In a study conducted by Dimensional Research, 82% of industry respondents said that there was an increase in successful cyber attacks in 2015. No wonder, security spending in the industry is estimated to rise from $26.3 billion in 2015 to $33.9 billion by 2020, according to a report from MarketsandMarkets.
Source of vulnerability
A key entry point for hacktivists and cyber criminals includes OT, such as Supervisory Control and Data Acquisition (SCADA) and Distributed Control System (DCS), used for industrial automation and control. Over the years, many companies have integrated these OT systems with their enterprise IT systems including applications, IT servers, databases and networks.
This has increased the risk of cyber criminals infiltrating a network and gaining unauthorized control of OT systems and processes.
At the minimum, such attacks can lead to production stoppages or impact product quality, but at their worst, they could even destroy infrastructure, or result in catastrophic safety and environmental issues. Given the global nature of O&G production and distribution, cyber attacks will also have serious geopolitical implications.
Often, the key culprit in such situations is poor information governance and ineffective monitoring mechanisms. To effectively protect your operational assets, you therefore need robust and integrated information risk management strategies, complemented by nimble disaster recovery plans.
Mitigating cyber risk
Stringent OT-IT environment reviews: The key to preventing and combating external attacks, is to clearly understand your risk profile – through consistent and stringent reviews of your OT and IT environment. This entails regular assessment of information flow patterns and usage techniques, along with accurate analysis of remote access management tools.
Integrated assessment: Effective monitoring of your information highway is possible only if you have an integrated approach that covers all the key points – external and internal IT networks, wireless network, Cloud infrastructure, OT network, as well as mobile devices and infrastructure. By evaluating all these critical elements, you can zero in on possible risks, and create a comprehensive game plan for addressing the potential concerns.
Enterprise-wide solution: The logical follow-up to an integrated assessment approach is then to have an enterprise-wide IT and information security solution. Such a solution must help manage, archive, protect, and authenticate all the structured and unstructured information. It must ideally enable mobile accessibility to business-critical, contextualized and integrated information, with which you can make sound, intelligent decisions regarding your assets.
It is also imperative to build and apply enterprise information security architecture to all your data, systems, processes, and people, to be able to easily track and monitor your OT and IT environment.
Comprehensive testing: By regularly testing the security of each component of the architecture including the applications, operating systems, and the field devices, you can further fortify your information landscape.
Adopted as a regular practice, this could identify imminent threats or a developing threat, which then has greater chances of mitigation and containment. For instance, regular testing could help identify instances where you spot attempted attacks by identifying exceptions to normal data transmission and usage patterns.
Standardization of procedures: With stakeholders across upstream, downstream and midstream in your value chain, it is important to enforce standard procedures across all participants. This also includes consistent coding standards for components and documents. Doing this enables putting in place a consistent master data management solution in place.
With standardization in place, you can then harness Cloud-based solutions to foster collaboration across stakeholders in your value chain.
The LTI Way
LTI has strong capabilities in automation and engineering systems, especially in the O&G sector. This applies to industrial appliances, process control networks, software applications and industrial Cloud services.
We have delivered specialist solutions to clients in remediation and governance for evergreen, OT and IT assets in oilfield and refinery operations.
To this industry-specific expertise, we bring our suite of industrial cyber security solutions. These solutions span various use-cases – identifying security vulnerabilities, defining future state, zoning and separation of networks, incident response and recovery risk assessment, and risk-based compliance solutions.
We help define, assess, and implement security policies across O&G assets and processes. Our clients have benefited with risk mitigation by almost 100%, while at the same time bringing down their information security cost by 15%.
You can too. Let’s talk.