Cybersecurity: Preventing Infection in a Body of Data

Abstract

Fool me once, shame on you; fool me twice, shame on me. That’s an adage that often alerts us to the dangers of knowing - and yet not mitigating - the repercussions of risk. And with the resurgence of cyberattacks globally, it’s also a wakeup call to cyber readiness. The oil and gas industry faces particular risk - though it’s not necessarily ready (Fig 1). Sixty-one percent of oil and gas professionals who are responsible for cyber risk said their organization fell short last year in protecting and securing its industrial control systems (ICS). Sixty-eight percent surveyed said their organization had experienced at least one cyber compromise in the past year, resulting in OT disruption or the loss of confidential information (Ponemon 2017). And perhaps most alarming: They did not have a clear strategy to address it. This is an industry where the opportunities for infiltration are nearly limitless. A typical large oil and gas company uses half a million processors just for reservoir simulation; it generates, transmits, and stores petabytes (each equal to 1,015 bytes) of sensitive field data; and it operates thousands of drilling and production control systems in diverse locations, with numerous fields, vendors, service providers, and partners (Mittal et al. 2015). ICS are used to control assets spanning thousands of square miles - such as the 2.6 million miles of oil and gas pipeline in the US alone (PHMSA). ICS may be as simple as a few panel-mounted controllers or as complex as interconnected and interactive distributed control systems with thousands of field connections. At the same time, cloud-based internet of things (IoT) technology, wireless communications networks, and analytical and automated tools are connecting operations in real time, with new data-based links between rigs, refineries, and headquarters. And as these connections multiply exponentially, the exposure - and thus the threats - increase. “The industry is increasingly becoming a target, with attacks growing in frequency, sophistication, and impact. Data is becoming more valuable, perhaps the most valuable commodity in the world right now, and oil and gas companies are oozing with data,” Ben Dickinson, global cybersecurity lead for ABB’s oil, gas, and chemicals unit, said at the 2019 SPE Offshore Europe conference.