Oil and Gas Industry Partnership With Government to Improve Cybersecurity

Abstract

Abstract The Oil & Gas industry faces common challenges in securing its process control systems. These SCADA and DCS systems are critical to the industry because they control the operations of oil fields, pipelines and refineries. These systems are also critical to a nation's infrastructure and are essential to its national security, public safety, economic well-being and way of life. Within a critical infrastructure environment, addressing security is a shared problem that needs to be addressed collaboratively. Until now, little progress had been made to address this issue from an industry-wide standpoint. Linking Oil & Gas Industry to Improve Cyber Security (LOGIIC) is a partnership of the Oil & Gas industry with the U.S. Department of Homeland Security (DHS). This partnership brings together the best resources from participating industry members, government, and the research community. The LOGIIC correlation project represents the first time a public-private collaborative model has been implemented to address a critical Oil & Gas industry research and development issue in cyber security. This partnership resulted in innovative improvements being made to cyber security on process control networks. This paper describes the LOGIIC model and explains how industries can work together with government and process control system and security technology vendors to address common challenges. Details of the project are discussed, including: how the testbed was created; what attack scenarios were developed and implemented; and how actual process control activities were simulated in a lab environment. It also describes the lessons learned from the partnership and our future plans to collaborate with government on cyber security issues. NOTE: Substantial portions of this paper are from various LOGIIC documents and presentations. Some images and portions of this paper have already been presented at LOGIIC meetings and other related conferences, and may be included in future presentations or publications.