The proliferation of IoT endpoint technologies supporting the digital agenda in the oil and gas industry is increasing the attack surface of Critical Infrastructure networks and exposing organisations for more dangerous Cyber-Physical attacks. Accelerated digital deployments and deeper internet-based connectivity for remote operations management increases the likelihood of damaging Cyber-Physical attacks on field-based asset(s) and the control centre. These types of attacks can cause physical harm and result in safety hazards or worse a major control failing leading to loss of life, environmental damage or negative brand and financial impact. Such attacks can potentially go beyond damage to control systems, devices, equipment and network. They can actually pose risk to the entire supply chain and disrupt regional sector operations. This is the essence of Cyber-Physical risk, where oil and gas companies have to devote more focus on understanding the potential negative impacts new technologies can have on their business.
In this paper, we aim to analyse the importance of predictive techniques versus traditional methods of reactive security monitoring and response. We shall further elaborate on a parallel process of enhancing corporate response plans through development of organisational risk profiles and the adoption of relevant technology and digital roadmap as part of overall security architecture.
The US Department of Homeland Security mentions oil and gas as the most attacked industry. EY's 2015 Global Information Security Survey showed that 41% of oil and gas organisations admit to inadequate cyber threat detection capabilities and 39% have no real-time insight on cyber threats. Our client interaction has also revealed that many companies were unaware that cyber penetration testing was necessary, which is especially critical given the deeper connectivity between OT and IT systems.
