With malicious actors targeting critical utilities. the top issues facing compliance managers in the oil and gas industry revolve around cybersecurity. A single intrusion to a power grid or energy source provider can cripple global economies. Regulatory compliance for the energy sector needs to be viewed through a “security-first” lens to ensure ongoing protection of systems that power the world.

Regulatory & Compliance Issues in the Oil and Gas Industry

What is the security status of the oil and gas industry?

According to the Department of Energy 2018 multiyear plan, Nation-state actors increasingly target the energy industry infrastructure. According to a 2015 Director of National Intelligence report, cybercriminals were working to find ways to remotely access industrial control grids. The focused cyber attacks on critical utilities include probes, data theft, and new malware.

According to the Department of Energy, the 2015  average annual cost of cybercrime to the energy and utility industries was $27.62 million. In February 2017, the Ponemon Institute released The State of Cybersecurity in the OIl & Gas Industry: United States. The key findings, based on 377  individuals responsible for security in the oil and gas industry, included:

1. 35% rated operational technogloy environment as cyber ready.
2. 68% had operations with at least one security compromise.
3. 59% felt operations technology was at greater risk than information technology.
4. 67% believe industrial control systems risks increased over the past few years.
5. 61% felt their industrial control systems protection and security was inadequate
6. 65% felt insider negligence posed the largest security threat.
7. 15% felt malicious or criminal insiders posed a risk minimizing the importance of advanced monitoring.
8. 41% continually monitor all infrastructure.
9. 46% of operational technology cyber attacks remain undetected.
10. 68% felt security analytics helped achieved a stronger security posture.

What exploits and security breaches threaten the oil and gas industry?

New trends in digitizing the energy sector also increase the likelihood of cyberattacks. For example, the industry increasingly connects smart gas, water, and transportation using the Internet of Things (IoT). Simultaneously, the oil and gas industry supervisory control and data acquisition (SCADA) systems use outdated, insecure software.

Attacks to the operational technology environment remain undetected thus disrupting operations for longer periods of time. Lack of awareness directly correlates to the infrastructure security tasks remaining incomplete. Organizations lacking awareness leads to a vicious cycle of non-investment in infrastructure security. Overall, the data most at risk seemed to be exploratory information and production information.

How digitization of the oil and gas industry increases security risks

From an IT security standpoint, increased digitization is a primary reason that most oil and gas companies are at risk. Although they need to update operating technology to integrate with IoT, many use insecure legacy systems. The movement to digitize also increased the number of vendors integrated into the supply chain, increasing the risks.

Integrated into operations in the 1960’s, supervisory control and data acquisitions systems (SCADA) enabled the oil and gas industry to efficiently manage process production. The SCADA systems enable companies to control and monitor their operational technologies by using sensors to collect and transmit data.  SCADA systems remain embedded in the oil and gas industry due to historical use. However, SCADA systems which work well to enable operational technologies were not intended to connect to information technology networks. Thus, they often do not incorporate the needed security features to protect against external intrusions.

What are the security problems with connecting operational technology and information technology?

The primary security issue arising out of these connections lies in the number of vendors used to enable business solutions. The increasing sophistication of ransomware combined with the cybersecurity gaps make the Industrial Internet of Things (IIoT) and its connection to Industrial Control Systems (ICS) problematic.

As evidenced by 2017’s WananCry and the continued evolution of ransomware through 2018, malicious actors will likely focus on industrial ransomware attacks. Nation-state actors look to control global politics through fear while the rise in daily technology use makes the energy sector more critical overall. For example, as more individuals and businesses use smart home technology to control heat, the oil and gas sector becomes a greater target.

While traditional IoT remains a security issue, even more risks face IIoT. Media outlets increasingly put pressure on smart home technology but do not incorporate the same level of responsibility for IIoT, likely because they do not know it exists. Therefore, as IIoT technologies connect the operational industrial network to the IT landscape, they create a weak point in the cybersecurity protections, effectively a backdoor for hackers.

How to secure effectively secure the IIoT and IT environment connection within the oil and gas industry

The first step to better securing the oil and gas industry comes from engaging in a risk mitigation strategy. Increased vendors and technology use add to the complexity of securing the operational and information technology environment.

Understanding the vulnerabilities and risks allows oil and gas companies to begin the process of risk mitigation. IIoT vendors who enable information sharing across and between the operational and information technology environments access critical data and systems. Their vulnerabilities and risks translate directly to the oil and gas sector’s stability. Some suggestions to help secure the IIoT, IoT, operational and information data landscapes, however, include:

1. Create a list of information assets
2. Create a list of all applications and systems that connect to your IT network
3. Create a list of all vendors
4. Define risks to the IT environment, including software, systems, networks, devices, and vendors.
5. Review Service Level Agreements to maintain supply chain security
6. Establish controls that protect systems, networks, and applications to mitigate risks.
7. Continuously monitor the IT environment to ensure ongoing control effectiveness

How ZenGRC Eases Security-First Compliance for the Oil and Gas Industries

Taking a security-first approach to compliance enables the oil and gas industries to better protect their operational and information technology environments. However, documenting continuous monitoring efforts remains a pain point. After establishing controls to mitigate threats to the data environment, companies need to map those controls across the various frameworks and regulations. For example, mapping controls to both NIST and ISO 27001 becomes time-consuming if done manually.