Oil and gas plants have increased their cyber risk profile as they modernise plants and close the \u2018air gap\u2019 between IT networks and operational technology (OT) networks.<\/p>\n
This is according to Phil Neray, VP of Industrial Cybersecurity at global security specialists CyberX, who notes that many oil and gas facilities are still using equipment that is 15 to 20 years old and designed before industrial cybersecurity was a primary consideration. In addition, many oil and gas facilities still run their IT and OT networks in siloes, with plant engineers \u2013 not cyber security experts \u2013 responsible for cyber security in the plants.<\/p>\n
However, attacks such as last year\u2019s high-profile TRITON attack on a petrochemical facility in Saudi Arabia, where hackers compromised the plant\u2019s safety devices, highlight the cyber risks facing oil & gas infrastructures today.<\/p>\n
CyberX\u2019s recent 2019 Global ICS & IIoT Risk Report, which assessed vulnerabilities across over 850 industrial control networks around the world, found several common vulnerabilities: 53% of industrial sites used outdated Windows systems, 57% were not running anti-virus that updated signatures automatically, 69% \u00a0have passwords traversing the network in plain-text, and the \u2018air gap\u2019 is a myth \u2013 as 40% of industrial sites have at least one direct connection to the Internet. In addition, 84% have at least one remotely accessible device and 16% of sites have at least one wireless access point.<\/p>\n
\u201cThere are no compliance regulations obliging oil and gas facilities to report breaches, but we can assume there have been many more breaches than the TRITON attack,\u201d said Neray.<\/p>\n
\u201cThere could be various motivations for attacks on such infrastructure \u2013 nation state attacks carried out for political considerations; ransomware attacks; hacktivists objecting to policies or drilling activities; or even attacks designed to steal intellectual property.\u201d<\/p>\n
With oil and gas installations a significant and potentially lucrative target, attackers are likely to increasingly turn their attention to these facilities, particularly as plants modernise their infrastructures with new, connected IoT and automation systems.<\/p>\n
While basic cybersecurity approaches such as patching, encryption and up-to-date AV are necessary in the OT environment, standard out-of-the-box IT network security devices are not effective in industrial facilities, according to Neray.<\/p>\n
\u201cIndustrial cybersecurity requires specialised solutions, since OT systems use unique protocols and non-standard operating systems,” he said.<\/p>\n
“Industrial cybersecurity systems also need embedded machine learning and behavioural analytics to understand routine M2M traffic patterns and detect suspicious activity.\u201d<\/p>\n
Neray says oil and gas organisations are taking the increased cyber risk seriously, and are now moving to address vulnerabilities, but that more urgency is needed.<\/p>\n
\u201cCyber risk at OT level is a business risk,” added Neray.<\/p>\n
“A danger for management teams is that some tend to think of cyber crime as a technical issue rather than as a business risk issue. But cyber crime has the potential to cause millions of dollars in losses, environmental damage, human safety risk, as well as downtime, brand impact, compliance issues and loss of intellectual property.<\/p>\n
CyberX is available in Southern Africa through GECI, an international tactical cybersecurity specialist now launching a portfolio of cyber security innovations in the region.<\/p>\n
\u201cCyber war and cyber crime could happen to anyone – it\u2019s a pandemic and critical infrastructure is at risk,\u201d said South African GECI representative Mike Bergen.<\/p>\n
<\/p>\n","protected":false},"excerpt":{"rendered":"
Oil and gas plants have increased their cyber risk profile as they modernise plants and close the \u2018air gap\u2019 between IT networks and operational technology (OT) networks. This is according to Phil Neray, VP of Industrial Cybersecurity at global security specialists CyberX, who notes that many oil and gas facilities are still using equipment that […]<\/p>\n","protected":false},"author":25,"featured_media":26300,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[900,5,888,275,399,9059,262],"tags":[826,9646,1696,388,9645,9643,9647,390,1113,9648,9642,9644,3778,8322,1882,7021],"class_list":["post-26299","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-energy","category-enterprise-security","category-green","category-intelligent-technology-newsletter","category-more-news","category-south-africa","category-used","tag-automation","tag-av","tag-cyber-risk","tag-cybersecurity","tag-cyberx","tag-gas","tag-geci","tag-iot","tag-m2m","tag-mike-bergen","tag-oil","tag-phil-neray","tag-saudi-arabia","tag-siloes","tag-southern-africa","tag-triton"],"acf":[],"publishpress_future_workflow_manual_trigger":{"enabledWorkflows":[]},"_links":{"self":[{"href":"https:\/\/www.intelligentcio.com\/africa\/wp-json\/wp\/v2\/posts\/26299","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.intelligentcio.com\/africa\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.intelligentcio.com\/africa\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.intelligentcio.com\/africa\/wp-json\/wp\/v2\/users\/25"}],"replies":[{"embeddable":true,"href":"https:\/\/www.intelligentcio.com\/africa\/wp-json\/wp\/v2\/comments?post=26299"}],"version-history":[{"count":3,"href":"https:\/\/www.intelligentcio.com\/africa\/wp-json\/wp\/v2\/posts\/26299\/revisions"}],"predecessor-version":[{"id":26303,"href":"https:\/\/www.intelligentcio.com\/africa\/wp-json\/wp\/v2\/posts\/26299\/revisions\/26303"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.intelligentcio.com\/africa\/wp-json\/wp\/v2\/media\/26300"}],"wp:attachment":[{"href":"https:\/\/www.intelligentcio.com\/africa\/wp-json\/wp\/v2\/media?parent=26299"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.intelligentcio.com\/africa\/wp-json\/wp\/v2\/categories?post=26299"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.intelligentcio.com\/africa\/wp-json\/wp\/v2\/tags?post=26299"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}