The digital space is evolving at a rate that is almost impossible to control. The innovations are something to behold in all sectors and the oil and gas industry is no exception. Unfortunately, while the rest of the world scurries to learn the new technology, the hackers and computer geniuses of the world are already there. As companies continue their transition into the digital oilfield, it becomes more and more evident that we will need to take measures to protect them from cyber attacks.
A 2013 study indicated that 40% of all cyber attacks targeted the energy sector which makes sense given our dependency on these resources. As the industry continues to embrace the digital space in order to increase efficiency and performance, cybercriminals are no longer limited to targeting the public-facing aspects of oil and gas companies. They will now have access to the up and downstream industries.
Upstream Risks
“Upstream” in oil and gas refers to the location and production of crude oil and natural. It is this particular aspect of the industry that is undergoing perhaps the most significant changes as it transitions to IoT. A risk profile published by Deloitte University Press attempted to classify the risk associated with upstream subcategories by determining their vulnerability to attack and analyzing the impact (severity) of an attack in that category.
Low-risk items in the upstream sector included geophysical surveys, seismic imaging, and field development planning. Well completion and well intervention, workover, and abandonment presented moderate risks. According to the risk profile, the biggest danger arose in the following categories:
Exploratory and Appraisal Drilling – High vulnerability and high severity.
Production – Extreme vulnerability and very high severity.
Development Drilling – Extreme vulnerability and extreme severity.
Downstream Risk
“Downstream” in oil and gas refers to the portion of the industry that is responsible for refining and distributing product and includes things like pipelines and tank farms. A cyber attack concentrated here could potentially create health, safety, and environmental issues, all of which are costly to correct.
The risk profile for the downstream sector is uneven in nature. Trucking, distribution, storage, and transfer are all relatively low in vulnerability to and severity of cyber attacks. Logistics, software, and commodity market trading are relatively vulnerable, but the impact of an attack in these areas would be low. The biggest risk is in the following areas:
Plant-Wide Utilities – Items in this category include electricity and steam. They ranked very high in vulnerability and extreme in severity of an attack.
Operation Specific Controls – While things like reboilers and pumps are at low risk for attack a single success story could be extremely detrimental, making this particular target rank high in the risk assessment.
Wrap-up
Identifying the risks associated with each individual aspect of the oil and gas industry is the first step towards preventing cyber attacks. It is only by increasing awareness that we will be able to plan and implement deterrents and safeguards designed to protect our industry from a potentially catastrophic breach.