A cyber breach in the oil and gas industry could prove catastrophic, so in many ways it’s no surprise that companies are taking action. “When it comes to digital, the next big thing with every customer that we speak to is always cyber security. It is at the heart of the discussion,” said Matthias Heilmann, chief digital officer at GE Oil & Gas.
ABI Research predicted that by 2018, the oil and gas industry will be spending $1.87 billion on cybersecurity. “Customers are extremely concerned about intrusions to their systems,” Heilmann said.
The threat of a breach is growing. “We’ve gone from having a few viruses every so often…to a few hundred every week,” said Siv Hilde Houmb, chief technology officer and founder of Secure-NOK, a firm that specializes in cybersecurity software.
The consequences of a breach could be dire. One day’s worth of downtime could cost a company in the oil and gas industry around $1 million a day, and companies are expected to lose between one and three days a year to downtime. Any more downtime could mean the difference between profit and loss.
There are also potentially more serious consequences. In December 2015, a cyber attack hit Ukraine’s power grid, causing a power outage. Attackers left hundreds of thousands of people without power and shut off backup power to the grid’s distribution centers.
The Stuxnet malware that hit Iran’s nuclear facilities in 2010 sabotaged centrifuges used in the country’s enrichment program. Instead of spinning at a precise speed, Stuxnet would modify the centrifuges to slightly vary the speed erratically, enough to degrade the quality of the resultant uranium, but not enough to immediately arouse suspicion.
Building up defenses
Companies are now taking steps to avoid something like the Ukraine attack or Stuxnet hitting their own facilities. Secure-NOK’s system uses machine learning to spot potential breaches before they occur. Plugging in a USB drive, for example, may prompt the software to read its contents and see if there are any signs of rogue software.
Even with top malware security, breaches are likely. Secure-NOK claims around 30 percent of malware is likely to slip through the system, simply because of how often new malware is released. New malware often means writing an update for malware software to help it detect the new threat.
Another form of protection is to isolate the amount of damage a malware breach could cause.
Waterfall’s product creates an image of the servers interfacing with the equipment and copies it to a different server. Day-to-day work from teams like finance and marketing are done on the second server, so malware breaches cannot access the primary server, while server changes are vetted before moving back to the original server.
No one solution will solve all security problems, though, and Waterfall recommends using multiple security products to provide strong protection.
Anticipation of risks
There are guidelines on how to protect assets. The National Institute of Standards and Technology provides the core cybersecurity risk assessment for general industry, then companies like IDC will modify the guidelines to make them more suitable for an industry like oil and gas. Even these are just frameworks, though. Companies will need to develop their own methods of identifying risks based on these starting points.
Even with the best security in place, it pays to consider the worst-case scenario. A contingency plan, or risk mitigation, is usually discussed with the chief information officer and chief security officer, but it doesn’t always work out that way.
“When you talk to these guys, they’re like, ‘oh yeah, we have a plan for that,’ but they never tell you what it is,” said George Collier, sales director at Waterfall. Unfortunately, as previous incidents have shown, companies will need to plan for the worst, just in case.
Michael Brown is a technology reporter and editor. He has written for the International Business Times and the Sunday Times in London, and holds a master of science from Columbia University School of Journalism.