The Cybersecurity Implications of Infrastructure Modernization
The adoption of new technologies in oil and gas facilities is a dual-edged sword. On one side, there are the obvious benefits of implementing industrial internet of things (IIoT) devices to improve efficiencies and reduce operational costs.
On the other side, there are inherent risks associated with upgrading systems. Case in point: the Columbia Gas incident in metropolitan Boston last year, which produced a series of explosions in Andover, North Andover, and Lawrence, and resulted in more than 70 fires, one death, dozens of injuries, and the destruction or damage of more than 100 structures. Approximately 9,000 customers were left without power.
The New York Timesreported that a system upgrade caused gauges that monitored pressure levels to be taken offline, and that unchecked over-pressurization triggered the blasts.
While human error was probably the cause of the Columbia Gas incidents, it could just as easily have been the work of terrorists.
Oil and gas executives are now acutely aware that once isolated OT networks charged with refining, mixing and the distribution of petroleum are increasingly connected to the “outside world” via the Industrial Internet of Things (IIoT).
In addition, modernization inevitably involves some degree of digital transformation, which exposes facilities to more cybersecurity threats than ever before.
Attacks such as BlackEnergy, Industroyer, VPNFilter, and Wannacry are just a few of the recent malware campaigns that have affected critical infrastructures. The actors in some cases were rogue factions including nation states that hacked into industrial networks and caused havoc.
However, the threat from within is also omnipresent and highly significant, as insiders have ‘the keys to the kingdom’ — or at least know how to find them. Some studies show that insider threats account for more than 50 percent of all industrial cybersecurity incidents.
The Internet of Things (IoT) and the IIoT hold tremendous promise for improving oil and gas operations. Increasingly, companies are investing in the cost-saving and the productivity-enhancing benefits of networked smart devices that can communicate and coordinate with one another via the Internet.
The downside of IIoT is that few vendors and customers have fully considered the cybersecurity risks associated with the technology. The introduction of new access points into a company’s network, plus the current lack of security standards for IoT devices, can create holes for punching through perimeter defenses.
