Unlike their peers in similar sectors, oil and gas organizations haven’t always faced tough regulatory OT requirements. Absent catalyst events like the widespread grid outages that led codification of NERC reliability rules, regulators were mostly happy to leave companies and industry groups in charge. Even with high profile incidents like Colonial and growing unease about the cybersecurity consequences of geopolitical instability, many orgs were still not being proactive about their OT security.
But with the 2021 TSA Security Directive on pipeline and LNG operators, recently updated with new guidance, CIP compliance and security rules have arrived. This matches past developments in other sectors, with guidance moving from voluntary to compulsory, and increasingly prescriptive rules being put into place. Requirements are more and more programmatic, including formal vulnerability assessments and regular testing and validation of controls.
It’s also not just regulators demanding concrete answers on readiness. Underwriters, suppliers, investors, and customers—everybody’s expectations on cybersecurity for oil and gas are high. It’s up to OT teams to take the lead in protecting the organization by securing the environments they operate and control, ensuring unique needs stay met.
The unique operating challenges of oil and gas multiply the security difficulties most all OT teams already face, while adding new constraints to the mix. Like most OT environments, oil and gas production systems are a complex mix of vendors and versions, with legacy and new infrastructure carefully integrated and optimized to maximize safety and reliability.
Oil and gas production requires the physical connection of disparate physical sites and facilities, including remote and distributed assets, resulting in systems that span thousands of miles and nearly every terrain. These environments are typically optimized to ensure maximum safety, uptime, reliability, and productivity. Any other outcome, compliance or security included, is secondary.
All these pressures are being confronted by organizational cultures not exactly designed for agility, with many decision-makers still seeing technology, digital, as an expensive and potentially dangerous distraction. This is especially true when it comes to cybersecurity, where many decision-makers still believe they face a binary choice between safety and security.
At the same time, the teams responsible for operations and maintenance are already busy beyond capacity, and don’t have the time or expertise required to add security to their job description. Some assets might sit unattended or unwatched for weeks on end, with others only accessible after much hard work and disruption.
Establishing visibility across the distributed complexity of oil and gas systems would be difficult for even a well-resourced team of dedicated experts. OT organizations must find a way to solve the technical and governance challenges standing in the way of getting fundamental security questions answered.
Oil, gas, and energy OT teams deserve security tools built with their needs in mind, especially the extreme system complexity and sensitivity. Here's what we recommend for ICS security teams in the oil and gas industry:
