Top 10 Cyber Security Issues for Oil & Gas Industry

(Press Release) With the exploitation of new cost-effective operational concepts, use of digital technologies and increased dependence on cyber structures, the oil and gas industry is exposed to new sets of vulnerabilities and threats. Cyber-attacks have grown in stature and sophistication, making them more difficult to detect and defend against, and costing companies increasing sums of money to recover from.

 

DNV GL delivering today a study to the Lysne Committee (Lysneutvalget1) that reveals the top ten most pressing cyber security vulnerabilities for companies operating offshore Norway.

 

“Headline cyber security incidents are rare, but a lot of lesser attacks go undetected or unreported as many organizations do not know that someone has broken into their systems. The first line of attack is often the office environment of an oil and gas company, working through to the production network and process control and safety systems,” says Petter Myrvang, head of the Security and Information Risk, DNV GL - Oil & Gas.

 

While the study focused on operations on the Norwegian Continental Shelf, the issues are equally applicable to oil and gas operations anywhere in the world.

 

1.  Lack of cyber security awareness and training among employees

2.  Remote work during operations and maintenance

3.  Using standard IT products with known vulnerabilities in the production environment

4.  A limited cyber security culture among vendors, suppliers and contractors

5.  Insufficient separation of data networks

6.  The use of mobile devices and storage units including smartphones

7.  Data networks between on- and offshore facilities

8.  Insufficient physical security of data rooms, cabinets, etc.

9.  Vulnerable software

10. Outdated and ageing control systems in facilities