When the Ponemon Institute surveyed oil and gas professionals responsible for securing or overseeing cyber risk in the operational technology environment, it found 59% believed there is greater cyber risk there than in enterprise information technology.

Managing threats towards operational technology requires knowledge beyond general information security. Such knowledge includes oil and gas operational domain competence related to automated, unmanned, integrated and remote operations which are accessible online (figure 1) .

Globalized projects and rapid digitalization increase cyber threats

In addition, the complexity and global nature of oil and gas field development projects, and rapidly increasing digitalization across the supply chain, increase cyber risk.

Facilities and topsides may be designed in London, and subsea equipment designed in Paris, for example. The shipyard building the hull may be in South Korea, and the fabrication yard there or in China or Singapore. A typical project involves multiple contractors and hundreds of information interfaces, requiring a high level of diligence to understand where risks might arise.

The industry encourages the sharing of information on digitalization processes, software and control systems, and 3D virtual models, for example. These and other trends create risks that may not yet be fully understood or appreciated. Determining who is responsible and accountable for such risks is not yet clear in all cases. Is it the operator, the engineering, procurement and construction contractor, or the software vendor, for example?

DNV GL guideline shows how to manage cyber threats

DNV GL has launched the globally-applicable Recommended Practice (RP) DNVGL-RP-G108Cyber security in the oil and gas industry based on IEC 62443 to address how oil and gas operators, working with system integrators and vendors, can manage the emerging cyber threat. It outlines a tailored approach for the industry on how to build security, with the emphasis on operational technology.

As the title suggests, the new RP is based on the International Electrotechnical Commission’s IEC 62443 standard covering security for industrial automation and control systems. The DNV GL guideline also embraces international practice and experience. It takes into account health, safety and environmental requirements as well as the IEC 61511 standard for specification, design, installation, operation and maintenance of a safety instrumented system.

Industry collaboration pays off

DNVGL-RP-G108 is the result of a joint industry project (JIP) over two years with partners ABB, Emerson, Honeywell, Kongsberg Maritime, Lundin, Shell Norway, Siemens, Statoil, and Woodside Energy. The Norwegian Petroleum Safety Authority has observed the work and exchanged experiences with the JIP group from a regulatory perspective.

“Industry players need confidence that countermeasures can deal with more frequent and sophisticated cyber attacks, which are becoming increasingly costly and harder for companies to recover from,” said Kristoffersen, who project managed the JIP.

He added: “Until now, there has been a lack of guidance for the oil and gas industry on how to implement these requirements. The new RP, developed in collaboration with key players, puts operational technology in the spotlight alongside IT, so the industry can protect its operations. It is not only for new installations. Existing and older installations may not be prepared for the new connected reality – and need to be updated with respect to the new risk picture.”

The scope of Recommended Practice DNVGL-RP-G108

The RP provides guidance on how to use the IEC 62443 standard for front-end engineering and design projects and operations, including good practice and a reusable approach (figure 2) . The standard defines what to do, while the RP describes how it should be implemented. Among other benefits, this will result in:

• Reduced risk of cyber security incidents
• Cost savings for operators by reducing the resources needed to define requirements and follow up
• Cost savings for contractors and vendors based on identical requirements from operators
• Simplified audits for authorities and auditors due to common requirements and common conformance claims.

Collaborating on cyber security delivers benefits to oil and gas companies

Industry participants in the JIP that led to DNVGL-RP-G108 say they have benefitted from the collaborative approach.

“The […] process leading to this Recommended Practice has enabled our team to leverage industry best practices, share learnings, and grow capability,” said Woodside Energy’s Fallon. “Aligning our operational technology cyber security approach to IEC 62443 enables us to learn from and contribute to industry knowledge and capability. The RP provides practical guidance on applying the standard to oil and gas.”

In a joint statement, vendors involved in the JIP commented: “Our customers in the oil and gas industry are to a large extent facing the same types of cyber threats found in information technology systems. Being able to standardize what we deliver to our customers is important in reducing cyber risks and reducing cost. Above all, it will increase the safety, availability and reliability of the operational technology systems.”

The statement continued: “The organizations operating the systems can also manage cyber risks by following and implementing the identification, protection, detection, response and recovery steps defined in the standards to withstand cyber attacks. In the process of defining this RP, we have collaborated with both our competitors and our customers on guidance to the IEC 62443 series of standards.”

Download a complimentary copy of DNVGL-RP-G108

References

1 ’Digitalization in the oil and gas industry’, DNV GL
2 ’Dismantling barriers to digitalization’, DNV GL PERSPECTIVES, DNV GL, April 2016
3 ’The state of cybersecurity in the oil & gas industry: United States’, Ponemon Institute LLC, February 2017
4 ’Protecting the connected barrels: cybersecurity for upstream oil and gas’, A Mittal et al, Deloitte Center for Energy Solutions, Publ. Deloitte University Press, June 2017

Disclaimer:
DNV GL prides itself on providing accurate information but makes no claims or guarantees about the accuracy, completeness or adequacy of contents in this publication, and disclaims liability for any errors or omissions. The authors’ views here do not necessarily reflect DNV GL’s views.