OIL & GAS Are They Still Components Of Critical Infrastructure?

As the world gets increasingly aware of the impact of humans on environment, the transition from conventional sources of energy to cleaner and renewable sources is becoming more obvious and essential. Green energy is the answer to oil and gas dependent economy. It ensures greater sustainability and better health for the ‘pale blue dot,’ the appellation given by Carl Sagan who was instrumental in popularizing science.

Dependence on fossil fuel has wreaked havoc to the environment. Carbon emissions, that result from excessive use of oil and gas, have affected life on our lonely planet. It has raised the average temperature of earth by a good many degrees. As the vehicles and factories release smoke in the air, more and more of black soot deposits in polar region. This is responsible for absorption of more sunlight which naturally results in increase of temperature. This in turn melts ice and raises the sea level by inches, if not meters, every year. Scientists predict that by 2050 a large number of cities in the coastal areas will be immersed under water.

Green energy, that includes power sources like solar, wind, geo-thermal, hydro-electric, biogas and biomass, provides greater environmental benefits and lessens dependence on oil and gas. Although ‘green energy’ and ‘renewable energy’ are used interchangeably, there is a subtle difference. Renewable energy includes all the sources termed as ‘green energy’ but it also encompasses technologies and products that can adversely affect the environment. Therefore, when people rely on green power, they are essentially supporting renewable energy projects that have environment impact.

Critical infrastructure means all physical or virtual resources which are vital for a well-functioning nation and whose incapacity or destruction would seriously affect the security, national economy, public health and safety, or any combination of these aspects. Areas of critical infrastructure include the provision of energy, extraction and production of oil and gas, mining, water treatment and sewage, food production, manufacturing and transport, communication and telecommunication network. All of these areas are central to the successful functioning of a nation’s economy, society and security.

The above definition broadly remains valid in all cases. However, what is considered as most critical varies according to different locations from economic and environmental perspectives. An ideal illustration of this is the Oil & Gas (O&G) sector. Interruption in any of the various operations to bring these energy sources to the end-user has the potential to bring the country

on a stand still. For this reason, oil and gas, along with the related infrastructure, from the point of extraction till their consumption, are subject to safe and secure protocols, which may range from ‘basic’ to ‘very complex’. For example, all physical sites and facilities for discovery, drilling, processing, transport, etc. of O&G are sufficiently secured with necessary equipment and other resources, appropriate for the conditions in each case and each location.

The O&G industry is just one of the many aspects which is regarded as critical infrastructure, but its operations employ numerous security features which are common among many other segments of high importance. Therefore, each critical infrastructure sector can take advantage from the informed use of the experiences of others to address its security needs.

Just as automation and technology have entered and affected every part of our individual and collective lives, so has O&G sector and, in the same way, this sector is also prone to becoming a victim of cyber attacks. Every area of the O&G sector operations is a likely target and elaborate measures are required to counter these attacks.

The segment which is at the highest risk is Industrial Control Systems (ICSs) which connect all major functions in O&G production and supply cycle.

In addition to that, the use of expanded Internet by a large workforce and IoT connectivity further complicates the challenge of cyber security, rendering the said systems vulnerable to the attacks of a variety of custom-designed and highly advanced malicious software. It is notable that some attacks result in halting or hampering the operations, having monetary consequences, but some attacks can actually result in loss of human lives and physical damage to production, processing, and storage equipment.

Lately, these attacks have gathered pace and volume. A malware, Triton, originating from Russia was used to cause damages to Saudi oil facilities. Likewise, natural gas pipeline infrastructure in the United States has been targeted multiple times in last few years and an Indian hacker group attacked the system of Saipem –oil and gas company of Italy. Cyber-attacks can be targeted at any of the 3 major operational levels of oil industry i.e. upstream, midstream, or downstream. However, the worst scenario would be if all 3 are attacked at the same time, crippling the entire system.

The aim of the cyber-attacks could vary according to the origin of the attack and may be directed to disrupt plants’ operations, damage the physical facilities and equipment, disturb production and supply cycle, alter the quality of products, violate compliance-related matters, and cause safety irregularities.

OBSTACLES TO CYBERSECURITY

The Programmable Logic Controllers (PLCs) and ICSs, that are vital and main tools of Supervisory Control and Data Acquisition (SCADA) systems, lack cyber security features, therefore, leaving SCADA systems exposed to the high risk of being hacked.

There are considerable problems which hinder in security of SCADA system components. Each SCADA device is distinct, formulated for particular functions and producing specific results. A need to change the design of SCADA is not realized if the device continues to give the required output.

Oil and gas installations heavily rely on various technologies and their suppliers. Technologies and devices developed during the 70s and 80s do support and work in harmony with the IoT sensors and other related post-internet gadgets. But the ones engineered before the internet age do not easily adapt or co-exist with the modern methods employed in energy sector.

In the end, there is an option of adding on a security patch to main system, however, installing that patch presents its own difficulties. A manufacturing plant or an oil refinery, for example, cannot be turned off for installing the security patch, and started over. The shutting off of system, even for necessary upgrade, would result in huge losses; and every alteration in the system would require prior testing before its formal launch.