ORGANISATIONS ACROSS THE INDUSTRY MUST BE PROACTIVE BECAUSE IF YOU IDENTIFY A THREAT IN YOUR SYSTEMS , IT HAS ALREADY DONE ITS WORK .
DISRUPTIVE TECH
ORGANISATIONS ACROSS THE INDUSTRY MUST BE PROACTIVE BECAUSE IF YOU IDENTIFY A THREAT IN YOUR SYSTEMS , IT HAS ALREADY DONE ITS WORK .
Let us celebrate , once again , the economic strength of our region . A report by PwC lauded the resilience of the GCC economy , which remained stable in 2023 despite slowing growth rates around the world . Nonetheless , the region must come to terms with its own challenges , not least in its oil and gas sector where issues such as ESG and energy transition loom large .
But even as the industry looks to its future , there are adversaries conspiring to constrain its progress . The entire value chain runs on digital technology and cyberthreat actors are hard at work trying to sow chaos .
As a case in point , petrochemical giant Saudi Aramco has been targeted on multiple occasions . Its ICS , industrial control system was hit by malware in 2017 in an incident that could , according to the company , have caused an explosion but for a bug in the attack code .
The oil and gas industry are a prime target for cybercriminals between its Operational Technology , OT crown jewels and minimal risk tolerance for downtime .
It is only a matter of time before actual harm occurs , to the life and limb of humans or to the life blood of economies . Industries like finance , telecommunications , and oil and gas are vital organs that allow a technological society to function . But as ICS , OT have evolved in parallel with IT , it has become subject to the same digital transformation .
There is immense pressure to take advantage of technology like 5G and the Internet of Things , IoT to make petrochemical entities more efficient and innovative . However , security professionals must also deal with this IT-OT convergence because threat actors are evolving too , and they continue to see opportunity in the oil and gas sector .
Let us dig into the playbook that will guide us through providing cybersecurity in an ICS setting .
End to end visibility
IT , OT environments are like traditional IT in that to protect them , visibility is the first step . While attacks on IT can expose and threaten data , the physical machinery of OT , when targeted , has the potential to cripple the entire business , or even harm employees and customers .
Each OT asset must be accounted for . Its function and interdependence with other assets must be understood , as must its risk , its vulnerability to attack and the projected harm if it is compromised . Included in this visibility assessment will be every third-party organisation in the supply and value chains .
Target weakest link
Credentials theft is such a common occurrence , and the root cause of so many breaches that we must perform threat assessments on our people . To be clear , we are not just talking about wilful sabotage by rogue employees . Credentials theft commonly occurs between external threat actors and honest employees who are duped into revealing information that should be kept secret .
Employee awareness training is critical to critical systems . Your people should understand the environment in which they operate and all the potential avenues of attack . They should know how their daily tasks relate to the organisation ’ s cyber posture , and they should be taught the best practices of cyber hygiene .
Awareness sessions should include attack drills to expose knowledge gaps . Your aim is to develop a
Sertan Selcuk , VP METAP and CIS , OPSWAT
www . intelligentcio . com INTELLIGENTCIO MIDDLE EAST 81