Security
PR Newswire | 21 March 2017

Atos, Siemens Expand Strategic Relationship To Provide Cybersecurity for US Utilities, Oil and Gas Industry

Atos, a global leader in digital services, and Siemens, a global engineering leader, announced that they have entered into a memorandum of understanding and will leverage their portfolios to help customers establish an integrated first line of defense against cyberattacks. Siemens and Atos work together in the area of cybersecurity for industrial companies, providing customers in the manufacturing and processing industries with comprehensive security services and products.

The Atos and Siemens partnership in the US is part of a global agreement around cybersecurity including common go-to-market and shared research and development efforts to target information technology (IT) and operational technology (OT) security for any market.

As utilities increasingly use software to become more efficient and reliable, there is a corresponding need to boost cyberdefenses—going beyond compliance regulations to secure operations. In oil and gas, digitalization brings a convergence of IT and OT connectivity that enables data to travel from the field to the control room to the enterprise network—underscoring the need for a unique set of solutions to address the crossover between IT and OT.

A recent study from the independent Ponemon Institute shows that nearly 70% of US oil and gas cyber managers said their operations have had at least one security compromise in the past year, resulting in the loss of confidential information or OT disruption—highlighting the need for the oil and gas industry to increase its cyberdefenses.

Read the full story here.

Reuters | 8 March 2017

Libyan Oil Guard Head Says Asked To Protect Oil Ports After Clashes

An oil guard official appointed by Libya’s UN-backed government said on 7 March that he had been tasked with protecting oil ports by an armed faction that took over Es Sider and Ras Lanuf terminals.

Benghazi Defense Brigades leader Mustafa al-Sharksi attends a news conference on 6 March 6 in Libya. Credit: Reuters/Stringer.

Idris Bukhamada, recently named by the Government of National Accord as the head of the Petroleum Facilities Guard, told local TV that export operations at the ports were continuing and that the oil was for all Libyans.

He was speaking after east Libyan forces carried out air strikes for a fifth day against the Benghazi Defense Brigades (BDB), the faction that overran the ports. The eastern-based Libyan National Army (LNA) and the BDB have been battling for control in Libya’s eastern Oil Crescent since 3 March, threatening output from oil ports that the LNA seized in September.

A senior official from Libya’s National Oil Corporation (NOC) said on Monday that production had dipped by 35,000 B/D because of the latest unrest, leaving national production at just more than 660,000 B/D.

OPEC member Libya was producing more than 1.6 million B/D before a 2011 uprising led to political turmoil and conflict that slashed output to a fraction of earlier levels.

“We have been tasked by the BDB to protect the oil ports,” Bukhamada said, adding his oil guard belonged to the state and had no military mission.

“I reassure all companies and NOC partners that export operations are continuing and have not stopped,” he told Libyan TV channel Al Nabaa.

Since the BDB attacked on 3 March, a front line has formed at the center of the Oil Crescent, between the ports of Ras Lanuf and Brega. The Libyan National Army still controls Brega as well as a fourth port, Zueitina, which lies to the northeast.

It says it is using air strikes to prepare the ground for a counter-attack.

Read the full story here.

The Associated Press | 6 March 2017

Hackers Drawn to Energy Sector’s Lack of Sensors, Controls

Oil and gas companies, including some of the most celebrated industry names in the Houston area, are facing increasingly sophisticated hackers seeking to steal trade secrets and disrupt operations, according to a newspaper investigation.

A stretch of the Gulf Coast near Houston features one of the largest concentrations of refineries, pipelines, and chemical plants in the country, and cybersecurity experts say it’s an alluring target for espionage and other cyberattacks.

“There are actors that are scanning for these vulnerable systems and taking advantage of those weaknesses when they find them,” said Marty Edwards, director of U.S. Homeland Security’s Cyber Emergency Response Team for industrial systems.

Homeland Security, which is responsible for protecting the nation from cybercrime, received reports of some 350 incidents at energy companies from 2011 to 2015, an investigation by the Houston Chronicle has found. Over that period, the agency found nearly 900 security flaws within US energy companies, more than any other industry.

 

Read the full story here.

Bloomberg | 15 February 2017

Libya Crude Output Rises as Work Conditions for Big Oil Improve

Libya’s crude production exceeded 700,000 B/D and is expected to keep rising as working conditions in the conflict-ridden country improve for international companies such as Eni and Total, an official from the state oil company said.

The North African country’s crude production is expected to reach 1.2 million B/D by August and 1.7 million by March 2018 when the nation’s ports and export terminals will be operating at full capacity, Jadalla Alaokali, board member of Libya’s National Oil Corp., said in an interview in Cairo. Output at the El-Feel, or Elephant, oil field is expected to resume within 1 month, pumping 75,000 B/D, he said.

Eni and Total are working in Libya without difficulty, and Schlumberger resumed operations in the country about 3 months ago, he said. Eni is expected to start production from an offshore area in 5 years, he said.

“Eni and Total are working there with no problems, so the situation is improving every day in Libya, and I’d like to take this opportunity as an introduction for those who have interest to work in Libya,” Alaokali said. “More than 45% of the land is still virgin, hasn’t been explored, so we still have large areas that haven’t been discovered, so the opportunity is there.”

Read the full tory here.

IPIECA | 10 February 2017

IPIECA Launches Responsible Security Tools

IPIECA has developed two responsible security tools, produced in partnership with the Geneva Centre for the Democratic Control of Armed Forces (DCAF) and the International Committee of the Red Cross (ICRC). The two tools are:

The tools have been developed for all extractive companies to support engagement between companies and government security forces. Before engaging or investing in new operations in a host country, companies need to assess and evaluate the risks involved. The Host Country Security Assessment Guide is aimed to assist companies in evaluating the national and regional security contexts and identify the different challenges that are likely to affect extractive operations. Complex environments pose particularly challenging security and human rights risks and require a thorough analysis of the security sector and actors.

The security of company operations in a host country depends significantly on the company’s engagement and relations with the national security sector. Therefore, it is important to establish predictable relations with key security actors early on because inappropriate or underprepared first consultations with stakeholders can have long-term negative effects on company operations. The Host Government Engagement Strategy Tool is aimed to support company representatives prepare for these first consultations and establish a strategy for the engagement and communication with security sector representatives.

Read more about IPIECA here.

King & Spalding | 18 January 2017

Maritime Cybersecurity Regulation on the Horizon

Over the past year, various institutions and organizations—both domestic and international—have shown an interest in moving the increasingly prevalent cybersecurity conversation offshore. Domestically, both Congress and federal agencies have pushed to mandate cybersecurity measures for ships, ports, terminals, and offshore facilities. Internationally, a United Nations agency has issued new guidelines designed to enhance cybersecurity in worldwide shipping operations.

Critical energy infrastructure has long been at the forefront of cybersecurity, both because it is a frequent target of cyberattacks and because the potentially debilitating effects of a successful attack. However, maritime cybersecurity regulations will not necessarily target just the energy industry and are likely to come from a variety of sources, some of which may be unfamiliar to industry players.

Despite a strong national interest in regulating the cybersecurity of critical energy infrastructure, the industry’s maritime operations have largely gone under the radar. To date, approaches to cybersecurity in the energy industry’s maritime operations have largely been voluntary and, thus, company- or even vessel-specific. At the same time, global economic growth and the corresponding increase in energy demand have led many energy companies to explore offshore options for replenishing reserves and meeting production needs. Oil and gas producers, in particular, have shown a steadily rising interest in maritime technologies, such as floating production, storage, and offloading vessels and floating liquefied natural gas operations, that can both meet energy demand and align companies with global efforts to reduce emissions. But the rapid adoption of new operational technologies and an increased dependence on networked cyber structures opens the possibility of cyberattacks that could threaten the economy, worker safety, the environment, or national security.

As a new year begins, the energy industry is now facing the prospect of new regulatory oversight of its cybersecurity efforts in maritime operations. The past year revealed a series of indicators that maritime cybersecurity regulation is imminent. Six months ago, the United Nations International Maritime Organization published Interim Guidelines on Maritime Cyber Risk Management, which were drafted with input from representatives of 44 member states, including the United States Coast Guard (USCG). Six months before that, the US House of Representatives sent a bill to the Senate that would require USCG to enforce cybersecurity standards at US ports and in maritime operations. Meanwhile, the two federal agencies with primary jurisdiction over industrial maritime operations—USCG and the Bureau of Safety and Environmental Enforcement—have been speaking out publicly about the need for regulatory involvement in maritime cybersecurity. In 2017, maritime operations are expected to emerge as the next frontier of cybersecurity regulation affecting in the energy industry.

Houston Chronicle | 18 January 2017

Neglect the Basics at Your Peril, Cybersecurity Strategist Says

Hackers have gotten smarter and bolder in their recent attempts to steal coveted oil company data. Mario Chiock has worked for years to keep them at bay. Chiock joined Schlumberger in 1980 as a field engineer, but his traditional oil industry career took a turn in the mid-1990s when he began researching a new threat to corporate security, one that emerged alongside advanced computers and the internet. At the time, most in the oil industry had never heard of cybersecurity, much less practiced it.

Schlumberger Chief Security Officer Mario Chiock stands for a portrait on 20 December 2016 in Houston. Credit: Michael Ciaglo/Houston Chronicle.

Schlumberger Chief Security Officer Mario Chiock. Credit: Michael Ciaglo/Houston Chronicle.

Over the years, Schlumberger’s top cybersecurity adviser founded industry groups dedicated to educating oil companies on securing computer systems and sharing information between firms about cyber-incidents, as a way to learn how to guard against attacks.

The initiatives he began at Schlumberger aim to teach employees that they’re key to its cybersecurity. For example, Schlumberger sends its employees test phishing emails to see how many click on a link or email attachment.

“We need to make sure we’re always a few steps ahead of them,” Chiock said. He spoke about his experience and Schlumberger’s cybersecurity efforts.

Andrews Kurth via Mondaq | 22 November 2016

Cybersecurity Due Diligence Is Crucial in All Mergers and Acquisitions, Including Energy Transactions

A Cautionary Tale in Cybersecurity Due Diligence
Can a single data breach kill or sideline a deal? Perhaps so. In October, Verizon signaled that Yahoo’s disclosure of a 2014 cyberattack might be a “material” change to its July USD 4.83 billion takeover bid, which could lead Verizon to renegotiate or even drop the deal entirely. Concern over cybersecurity issues is not unique to technology or telecommunications combinations. In a 2016 NYSE Governance Services survey of public company directors and officers, only 26% of respondents would consider acquiring a company that recently suffered a high-profile data breach, while 85% of respondents claimed that it was “very” or “somewhat” likely that a major security vulnerability would affect a merger or acquisition under their watch (e.g., 52% said it would significantly lower valuation).

Bottom Line: Cybersecurity should play a more meaningful role in the due diligence portion of any potential merger and acquisition (M&A) deal. Certainly this is so when a material portion of the value in the acquisition comes from intangible assets that might be most vulnerable to hackers. Financial information comes to mind. Personal information of employees does as well. But companies also need to be concerned about their trade secrets, know-how, and other confidential business information whose value inheres in its secrecy. Therefore, a merely perfunctory approach to cybersecurity can become very costly. The union of companies today is a union of information, malware and all.

Energy M&A Is Not Immune
To weather the plunge in prices, many oil companies have sought out new innovations to reduce the cost of extraction and exploration. Investments in digital technologies will likely only increase. A 2015 Microsoft and Accenture survey of oil and gas industry professionals found that “big data” and the industrial internet of things are targets for greater spending in the next 3 to 5 years. Cybersecurity threats were perceived in the survey as one of the top two barriers to realizing value from these technologies.

Rigzone | 16 November 2016

Column: Changing Passwords Frequently Ineffective Against Cyberattacks

With so many things on my mind these days, I hate having to remember all the passwords I have. Not only do I have to remember passwords for my work computer and home computer but also a myriad of other accounts ranging from my bank, credit cards, and public library accounts. Having to change passwords every 60 days on my work computer is a particular pain. Not only do I have to remember a new password, but I frequently have to change the password when I’m in the middle of something and don’t want to be bothered.

The conventional wisdom has been that computer passwords need to be long, complex, and changed frequently. This practice has been required to protect work computers to maintain security against cyberattacks.

However, this practice is ineffective, said Stuart Wagner, director if information technology security and compliance with Enterprise Products, at the American Petroleum Institute’s Oil and Gas Cybersecurity Conference last week in Houston. Wagner not only believes that the requirement for character composition in passwords should be nixed but also the frequency at which passwords are changed.

Wagner is not alone in this belief. He pointed to research conducted by the University of North Carolina and Carlton University that supports the idea. Even Microsoft has changed their advice on the subject, Wagner noted.

Oil & Gas iQ | 10 November 2016

Digital Trenches—On the Front Lines of the Cyber War

In 2016, the weapons of mass destruction that stock the arsenals of the world powers make the machinery that killed so many millions during World War I look tame. Yet weapons of physical destruction are not the only ones that menace peace in our times.

The 21st century has witnessed the exponential development of cyberwarfare as an existential threat to the modern civilization. And the parallels between the actions of the First World War a century ago and the Cyber War in 2016 are glaring.

This report looks at the current state of the industry and uncover some alarming results:

  • 39% of professionals are not confident their current defense mechanisms can handle/detect cyberthreats
  • 65% of those surveyed are not confident that their defense mechanisms can handle/detect state actors/advanced persistent threats
  • One in five oil and gas companies still do not have a network integrated diagnostic system, even after all of the serious incidents, from Stuxnet to Shamoon
  • 61% of organizations do not use digital forensics to interpret digital traces

Rigzone | 8 November 2016

The State of Cybersecurity in Today’s Oil, Gas Industry

The convergence of digital technology with existing supervisory control and data acquisition (SCADA) infrastructure has increased the oil and gas industry’s risk to cyberattacks, industry insiders say.

Oil and gas companies are lucrative targets for cyberattackers motivated to perform industrial espionage, steal intellectual property, or cause critical infrastructure disruptions, Todd O’Boyle, cofounder and chief technology officer of Percipient Networks, said. Attacks are typically part of an ongoing attempt by individuals and interest groups worldwide—in some cases, government agencies and nation-states—to disrupt the oil and gas market and damage the financial standing of these companies, said Jessica Cooper, lead marketing manager for Check Point Software.

The oil and gas industry not only faces cyberthreats that are commercial in nature but also cyberthreats from activists such as environmental groups. These threats, if successful, “could have severe threats not just on the industry but also on the environment, public health and safety, and even national security,” according to March 2016 report by The Boston Consulting Group.

The oil and gas industry’s value chain not only offers many potential points for entry of attack but also leaves the industry vulnerable to multiple types of attacks. The Boston Consulting Group found that upstream data was the most vulnerable to cyberattacks. This is due to data often being transmitted from old or unsecured equipment and without standard protocols or security precautions.

Reuters | 1 November 2016

Niger Delta Leaders Want Army Out and Oil Firms To Relocate to Region

Leaders from the Nigeria’s Niger Delta called on 1 November on President Muhammadu Buhari to pull the army out from the oil hub, order oil firms to move headquarters there, and spend more on development to end militancy in the region.

Buhari met leaders from the southern swampland for the first time since militants started a wave of attacks on oil pipelines in January to push for a greater share of oil revenues.

At the meeting in the presidential villa in Abuja, Niger Delta leaders, joined by representatives of militant groups, gave Buhari a list of 16 demands to pacify the impoverished region where many say they do not benefit from the oil wealth.

The list “includes the withdrawal of the military in oil producing communities in the region,” King Alfred Diete-Spiff, a Niger Delta leader leading the region’s delegation, said after the meeting, adding, “We don’t want the communities militarized.”

Buhari sent in army reinforcements in May to hunt down militants, a move that stoked anger as residents complained of rape, looting, and arrests of youths unrelated to the militants, charges denied by the military.

The delegation leader also said oil firms should move headquarters to the region so unemployed youths—who often work for militants—could get more jobs. Foreign firms active in Nigeria are often based in the commercial capital Lagos.