Security Automation in Oil and Gas Companies - Coursework Example

Security automation in oil and gas companies Controlling risks in industrial operations is a quite difficult task. Moreover, in industries where operational risks are higher the identification of effective tools for reducing risks is depended on certain factors: the availability of resources for developing relevant research, the skills of existing staff, the extension of business activities and the business objectives. In this study the use of Security Automation Systems for limiting risks related to the oil and gas industry is critically discussed. The efforts made by firms that focus on the specific subject are presented. At the same time, the future trends related to SA systems are presented. The work of firms that develop such systems, such as ABB, Siemens, Rockwell Automation, SELEX and Duos Technologies, is discussed; the SA systems of the above firms are explored as of their characteristics and implications. It seems that existing SA systems can highly promote security in regard to daily operations of firms in the oil and gas industry. However, failures are difficult to be eliminated. The use of supportive tests and tools, such as SCADA software, is considered as unavoidable for ensuring the high performance of SA systems. In the future also, a similar practice would be employed since failures are indispensable part of all computerized systems, such as the SA systems. 1.0 Introduction The oil and gas industry is highly exposed to a series of risks. Reference can be made, for example, to the risks from exceeding initial budget or planned costs and the risks related to ‘assets damages and injuries of people’ (Bigliani 2013, p.1). The pollution caused to environment due to failures in daily operations of the relevant industrial units is also another aspect of risks that the firms operating in oil and gas industry are likely to face (Bigliani 2013). The last few years another type of risk has appeared in the oil and gas industry: failures in cybersecurity of the industry’s firms (Radvanovsky & Brodsky 2013). The virus attack against the computer systems of Saudi Aramco in August 2012 resulted to severe problems in the operations of most of the company’s units; in total, about 30,000 units of the firm were infected by the above virus (Bigliani 2013, p.5). The introduction of Security Automation Systems in the oil and gas industry has been considered as the most appropriate solution for addressing the industry’s risks. The structure, role and terms of implementation and operation of these systems are explored in this paper. Emphasis is given to the current state but also to the future trends in regard to the above systems. The efforts made at international level for reducing risks in the oil and gas industry cannot be denied. Since, there are still areas that need to be improved. The introduction in the industry of advanced Security Automation System, as the ones presented in this paper, would be a way for minimizing the industry’s risks, either in the short or the long term. 2.0 Security Automation Systems 2.1 Reasons for existence and role Automations systems (AS) are quite common in industries of various characteristics. In fact, such systems are employed in areas such as ‘manufacturing, transportation and gas supply’ (Dzung et al. 2005, p.1152). The modern industrial AS have a key difference compared to those used in the past: their data can be accessible by many users while in the past such option was not available (Dzung et al. 2005). For example, in an oil plant the data retrieved and processed through the components of a SA system is available not just to the administrators of the system but also to employees in other positions, such as the company’s strategic management team (Dzung et al. 2005). Figure 1 – Security protocols commonly used in SA systems (Dzung et al. 2005, p.1159) When referring to SA systems, security is expected to have three aspects: a) primarily, reference is made to the way in which the attacker is expected to harm a particular SA system: if the damage will be caused by the attacker personally, then there is the case of ‘physical security’ (Dzung et al. 2005, p.1153); instead, if an ‘electronic network’ (Dzung et al. 2005, p.1153) is involved, then there is the case of ‘system security’ (Dzung et al. 2005, p.1153). For example, violating the protocols on which a SA is based (Figure 1) can be considered as an attack against the system; b) at the next level, emphasis is given to the targets set when introducing a particular automation system; targets such the avoidance of modification of data included in the system by persons who are not authorized and the elimination of the potentials of such persons to access the system’s data are among the targets set when introducing a SA system (Dzung et al. 2005); c) finally, a SA system needs to offer to its users the confidence that the targets set when introducing this system will be achieved (Dzung et al. 2005). Security Automation Systems have been introduced in the oil and gas industry since existing systems for controlling risks related to the above industry had been proved ineffective. Moreover, the units of the industry’s firms need to be in continuous operation while their assets are vulnerable to damages caused either by accident or because of an attack (SELEX 2014, p.3). In addition, the safety of employees in these units cannot be easily secured, due to the nature of the industry’s operations (SELEX 2014, p.3). For this reason, when used in the oil and gas industry a SA system needs to be able to ensure the non-stop of operations and the safety of staff and of infrastructure (SELEX 1014, p.3). For example, the infrastructure of the industry’s units is highly exposed to attacks by groups entering the landline from paths that are quite difficult to be controlled, such as from sea (Goslin 2008, p.7). Figure 2 – Virtual Perimeter (fence) of SA system of Duos Technologies (Goslin 2008, p.8) A Security Automation System is able to provide full cover of the area surrounding the relevant industrial unit; for example, the Security Automation System developed by Duos Technologies creates ‘a virtual perimeter around the industrial unit involved’ (Goslin 2008, p.8). The mode of such perimeter is presented in the picture in Figure 2 above. The users of the particular SA system can have access to real-time data from the area covered; in this way, any attack against the particular industrial unit is reported to the unit’s controllers immediately (Goslin 2008). It should be noted that the system makes a comparison of the data retrieved from the areas under surveillance; as a result, the user of the system can be aware of any attempted attack against the unit without delay (Goslin 2008). It should be noted though that, in order to operate effectively, the above SA system needs to be supported by a number of devices, i.e. surveillance cameras. Through these cameras the system monitors continuously the area covered; any change/ movement is captured immediately and reported to the system’s users. For example, in the picture in Figure 2a the SA system shows the attempt of a small boat to enter a port (Goslin 2008). The above event could also appear in the area surrounding an oil well (Goslin 2008). Figure 2a – A boat approaching a port, as captured by a SA system established in a port (Goslin 2008, p.8) 2.2 Technical particulars of SA systems – control of efficiency Security Automation Systems, by their nature, require quite strong servers. These servers need to be appropriately linked with the computers of the industrial unit involved (Figure 3), so that the effectiveness of the SA is secured. Indeed, if being appropriately structured, a SA system can guarantee the achievement of the targets set by its designers in terms of security, in the context described above. Figure 3 – Industrial automation system – network architecture (Dzung et al. 2005, p.1162) As made clear through the graph in Figure 3 the servers used in a SA system need to be of specific technical characteristics so that they are able to operate smoothly. The technical characteristics of such servers can be differentiated depending on the software application used, the extension of the network system in which these servers will be connected but also the targets set by the system’s designer (ABB AB 2014). An example of such server is presented in Figure 4; it is the server used in the SA system developed by Duos Technologies. The technical characteristics of SA systems, as in their current state and their future trends, are presented analytically in section 3. Figure 4 – The server of the SA system developed by Duos Technologies (Goslin 2008, p.7) Due to their complexity, the SA systems need to be periodically checked using appropriately customized tests. A series of initiatives have been developed through the years by institutions and states for responding to the above need of SA systems. The ‘National SCADA Test Bed (NSTB)’ (Radvanovsky & Brodsky 2013, p.362) is a popular test of such type. The ‘NIST 800 series Security Guidelines’ (Radvanovsky & Brodsky 2013, p.362) is a Handbook including a series of documents referring to the reliability, security, infrastructure and support of computer systems and programs used in various sectors (Radvanovsky & Brodsky 2013). The above Handbook can be also effectively used for enhancing computer security in the oil and gas industry. Apart from tests and guidelines, the use of computer systems in oil and gas industry can check the technical status of these systems by employing appropriate software tools (ABB Review 2011). The ‘Cyber Security Evaluation Test (CSET)’ (Macaulay & Singer 2012, p.125) is such software program. The above program provides to its users a carefully designed process for testing the efficiency of their control system; the user follows the steps of the process following strictly the guidelines appeared on screen (Macaulay & Singer 2012). After completing the process the user is informed in regard to the alignment of his control system with the standards of the industry involved (Macaulay & Singer 2012). 3.0 Security Automation Systems in Oil and Gas industry 3.1 Current state Today, SA systems have to respond to the need of oil and gas industry for full integration (ABB AB 2014). The structure of a SA system that can promote integration in the industry’s units is presented in Figure 5. This SA system has been developed by ABB. Figure 5 – The SA system of ABB (ABB AB 2014, p.34) The above system is aligned with the quality standards applied in the particular industry, such as the IEC 61850 standard, as related to industrial communications (ABB AB 2014). In addition, the particular system employs Ethernet, so that reliability and speed in regard to the data transferred/ exchanged is secured (ABB AB 2014). Through a similar approach Siemens has developed the ‘Totally Integrated Automation (TIA)’ (Siemens AG 2014, p.4), an automation system that also emphasizes on integration in regard to all the system’s function (Siemens AG 2014, p.4). The specific system offers a particular advantage, compared to the other systems of the same type: ‘integration is secured not only horizontally but also vertically’ (Siemens AG 2014, p.4). This fact is made clear through the graph in Figure 6 where Siemen’s SA system is presented. Figure 6 – SA system of Siemens (Siemens AG 2014, p.4) It should be noted that the TIA system of Siemens is based on a carefully designed computer system, the ‘SIMATIC PC 7’ (Siemens AG 2014, p.10). This computer system has been developed in such way so that costs related to its implementation, operation and monitoring are kept at quite low level, compared to the other control systems with the same characteristics. The system’s effectiveness is made clear if reviewing its structure, as presented in Figure 7. Figure 7 – Control system/ computer system of TIA in Siemens (Siemens AG 2014, p.10) In any case, currently the programs and tools used in SA systems are of high range. An indicative list of such tools is presented in Figure 8. Figure 8 – Tools used in SA systems (ARC Advisory Group 2008, 2) According to the above graph, DCS is the tool mostly preferred by firms that decide to implement a SA system; of course, there is a percentage of 30.5% that represents other, less known tools that can also support a SA system. Among the tools presented above, SCADA is considered as quite popular, offering the advantage of high reliability and speed in data transfer (ABB 2013). The SA system developed by Rockwell Automation is different from that of Siemens. In Rockwell Automation’s SA system emphasis has been given on simplicity of structure, as related to easiness in use, the user interface but also the employment of quite strong drives, such as the PowerFlex drive (Figure 9). The specific system can be implemented easier and offers a quite rapid transfer of data. According to the system’s designers the above SA system can help a firm ‘to save about $570,000 on annual basis due to the decrease of MegaWatt hours (MWhrs) at least by 14,370hrs annually’ (ARC Advisory Group 2008, p.10). In other words, the specific system does not emphasize on integrity, as the SA of Siemens, but rather on the easiness of use and the speed in data exchange. Figure 9 – the SA system of Rockwell Automation (ARC Advisory Group 2008, p.8) In addition to the above, in the oil and gas industry SA systems need to be able to respond to the industry’s common threats, such as the fire in infrastructure. A SA system that would be able to meet the industry’s challenges would be that presented in Figure 10; in the relevant graph all parts of the SA system are presented, including the devices used at lower level but also the system’s central control unit. Figure 10 – A SA system focusing on the identification of fire in a gas plant (Honeywell 2009, p.5) 3.2 Future trends In the future the SA systems are expected to focus more on preventing risks rather than on managing risks. Existing SA systems seem to set integration as a priority without securing the non-appearance of risks (Honeywell 2009). Moreover, up to now the involvement of industry standards in the design of SA system is not clear; in fact, among the SA systems presented in this paper, only the one of ABB has emphasized on industry standards. The other SA systems seem to value more the integration, the easiness in the system’s use and the speed in the transfer of data. Of course, all these systems have included protocols for limiting system’s accessibility by non-authorized users. However, as explained in the beginning of this study, security, as a concept, has various dimensions. In the oil and gas industry, security has an additional dimension: the on-time alert for damages or failures of infrastructure so that threats for employees and for the environment can be controlled (Honeywell 2009). Moreover, from now on the designers of SA systems should focus on preventing cyber attacks which have become a major problem for firms in the oil and gas industry. The case of Aramco that had to ‘replace hard drives in 30,000 of its computers’ (ESentire 2013, p.5) after a cyber attack that the firm suffered in 2012, is an example of the above trend. It should be noted that through the years the forms of such attacks have been alternated, becoming more difficult to be faced (ESentire 2013). Currently, two forms of cyber attacks, the ‘Advanced Targeted Attacks’ (ESentire 2013, p.5) are considered as the most severe threat for the computer systems of firms in the oil and gas industry. Figure 11 – SCADAvantage SA system of ABB (ABB 2013, p.4) Another important trend related to the SA systems in the oil and gas industry is the following: existing software tools are transformed so that they can increase their effectiveness in managing high volume of data (Rockwell Automation 2013). An example is the SCADAvantage system, a database based on SCADA elements, but with the following differentiation: the new system has the form of a database so that the retrieval of data is easier; also, through this structure, the system can operate at higher speed, a fact that increases its competitiveness (ABB 2013, p.2). The advantages of the new system, compared to existing systems, can be identified by checking its structure (Figure 11). The involvement of relational databases in the SA systems of the oil and gas industry, as suggested by ABB, could increase reliability and speed (ABB 2012), two requirements that are critical in regard to the industry’s SA systems. 4.0 Summary The performance of SA systems in the oil and gas industry is depended on several factors, as presented above. In addition, the firms that focus on the development of SA systems for the oil and gas industry have followed different directions for ensuring these systems’ effectiveness. Each of these approaches offer different advantages for the firms in the oil and gas industry. Moreover, the specific field is characterized by important trends in the future, not only in regard to the type of software applications involved but also as of the type of threats against firms in the oil and gas industry. In this context, the following question would appear: is there a condition which could guarantee the full effectiveness of a SA system? The answer would be rather negative. No matter the design or the components chosen, the performance of SA systems can be affected by a variety of factors, as analyzed above. For this reason, when evaluating a SA system emphasis should be given rather to the system’s potentials to minimize risks, as possible, and to secure the non-exposure of the firm in major, non-controllable, threats. References ABB AB (2014) “System 800xA – Solutions Handbook” Organizational Brochure, pp.1-139 ABB (2013) “SCADAvantageTM for the Oil and Gas industry. Future – proofed software and solutions. Organizational Brochure, pp.1-15 ABB (2012) “Solutions for efficient, reliable and safe operations – Serving the midstream oil and gas industry.” Organizational Brochure. March 2012, pp.1-15 ABB Review (2011) “Oil and Gas.” Vol 2, pp.1-78 ARC Advisory Group (2008) “Rockwell Automation Builds a Business Value Proposition for the Oil & Gas Industry.” ARC White Paper. January 2008, pp.1-34 Bigliani, R. (2013) “Reducing Risk in Oil and Gas Operations.” White Paper, EMC. May 2013, pp.1-15. Dzung, D., Naedele, M., Hoff, T. & Crevatin, M. (2005) “Security for Industrial Communication Systems” Invited Paper. PROCEEDINGS OF THE IEEE, VOL. 93, NO. 6, JUNE 2005, 1152-1177. ESentire (2013) “Improving Cyber Security for Oil, Gas & Mining Companies.” White Paper. December 2013, pp.1-11 Goslin, C. (2008) “International Petroleum Industry Security System.” Duos Technologies Inc., pp.1-16. Honeywell (2009) “Integrated Fire and Gas Solution – Improves Plant Safety and Business Performance.” White Paper. April 2009, pp.1-10 Macaulay, T. & Singer, B. (2012) Cybersecurity for Industrial Control Systems: SCADA, DCS, PLC, HMI, and SIS. Boca Raton: CRC Press. Radvanovsky, R. & Brodsky, J. (2013) Handbook of SCADA/Control Systems Security. Boca Raton: CRC Press. Rockwell Automation (2013) “Automation Fair 2013 – Pre-Show Program.” Organizational Brochure. Publication CSV-BR665I-EN-P – July 2013, pp.1-31 SELEX SE Ltd (2014) “Oil & Gas Infrastructures Protection.” Organizational Brochure. SSD MM08052 03-14, pp.1-8 Siemens AG (2014) “Optimization of Plant Performance – Automation Solutions for the Oil & Gas Industry.” Organizational Brochure, pp.1-25 Read More