Role of Security Automation Systems in Oil and Gas Industry - Literature review Example

Role of Security Automation Systems in Oil and Gas Industry Role of Security Automation Systems in Oil and Gas Industry Introduction Operations in the oil and gas sector entail a balance between risks associated with owning and/or operating crucial assets and infrastructure on one hand, and maximizing margins on the other. Companies that operate in the industry are constantly faced with challenges in the form of regulatory, workflow, labor force and supply chain requirements. However, and more importantly, according to Siemens. There is also the ever-increasing risk of cyber attacks that target their information and communication technology (ICT) infrastructure as well as intellectual property. OGP (2010) observes that the adoption of new technologies by both upstream and downstream operators, such as security automation systems, is one way the industry players use to mitigate the issues and enhance service delivery. Examples of automation systems include supervisory control and data acquisition (SCADA), sensor networks, terminal automation systems and distributed control systems. These take on a lifecycle approach that offers high-level protection, detection, response, and recovery from cyber attacks. This paper will review literature that discusses the key role of such security automation systems in securing data in the oil and gas industry (MASGC, 2012). The Need for Security Automation Systems Security levels and maturity Security requirements can be perceived from four distinct levels. At the highest level of maturity in cybersecurity, oil and gas organizations implement more optimized and strategic security programs as described by the table below. Level Three: Optimized Level Two: Managed Rationalized vendor ecosystem for Global IT services within the process control domain Level One: Defined Tighter integration of control system layers with levels above Real-time information integration and provisioning taken as a key organization initiative Level Zero: Initial Minimal point-to-point integration of control system layers with levels above Increased focus on security within process control domain with defined standards Integrated Global Command Centers for system maintenance and services delivery with minimal on-site support Siloed process control systems, No integration to external world System Maintenance by business groups with some support from local vendors System maintenance by shared regional groups with consolidation of vendors Dedicated focus on improving Cyber-security of process control systems System maintenance by individual site personnel Minimal Enterprise IT involvement in reviews/decisions Enterprise IT groups fully involved in architecture definition, selection, deployment, support etc Standardized catalogue of IT services within across all plants globally No Enterprise IT involvement Some IT services at site-level identified for local outsourcing Catalogue of standardized PCD IT services identified and operating at site-level Enterprise IT groups driving solution architecture for system components within PCD also leveraging key evolving technologies No standard IT services definition in Process control domain Site-level standardization in IT hardware and software infrastructure and control automation system components Global standardization in IT hardware and software infrastructure and control automation system components Leveraging collaborative partner ecosystem consisting of IT Services vendors, Hardware and software vendors and Process control system vendors for standardized services delivery globally Disparate hardware and software solutions within the same site Remote access enabled for select critical systems within the process control domain Limited remote monitoring of Process control domains components for troubleshooting etc. Secure any-time any-where remote access to all PCD components including remote delivery of key IT services within the PCD Figure 1: Approaches to various levels of threat (Upadhya, 2011) It is recommended to adopt Stateful inspection of firewalls in order to study the information received from external sources. Such inspections allow tackling traffic like connectionless UDP and TCP that might compromise the operation. Essentially, as Upadhya (2011) contributes, these are defined by security automation systems, continuous management of threats and risks and the vigorous governance of the security culture. According to Clements & Goranson (2011), the amount of data presently processed at any oil, gas plant is considerably large, and it follows, therefore, that the system in place ought to manage it appropriately alongside production as an entire business unit. The technology implemented in the oil and gas industry significantly necessitates management of cyber risks. As organizations in the sector embrace networked infrastructures that permit efficient business operations, they at the same time rely on services, products and materials supplied by vendors (OGP, 2010). The figure shows how oil and gas industries operation systems are prone to attacks from hackers. It shows the trends of cyber attacks on different companies between 2000 and 2011. Figure 2: This figure shows trends in related fields that necessitate security automation systems in the oil and gas sector (Homeland Security Department, 2009). Key causes of security decline Threats are posed by newer and advanced technologies such as dynamic positioning systems, controlled drilling rigs, cloud-based services, and condition monitoring. However, systems that were designed to tie decentralized oil and gas facilities together were intended to be robust and open with ease of operations and repair but not essentially secure, which rendered infrastructures vulnerable. However, other literature put more blame on the rapid technological advances that have rendered most of the conventional systems outdated. In that context, the oil production process has three critical stages that are especially prone to cyber attack and they are, in that order, exploration and mining, processing and storage and finally, refinement and distribution. Security automation systems are designed to protect the infrastructure by detecting attacks, responding to them, and facilitating recovery in agile and persistent ways. Further, they perform these duties with minimal human intervention, reducing the need for trained and costly security staff to implement different and complex infrastructures in geographically diverse locations. The improved ability of automated systems to gather information and propagate expert communications speeds up problem resolutions and workflow because they convey real-time information. This has the long-term effect of improving decision-making processes and business results while reducing costly operational issues. As Fernandez (2013) points out, the oil and an aging workforce, a situation that essentially creates a unique gap in infrastructure and risk management, challenges gas industry culminating into HR challenges. What Security Automation Systems Hope to Achieve Safety in production processes The ultimate goal of security automation systems is to improve control and safety of the production process by detecting, diagnosing, and prioritizing the performance and reliability of systems (Upadhya, 2011). Studies have shown that technological innovations hold the key to future competitive advantages. Until fairly recently, the oil and gas industry has been reluctant to venture into innovations that stretched beyond what was necessary to extract resources from the ground with reasonable measures of success. However, the amount of sensitive data handled and potential cyber threats have altered the way security automation is perceived, which goes further than simply affording a competitive edge. Through automation, the use of the most current technology intends to wrap ideas and knowledge management around processes that makes investments work safer and more efficiently (IEEE, 2012). Automation also intends to protect the research and development that was put into the creation of intellectual property by creating and implementing another layer of security. While regulations are available to aid, organizations achieve the optimum balance between managing cyber risks and business performance faults them for emphasizing the often insufficient one-size-fits-all approach. In support, Richardson (2010) contributes that security automation is customizable to address vulnerabilities as they are uniquely presented by unique organizations. From an administrative, point of view, MASGC (2012) notes that policies are lacking for the proper remote access and manipulation of assets and infrastructure. The oil and gas organizations are made particularly vulnerable by infrastructure issues, with code weaknesses on one hand and lack of maintenance on the other. To address this issue from the technical perspective, security automation is specifically designed to harden the administrative desktop and ensure secure and robust active directories while enforcing appropriate policies for remote access and manipulation. If designed and implemented accurately and with integrity, an automated security system will not be compromised as easily as traditional methods (Fernandez, 2013). Standardization of security automation Security automation systems help oil and gas industry players to understand, implement, and maximize the basic concepts of cybersecurity. The concepts embrace fundamental asset and infrastructure management principles, which include an understanding, and acknowledgement, of the threat environment, protecting the network perimeter and maintaining updated internal systems. This view is shared by and supported by Homeland Security Department (2009) findings that such basic principles are often overlooked in the rush to implement the latest tools and technology in security. In contrast, security automation systems provide proactive and holistic approaches to cybersecurity, addressing the entire range of the lifecycle of information technology (IT) security (Fernandez, 2013). Security automation systems are designed to ensure that the organizations run on constant and informed security systems, which help to clarify the anatomy of the common threats found in the cyber domain. Persistent attacks are often in the form of techniques that employ multi-stage intrusion and detecting and combating them poses a great challenge. Boyer (2010) breaks the stages into targeting, initial breaching, and sustained attack. Traditional methods can be compromised in the reconnaissance stage, enabling attackers to collect exploitable intelligence. Upon establishing the initial breach, the attackers intrude specific individuals, applications, and systems and then, using internal network mapping, compromise assets and infrastructures. Boyer (2010) asserts that although security automation systems may face various challenges if they are required to get rid of cyber threats in their entirety, they are very efficient at managing the risks they pose. MASGC (2012) concurs that security automation systems provide logical strategies to counter threats in such environments. It shows how oil and gas exploration takes place using latest automated technology. The engineering workstations must function inside the enterprise network in its distinct security zone for efficient operation. Therefore, the control center systems at the exploration and drilling sites must be well protected. In this process, it is significant to include an internal DMZ between the operation network and enterprise network since internal DMZ offers access to all activities or operation information as seen below (OGP, 2010). Figure 3: This figure clearly shows Shell Refinery plant in Heide, Germany, which is fully automated using technology from Siemens (OGP, 2010). Focusing on the risk tolerance of an organization, system value and vulnerability, cybersecurity analysis is carried out based on the risks. Then both long and short-term strategic security objectives are set. For instance, a case study conducted by MASGC (2012) suggested that field operations running for several months concurrently in multiple locations on a daily basis can be connected and protected and the procedure repeated wherever else the operations are performed. This achieves the desired objective of training security personnel for different infrastructures in other locations. Hence, the advantage of security automation systems is that they offer an extra security layer that can be deployed within an organization’s key assets, creating additional barriers between then and potential risks. At the primary level of maturity, security measures and the associated responses are usually ad-hoc and manual (Upadhya, 2011). However, Homeland Security Department (2012) recommends the standardized levels most upstream organizations are adopting, whereby IT units and infrastructures are more specific and knowledgeable about particular risks. Security automation systems enhance such awareness and the IT personnel gains experience with possible security breaches. This provides for protective and responsive measures that are appropriately structured, proactive, and consistent at the standardized level of maturity. Oil and gas industries needs to study the market in order to understand how much oil and gas the market demands as indicated below. Figure 4: A grid framework prototype designed for oil and gas, power and telecommunication industries from exploration until it reaches the customer (IEEE, 2012). Threats to automation services in oil and gas industries However, despite the advantages of automation in oil and gas industries, the technology is associated with threats that might stall the exploration process if not handled. Some of the risks include service layer matters like logging, data security and auditing, DoS packet sniffing runtime, multi-tenant security measures, access control service and cloud oriented roles. In addition, OGP (2010) warns that some scenarios possess unique elements that have the potential to generate clone attacks. They described clone attacks as the risk that an attack that was successful in a different scenario with similar infrastructure may be repeated on another. Conclusion Although some of the literatures reviewed highlight the shortcomings of security automation, most support its adoption with. The industry no longer views its reliance on security automation systems vendors as a simple cost factor. Rather, they are more of value-added growth partners. Further, industry faces an exponential growth in the amount and sophistication of data generated by its infrastructure. However, it is also up against the risk of competitive irrelevance if the data does not work for it. This is brought about by the fact that the same data that translates into business opportunities carries equal measure of business challenges. Good security automation system customized for the industry will curb the risks and alert the security team before irreversible damage occurs. It helps an organization to focus on its maintenance efforts and keep its operations safe while still concentrating on the core business. They establish the prerequisite for further and more sophisticated solutions related to security and offer superior protection to situational awareness. References Boyer, S. (2010). Supervisory control and data acquisition (SCADA). Texas: International Society of Automation. DHS. (2010). Environmental Justice Strategy. Retrieved July 12 October 2014 from dhs.gov: http://www.dhs.gov/xlibrary/assets/.../dhs-environmental-justice-strategy.pdf Fernandez, I. (2013). Cyber security for industrial automation & control environments: Protection and prevention strategies in the face of growing threats. California: Frost & Sullivan. Homeland Security Department. (2009). Recommended Practice: Improving Industrial Control Systems Cyber security with Defense-In-Depth Strategies. New York: National Cyber Security Division. Retrieved 12 October 2014 from https://ics-cert.us- cert.gov/sites/default/files/recommended_practices/Defense_in_Depth_Oct09.pdf Clements, S.L & Goranson, C.A. (2011). Secure Data Transfer Guidance for Industrial Control and SCADA Systems. Washington: U.S Department of Energy. MASGC. (2012). Securing Our Homeland. Retrieved 12 October 2014 from Mississipi-Alabama Sea Grant Consortium: http://www.masgc.org/gmrp/plans/DHS.pdf IEEE. (2012). Introduction to industrial control networks. Retrieved 12 October 2014 from http://www.rfidblog.org.uk/preprint-gallowayhancke-industrialcontrolsurvey Richardson, R. (2010). 2009 CSI computer crime & security survey. New York: Computer Security Institute. O.G.P. (2010). Instrument and automation standards and committees for the international oil and gas industry. International association of oil and gas producer, Report 427. Upadhya, V. (2011). Oil and gas: Global IT services transformation. Toronto: WIPRO Technologies. Read More