Katharina Rick*
Today, concern about cybersecurity is particularly high within the oil and gas industry, which faces a far wider spectrum of threats – threats that are potentially more severe in comparison to other key industries. In the Middle East, specifically, the rate of cyberattacks targeting companies in the oil and gas sector is notably high, especially compared to global figures. In fact, according to Repository of Industrial Security Incidents (RISI) data, cyberattacks against oil and gas organizations in the Middle East make up more than half of the recorded instances. In parallel, in the US or other Western countries, they make up less than 30 percent of the recorded instances.
In recent years, there has been a growing prevalence of cyberattacks in the region. In 2014, Kaspersky Security Network revealed that, the previous year, more than 650,000 ransomware infection incidents had taken place across the Middle East and North Africa (MENA) region – including the oil and gas sector. A year later, in 2015, cybersecurity firm Symantec reported that Trojan Laziok, an aggressive malware program, had attempted to steal data from energy companies around the world, some based in the Middle East. Remarkably, 25 percent of the attempted cyberattacks targeted companies in the UAE versus 10 percent in both Saudi Arabia and Kuwait and 5 percent in both Oman and Qatar.
This, of course, raises three pivotal questions: Why are oil and gas companies in the Middle East more vulnerable to attacks? How can organizations that have fallen victim to cyberattacks ensure a quick recovery? And what can they do to fend off future attackers?
The reality is, in recent years, companies in the region have invested heavily in newer IT infrastructure and solutions – including multiple mobile devices connected to the oil and gas companies' networks. Given their widespread popularity and ability to store sensitive or confidential data, mobile devices are increasingly turning into an open frontier for cyberattacks. In the Middle East and Africa, the situation is especially dire considering the region’s high mobile phone penetration rates. And this trend shows no sign of waning: independent market research company eMarketer predicts that over 789 million people in the Middle East and Africa will own at least one mobile phone in 2019 – and it is fair to assume that they will be bringing their device to work.
In this day and age, inadequate boundary protection is a strong point of vulnerability. It can make it difficult to detect nefarious activity and can create avenues that allow outside parties to interface with systems and devices that directly support a company’s control processes. It can also provide an "easy" access route to industrial control systems – as most communication protocols for measuring and control devices are not as well encrypted as those for business communication systems.
Another critical point of vulnerability is information flow enforcement. If false data is fed into the system or information is siphoned off, most companies would likely never know that for a fact – it could even go completely undetected. There is wide speculation that the colossal malware attack on oil giant Saudi Aramco's systems in 2012 was actually a cover-up for earlier information flow breaches.
Insufficient control of information flows can allow attackers to establish unsanctioned and damaging commands and controls with potentially severe consequences for the physical infrastructure, the value of national assets and personal safety and health.
The potential points of attack are plenty. Transactions in the oil and gas arena are broad in scope and range from sensitive information on well sites to end-user consumption at the pumps.
The danger posed by large-scale threats is significant, given the physically expansive infrastructure of oil and gas production and distribution. For instance, the ramifications of a successful cyberattack on an oil and gas company in the Middle East could carry grave implications on national security. In most countries in the region, the oil and gas sector is the main source of income for the government and accounts for 60 to 70 percent of fiscal spending resources.
Governments in the region, including those of Saudi Arabia and Qatar, have crafted multi-phased national cyber security strategies and developed related policies and frameworks, focusing specific attention on critical infrastructure and national interests. For example, the Qatar National Cyber Security Strategy (NCSS) “was developed by the National Cyber Security Committee, presided by the Ministry of Information and Communications Technology, in light of the strategic thrusts of Qatar’s National ICT Plan 2015 to protect the national critical information infrastructure and to provide a safe and secure online environment for the different sectors.”
These various bodies and efforts notwithstanding, individual oil and gas companies in the Middle East need to take primary responsibility for their cybersecurity strategies themselves. The Boston Consulting Group (BCG) recommends a risk-based approach centered on three steps. These include:
• Developing an understanding of the precise risk to the company’s assets and the effort and resources necessary to mitigate them
• Building and sustaining a multilayered defense system
• Managing cybersecurity risk on a consistent basis
To conclude, the increasing technological complexity of today’s oil and gas industry – driven by, for example, the industry’s spiraling deployment of data mining and analytics technologies, sensor and networking technologies, industrial systems, and systems integration technologies – is rendering it increasingly vulnerable to cyberattacks. To protect themselves, their shareholders, and their customers adequately, oil and gas players in the Middle East must make cybersecurity a highest priority and an ongoing consideration at the executive level.
* The writer is Partner & Managing Director at Boston Consulting Group
