New report probes oil, gas industry’s readiness against cyberthreats
A new report probes the oil and natural gas industry’s preparedness for cyber threats and provides insight into the cybersecurity programs that are in place.
The report — titled, “Defense-in-Depth: Cybersecurity in the Natural Gas and Oil Industry” – was issued by the American Petroleum Institute (API), the Natural Gas Council (NGC), and the Oil and Natural Gas Subsector Coordinating Council (ONG SCC).
“Cybersecurity is a top priority for the natural gas and oil industry,” API President and CEO Mike Sommers said. “As the owners and operators of critical energy infrastructure, our companies are providing the leadership, proactive solutions, and ongoing coordination with federal agencies to help prevent future cyberattacks. Natural gas and oil pipeline systems are purpose-built to be highly resilient and our members are leaders in cybersecurity, sharing cyber threat indicators and intelligence with each other and with the U.S. government through the Oil and Natural Gas Information Sharing and Analysis Center (ONG-ISAC).”
The report says cyberattacks can present “enterprise risks” – risks that could compromise the viability of a company. Further, many companies have developed comprehensive approaches to cybersecurity. Companies orient their information technology and industrial control systems (ICS) cybersecurity programs to leading frameworks and best-in-class standards, it explains.
Pipeline companies have layers of security in place, the report states. The natural gas system is highly resilient because the production, gathering, processing, transmission, distribution, and storage of natural gas is geographically diverse, highly flexible and elastic. It is characterized by multiple fail-safes, redundancies, and backups.
The report adds that reliance upon voluntary mechanisms including proven frameworks and public-private collaboration, rather than prescriptive standards or regulations, is the best way to improve cybersecurity of natural gas and oil companies and the energy infrastructure. It affords the required flexibility to respond to a constantly-changing cyber threat landscape.
