Stronger spotlight on ICT security

New technological solutions, data sharing and interconnecting systems are meant to benefit the oil industry – but also help to increase vulnerability. The PSA is responding to this challenge by learning more and extending its supervisory activities.

ICT covers computers, software, systems and networks, and is essential for safe and efficient operations both offshore and on land.

“Industrial ICT systems manage processes, monitor possible gas emissions or fires, and handle safe shutdown of facilities and platforms,” observes Espen Seljemo at the PSA.

“That means they represent safety-critical equipment and solutions, which need good and robust protection – including against ICT security incidents.”

The PSA has been following up the industry’s work on ICT systems for many years. Attention has been directed at the industrial solutions and company efforts to safeguard these.

“ICT security is a matter of protecting software and critical systems against both intentional and unintentional harm,” says Seljemo, who heads many of the PSA’s projects in this area.

Priority

While current advances offer many opportunities and benefits, security must take priority. Understanding the consequences of introducing new solutions for the risk picture is important.

Different systems and programmes which were previously isolated have been integrated – not only locally, but also between industrial ICT solutions offshore and office systems on land.

Sharing data from these systems with equipment manufacturers and suppliers as well as other partners is a growing trend. Work that previously had to be done on a facility can now be conducted from land.

But increasing digitalisation makes the petroleum sector more exposed to advanced digital threats and vulnerabilities. Solutions which improve efficiency, competitiveness and safety can also reduce safeguards and create new angles of attack.

Systems, processes and equipment can be taken over remotely, for example. Both human error and system faults may disrupt operational regularity and cause financial loss.

With society seeing a growing number of cyberattacks, players must stay constantly aware of the need to upgrade their ICT security in order to deal with undesirable incidents.

Nothing new

“It’s important to emphasise that ICT security is nothing new, either for us or for the rest of the industry,” says Seljemo. “The industry drew up guidelines on this issue as early as 2006.

“And we conducted our first audit with this as a specific subject already the following year. ICT security has since been followed up in a number of our audits.”

The issue has also been incorporated by the PSA in its tripartite collaboration with the companies and unions in the petroleum sector, he explains.

“Developments are happening fast and the pace of change is rapid. ICT security is one of the areas affected by increased digitalisation.

“New solutions and technologies are being rapidly adopted, while the risk picture constantly changes. We’re more vulnerable than before, so we must take precautions to safeguard HSE and stay updated.”

Strengthened

The PSA’s work on ICT security has now been greatly strengthened, Seljemo reports. “This subject will receive great attention in coming years.”

The PSA is recruiting more specialists in the area, and has also received additional funds from the Ministry of Labour and Social Affairs.

Seljemo says that a number of activities directed at the industry’s follow-up in this area will be pursued in the 2018-21 period.

“An important part of this commitment involves learning more, so that we maintain an overall picture of ICT challenges and risks in the sector.

“We’ll look in depth at a number of important areas, and increase what we know about the technology developments now under way and how they affect the risk picture.”

The PSA will describe the changes and drivers which influence the threat and risk picture, and identify areas where more work may be needed to prevent planned and unplanned incidents.

“Our goal is to help the industry to maintain an acceptable level of safety, acquire adequate expertise and methods and establish robust and reliable processes here,” says Seljemo.

He emphasises that the knowledge acquired will be made available to and shared with the whole petroleum sector.

Audits

The PSA will also continue to follow up the industry’s work on ICT security through its audits. Attention will be concentrated on areas thought to present the biggest risk, Seljemo explains.

“We’ve planned a number of audits in this area in 2019. These will address selected companies and how they implement and operate industrial ICT system offshore and on land.

“We’ll also check that procedures and routines are being followed up on the individual facility, as well as the robustness of these systems.”