Tackling the threats

Norway’s position as a gas supplier to Europe gives safety and security a special place. And Jannicke Nilsson’s job in Equinor has never been more important.

As the group’s executive vice president for safety, security and sustainability (SSU), she works closely with today’s demanding threat picture.

 “The inhuman conditions we encounter via the news from Ukraine naturally affects me both as a human being and as a manager with my area of responsibility,” Nilsson comments.

The war in Ukraine has had serious consequences for energy supply in Europe, where Norway was the clear leader for natural gas deliveries during 2022. This has increased the security policy value of Norwegian petroleum activities, and the demands Equinor faces as the largest producer in that industry.

“This conflict is very serious and dramatic. At the same time, it underlines the significance of Equinor as a reliable supplier of energy to Europe.”

Increased threat

In March 2022, soon after Russia invaded its neighbour, the Norwegian police security service (PST) sounded the alarm over an increased threat to Norway’s petroleum sector. And blowing up two Baltic gas pipelines brought the war even closer.

“The sabotage of the Nord Stream pipelines showed how far somebody was willing to go,” says Nilsson. “It underlined the seriousness of the position and that the need to take action has become even greater.”

Threat assessments by the Norwegian security authorities provide an important basis for Equinor’s security work, she makes clear.

“We also look beyond Norway to ask such questions as what’s happening in the cyber area, where are wars being fought around the world, and where is change happening.

“Based on various information sources, we then produce our own threat evaluations. These are very important for the risk assessments which form the basis for our business.

“The gas supply chain to Europe is a highly significant part of this right now because of the value it creates.”

At the same time, Nilsson makes it clear that protecting people trumps everything – both environmental and financial value. “It must be safe to work in and for us,” she emphasises.

Experience

Equinor learnt a lot from its experience with the terrorist attack on Algeria’s In Amenas gas field in 2013, when 40 people were killed – including five of its own employees.

In the wake of that incident, the group’s security work was reviewed both internally and externally, and a number of measures were implemented.

These included promoting security to the corporate management level and dividing it into three areas – physical, ICT and personnel.

“A lot’s happened since In Amenas,” reports Nilsson. “We’ve adopted a far more integrated approach to security work, where we now see these three areas merging to a greater extent.

“At the same time, our work is risk-based. We make our biggest commitment where we believe the threat to be greatest. Deliberate attacks, for example, were defined as one of the principal risks for us as company long before the Ukraine war.”

This risk-based approach is inherited from many decades of systematic safety work in the group, and Nilsson sees many benefits deriving from the experiences this has provided.

“Transferring lessons learnt from safety to security is relatively simple, and we apply many of the same principles in both areas,” she observes.

“The bulk of our work is devoted to what we can do before something happens. In addition, we have good plans for when a response is needed.

“That’s particularly important now with cybersecurity, where we see a steady increase in attacks around the world. We can’t assume this will never happen to us.

“So we must be ready to do all we can to avoid an assault. At the same time, we have to know what we’re going to do if something happens.”

The group also works a lot on physical security of the subsea infrastructure on the Norwegian continental shelf. Several thousand kilometres of pipelines, along with power, internet and communication cables, form an extensive network on the seabed.

This must be protected, and a good deal of technological development is now being pursued in this area.

Transferring lessons learnt from safety to security is relatively simple, and we apply many of the same principles in both areas.

Expanding

However, the biggest security challenge facing Equinor is a steadily expanding attack surface, which reflects growing complexity and an expansion in the players involved.

“We’ve become a broader energy company, which means that we work with several value chains and a larger number of suppliers and sub-suppliers,” Nilsson says.

“At the same time, we’re becoming increasingly digitalised and are thereby acquiring more connections to our networks.”

She finds that all Equinor’s suppliers are working well on security, whether this involves cyber, physical or personnel risk.

“I think everyone who works in this industry is aware that we’re an exposed sector now.

“We set specific requirements for security when entering into contracts, depending on which positions and areas the supplier will be working in.

“The most important consideration is nevertheless working together and sharing information so that we build expertise collectively.”

Insider risk

Insider risk has been highlighted as a threat by the authorities on a number of occasions, and it has received greater attention in recent years.

“We have a trust-based culture, and aim to keep it,” Nilsson says. “At the same time, we must be conscious that players may exist who want to extract information from us as a company.

“Detailed assessments are conducted when making new appointments. However, the vast majority are already working for us. So it’s important to identify which positions here could be the most interesting for other players to access.

“We also work systematically on expertise-building among managers, so that they’re observant and can conduct clarifying conversations from an early stage.”

I think everyone who works in this industry is aware that we’re an exposed sector now.

Sharing

“Our base values — open, collaborative, caring and courageous – underpin everything we do, including how we work on security,” she adds.

“It’s important for us to be open about as much as possible, even though we naturally keep some details relating to security issues confidential.”

A great need for information has been felt over the past year, both by employees and by their next of kin.

“When the war started, we established a strategic project team to see how we could best work across the group,” Nilsson explains. “Fixed meetings with both safety delegates and unions were established to ensure information flowed as openly as possible.

“We’ve received comments about where we need to be more open and which areas we must expand the information we share. Our emphasis is on informing employees, so they have the facts to pass on to their families.”

Collaboration both internally in Equinor and with government agencies has also been strengthened over the past year.

“We’ve collaborated well with the PSA over a long time,” Nilsson says, and explains that this cooperation has now extended to the ministries, the intelligence service, the PST, the Norwegian National Security Authority (NSM), the police and the armed forces.

“It’s also important that we involve suppliers and other players, such as Gassco, so that we’re working together around the whole value chain.”

Never good enough

Nilsson is pleased that the systematic work done over a long time has equipped the group better to assess which areas are the most important to work on.

But she also points out that conditions are constantly developing. That poses big demands for new expertise both in the industry and on the authorities.

“Our most important priority is to look after those who work in and for Equinor. We must then continue to work systematically and collaborate – and not forget that what was good enough last week won’t be good enough in the next one.”

Read more articles about security: