DNV GL Launches RP On How To Fight Cyber Threats In Oil And Gas Industry

The benefits of digitalization in the oil and gas industry are profound, but are also causing cyber risks to emerge. Almost 68% [1] of oil and gas companies were affected by at least one significant cyber incident in 2016, and many attacks are assumed to be undetected or unpublished. Based on a joint industry project, DNV GL is now launching a globally applicable recommended practice (RP), DNVGL-RP-G108, addressing how oil and gas operators, together with system integrators and vendors, can manage the emerging cyber threat.

Critical network segments in production sites, which used to be kept isolated, are now connected to networks, making the operational technology (OT) more vulnerable. According to recent research[1], fifty-nine per cent of oil and gas companies surveyed believe there is greater risk in the OT than the IT environment. Managing threats towards OT requires knowledge beyond general information security, such as oil and gas operational domain competence, in particular related to automated, unmanned, integrated and remote operations which are accessible online.

The new DNV GL recommended practice (RP) “Cyber security in the oil and gas industry based on IEC 62443” is the result of a nearly two-year-long joint industry project (JIP) together with partners Shell Norge AS, Statoil, Woodside, Lundin Norway, Siemens, Honeywell, ABB, Emerson and Kongsberg Maritime. The Norwegian Petroleum Safety Authority has observed the work and exchanged experiences with the JIP group from a regulatory perspective. The RP is based on the IEC 62443 standard, international practice, professional experience, and takes into account HSE requirements and the IEC 61511 functional safety standard. It outlines a tailored approach for the oil and gas industry on how to build security, with the emphasis on OT.

Pål Børre Kristoffersen, JIP Project Manager, DNV GL – Oil & Gas, says: “Industry players need confidence that security countermeasures can deal with more frequent and sophisticated cyber-attacks, which are becoming increasingly costly and harder for companies to recover from. Dealing with cyber-security challenges has become a key focus area for the oil and gas sector, and there is greater awareness of the requirements that need to be in place. There has, until now, been a lack of guidance for the oil and gas industry on how to implement these requirements. The new RP, developed in collaboration with key players, puts OT, together with IT, in the limelight, so the oil and gas industry can protect their operations.”

The scope of the RP is guidance on how to use the IEC 62443 series of standards for projects and operational phases, including good practice and a reusable approach. It is tailored for oil and gas onshore and offshore operations. The IEC standards define what to do, while the RP describes how, and implementation will result in:

• A reduced risk of cyber-security incidents
• Cost-savings for operators by reducing the resources needed to define requirements and follow up
• Cost-savings for contractors and vendors based on standardized design requirements from operators
• Simplified audits for authorities and auditors due to common requirements and common conformance claims.

Julie Fallon, Senior Vice President Engineering, Woodside says: “Aligning our Operational Technology cyber security approach to IEC 62443 enables us to learn from and contribute to industry knowledge and capability. The recommended practice provides practical guidance on applying the standard to oil and gas.”

“The OT convergence between IT and Engineering is critical to ensuring successful OT security management. The JIP process leading to this RP has enabled our team to leverage industry best practices, share learnings, and grow capability,” she adds.

A joint statement from the vendors involved in the RP: “Our customers in the oil and gas industry are to a large extent facing the same types of cyber-threats found in information technology systems. Being able to standardize what we deliver to our customers is important in reducing cyber-risks and reducing cost. Above all, it will increase the safety, availability and reliability of the operational technology systems. The organizations operating the systems can also manage cyber-risks by following and implementing the identification, protection, detection, response and recovery steps defined in the standards to withstand cyber-attacks. In the process of defining this RP, we have collaborated with both our competitors and our customers on guidance to the IEC 62443 series of standards.”

Reference: dnvgl.com

Disclaimer :
The information contained in this website is for general information purposes only. While we endeavour to keep the information up to date and correct, we make no representations or warranties of any kind, express or implied, about the completeness, accuracy, reliability, suitability or availability with respect to the website or the information, products, services, or related graphics contained on the website for any purpose. Any reliance you place on such information is therefore strictly at your own risk.

In no event will we be liable for any loss or damage including without limitation, indirect or consequential loss or damage, or any loss or damage whatsoever arising from loss of data or profits arising out of, or in connection with, the use of this website.

Latest Shipping News You Would Like:

U.S Navy And The Philippines Begin Joint Naval Drills In South China Sea Amidst Tensions With China

Posted on October 3, 2023

In a show of force against China amid ever growing tensions in the much-disputed waterway, defense allies the Philippines and the US started conducting combined naval activities on Monday.

Captain Of Cargo Ship Carrying €157million Worth Of Cocaine Appears In Wexford Court

Posted on October 3, 2023

The ship captain of the MV Matthew got a bail rejection after he appeared at the court on being charged over the €157 million cocaine seizure off the country’s south coast.

Indian Navy’s First Training Squadron Warships Arrive At Port Klang, Malaysia

Posted on October 3, 2023

As part of the Indian Navy’s log-range deployment in Southeast Asia, the vessels of the First Training Squadron (1TS)-ICGS Sarathi, INS Tir, and INS Sujata are visiting Malaysia’s Port Klang.

Environmental Groups Demand Rules To Protect The North Atlantic Right Whale From Ship Collisions

Posted on October 3, 2023

A coalition of environmental groups has been calling on the country’s federal government to have in place emergency rules to safeguard a fast-vanishing species of whale from collisions with large vessels.

U.S Navy And Lockheed Martin Fire Submarine-Launched Ballistic Missile With A 4000 NM Range

Posted on October 3, 2023

The Fleet Ballistic Missile — One Trident II D5 Life Extension, was successfully launched on 27 September by Lockheed Martin and the U.S. Navy, off the coast of California.