The potential impact of cyber attacks on utilities and the national grids has been frequently discussed. However, the oil and gas sector is also exposed to significant cyber threats. The rise of the “digital oilfield” has left oil and gas companies increasingly dependent on data to sustain production. As these technologies become widespread, the cyber risk for the oil and gas industry will continue to rise, demanding action and preparedness to protect against these threats.

Digital technologies have already been widely implemented across all segments of energy production, driving improved efficiency and increased production by harnessing the power of connectivity and data. The size of the worldwide digital oil field technology market increased from $18.7 billion in 2011 to $24.6 billion in 2014, for a compound annual growth rate of 9.6 percent between 2011 and 2014. By 2022, the market is expected to be $33.3 billion.

Control rooms, substations and devices used to manage oil and gas plants, refineries and pipelines are now all digital, utilizing video-enabled telepresence and high-speed data links. Upstream, digital technologies are used for reservoir modelling, drilling resource dispatching, computer-aided hydraulic fracturing, production optimization, reliability and preventive maintenance, and supply chain planning analytics.

Downstream, the shift to digital is being realized through supply-demand matching smart grids and new approaches to networking operational systems such as Supervisory Control and Data Acquisition (SCADA). Applications of digital technologies further downstream include trading activities, marketing and business insights.

These technologies are now so crucial to oil and gas operations that, according to the Journal of Petroleum Technology, a large offshore field could deliver more than 0.75 terabytes of data each week, while a large refinery will produce 1 terabyte of raw data per day.

As oil reserves become scarcer and companies scramble to stay ahead of their competitors the industry’s dependency on data will continue to increase.

By harnessing people, information and processes, digital technologies enable companies to achieve crucial efficiencies and cost savings. For example, by establishing links between operational technology and IT networks (such as linking SCADA operational technology to IT business and desktop applications), companies achieve benefits including remote monitoring and administration. Meanwhile, production data from the field can be matched with demand to maximise earnings.

According to IHS-CERA, digital oilfield-related implementation may result in up to 8 percent higher production rates, as well as up to 25 percent in operating cost savings and 2 to 4 percent lower project costs. This production boost will prove indispensable as oil reserves are depleted and companies find themselves turning to more complex and remote sources. The resulting increased demand for real-time data, distributed sensors, high-speed communications, and data-mining techniques will hasten the adoption and innovation of digital technology.

Given this significant and increasing reliance on data and interconnected systems, the oil and gas industry finds itself vulnerable to cyber attacks, whether conducted by hostile governments, militant groups or private citizens wishing to make political statements or mischief. Numerous such attacks against oil and gas companies have already taken place. Malware and phishing are two common types of cyber threats that have targeted digital oil.

• Malware: Malware includes viruses and other malicious software that targets IT data assets. In July 2014, the Energetic Bear virus was released by a Russian hacking group and targeted oil, gas, power, and energy investment companies. Prior to its discovery by a cyber security firm, the virus covertly enabled the hackers to monitor energy consumption in real time and disable physical systems.
• Phishing: Phishing is a form of social engineering that uses deception and manipulation to target data assets. Spear phishing uses emails that appear to be from a known individual to target employees and steal data. This technique was used in 2011 by Chinese hackers in a series of cyber attacks targeting oil and energy companies known as “Night Dragon.”

Other types of attacks include insider threats and denial of service attacks. By 2018, an ABI Research study predicts that cyber attacks against oil and gas infrastructure will drive $1.87 billion in cybersecurity spending by the oil and gas sector.

It is crucial that the oil and gas industry develops the necessary capabilities to defend against cyber risk. Taking cues from the utility industry, oil and gas companies should prioritize investment in cybersecurity measures. Furthermore, the industry must seek to implement wide-ranging information sharing and threat intelligence programs to maximize knowledge regarding advanced persistent threats and related solutions.

With necessary resources dedicated to effective risk management, the innovations of the digital oilfield will continue to bring the oil and gas industry into an era of increased efficiency and production, while managing the cyber risk associated with increased digital connectivity.