Cybersecurity for Upstream Operations

Credit: Getty Images.


Optimizing the design, function, and benefits of the logical cyber-representation of physical asset environments, whether for wells being drilled or produced, pipelines, or treatment facilities, is an evolving trend for the oil and gas industry to gain operational efficiency. The analysis described shows that operational efficiency and cybersecurity compromise is essential for business success when constructing the information and control models.

Cybersecuirty is crucial for every function within the oil and gas supply chain. It is important to pay attention to the data flow to protect the data and facilities, while developing capabilities to deal with intrusions. This is the essence of cybersecurity and operational leadership.

This article emphasizes the value gained by investing in cybersecurity for upstream operations—including drilling, workovers, and completions—whether the operations are capital-, technology-, or personnel-intensive, and remote and extended infrastructures must be included.

The most effective strategy for ensuring the cybersecurity of industrial control systems is the iterative process because threats are constantly changing and security has an experience curve.

Successful cybersecurity requires a careful consideration of various business aspects. And it depends on an integrated approach to addressing science and technology, economics and business, government and regulations, and society and social behavior. Importantly, security is never just about an information technology problem but is rather a core business issue.

Corporate cultures that have laid out clear responsibilities for employees at different levels have fewer security gaps because every employee is aware of his or her area of responsibility in managing risk. The risk matrix is a useful tool for assigning responsibilities. It will also boost the company’s defense base against hacks. Another key tool for integrated physical and cybersecurity systems is a safety-instrumented system (SIS).

Oil and gas companies with successful security are those that reach out across the community to address the likelihood of risks and to prioritize the exchange of knowledge.

Multiple engineering and research programs have addressed cybersecurity for downstream operations of the oil and gas industry. Other projects have discussed remote upstream operation information and logic models that have been implemented to digitize the upstream industry, moving it to a new level of automation, efficiency, and improved overall performance.

The perks of the transforming digitization include assurance, cross-organizational collaboration, leveraging of knowledge, and safer operations with minimal human presence on the wellsite as a result of remote control.

On the other hand, when adding intelligence, you add sensors, controls, and networks. This digital expansion creates vulnerability and more entry points—back doors—to exploit defects and weaknesses. One of the reasons for this proliferation of weaknesses is that no logical system can perfectly describe a physical system because there are too many pieces. For instance, it is difficult to represent people’s behavior or to model the interface between human and machine.

The value of the data and information that is gathered represents a security risk for upstream operations. In the fields of exploration and drilling, geophysicists, geologists, and petroleum engineers use big data to make valuable predictions and test underlying assumptions (sensitivity analysis) before making business-critical decisions. Geophysicists increasingly use large masses of data and rely on faster computing and processing technologies to build seismic maps and subsurface images.

Similarly, geologists use data to form theories about the downhole subsurface structure and how it was formed over millions of years. They survey the area looking for patterns or anomalies that would lead to a potential resource discovery.

During development drilling and completion activities, information security is useful for validating data to prevent human error and optimize environmental management, for example by preventing a well blowout by using accurate pore pressure data obtained through measurement-while-drilling systems. A gap in data may affect operational performance. On the other side, quality data availability helps in simulation, yields close estimates of downhole profiles, and aims to reduce operational risks.

Read the full story here.



Don't miss our latest HSE content, delivered to your inbox twice monthly. Sign up for the HSE Now newsletter.  If you are not logged in, you will receive a confirmation email that you will need to click on to confirm you want to receive the newsletter.





HSE Now is a source for news and technical information affecting the health, safety, security, environment, and social responsibility discipline of the upstream oil and gas industry.