Smuggling of 5.2 million crushed Captagon pills thwarted at Al-Hadithah Port    Biden, Macron discuss efforts to enable stronger, more capable European defense    India, UK agree to enhance relations    Pfizer: COVID-19 vaccine 91% effective in children aged 5-11    International confrontations ignite WWE Crown Jewel fights in Riyadh Season 2021    High turnout at RUSH Festival    Friends pip Asfaan; Chinar, ICAD, Pak Zalmi prevail in Kanoo league    SGI forum in Riyadh signifies new era of action to tackle climate crisis    FATF puts Turkey on 'grey list'; Pakistan to remain on 'grey list'    Central Bank of Iraq, AGFUND to cooperate in financial inclusion, financial education, digitization    KAPSARC investigates ways to diversify non-oil exports to achieve Vision 2030    SFD CEO receives National Bank of Iraq chairman    17 foreign diplomats symbolize global interaction with Riyadh Season 2021    King, Crown Prince condole with US President over Colin Powell's death    'Be a Star' — WWE stars fight cyberbullying in Riyadh    Prop gun fired by actor Alec Baldwin kills cinematographer on movie set    Trend Micro blocked 48 million threats in KSA, reveals its Midyear round up report for H1 2021    Saudi National Team is among top 50 teams in world in FIFA ranking    Bollywood superstar's son denied bail in drugs case    General admission tickets on sale now for F1 STC Saudi Arabian Grand Prix 2021    Acclaimed Spanish female crime writer revealed to be three men    Saudis, expats mourn death of prominent Filipino preacher in Riyadh    Bollywood actor Sidharth Shukla dies at 40    Custodian of the Two Holy Mosques Directs KSrelief to Urgently Provide Malaysia with Medical, Preventive Equipment and Supplies to Address COVID-19 Pandemic    Weather Forecast for Sunday    Custodian of the Two Holy Mosques Congratulates President of Maldives on Independence Day    RSNF Commander Patronizes Ceremonial Launching of His Majesty's Ship "Jazan"    OIC Condemns Houthi Attempts to Target Civilians in Saudi Arabia    Philippines evacuates thousands as monsoon rains flood cities, provinces    Heavy rain in India triggers floods, landslides; at least 125 dead    U.S. Records 64,321 New Infections of Coronavirus    Without Fans, Tokyo Olympics Kicked Off    Pilgrims Perform Dhuhr and Asr Prayers at Arafat Holy Site    Dr. Mohammed Sulaiman Al-Jasser, Saudi Arabia's Pick to Chair IsDB Group for the next five years, unanimously approved by BoG Committee of Procedures    Saudi Press: Fitch affirms Saudi Credit Rating at "A" with a revised outlook to stable from negative    Handled Cargo at Saudi Ports Increases during June 2021    SDAIA, DARP & STC Launch Pilgrim's Smart Bracelet (NUSK)    Tabuk sculptor spends 8 years in carving entire Holy Qur'an on 30 marble slabs    2 Goals by Diaz Gives Colombia 3rd Place at Copa America    Saudi Cinema Night at Arab World Institute in Paris Kicks Off    KSU Leads Joint International Scientific Project for Early Detection of Breast Cancer    Saudi Arabia to Participate in Cannes Film Festival 2021    Arab Cup U-17 Championship Draw Saudi Arabia, Morocco, Palestine, Kuwait, in the 1st Group    AWI Hosts Saudi Cinema Nights in Paris    Brazil Beats Chile at Copa America Despite 2nd-Half Red Card    Council of Senior Scholars: Muslim Brothers' Group Don't Represent Method of Islam, rather only Follows its Partisan Objectives, Violating our Graceful Religion    Eid Al-Adha Prayer Performed at the Grand Holy Mosque    Pilgrims Perform Dhuhr and Asr Prayers in Arafat Holy Site    

Thank you for reporting!
This image will be automatically disabled when it gets reported by several people.

Cybersecurity must be top priority for oil & gas players in Middle East
Published in The Saudi Gazette on 11 - 07 - 2016

Today, concern about cybersecurity is particularly high within the oil and gas industry, which faces a far wider spectrum of threats – threats that are potentially more severe in comparison to other key industries. In the Middle East, specifically, the rate of cyberattacks targeting companies in the oil and gas sector is notably high, especially compared to global figures. In fact, according to Repository of Industrial Security Incidents (RISI) data, cyberattacks against oil and gas organizations in the Middle East make up more than half of the recorded instances. In parallel, in the US or other Western countries, they make up less than 30 percent of the recorded instances.
In recent years, there has been a growing prevalence of cyberattacks in the region. In 2014, Kaspersky Security Network revealed that, the previous year, more than 650,000 ransomware infection incidents had taken place across the Middle East and North Africa (MENA) region – including the oil and gas sector. A year later, in 2015, cybersecurity firm Symantec reported that Trojan Laziok, an aggressive malware program, had attempted to steal data from energy companies around the world, some based in the Middle East. Remarkably, 25 percent of the attempted cyberattacks targeted companies in the UAE versus 10 percent in both Saudi Arabia and Kuwait and 5 percent in both Oman and Qatar.
This, of course, raises three pivotal questions: Why are oil and gas companies in the Middle East more vulnerable to attacks? How can organizations that have fallen victim to cyberattacks ensure a quick recovery? And what can they do to fend off future attackers?
The reality is, in recent years, companies in the region have invested heavily in newer IT infrastructure and solutions – including multiple mobile devices connected to the oil and gas companies' networks. Given their widespread popularity and ability to store sensitive or confidential data, mobile devices are increasingly turning into an open frontier for cyberattacks. In the Middle East and Africa, the situation is especially dire considering the region's high mobile phone penetration rates. And this trend shows no sign of waning: independent market research company eMarketer predicts that over 789 million people in the Middle East and Africa will own at least one mobile phone in 2019 – and it is fair to assume that they will be bringing their device to work.
In this day and age, inadequate boundary protection is a strong point of vulnerability. It can make it difficult to detect nefarious activity and can create avenues that allow outside parties to interface with systems and devices that directly support a company's control processes. It can also provide an "easy" access route to industrial control systems – as most communication protocols for measuring and control devices are not as well encrypted as those for business communication systems.
Another critical point of vulnerability is information flow enforcement. If false data is fed into the system or information is siphoned off, most companies would likely never know that for a fact – it could even go completely undetected. There is wide speculation that the colossal malware attack on oil giant Saudi Aramco's systems in 2012 was actually a cover-up for earlier information flow breaches.
Insufficient control of information flows can allow attackers to establish unsanctioned and damaging commands and controls with potentially severe consequences for the physical infrastructure, the value of national assets and personal safety and health.
The potential points of attack are plenty. Transactions in the oil and gas arena are broad in scope and range from sensitive information on well sites to end-user consumption at the pumps.
The danger posed by large-scale threats is significant, given the physically expansive infrastructure of oil and gas production and distribution. For instance, the ramifications of a successful cyberattack on an oil and gas company in the Middle East could carry grave implications on national security. In most countries in the region, the oil and gas sector is the main source of income for the government and accounts for 60 to 70 percent of fiscal spending resources.
Governments in the region, including those of Saudi Arabia and Qatar, have crafted multi-phased national cyber security strategies and developed related policies and frameworks, focusing specific attention on critical infrastructure and national interests. For example, the Qatar National Cyber Security Strategy (NCSS) "was developed by the National Cyber Security Committee, presided by the Ministry of Information and Communications Technology, in light of the strategic thrusts of Qatar's National ICT Plan 2015 to protect the national critical information infrastructure and to provide a safe and secure online environment for the different sectors."
These various bodies and efforts notwithstanding, individual oil and gas companies in the Middle East need to take primary responsibility for their cybersecurity strategies themselves. The Boston Consulting Group (BCG) recommends a risk-based approach centered on three steps. These include:
Developing an understanding of the precise risk to the company's assets and the effort and resources necessary to mitigate them
Building and sustaining a multilayered defense system
Managing cybersecurity risk on a consistent basis
To conclude, the increasing technological complexity of today's oil and gas industry – driven by, for example, the industry's spiraling deployment of data mining and analytics technologies, sensor and networking technologies, industrial systems, and systems integration technologies – is rendering it increasingly vulnerable to cyberattacks. To protect themselves, their shareholders, and their customers adequately, oil and gas players in the Middle East must make cybersecurity a highest priority and an ongoing consideration at the executive level.
* The writer is Partner & Managing Director at Boston Consulting Group

Clic here to read the story from its source.