Even with the rising threats and a recent attack on US power and natural gas supplier, energy companies are spending less than 0.2% of their proceeds on cyber-security and this is third less than financial institutions. This data is collected by Precision Analytics and The CAP group and the security consultants that work within the industry.
Furthermore, Symantec claims to have been tracking at least 140 groups of hackers that are targeting the energy sector actively. Symantec is just one of the many security firms working with the industry.
Brian Walker, former head of Marathon Oil’s global IT, who is now an independent consultant says that, “It’s scary, executives making funding decisions “aren’t necessarily millennial’s who intuitively understand” how cyber threats reach seemingly disconnected units.”
Walker who states he’s in his early 50’s claims that, “It’s guys my age that are the problem, we’ve been 30 years trained in a world that doesn’t work this way anymore.”
Earlier this month, seven pipeline operators which included Energy Transfer Partners and TransCanada claimed that their third-party communication system were shut down, whereas five of these claim that the reason behind this shut down was hacking.
Even though this attack did not disrupt the supply it did disrupt the ongoing vulnerability to electronic sabotage. This attack showed how even a minor attack can obstruct the system with ripple effects and make it difficult for the analysts and traders to predict a key government report on gas stockpiles.
Walker advises that this “cyber blind spot is a real challenge.”
He further adds, “Our fear is that we will play an ostrich and put our head in the sand until something blows up and people get killed or until the lights go out for a month.”
This threat is not anything new, Bill Wright, the director of government affairs claim, “In 2012, Saudi Aramco production was locked down during the disk-wiping Shamoon incursion, and the company was hit again by the same group in November 2016.”
He further adds saying, “In the US, Symantec has been following another group, nicknamed Dragonfly, that’s been around since at least 2011.
Last year, the group became “a lot more aggressive” with the goal of soliciting information on how energy companies work and figuring out how to maintain stealth access on their systems.”
According to Wright, “The Federal Bureau of Investigation and the Department of Homeland Security issued a joint technical analysis about a month ago, tying Dragonfly to the Russian government and describing its ability to conduct sabotage.
The low levels of spending by the industry comes as it rushed to adapt new ways to produce more product at a lower cost amid a historic, three-year slump in oil prices. Based on the increased interest from the hacking groups in the industry unless the energy sector reviews its investment into cyber security this could potentially lead to an serious attack which they cannot deny they saw coming.
