The downstream industry is undergoing a transformation as it adapts to take advantage of the increased efficiencies, high flexibility, and cutting-edge innovation that digitisation offers. However, with increased digitisation there is a potential increase in the opportunities for cyberattacks, yet many organisations are not taking the threat seriously enough.
A cybersecurity incident can halt processing functions within minutes and cost an organisation thousands of pounds to rectify. Also, the reputational damage of an IT security breach, especially if it involves customer data or a breach of environmental safety protocols, can be devastating. The severity of the damage and its consequences depend on how well prepared a business is to protect, detect, and defend against cyber threats. Digital security should therefore be built into every product, underlying business processes at every organisational level, including global energy supply chains.
Cybersecurity is crucial for protecting organisations and businesses, and to add to the complexity of that task, the cybersecurity threat landscape is constantly evolving. As advanced technologies such as IIoT become more integrated into refining operations, the overall attack surface expands, creating new opportunities for malicious actors. Weaknesses and vulnerabilities may exist within technology, procedures, and even field personnel. By creating effective, secure barriers against threats and attacks, companies can win the battle against cyber risks. However, one of the biggest challenges is often not knowing where to start.
Nearly every device in a modern downstream plant is connected, and are becoming increasingly so as technology advances. This means it becomes more open to a cyberattack. A breach in a refinery might allow hackers to access safety-critical systems. Also, despite extensive pre-release testing, software vulnerabilities are common. If patches and updates are not installed regularly, hackers can take advantage of backdoor access to applications, easily taking over and reprogramming distributed control systems (DCS).
In the downstream sector, risk particularly lies at the intersection of IT and OT. While IT governs business data, OT controls physical systems such as pumps, valves, and heaters. Traditionally, these systems were separated, but as more smart refineries come online, they are interconnected for real-time data analytics. This convergence means that a vulnerability in a corporate email system could potentially open up a pathway into the plant’s control network.
Businesses must bear the cost of cyberattacks that may include paying a ransom, data recovery expenses, forensic investigations, and compensation for affected customers. Business disruption will not only result in loss of productivity, it also erodes customer trust, resulting in a loss of credibility and negative publicity. In the case of a data breach, businesses may face legal consequences from authorities and customers for failing to take appropriate security measures.
Ransomware remains the biggest threat and costs the oil and gas industry millions each year. Ransomware attacks are caused by hackers who encrypt and bar businesses from accessing their own data, asking for a ransom to decrypt the data. Although devices can be reset, it is often a challenging process for highly specialised refinery systems, and the loss of data and settings can be problematic.
In the worst cases, businesses have been forced to shut down permanently. Any asset can be at risk, but vulnerable areas include specialised DCS, supervisory control and data acquisition (SCADA) networks, and potentially entire refining units or petrochemical complexes, where a breach can force a total emergency shutdown of processing operations.
In downstream processing, cybersecurity is inextricably linked to process safety management (PSM). This makes cybersecurity more than a data loss issue as it also represents a physical safety issue. For example, if an attacker manipulates pressure or temperature set-points, the result could be an explosion, fire, or toxic release. Systems must remain available to ensure the plant operates safely, with data integrity maintained so that operators make decisions based on accurate, untampered information.
Human factor
Cyber threats do not just come from outside sources, they can also arise internally, both intentionally and unintentionally. Such insider threats are risks caused by current and former employees, business associates, and potentially the supply chain. Phishing scams involve emails or messages sent by hackers, with links to fake websites deceiving authorised users to divulge personal and login credentials, or even download malware. While systems and users will mostly identify these emails as spam, a few will not which makes an organisation vulnerable.
However, emails can also be disguised as legitimate internal communications, such as an email that appears to come from the HR department with a request to download a file, or a message received from a colleague with a link to a website. Such messages may be security threats containing hidden spyware or malware. The intruders quietly move across the network, slowing down resources, modifying or deleting files, or even relaying data off site. But threats to data are not only confined to cyberattacks on a network. Loss or theft of unencrypted USB drives, unauthorised access to laptops or mobile devices when users are travelling, or sending an email containing data to the wrong person can all result in a damaging data breach.
The first line of defence against cyber threats is therefore a business’s employees. By increasing cybersecurity and risk awareness, employees become a human firewall. Comprehensive training for employees and other relevant stakeholders is key to avoiding and mitigating cyber risks. A company must have a robust employee cybersecurity training programme to ensure employees can recognise potential threats.
Beyond training, the creation of a cybersecurity culture within the organisation encourages an active and positive environment for employees to engage in cybersecurity. An example includes participating in industry consortia or public-private projects on cybersecurity.
Cybersecurity must be a top priority for management and trickle down to all parts of the organisation, irrespective of size and location. It is also vital to ensure end-to-end security of the global value chain, not only securing the management’s own organisation but flowing down security requirements to the entire supply chain, including second tier and third tier suppliers.
The importance of a comprehensive cybersecurity strategy
Businesses need a comprehensive cybersecurity strategy to maximise security by understanding the threat landscape and identifying risks and vulnerabilities. This strategy requires a combination of technical measures, human awareness, and strategic alignment. It is critical to understand the level of risk that a processing facility faces from a cyberattack and then ensure the appropriate protection is in place. Cybersecurity risk assessments are therefore essential and include testing for vulnerabilities, inspecting security controls, and identifying risk.
Vulnerability scanning helps an organisation identify unknown vulnerabilities in its IT and OT infrastructure and applications. This proactively detects weaknesses in systems to ensure that an organisation stays ahead of risks. As new vulnerabilities are exposed on a daily basis, a secured system/application today may be vulnerable tomorrow. Regular scanning, testing, and auditing are therefore vital to maintain cybersecurity resilience.
Certification for products, services, and industrial processes demonstrates that an organisation has a mature multi-layered cybersecurity approach that accounts for both corporate IT and OT. This includes foundational information security standards like ISO/IEC 27001, but also sector-specific frameworks such as IEC 62443 for Industrial Automation and Control Systems (IACS) and API Standard 1164 for pipeline control systems cybersecurity.
While marks such as CSA Cyber Essentials and Cyber Trust confirm a strong baseline of cyber hygiene across the business, the integration of NIST SP 800-82 guidelines ensures that the specific risks of OT are addressed, ensuring the organisation meets the security and safety requirements expected in hazardous downstream environments.
Having a robust cybersecurity management system (CSMS) plays a crucial role in identifying potential vulnerabilities and threats that a business may have. Each system should be individually assessed, with regular audits by a third-party being particularly recommended. These countermeasures help establish a strong baseline in cybersecurity and demonstrate to customers and partners that the organisation is well prepared to defend itself against cyberattacks.
Secure by design
The concept of security by design was developed to mitigate risks of cyberattack. This principle can be applied to many different types of system, including individual sensors or devices, integrated operational technologies, and industrial processes. This means that cybersecurity should be embedded within products and services from the design phase of any product, service, or underlying process.
As cyberattacks are becoming more sophisticated, targeted, and effective, companies cannot just rely on the basic level security tools delivered with IT infrastructure and software. Instead, a holistic and overarching approach is needed to ensure the highest levels of cybersecurity.
Building a resilient cybersecurity foundation in the downstream sector, where OT must be as secure as IT, helps a business get ahead of potential threats before they materialise. This requires a robust infrastructure capable of pre-empting threats before they impact process safety. Clear corporate policies are therefore necessary, alongside adherence to industry-specific standards like IEC 62443, recognised certifications, and ongoing staff training. Safeguarding sensitive information, proprietary refining assets, and critical systems means organisations can pursue a digital transformation journey with confidence. This positions them to fully capitalise on the opportunities that new technologies, such as Industry 4.0 and digital twins have to offer.
Written by Chris Whyborn, TÜV SÜD Business Assurance
