Domain-Specific Incident Response for Cybersecurity Attacks Tailored to the Oil & Gas Industry for H2020-DS-2014-1 Topic DS-06-2014 Risk Mbt

Horizon 2020: The ultimate goal is to deliver a dynamic incident response (IR) capability tailored to the oil and gas (O&G) drilling industry. This IR capability will be dynamic, taking into account the totality of the environment including 1) the nature of the attack; 2) the status of the electronic systems (e.g. network, computers PLCs); 3) the status of the physical systems (e.g., the rig and subsystems); 4) cyber threat pattern(s); 5) the state of the drilling process; and the stakeholders in the dril ling operations. No similar commercial capability exists in the O&G industry. This has been validated by our work in the area of the drilling industry cybersecurity as well as extensive interaction with industry experts in Chevron, NOV, Marathon , RigNe t, and TransOcean have offered letters of support to commercialize the resulting technology. The energy industry is highly dependent on industrial control systems (ICS) and/or SCADA (supervisory control and data acquisition) equipment in running their a utomated systems. Before Stuxnet, ICS and SCADA systems were thought to be immune from successful cyber attacks because the complex and proprietary software code requires attackers to have extensive knowledge. These systems are isolated from corporate net works that provide more opportunistic targets for financial gains. These systems were designed and engineered without cybersecurity. Concomitant with the knowledge that ICS/SCADA systems are insecure came the realization of the possible dire consequence s from an attack. Successful cybersecurity attacks on the energy sector could result in 1) environmental consequences on the order of the Macondo oil spill, 2) ?freeze outs? due to disruption of pipeline delivery of natural gas, or 3) a crippled supply ch ain of gas production, refining, and distribution. The resulting technology is applicable across the entire ICS/SCADA domain including the nuclear power industry, water generation, and chemical processing plants.