American Oil and Gas Reporter - February 2019 - 70

SpecialReport: Production Operations
demonstrate what a company is and is
not doing sufficiently well. For perceived
cost reasons, some companies elect to
handle these duties using in-house personnel who often have limited training
in risk assessment and problem solving,
or elect to use corporate-level experts
unfamiliar with individual facilities or
security practices, such as procedures for
handling USB or thumb drives in an operational environment.

incorporating new tactics and insights
gained from failures.
The first consideration is for operators
to focus on their business objectives,
connecting only what will help achieve
business objectives. Their plans should
start small and scale up to maintain the
right balance between connectivity and
security by properly partitioning networks into physical segments, and
adding additional security controls where
needed (Figure 1). Using virtual local
area networks (VLANs) for segmentation should not be considered secure,
since they are prone to VLAN-hopping,
which is a network attack vector commonly used to gain access to systems
on VLANs not in the route scope of
the originating VLAN.
Using VLANS also can enable a technique called pivoting on a system with
access to multiple VLANS to gain access
beyond intended authorization. This

Pragmatic Approach
Digital transformation is a multifaceted
process; some businesses undergo it gradually, incorporating new technologies as
they gain confidence in their reliability
and investment value. The key is to keep
pace with the threat's evolving nature,
adapt to changes, and remain flexible
from an organizational and technological
standpoint. This requires a pragmatic approach that emphasizes developing and
FIGURE 1

Network Segmentation of Business
And Industrial Control System Architectures
DMZ

IT

Enterprise
Security Zone
Enterprise
Network

Level 5

Site Business Planning
and Logistics Network

Level 4

DMZ
Manufacturing
Security Zone Site Manufacturing
Operations and
Control:

Control Center/
Processing LAN

Level 3

OT

Cell Security Zone

Area Control:

Local HMI LAN

Level 2

Basic Control:

Controller LAN

Level 1

Process:

Field I/O Devices
Instrument BUS

Level 0

Source: U.S. Department of Homeland Security's National Cybersecurity & Communications
Integration Center and Industrial Control Systems Cyber Emergency Response Team

70 THE AMERICAN OIL & GAS REPORTER

method can be used to steal credentials,
install malware or perform other malicious
activities. Upgrading network firewalls
from network layer three to network layer
seven protection vastly improves administrators' ability to manage traffic, control
access and limit or block command functions and privileged use.
Data security is always a critical issue
in digital workflows. Data availability
in a digital oil field operation is essential
to achieving performance improvements,
but its importance raises the problem of
how to structure an enterprise system to
ensure information is stored and distributed safely. Historically, a common approach is based on multilayered reference
architecture models for securing digitized
oil fields. While these models are evolving
to meet new technology and connection
methods, they are rooted in the Purdue
Reference Architecture, which is extrapolated in IEC 62443-3-3 Appendix A to
"zones" and "conduits" using a fivelevel approach. Modifications include
adding a sixth "external" level in the enterprise zone:
· Level 0: The physical process of
drilling, producing and operating fields;
· Level 1: Intelligent devices such
as wireless sensors, analyzers, actuators
and related instrumentation;
· Level 2: Control systems such as
human-machine interfaces, and supervisory and data acquisition software;
· Level 3: Operational systems, including reservoir modeling, predictive
diagnostics, data historians and related
middleware;
· Level 4: Business logistics systems
to manage the business-related activities
of the operation; and
· Level 5: External, including private,
public and hybrid cloud or hosted services
and infrastructure.
By configuring security zones and
conduits based on this reference architecture as specified in the IEC 62443
standard, upstream operations can provide
a sound, supportable level of secure architecture that supports their operations
American Oil and Gas Reporter - February 2019

Table of Contents for the Digital Edition of American Oil and Gas Reporter - February 2019
