Chemical Engineering June 2022 - 33

ture and preparing sensitive data for
exfiltration. In recent incidents, threat
actors have sold stolen data outright
to competitors. In other cases, the
threat actors use the data as leverage
for a ransom payment.
At the same time, the current regulatory
framework intended to support
the CPI against cyberthreats is
under question. Critics argue that
the Chemical Facility Anti-Terrorism
Standards (CFATS), the federal regulations
specific to the chemicals sector
(which have not been updated
since their adoption in 2007), do
not adequately reflect the current
risk landscape.
For example, there is nothing in
the CFATS addressing email phishing
campaigns. In fact, a 2020 audit
by the U.S. Government Accountability
Office (GAO) found that chemical
facilities are more vulnerable to
cyberattacks simply because they
are relying on the outdated regulatory
guidance [1]. A key issue identified
by the audit is the lack of an
actual process or structure to routinely
review the guidance and update
to
reflect
the
current
threat
landscape. Relatedly, a key component
of the CFATS program is thirdparty
inspection and oversight, but
the GAO similarly found that inspectors
did not have adequate cyber
expertise or training to properly
identify deficiencies.
Specific risk profiles for the CPI
The chemicals sector is an essential
part of the nation's infrastructure. As
a result, owners and operators are
a high priority for threat actors because
of the perceived leverage in
ransom demands due to high costs
of production disruption or theft of
sensitive data (Figure 2). Additionally,
these types of attacks receive higher
attention, which promotes the " Ransomware
as a Service " business
model that essentially sells malware
to other groups.
In addition, CPI enterprises are becoming
more automated, computerdependent
and interconnected. The
sector has traditionally been slow to
adopt new technological innovations,
but digitalization measures are becoming
more popular (for instance,
digital twins of physical production
FIGURE 2. Chemical companies can be attractive targets for cyberattacks because of the potential for
high-value ransom demands, including the threat of production disruption or sensitive data exposure
assets and smart supply chains).
Computer-based, automated ICS
are widely used by chemical companies
to manage and operate their
facilities. Most CPI companies have
internet-connected devices as part
of their process-control systems to
allow, among other things, instrument
manufacturers to service devices
remotely. These remote access
points are a popular way for threat
actors to gain access to a system.
An added risk is the mixture of old
and new equipment, which is common
in CPI facilities. However, these
technological modifications are often
made incrementally, and there is
not always a clear understanding
of how updates in one area may
affect other areas, which can lead
to vulnerabilities.
Finally, the COVID-19 pandemic
has created new cyber challenges
for the sector. With the shift towards
remote work and a distributed workforce
across home networks and
hot spots, company networks are
spread wider than they have ever
been, creating a host of vulnerabilities.
As a result, there has been a
correlative uptick in electronic messaging,
which has led to an increase
of phishing messages designed to
look like official communications to
persuade people to click on malicious
links or enter credentials. Additionally,
there are more platforms
to allow interaction between remote
experts and field personnel. And,
as noted previously, some essential
CHEMICAL ENGINEERING WWW.CHEMENGONLINE.COM
JUNE 2022
functions at the plant level, including
service engineering, are now
routinely done remotely through
applications that are at risk of
being compromised.
Despite these continued risks, organizations
are also being asked to
cut costs because of the economic
downturn that has resulted from the
pandemic. These cuts can have a
substantial
impact on operations,
often requiring companies to choose
between new initiatives to fund,
potentially thwarting investment in
preventative security.
Cyberattacks in the CPI
In 2017, one of the most well-known
attacks in the CPI occurred, when a
petrochemical facility in Saudi Arabia
was attacked. The safety control
systems that were in place to prevent
a cyber intrusion were thought to be
impenetrable. Fortunately, the attack
was detected early, and the threat
actor was unable to cause serious
damage. Nevertheless, the potential
for disaster was so great that the attack
has been dubbed " the world's
most murderous malware " because
experts believe the attack was designed
by a nation state actor (probably
Iran) to trigger an explosion at
the facility.
In 2019, three large chemical
manufacturers - Norsk Hydro, Momentive
and Hexion - were victims
of ransomware attacks [2, 3]. As a
result of the attacks, the Norwaybased
global aluminum producer,
33

http://WWW.CHEMENGONLINE.COM

Chemical Engineering June 2022

Table of Contents for the Digital Edition of Chemical Engineering June 2022