Hydrocarbon Processing - December 2022 - 12

Executive Q&A
and securing the rest with multi-factor
authentication, network segregation and
authorization on a strict need-to-know
basis. Detecting and protecting all remote
connections requires both IT and
OT staff to collaborate.
Second, while solutions entering the
market are offering spectacular features
for monitoring and managing OT environments,
few provide any cybersecurity.
Even worse, some of these technologies
introduce new vulnerabilities when connected
to already fragile OT environments.
Cybersecurity experts should
evaluate any new tool to effectively manage
risks and determine capabilities.
Third, OT systems are fragile when
INSIDE
INTELLIGENCE
for the Downstream
Industry
SUBSCRIBE
TODAY
HydrocarbonProcessing.com
/Subscribe
it comes to cybersecurity and the patching
of vulnerabilities. These systems may
be many decades old and have limited or
no ability to receive patches or updates.
With each passing day, these kinds of
systems become increasingly vulnerable.
Organizations need a comprehensive cybersecurity
strategy to manage legacy devices,
update device configurations and
regularly apply patches (to the devices
that support patching). Further, organizations
should implement an additional
layer of protection for legacy devices that
are critical to their operations.
Finally, OT environments often rely
heavily on physical security controls,
which are insufficient. Traditionally, OT
systems may tolerate reuse and sharing
of credentials, which creates risks. These
credentials can be compromised externally
and could compromise OT and IT
operations. Therefore, having a comprehensive
OT cybersecurity awareness program
is important.
HP: What role does the supply
chain play in securing OT
environments?
FS: In the oil and gas industry, multiple
vendors, contractors and asset owners
are involved in projects. To ensure effective
cybersecurity, it is important to have
a clear understanding of the cyber risks,
roles and responsibilities for each stakeholder.
The supply chain management
(SCM) team plays a critical role when
procuring new equipment, services and
vendors, and should be an integral part
of cybersecurity processes. By involving
cybersecurity experts to help manage
risks when new solutions are considered,
the supply chain management team can
12 DECEMBER 2022
help protect organizations from increasing
cyber risks unknowingly.
HP: What standards could
support the efforts of securing
OT environments?
FS: Cybersecurity must be embedded
within all processes and procedures
throughout the lifecycle of any project
implementation-from early concept
studies to the decommissioning of equipment.
Yet, there is no dedicated standard
for the HPI.
That said, the International Society of
Automation (ISA)/International Electrotechnical
Commission (IEC) 62443 series
of standards can be utilized effectively
within processing industries in general
and hydrocarbon processing specifically.
The standards describe cybersecurity requirements.
By using recommended practices
tailored to the HPI, the following
standards can be effectively applied:
* ISA/IEC 62443 Part 2-1 can be
used to establish a security program
and define requirements for how
security needs to be considered.
* Organizations can use ISA/
IEC 62443 Part 2-3 for patch
management in OT environments.
* Applying ISA/IEC 62443 P
art 2-4 can help establish
security program requirements
for service providers.
* Technical requirements can be
established with ISA/IEC 62443
Part 3-3 to help secure systems.
* Importantly, vendors could be
required to show compliance to
standards like ISA/IEC 62443
Part 4-1, demonstrating their
cybersecurity capabilities.
* Likewise, ISA/IEC 62443
Part 4-2 could be leveraged to
ensure devices with appropriate
cybersecurity capabilities are
procured and deployed into
environments.
Cybersecurity is a global threat. Creating
trusted connected environments
is critical. Mitigating cybersecurity risks
requires an all-encompassing strategy
involving people, processes and technology.
Because cyber risks can creep into
critical OT environments through vendor-supplied
devices, systems, software
and services, addressing supply chain
risks is imperative for downstream refining
and petrochemical industries.
HPI
MARKET
DATA
2022
HydrocarbonProcessing.com
http://www.HydrocarbonProcessing.com/subscribe http://www.HydrocarbonProcessing.com
Hydrocarbon Processing - December 2022

Table of Contents for the Digital Edition of Hydrocarbon Processing - December 2022
