Page 136: of Offshore Engineer Magazine (May/Jun 2015)

135 137

that offshore facilities are not much different cal infrastructure industries. “Traditional ICS than their onshore counterparts. They all pump, protection strategies are failing to keep up with process, and store flammable products. But the emergence of ICS targeted cyber threats. deeper examination reveals a more nuanced It is important that mission-critical assets like situation. Yes, offshore platforms are different; offshore platforms have the capability to monitor they remain isolated with limited communication remote and onboard network traffc for miscon- and with a wealth of threats packed into a very fgurations and suspicious events. small space. Offshore platforms have high pro- “Platforms often require remote diagnostics duction costs. Even a simple platform in shallow and troubleshooting with various network con- water cost US$50,000 per day to operate, while nections back to engineering expertise. Having a semisubmersible in deepwater can easily run the ability to monitor those connections and up to $400,000 or more per day. When production rapidly spot changes from expected baseline stops, those costs pile up fast. communications is an essential capability.

Platforms do not seem to be specifcally tar- Understanding the underlying control system’s geted by hackers, but that can change in a heart- behavior and interactions between devices is a beat. Cyber security defensive strategies apply, view that should be shared by operations staff although the ability for an operator to implement and industrial cyber security professionals,” them might be different when working offshore. Assante said.

“Challenges, such as hiring and maintaining

LIMITATIONS OF ISOLATION qualifed cyber security staff and being able to provide the necessary operations and engineer- It’s obvious to state, but offshore platforms are ing context, have stalled efforts to go beyond isolated. Anyone who needs to reach the platform static defenses like frewalls and network seg- has to have safety training and appropriate per- mentation,” said Michael Assante, leader of the sonal protection equipment, and taking people global cyber skills development program at the back and forth requires planning and scheduling.

SANS Institute for power, oil, gas and other criti- The ability to communicate is also limited given oedigital.com

OE | May 2015REVIEW 138 137_OE0515_REVIEW_Safety&Security.indd 138 4/20/15 10:35 PM