Page 142: of Offshore Engineer Magazine (May/Jun 2015)

141 143

Gregory Hale highlights

Security seeks parallel the importance of both safety and following proper existence with safety security protocols.

afety, physical security, cyber security: Trends • Control risk factors every day, which involves

S in the offshore environment show a similar controlling the original design by maintaining the pattern in terms of how each end up applied, established layers of protection and managing except all are at different levels of application. changes to the design using integrated manage-

For safety, just look at the Pemex dehydration ment systems and pumping platform in the Gulf of Mexico that • Analyze actual problems and determine weak- sustained an explosion and fre in early April. nesses in the system, which involves identifying

While investigators are still searching for the weaknesses in design and management systems cause of the blast that killed four workers, left and weaknesses in risk understanding through three missing and 45 injured, the end result could root cause analysis of actual problems (losses have been much worse. and near-losses)

Within a week after the fire, Pemex said it

CYBER VIEW expected to restore 80% of production within a week or two after that, according to exploration When a user violates safety procedures on the

The April Pemex and production director Gustavo Hernandez. platform, he or she clearly hears about it, but blast on a dehydra- Estimated production of 646,000 b/d of crude what about any breaks in security protocols?

tion and pumping and 1.4 Bcf/d of gas in the region will not suffer Awareness about cyber security is growing, platform in the from the blast and resulting freball that hit the there is no doubt. But awareness and action are

Gulf of Mexico processing platform, he said. two different things. These days, it would be safe showed that inci-

One of the reasons the blast was not more severe to say security is much like safety was 10-20 years dents will happen was because workers could turn off the feeder ago. Security wags, however, want to acceler- in a dangerous lines. Safety planning and preparation paid off. ate that understanding to get the same level as environment. There

When it comes to safety, to contain a complex safety, but that only comes with training and top were at least four process, a manufacturer must understand the management understanding the threat situation fatalities in the standards and design and implement manage- and being willing to pay.

incident and three ment systems to: Let’s face it, the attack environment has workers missing, • Understand the risk, which involves predict- changed and is more sophisticated than it was but it could have ing problems, including predicting the risk of even two years ago. An intruder’s goal is to steal been worse. Photos possible accident/loss scenarios, establish the intellectual property, pilfer key data and/or dis- from Pemex’s Flickr appropriate design and the right layers of protec- rupt production.

page. tion to control risk to a tolerable level Security, like safety, all boils down to four key factors: • Prevention • Preparation • Response • Recover

That all works and is a good baseline, but it also goes be- yond just having technology and data points.

Technology will not fx a prob- lem unless the right processes and the right best practices are in place. Technology will help enable people to make the right decision. But the security culture has to be on a par with the safety culture to protect against a cyber attack. Even with multiple technology protec- tive layers, users need to enforce oedigital.com

OE | May 2015REVIEW 144 146_OE0515_REVIEW_Gregs column.indd 144 4/20/15 10:28 PM