August/September 2014

COMMUNITIES: INDUSTRY
Oil and Natural Gas Industry Forms Cybersecurity Organization

With the threat of cyberattacks increasing, members of the oil and natural gas industry, including the American Petroleum Institute, announced the formation of a cybersecurity organization in June.

Functioning as an industry owned and operated organization, the new Oil and Natural Gas Information Sharing and Analysis Center (ONG-ISAC) will be dedicated to facilitating information exchange, evaluating risks, and providing security guidance for US companies. Participants will be able to submit information on cybersecurity incidents both anonymously or with attribution via a secure web portal.

The organization will also circulate information on threats and vulnerabilities among ONG-ISAC members, other ISACs, vendors, and the US government; provide industry participants with access to cybersecurity experts; alert participants of cyberthreats deemed urgent in near real-time; and coordinate industry-wide responses to computer-based attacks.

“Computer-based attacks are one of the fastest-growing threats to American businesses and infrastructure,” says API Vice President Kyle Isakower. “The center builds on existing programs to help companies quickly identify and respond to threats against energy production and distribution systems such as refineries and pipelines and stay connected with law enforcement agencies.”

ONG-ISAC is the result of more than two years of work by the API Information Technology Security Subcommittee. “We struggled for a while figuring out how to be able to share information without there being attribution,” says Curt Craig, a Hunt Oil executive and ONG-ISAC founding director. The cybersecurity strategy that the group settled on, he adds, is patterned after the one used by the financial services industry.

Once the subcommittee had settled on a method for information sharing, API provided seed money to launch ONG-ISAC, and the organization is now enrolling members. Thus far, more than 30 companies have pledged to become members, and basic services are expected to begin for members by October.

Despite early recruitment success, getting members to share information that can help protect the industry from cyberthreats is another matter entirely, but Craig is confident the ISAC model will make it easier for competing companies to work together. One week a company might spend its own time and resources defending against an attack and anonymously sharing how it did so with its competitors, he says, but the next week it might be the one saving time and resources because another ONG-ISAC member was the first hit by a particular attack and shared its information anonymously as well.

NSPE member Joseph Weiss, P.E., author of Protecting Industrial Control Systems from Electronic Threats and managing partner of Applied Control Solutions, an industrial control systems security consulting firm, is less optimistic about the new organization’s chances for success.

“I don’t believe, and I could be wrong, that it’s going to be any more successful than where we already are,” he says. “The problem, as much as anything, is engineers are willing to share the information, but the IT people won’t, and that’s across every industry.”

Weiss also disputes the idea that ISACs have been successful in other critical infrastructure sectors.

“They’re not successful,” he says. “People will share general practices, [but] the real issue is will they share incidents. That’s where you see very, very, very little. So information sharing isn’t the issue. The issue is what information is being shared.”