Oil industry forms cyberattack information hub

HOUSTON – A Hunt Oil executive and others are planning to select cybersecurity experts this year to staff a new group that will collect information and analyze cyberattacks on the oil and gas industry.

The American Petroleum Institute said Thursday it helped form the new Oil and Natural Gas Information Sharing and Analysis Center, a data hub that oil and gas companies will be able to use to learn more about cyberthreats to automated systems that run exploration-and-production operations, pipelines, refineries and other energy infrastructure.

Curt Craig, a Hunt Oil executive and a founding director of the cybersecurity group, said once the professional team is in place, analysts will send cybersecurity reports to member companies.

On its website, the group says energy-reported attacks made up 53 percent of the more than 200 incidents reported to the Department of Homeland Security’s industrial control systems emergency response team. Some oil companies already share information on cyberattacks, but some players say the industry desperately needs to open up more lines of communication.

“If everyone’s out there doing their own thing, everyone has to learn the same lessons time and time again,” said Craig, manager of business systems and information security for Dallas-based Hunt Oil, in an interview with FuelFix on Friday. “Sharing information and intelligence around cyberthreats is a much more efficient way to improve everyone’s maturity and capability, in a shorter period of time.”

The industry has kicked around the idea of a formal group for about 18 months, he said.  So far, 25 oil and gas companies have signed on as members.

The Oil and Natural Gas Information Sharing and Analysis Center hopes to be a formal gathering place for the industry to dig through accumulated knowledge about threats to control systems that link much of the nation’s energy infrastructure, as hackers send increasingly complex malware into energy-company computer systems.

It’s one of 17 individual Information Sharing and Analysis Centers, or ISACs, which collect information for defense-industry suppliers, the electricity sector, financial services firms, and other industries, according to the National Council of ISACs.

Craig said there’s plenty of common ground that upstream, midstream and downstream oil and gas sectors can learn from each other, as operations from petroleum refineries to offshore drilling platforms rely on automated systems that run day-to-day functions.

The group’s staff “will be small initially,” tailored to the needs of its member companies, he said. The group said it won’t track or report on incidents that may be experienced by its members, but does facilitate sharing of threat intelligence among the companies.