OIL & GAS
Protecting the assets
that keep energy moving.
Industrial safety and cybersecurity across the hydrocarbon value chain.
One value chain. Connected responsibilities.
From exploration to delivery, each stage brings its own operating context.
Upstream
Exploration & production
Midstream
Transport & storage
Downstream
Processing & distribution
Marketing & delivery to customers
Commercial activities connect producers and processors with end users through wholesale and retail distribution. Products include fuels, lubricants and petrochemical materials. Marketing and distribution are generally associated with the downstream segment.
Explore the processes in more detail
Upstream
Exploration identifies potential oil and natural gas deposits. Production includes drilling and operating wells that bring hydrocarbons to the surface, onshore and offshore.
Midstream
Pipelines, pumping stations, storage terminals, ships and rail systems connect production with processing and distribution facilities.
Downstream
Refining and gas processing convert hydrocarbons into usable products. These activities connect with distribution and marketing to industrial and consumer markets.
Protection starts with operational priorities.
Connect industrial risk decisions with the consequences that matter.
People
Keep people safe and operations secure.
Environment
Prevent and mitigate environmental harm.
Physical assets
Protect critical infrastructure and equipment.
Operational continuity
Support safe, reliable and resilient operations.
Critical infrastructure & compliance
Facilities may have critical-infrastructure significance depending on their role and the consequences of disruption. Determine applicable obligations and assessment criteria for each site, jurisdiction and activity.
Coordinate cybersecurity and process-safety responsibilities across owners, operators and suppliers. Relevant standards and guidance may include ISA/IEC 62443, NIST SP 800-82, IEC 61511, API and NFPA publications, according to the application.
Control systems & legacy equipment
Industrial control systems combine controllers, instrumentation, networks and operational procedures. Older equipment may have limited built-in security capabilities or restricted maintenance windows.
Select safeguards with the process, reliability constraints and safety functions in mind. Coordinate changes with engineering and operations so that a security measure does not introduce unacceptable operational risk.
Understand the sources of risk.
Expand each topic to explore its operational context.
Ransomware & social engineering
Compromised credentials or unavailable systems can affect industrial operations. Evaluate access routes, dependencies and recovery needs in the context of the process.
Legacy systems & connected devices
Unsupported platforms, patch constraints and connected field devices can introduce weaknesses. Understand the assets, communications and operating constraints before selecting controls.
Third-party access & insider threats
Supplier connections, software changes and privileged users can introduce intentional or accidental risk. Define access responsibilities and review how external dependencies affect operations.
Remote access & service disruption
Remote connections and denial-of-service events can affect system access or availability. Evaluate essential communications, access controls and options for safe operation during disruption.
A practical approach to protection.
Build decisions around industrial context and risk.
Assess priorities
Understand your operational context and key risks.
Define safeguards
Select proportionate technical and operational measures.
Verify performance
Test and validate that safeguards meet their objectives.
Sustain protection
Review changes and maintain protection as operations evolve.
Explore mitigation measures
- Organize cybersecurity responsibilities and activities across the lifecycle.
- Use risk assessment to guide segmentation, access controls and safeguards.
- Plan monitoring and response around actionable industrial events.
- Coordinate supplier access, changes, patching and recovery procedures.
- Train personnel and exercise response plans within operational constraints.
- Review evidence, test safeguards and manage changes over time.
Risk assessment • Access control • Monitoring • Response
Bring the next step into focus.
Explore lifecycle services or develop your team’s capabilities.
Discuss your requirementsNews from de market
Explosion at diesel processing facility injures worker in mexico facility
Chemical plant fire in Spain sends several towns into lockdown
The Flixborough disaster
Fire on Petrobras offshore platform seriously injures 14
Svilosa Chemical plant fire injures three employees
Pemex refinery blaze injures four
A factory fire in Hull, UK, involved 300 tonnes of plastic
Fire injures “a number of people” at Kuwait’s largest oil refinery
UK gas processing terminal shut down after methane leak
First interim report into July chemical explosion that killed seven in Leverkusen reveals likely cause
US CSB releases safety video on fatal 2019 hydrogen sulphide release
US refinery reaches $1 million settlement, admits no wrongdoing in 2018 explosion that injured 36
Russian chemical plant fire kills seven
US chemical plant leak kills two, injures 30
2 dead, 30 hospitalized after ‘mass casualties’ incident at LyondellBasell chemical plant near La Porte
Chemical park explosion kills two person in Germany, five people still missing and 31 injured
Pipeline Pumping Station Explosion Kills Three in Iran
Chemical factory explosion kills one and leaves 39 injured in Thailand
‘Eye of Fire’ in Gulf of Mexico Caused by Thunderstorm, Says PEMEX
The explosion of a chemical plant causes major fires and mass evacuations in the US.
Oil company fined £400,000 for North Sea platform gas leak
Massive fire at chemical plant in Rockton, Illinois, could burn for days
Deadly explosion reported at Romania’s largest oil refinery
Cyberattack forces closure of major U.S. pipeline
Manage, evaluate, and deploy ISA/IEC-62443 like an expert
ARPEL and WisePlant sign cooperation agreement to promote the strengthening of cybersecurity in the energy sector in Latin America and the Caribbean
