A UK-based company offers a new approach to cybersecurity monitoring for oil and gas and other industries.
As the oil and gas industry pushes towards greater use of automation and digital technologies to enhance operational efficiency, productivity and safety, it must grapple with the cybersecurity threats that automation and digital technology present. With cyberthreats impacting energy operations, from upstream to energy trading, the traditional tools of perimeter monitoring make it challenging for oil and gas companies to gather and understand all of the information that lies in their digital shadows.
Digital Shadows’ technology goes beyond the perimeter, prowling through everything online, to find potential threats to oil and gas companies and their operations. These sources not only include the visibly-open Internet that everybody uses, but sources not indexed by Google such as LinkedIn and Facebook. Digital Shadows also monitors a subset of the Internet called the Deep Web, or Dark Web. This includes websites that that allow people to remain anonymous online, such as Tor and I2P. While much of this material is benign, forums and message boards where weapons, drugs, company data can be bought and sold are found here.
The idea for Digital Shadows came about five to six years ago, after CEO and co-founder Alastair Paterson started thinking about the growing digital footprints that people have in today’s world. These digital footprints are left by people’s online information, such as social media postings.
“I thought about how my niece and nephew, as they were growing up, would have all this information online about them,” Paterson said.
Paterson, who had worked for over a decade advising secure government and FTSE 100 clients on large-scale data and analytics for risk and intelligence, explained that every digital footprint has a shadow, which contains risks posed by online data. This can be information that accidentally got out, or was stolen and posted online for malicious reasons.
Through machine learning and natural language processing, Digital Shadows can pull data in 27 languages from millions of online sites in real-time, Paterson told Rigzone. The company, founded in 2011, works with companies not only in the oil and gas and utility sectors, but in manufacturing, automotive, banking, supermarkets, and fashion.
In the case of oil and gas, Digital Shadows monitors everything to do with a company’s assets and supply chain across the entire Internet. Its technology prowls through mentions of the company online in places where cyberattackers collaborate, trade intelligence and plan attacks, gathering data on the company. Digital Shadow’s analyst team then follows up on this data, culling out false positives, and the alerts a company about a possible threat. The company can follow up by logging into a portal. The company’s analysts come from diverse backgrounds, including law enforcement, military, academia and critical infrastructure.
“Lots of oil and gas companies are still trying to wrap their brains around it,” Paterson said of cybersecurity threats.
As oil and gas companies move towards using the cloud and mobile devices, they are at far more risk of critical data leaking out. As they face cybersecurity risks, they’re also contending with a shortage of cybersecurity professionals in the oil and gas sector. A short of cyber talent not only exists in oil and gas, but in every business sector across the board, Paterson noted.
Headquartered in London and San Francisco, the company is planning to more than double its workforce this year from 50 to 120 to meet the growing demand for its services.
Detecting and thwarting cyberattacks remains a priority among oil and gas industries in the coming years. A survey conducted in November 2015 for Tripwire Inc. – and published Jan. 14 – found that 82 percent of oil and gas industry respondents said their companies have seen an increase in successful cyberattacks over the past 12 months, and 53 percent of oil and gas survey respondents said the rate of cyberattacks has grown between 50 and 100 percent over the past month. Additionally, 69 percent of oil and gas respondents said they were “not confident” their organizations were able to detect all cyberattacks.
Oil and gas companies are looking to address cybersecurity issues; a November 2015 report by IDC estimates that that more than 90 percent of oil and gas companies will have a standard set of cybersecurity applications in operations within the next 16 months.
The oil and gas industry is a high-profile target for hacktivists such as OpGreenRights for the perceived wrongs that oil and gas activity have on the environment. These cyberattackers are typically trying to harass or embarrass the company and its executives, or to take down servers and steal information, such as employee phone numbers and email addresses, and post online.
Hacktivists are one of three main types of cyberattackers. Another group, criminals, are generally less of a threat to oil and gas and more of a threat to financial institutions, Paterson said. The third group, nation-states, pose a major threat to oil and gas companies. These countries typically are looking for a competitive edge by seeking more information on a company’s reserves or technology.
石油圈
