3rd Party and Supply Chain Risk in Oil & Gas
DOI:
https://doi.org/10.63282/3050-9246.IJETCSIT-V3I4P118Keywords:
Supply Chain Risk, Oil and Gas, Third-Party Risk, SBOM, ICS, Vendor Management, Critical InfrastructureAbstract
The oil and gas business relies on a long supply chain. Hardware and software that run the automation and digital capabilities are sourced from several hundred vendors and integrators. This runs the whole gamut from the control systems that run pipelines (SCADA) and refineries (DCS), the machinery that drives drilling (rig automation), that spins pipelines and other equipment (turbomachinery), that measures the quantities of gas or liquid in midstream storage, on to the software-based platforms that perform analytics in the cloud based on all that data. Since 2020, numerous supply chain security breaches-SolarWinds, Kaseya, Log4Shell and credential abuse patterns-have demonstrated that these external relationships are an attack vector. Why is oil and gas different from some other critical infrastructure? How have prominent cyber events stressed this industry and what guidance has arisen as a result? We provide a way forward by presenting a framework for a vendor risk program designed to cover five stages: identification of third-party relationships, tiering the suppliers by risk level, defining contract requirements with those vendors, onboard vetting procedures and ongoing monitoring of vendor activities. The content below deliberately generalizes to help oil and gas organizations apply the recommended vendor risk processes to any specific ecosystem of vendors and integrators they may have.
References
[1] U.S. Cybersecurity and Infrastructure Security Agency, “Advanced Persistent Threat Compromise of Government Agencies, Critical Infrastructure, and Private Sector Organizations,” Alert AA20-352A, December 2020.
[2] U.S. Cybersecurity and Infrastructure Security Agency and Federal Bureau of Investigation, “Kaseya VSA Supply-Chain Ransomware Attack,” Alert AA21-209A, July 2021.
[3] U.S. Cybersecurity and Infrastructure Security Agency, “Apache Log4j Vulnerability Guidance,” Alert AA21-356A, December 2021.
[4] J. Boyens, A. Smith, N. Bartol, K. Winkler, A. Holbrook, and M. Fallon, “Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations,” NIST Special Publication 800-161 Revision 1, May 2022.
[5] European Union Agency for Cybersecurity (ENISA), “Threat Landscape for Supply Chain Attacks,” July 2021.
[6] U.S. Cybersecurity and Infrastructure Security Agency, “Defending Against Software Supply Chain Attacks,” guidance document, April 2021.
[7] U.S. Cybersecurity and Infrastructure Security Agency and Federal Bureau of Investigation, “DarkSide Ransomware: Best Practices for Preventing Business Disruption from Ransomware Attacks,” Joint Advisory AA21-131A, May 2021.
[8] U.S. Cybersecurity and Infrastructure Security Agency, Department of Energy, Federal Bureau of Investigation, and National Security Agency, “APT Cyber Tools Targeting ICS/SCADA Devices,” Joint Advisory AA22-103A, April 13, 2022.
[9] M. Souppaya, K. Scarfone, and D. Dodson, “Secure Software Development Framework (SSDF) Version 1.1,” NIST Special Publication 800-218, February 2022.
[10] The White House, “Executive Order 14028: Improving the Nation’s Cybersecurity,” May 12, 2021.
[11] International Electrotechnical Commission, “IEC 62443-2-4: Security Program Requirements for IACS Service Providers,” 2015 with amendments.
[12] American Petroleum Institute, “API Standard 1164: Pipeline Control Systems Cybersecurity,” third edition, 2021.
[13] U.S. Department of Homeland Security, Transportation Security Administration, “Security Directive Pipeline-2021-01 and Pipeline-2021-02 (revised),” 2021–2022.
[14] Verizon, “2022 Data Breach Investigations Report,” May 2022.
[15] National Telecommunications and Information Administration, “The Minimum Elements for a Software Bill of Materials (SBOM),” July 2021.
[16] National Institute of Standards and Technology, “Framework for Improving Critical Infrastructure Cybersecurity,” Version 1.1, April 2018.
