Critical infrastructure is consistently the subject of concern and administrative action when it comes to cybersecurity, with everything from an executive order from the president to the establishment of a threat information framework by NIST speaking to the magnitude of the issue.
As part of a voluntary effort, the oil and natural gas industry is launching the Oil and Natural Gas Information Sharing and Analysis Center (ONG-ISAC), dedicated to protecting critical energy infrastructure from computer-based attacks.
The ONG-ISAC will serve as a unified, central reservoir of cyber intelligence and a virtual pipeline that facilitates the secure sharing of vetted, actionable and timely cyber intelligence to members.
“Cyber-based attacks are one of the fastest-growing threats to America’s infrastructure,” said David Frazier, chairman of the ONG-ISAC, in a statement. “ONG-ISAC will help our industry to quickly identify and respond to threats against refineries, pipelines and other distribution systems that serve US consumers and businesses. It also will provide industry participants a secure way to share information and stay connected with law enforcement agencies.”
An industry-owned and operated organization, the ONG-ISAC will facilitate the exchange of information, evaluate risks, and provide up-to-date security guidance to US companies. Participants can submit incidents either anonymously or with attribution via a secure web portal; circulate information on threats and vulnerabilities among ONG-ISAC members, other ISACs, vendors and the US government; provide industry participants with access to cybersecurity experts; alert participants of cyber-threats deemed ‘urgent’ or ‘elevated’ in near real-time, within 60 minutes; coordinate industry-wide responses to computer-based attacks; and ensure compliance with all antitrust and federal disclosure guidelines.
The threat landscape is not to be underestimated, and it's growing. Based on data from the US Department of Homeland Security’s Industrial Control Systems Computer Emergency Response Team (ICS-CERT), there were 256 specific cyber-incidents related to critical infrastructure in 2013. Among them, 59%, or 151 incidents, occurred in the energy sector. In comparison, 41% of malware attacks reported in 2012 were made on the systems of energy companies, like grid operators and natural gas pipeline companies, representinng 198 incidents.
“The energy sector is a big part of the global economy and therefore has extremely high-stakes security risks compared to other industries,” said Stephen Coty, director of security research with Alert Logic, in a statement. “Daily survival of the population and businesses alike depend on the availability of energy resources, making energy companies a prime target for hackers.”