No abstract

Process control systems that control the operation of industries are at risk because they were not designed with widespread connectivity in mind. Some lack even basic information security measures. These control systems are not only critical to specific industries but also to a nation's infrastructure because they control operations such as refineries, pipelines, manufacturing, power utilities, and water plants. This study illustrates control system cyber security risks and shows how an industry can work together with government, control system vendors, and security technology vendors to address common challenges. Linking Oil and Gas Industry to Improve Cyber security ( LOGIIC ) is a partnership of the Oil and Gas ( O&G ) Industry with the US Department of Homeland Security ( DHS ). In a collaborative effort, participants from private industry, the government, vendors, and the research community all joined together to reach a common solution to cyber security issues in control system. ISA Security Compliance Institute ( ISCI ), a leading, global, nonprofit organization, is another industry partnership that plans to provide baseline security certifications and is helping to provide security compliance “out of the box”. LOGIIC and ISA will be referenced in many of the examples included in this article.

In this paper, the focus is on the changes happening in the oil industry and the evolution of new tools and technologies transferred from other fields aiming to make the industry, more efficient and more acceptable to the consumer base. The discussion about the changing trends in petroleum engineering education is primarily focused on the U. S. producers. But some of the observations may equally apply to other national oil producers. Currently and for the foreseeable future, oil and gas will continue to be the world's primary energy feedstock. This means that petroleum assets are as critical as they have been during the last century to meet the energy demands globally. If the industry continues its mission in providing oil and natural gas resources to the world communities, it will need the services of appropriately skilled professionals. Oil industry hires many technical professionals. At the core, however, there are unique petroleum engineering concepts and domain knowledge that defines the industry and its technology base. It probably fits better in describing the sciences and techniques as a broader base of subsurface engineering1 rather than energy engineering. This particular domain expertise can be gained in depth via formal university degrees or summarily through continuing education courses and augmented with on the job training. The oil industry is changing, and parallel to that, are the expanded core competencies needed to take new directions. Some major emphasis areas affecting the shape of petroleum engineering education include technology transfer from the fields of information sciences, medical imaging, and human factor engineering. These all influence the core educational preparation of the petroleum engineering professionals. We discuss the history of PTE (petroleum engineering) education and the evolution of the industry and its manpower needs. As an example, we consider the petroleum engineering program at USC and review how, in response to the changing trends in the oil and gas operations, engagement with the industry has been helpful in opening new directions and changes in the academic educational content offered to the graduates. Utilizing case studies and experiences from the USC program, we illustrate the larger trends which have wider application to the industry and to changing the shape of university petroleum education programs.

This paper presents a cybersecurity risk assessment guide for mergers and acquisitions (M&A) in the oil and gas industry. The mechanisms used for assessing cyber risk are technology neutral and developed around an organization's security culture, information systems, and operating infrastructure as they apply to the M&A process. Assessing a security infrastructure includes any connections between information technology and operational technology systems. Security considerations relating to the integration of acquired operating and information system assets are also factored into the approach. For mergers, we present six open-ended questions that are linked to specific cybersecurity functions and corresponding domains. Each domain includes industry best practices for acquirers to understand the relative maturity of a target company's cybersecurity program. Asset acquisitions require a less-comprehensive approach that focuses on four relevant areas of risk. The assessment presented in this paper can be used by companies operating across the oil and gas supply chain.