How we designed the secure links between remote oil stations and a new central control centre.
Single engagement, 2017–2018. Details anonymised.
A major oil and gas producer in the Middle East was building a central control centre. The producer was part of a consortium with a European oil major. The centre would gather data, and some control, from remote production stations across its oil fields. The stations used DCS from several vendors, with PLCs and RTUs at cluster stations and wellheads. Each station had its own industrial DMZ (IDMZ).
The centre was part of the country’s critical national infrastructure. The operator needed to link every station to it without exposing live production control. Central operators could also take over control from local control rooms. So the design had to protect control paths as well as data. Safety and fire and gas systems stayed under local control.
The operator brought us in as cyber experts, through an engineering consultancy. We reviewed the control centre designs and designed the central IDMZ. At front-end design (FEED), we set the cyber risk method. We then took the work to basic design, with full cyber security specifications. The scope took in links to remote stations, central SCADA, the data analytics and planning system, remote access, historians, and backup and restore. We worked to the operator’s standards and IEC 62443. We also worked to national laws and regulations.
Linking many remote stations to one centre created new trust links, data paths and shared dependencies. As national infrastructure, the centre must not become a route for an attack to spread from one site to the rest. A weak link, or a flaw in the central IDMZ, could expose every station.
The remote stations ran control systems of different ages from several vendors. Each had its own protocols, gateways and support needs. The central design had to work with all of them without weakening each site’s IDMZ. Central control had to work without undermining local operators, safety systems or uptime.
Historians, central SCADA, the planning system, remote access, and backup and restore all had to cross security boundaries. Each needed its own controlled path. Then the operator’s standards, IEC 62443 and national laws had to become a real design. Suppliers had to be able to build it, and the operator to run it.
We began with planning meetings to agree the scope, the people involved and the timeline. We then reviewed the control centre designs, and the assets and links at the centre and at each station IDMZ. We worked with the operator’s operations and engineering teams to learn how the sites ran and who needed access.
Our risk method was based on IEC 62443. For each asset and entry point, it looks at threats, weak points, impact and current controls, using an industrial threat catalogue. It covers people, process and technology, including the boundary protections at the remote and central IDMZs. Most of all, it looks at how one breach could spread through the centre to other sites.
We designed the central IDMZ as a set of security zones and controlled conduits, not a single firewall. Historians, central SCADA, the planning system, remote access, and backup and restore each got their own controlled path. Design and risk were built together, so each risk led to a design need. At basic design, this became full cyber security specifications for the build.
We delivered the central IDMZ design and the cyber risk method. At basic design, we added full cyber security specifications. The design set the zones, conduits and a controlled path for every station link and shared service. Each design choice traced back to a risk.
We designed the security for linking remote oil stations to one control centre, and set the risk basis for it.
The work gave the operator a basis for deciding how stations should connect, what could cross each boundary and how access and shared services should be controlled. We used cyber-informed engineering, with design and risk in one scope. So the operator could weigh links, operations and cyber risk together. Supplier, testing and site needs were raised while the project was still in design.
