Upstream oil and gas OT security: remote access, visibility and centralization risks, with VOLTZITE cellular gateway compromises cited
Industrial Cyber interviews OT security executives from Dragos, OMV Petrom, Thales and an energy-sector former CISO on how upstream oil and gas operators secure dispersed, remote and often unmanned sites. The article cites the Dragos 2026 OT/ICS review: 29% of oil and gas cases showed poor IT/OT segmentation, the highest of any sector, and VOLTZITE compromised cellular gateways across U.S. oil and gas infrastructure before moving undetected into engineering workstations. Remote and third-party access is identified as the main weak point, followed by limited visibility and the concentration of risk in remote operations centers (ROCs). A Tosi survey of 100 U.S. upstream and midstream OT leaders found 87% were confident they could detect a breach within 24 hours, but only 16% attributed that confidence to continuous OT monitoring. The piece is expert commentary and best-practice guidance, not a report of a new incident.
Detalhes técnicos
- Link security: SCADA over satellite, cellular and radio links is exposed to command spoofing, false telemetry and session hijacking. Legacy RTUs and serial protocols (Modbus, older DNP3) lack native authentication, and key and certificate management across intermittently connected sites is hard.
- Third-party access: Persistent vendor VPNs, shared credentials, and shadow access such as vendor-installed 4G routers bypass corporate controls. Contractor offboarding is often not communicated to cybersecurity teams.
- Centralization: ROCs, jump hosts and remote access gateways become high-value targets, and one foothold could reach many wells or sites at once.
- Safety systems: The 2017 TRITON attack (XENOTIME) shows adversaries target safety instrumented systems (SIS). The 2021 Colonial Pipeline incident is cited as an example of attacks via remote access.
- Visibility: Asset inventories are poorly maintained. Experts recommend passive network discovery at aggregation points, supplemented by active queries and engineering records.
Remediação
- Build defensible architecture: industrial firewalls at outstations, and encrypted links (VPN, IPsec, SD-WAN, TLS, private APN) with certificate-based authentication.
- Secure remote access: MFA on every path, named accounts, a brokered jump host, and time-bound, approved and recorded sessions.
- Keep SIS independent from networked control, with shutdowns local and controller mode switches in run mode.
- Limit remote commands to safe, predefined actions and validate telemetry against baselines.
- Use passive OT monitoring with tiered asset inventories, and exercise ICS incident response for the loss of the ROC.
- Add physical tamper detection and keep local fallback modes at sites.
Linha do tempo
-
Upstream oil and gas OT security: remote access, visibility and centralization risks, with VOLTZITE cellular gateway compromises cited
ler a análise desta fonte ocultar
Industrial Cyber interviews OT security executives from Dragos, OMV Petrom, Thales and an energy-sector former CISO on how upstream oil and gas operators secure dispersed, remote and often unmanned sites. The article cites the Dragos 2026 OT/ICS review: 29% of oil and gas cases showed poor IT/OT segmentation, the highest of any sector, and VOLTZITE compromised cellular gateways across U.S. oil and gas infrastructure before moving undetected into engineering workstations. Remote and third-party access is identified as the main weak point, followed by limited visibility and the concentration of risk in remote operations centers (ROCs). A Tosi survey of 100 U.S. upstream and midstream OT leaders found 87% were confident they could detect a breach within 24 hours, but only 16% attributed that confidence to continuous OT monitoring. The piece is expert commentary and best-practice guidance, not a report of a new incident.
Technical Details
- Link security: SCADA over satellite, cellular and radio links is exposed to command spoofing, false telemetry and session hijacking. Legacy RTUs and serial protocols (Modbus, older DNP3) lack native authentication, and key and certificate management across intermittently connected sites is hard.
- Third-party access: Persistent vendor VPNs, shared credentials, and shadow access such as vendor-installed 4G routers bypass corporate controls. Contractor offboarding is often not communicated to cybersecurity teams.
- Centralization: ROCs, jump hosts and remote access gateways become high-value targets, and one foothold could reach many wells or sites at once.
- Safety systems: The 2017 TRITON attack (XENOTIME) shows adversaries target safety instrumented systems (SIS). The 2021 Colonial Pipeline incident is cited as an example of attacks via remote access.
- Visibility: Asset inventories are poorly maintained. Experts recommend passive network discovery at aggregation points, supplemented by active queries and engineering records.
Remediation
- Build defensible architecture: industrial firewalls at outstations, and encrypted links (VPN, IPsec, SD-WAN, TLS, private APN) with certificate-based authentication.
- Secure remote access: MFA on every path, named accounts, a brokered jump host, and time-bound, approved and recorded sessions.
- Keep SIS independent from networked control, with shutdowns local and controller mode switches in run mode.
- Limit remote commands to safe, predefined actions and validate telemetry against baselines.
- Use passive OT monitoring with tiered asset inventories, and exercise ICS incident response for the loss of the ROC.
- Add physical tamper detection and keep local fallback modes at sites.