About 82% of the world’s oil and gas companies have been the target of cyber attacks over the past 12 months, an advisor on cyber affairs at the Passive Defense Organization of Iran said.
“About 50% of the attacks have successfully damaged the companies, 70% of which had problems in diagnosing the attacks,” Mohammad Reza Farajipour was also quoted as saying by Shana.
Passive defense refers to measures taken, without using any weapons, to reduce the probability of and minimize the effects of damage caused by hostile actions.
By contrast, active defense refers to direct confrontation with the enemy using military hardware to repel attacks and counter threats.
Farajipour, who was speaking on the issue in the National Iranian Oil Refining and Distribution Company on Monday, noted that managers of oil companies should be equipped with techniques and tactics of information technology management so as to secure the digital environment, reduce vulnerability and defend against serious attacks.
Proposing measures refineries can take to protect their equipment and infrastructure against cyber attacks, the official said, “Identification and valuation of capitals in the cyber field, diagnosis of vulnerable points of refineries, assessing consequences of cyber risks and defining methods to reduce those consequences, are measures managers should take.”
Farajipour referred to the growing dependence on information technology and generally web-based communications as the factor preparing the ground for hackers to threaten enterprises, especially in the oil and gas industry, adding that oil companies face serious cyber threats, which can paralyze refineries by disconnecting their utility units.
“A cyber attack can negatively affect huge oil and gas fields, pipelines, infrastructures and, as a result, commercial transactions of energy markets,” he said.
The advisor stressed that hackers in the sector aim to access financial data of industrial activists, information on the exploration of oil and gas fields and gain competitive advantages over rival companies.
“One way to reduce cyber risks is to separate systems dependent on information technology from those of operation technology,” Farajipour said.
"This means that if the information technology network of an oil company comes under an attack, hackers would have less time and chance to get access to industrial control systems."
Gholamreza Jalali, head of the organization, also called for technical and engineering considerations of passive defense in setting up infrastructures and upgrading current facilities in the oil refining and distribution industries.
