The Cloud Offers Opportunity for Oil and Gas Cybersecurity
Authors: Carpenter Chris 
Published: July 2019

This article, written by JPT Technology Editor Chris Carpenter, contains highlights of paper SPE 191563, “Cyber Security, the Cloud, and Oil and Gas,” by Peter Black, SPE, EnergySys, prepared for the 2018 SPE Annual Technical Conference and Exhibition, Dallas, 24–26 September. The paper has not been peer reviewed.

The rapid acceleration in the adoption of cloud services has increased the focus on cybersecurity. While data protection and privacy have always been key concerns in the oil and gas industry, they frequently have been achieved by isolating networks and strengthening perimeter defenses. However, this approach has allowed poor practices in many areas. The author argues that the advent of cloud technology should not be regarded as a further challenge to security, but an opportunity to revitalize and improve a•company’s defenses dramatically.

Introduction

Computer security involves a web of trust between operating systems, hypervisors, applications, networks, employees, contractors, and administrators (Fig. 1). This system must guard against intentional and unintentional breaches and attacks by malicious actors who might be individuals, corporations, or even governments. The directionality of this trust relationship is complex: for example, an application must establish a user’s identity to determine what level of trust to apply to their actions; a user must trust that an application will not distribute entered information illicitly.

Traditional models for network protection typically have focused on perimeter security. This focus frequently has allowed multiple attack vectors to be ignored or left unaddressed. Companies often maintain robust firewall policies alongside poor password-management practices. In addition, many commercial software packages for the industry have implemented their own authentication systems, making a multiplicity of different user identifiers and passwords•unavoidable.•

Defining the Cloud

The cloud is not, in and of itself, about technology. Fundamentally, it is about a different approach to the consumption of computing services, one in which services are provided on a utility basis. A 2011 paper authored by members of the US•National Institute of Standards and Technology (NIST) provided one of the most commonly cited definitions of cloud computing. Their five essential characteristics of the cloud are not about technology, but about the nature of the•service.•

On-demand self-service. This means that consumers (or end users) can provision computing capabilities, such as servers and storage and application features, without needing to contact a service provider.

Broad network access. This characteristic implies that the access to services is through standard mechanisms and does not require specialist or proprietary technology.

Resource pooling. Resources such as computing power or network storage are shared among multiple users or tenants.

Measured service. Use of computing resources is measured and controlled to benefit the provider and the consumer.

Rapid elasticity. The resources provisioned by a user, in a self-service model, can be scaled up or down to meet demand in an apparently unlimited fashion.