tai 188bet Coso Erm and cyber risks in oil and gas industry

Summary

tai 188bet business world is changing rapidly, new risks continue to emerge at a faster pace than has been seen in tai 188bet past while existing risks are also evolved. To compactandbringmorevalueindealingwithrisks, tai 188bet Committeeof Sponsoring Organisations of tai 188bet Treadway Commission (COSO) has updated its most widely recognised risk management frameworks - COSO ERM 2004. tai 188bet newly introduced framework, COSO Enterprise Risk Management - Integrating with Strategy and Performance (COSO - ERM 2017), aims to provide companies with a more robust approach to managing risks, which helps to create, preserve and realise value of tai 188bet companies.

Oil and gas is one of tai 188bet highest risk and capital-intensive industries facing many uncertainties around exploration, extraction, distribution, volatile commodity prices and tai 188bet perplexing political landscape. Therefore, a discipline and systematic approach for risk managementisneededforoilandgascompaniestoidentify, assess, manageandmonitorrisks, and COSOERMprovidesariskmanagement framework to do so. Oil and gas companies are also in tai 188bet forefront to adopt many technologies such as robotics, digitisation, and tai 188bet Internet of Things (IoT) intotheoperationalenvironment. Asaresult, cyber risk becomesincreasinglyimportantforoilandgascompanies to respond to.

Key words: Enterprise risk management, cyber risk.

1. COSO ERM 2017

Enterprise risk management (ERM) has attracted much attention in tai 188bet last several years, particularly following tai 188bet great global financial crisis. In today’s uncertain world of complex and interrelated risks, an increasing number of organisations have implemented or are developing an ERM system as an enabler to deliver their strategies and achieve their objectives.

However, gaps remain in using risk as a value creator. According to a Deloitte global survey in 2017 with over 300 board members and C-suite executives of companies from USD 1 billion in revenue and up, operating in various industries in tai 188bet Americas, EMEA and Asia/Pacific regions, nearly 9 out of 10 organisations recognise that risk management should focus on value creation - not mere risk avoidance. But fewer than 20% are taking sufficient action in this regard.

Along with many available risk management frameworks such as COSO Enterprise Risk Management - Integrated Framework(2004), ISO 31000 Risk Management (2009) - Principles and Guidelines on Implementation, BS 31100 Code of Practice for Risk Management, FERMA A Risk Management Standard and OCEG Red Book 2.0 (GRC Capability Model), COSO Enterprise Risk Management - Integrating with Strategy and Performance (COSO - ERM 2017) was introduced in 2017 and distinguished itself from other risk management approaches by its emphasis on tai 188bet connections between risk, strategy and value.

Traditionally, tai 188bet key driver for enterprise risk management (ERM) implementation is to protect value of tai 188bet organisation and tai 188bet focus is mostly to reduce tai 188bet risk impact and risk functions tasked with identifying threats to tai 188bet organisation’s business objectives or strategies. In many organisations, risk is an important, but largely supportive function focused on well-defined risks such as strategic, financial, operational and cyber risk, yet rarely integrated with tai 188bet core business. This can create a gap of considering of risks in decision making process.

tai 188bet right risk management should be embedded in management’s business processes, where identifying and managing risks are integral parts of decision making process. This level of integration can help organisation achieve intended business objectives more effectively and get better value from its ERM program. tai 188bet new ERM framework is focused on tai 188bet relationship between risk and value and tai 188bet important role of ERM in creating, preserving, and realising value. It helps an organisation exploring new opportunities by taking acceptable risks and realising tai 188bet value of taking these risks.

There are also advantages to enhance ERM with a strategic risk approach by embedding risk into strategic planning process. This will help organisation to consider alternative strategies according to organisation’s risk appetite. It also improves tai 188bet resilience of tai 188bet company’s strategy and helps to address barriers to execution; encompasses activities to prepare for and respond to novel crises; covers tai 188bet spectrum of risks, from high- level strategic risks that affecting all business units to tai 188bet operational risks managed at tai 188bet department level; links risk data at different levels, allows reallocation of resources to tai 188bet organisation’s top risks and embeds risk management into existing organisational processes.

2. Risks in oil and gas industry

Organisations in virtually industry and country are reminded frequently that they operate in a risky world. As a capital-intensive industry, oil and gas is not an exception. Risk is a characteristic of oil and gas business, as a part of fundamentals. Below are some common risks in oil and gas industry:

Political risk - An oil and gas company is covered by a range of regulations that limit where, when and how extraction is done, which differ from state to state. Political risk generally increases when oil and gas companies are working on deposits abroad. Numerous issues may arise from this, including sudden nationalisation and/or shifting political winds that change tai 188bet regulatory environment. Depending on what country tai 188bet oil is being extracted from, tai 188bet deal a company starts with is not always tai 188bet deal it ends up with, as tai 188bet government may change its mind after tai 188bet capital is invested, in order to take more profit for itself or for some other political reasons. An important approach that a company takes in mitigating this risk includes careful analysis and building sustainable relationships with international oil and gas partners - if it hopes to remain in business for tai 188bet long run.

Geological risk - Many of tai 188bet easy-to-get oil and gas is already tapped out, or in tai 188bet process of being tapped out. Exploration has moved on to areas that involve drilling in less friendly environments, such as on a platform in tai 188bet middle of an undulating ocean. There is a wide variety of unconventional oil and gas extraction techniques that have helped squeeze out resources in areas where it would have otherwise been impossible. Geological risk refers to both tai 188bet difficulty of extraction and tai 188bet possibility that tai 188bet accessible reserves in any deposit will be smaller than estimated.
 
Price risk - Beyond tai 188bet geological risk, tai 188bet price of oil and gas is tai 188bet primary factor in deciding whether a reserve is economically feasible. Basically, tai 188bet higher tai 188bet geological barriers to easy extraction, tai 188bet more price risk a given project faces. This is because unconventional extraction usually costs more than a vertical drill down to a deposit. This does not mean that oil and gas companies automatically cease operations on a project that becomes unprofitable due to a price dip. Often, these projects cannot be quickly shut down and then restarted. Instead, oil and gas companies attempt to forecast tai 188bet likely prices over tai 188bet term of tai 188bet project in order to decide whether to begin. Once a project has begun, price risk is a constant companion.

Supply and demand risks - Supply and demand shocks are a very real risk for oil and gas companies. As mentioned above, operations take a lot of capital and time to get going, and they are not easy to shut down when prices go south or to ramp up when they go north. tai 188bet uneven nature of production is part of what makes tai 188bet price of oil and gas so volatile. Other economic factors also play into this, as financial crises and macroeconomic factors can dry up capital or otherwise affect tai 188bet industry independently of tai 188bet usual price risks.

3. Cyber risk

Theoilandgasindustryismovingintothenextstageof evolution, whereby robotics, digitisation, and tai 188bet Internet of Things (IoT) are rapidly being integrated into tai 188bet operational environment. tai 188bet interest of cyber criminals in industrial operations has increased over tai 188bet last decade resulting in cyberattacks that have compromised both production and safety. These attacks have made cyber security a hot discussion topic in boardrooms around tai 188bet world, and now, a growing number of organisations are developing large transformation programmes to address these new operational threats.

On 30 March 2018, various major U.S. pipelines across tai 188bet US reported data system blackouts after a third-party electronic communication system was attacked. That electronic data interchange (EDI) system, which was identified as Energy Services Group’s Latitude Technologies Unit, controls computer-to-computer document exchanges with customers. tai 188bet Energy Services Group provides tai 188bet system to more than 100 natural gas pipelines, energy marketers and utilities nationally.

tai 188bet EDI cyberattack led to tai 188bet shutdown of tai 188bet communication systems for several pipelines utilising those services, including that of Dallas, Texas - based Energy Transfer Partners - a U.S. Fortune 500 natural gas and propane company owning more than 71,000 miles of pipelines containing natural gas, crude oil and other commodities.

Although tai 188bet incident is presumed to have been focused on gaining pricing information for competitive advantage as opposed to disruption of tai 188bet pipelines, experts are stressing tai 188bet importance of securing third-party systems in supervisory control and data acquisition (SCADA) environments. There is a critical need that all supply chain network providers that connect to tai 188bet companies’ assets be held to tai 188bet same high security standards. Fred Kneip, CEO of CyberGRX, said that it does not matter how well an organisation protects its own perimeter if third parties with weak security controls create vulnerabilities that can be easily exploited.

However, making operational processes secure, vigilant and resilient is a challenge as this requires tai 188bet organisation to harmonise and align two cultures, engineering and IT. In addition, tai 188bet operational environment demands tailored technical solutions that are not always easy to secure. Solving these challenges requires a clear understanding of both tai 188bet engineering and IT disciplines as well as leading sector specific cyber security practices.

Consider tai 188bet following scenarios, tai 188bet possibility of which did not exist a few years ago:

• Insecure remote access communication allows a cyber-criminal to hijack a process control system and push production to unsafe levels.

• Poor security practices by a third party contractor allow a virus to migrate into tai 188bet production environment, shutting down critical Supervisory Control and Data Acquisition (SCADA) systems and creating unsafe working conditions.

• Improper testing of IT systems prior to deployment results in a system crash, leading to disruption or shutdown of operations.

• Technology acquired directly by a facility, without adequate testing and evaluation, goes unpatched and introduces a vulnerability which allows members of an adversarial community to gain remote access to programmable logic controllers (PLC), thus giving them tai 188bet ability to disrupt tai 188bet production process at will.

This concern is not just academic: Hackers have initiated hundreds of cybersecurity incidents targeting US oil and gas control systems (Figure 2), many with significant real-world impacts.

Organisations have no alternative options but to be proactive in combating cyber risk.

Conduct a maturity assessment - Once tai 188bet risks are understood, an oil and gas company should assess tai 188bet maturity of its cyber security controls in an operational environment. While not every risk can be mitigated, it is important to know what type of controls are in place and where to focus improvement efforts. This means giving appropriate consideration to how potential security breaches within Industrial Control System (ICS) link to business risks. Importantly, this can not be done by an engineering or IT group independently; it requires a multi disciplinary team of business, operations, engineering, and IT security professionals.

Build a unified programme - Although building and implementing a program of this nature is a multi year, transformational effort, each phase of tai 188bet initiative should have tai 188bet same objective in mind, moving up tai 188bet maturity scale to create an ICS environment that is secure, resilient, and vigilant.

Implement key controls - Including awareness training, access control, network security, portable media, incident response.

Embrace good governance - Clear ownership of ICS security is crucial, and roles and responsibilities should be clearly defined for everyone involved, from managers to process operators to third parties. Ultimately, there must be a single line of accountability. Without one, it is challenging not only to define requirements that apply to tai 188bet whole organisation but also to identify where centralised versus local solutions are appropriate.

4. Conclusions

In tai 188bet past few years, tai 188bet oil and gas industry has seen tai 188bet traditional boundaries between corporate IT and ICS largely disappear. Today, tai 188bet evolution continues with tai 188bet digitisation of tai 188bet oil and gas field. Apart from tai 188bet traditional risks that tai 188bet oil and gas industry has faced up for decades, as this interconnectedness marches on, so does tai 188bet frequency and sophistication of cyber- attacks. However, most companies have not kept pace in terms of their preparedness. tai 188bet place to start is assessing tai 188bet maturity of tai 188bet cyber security controls environment. Going beyond traditional operational safety considerations to implement a secure, vigilant, and resilient programme is not only essential for enhancing an oil and gas company’s ability to protect operational integrity amid a growing range of cyber threats, but also to achieve operational excellence by taking advantage of tai 188bet productivity benefits offered by a digitised, fully integrated ICS environment.

In summary, boards of directors and senior executives at oil and gas companies cannot afford to manage risks reactively, especially in light of tai 188bet speed of change in tai 188bet industry that could accelerate beyond tai 188bet current velocity. That tai 188bet energy world is changing is not up for debate. tai 188bet real question is: How fast can energy companies adapt to tai 188bet speed of change and prepare for tai 188bet unexpected?

References

1. Andrew Slaughter, Paul Zonneveld, Thomas Shattuck. Refining at risk. Securing downstream assets from cybersecurity threats. Deloitte. 2017.

2. Mary E.Galligan, Kelly Rau. COSO in tai 188bet cyber age. Deloitte Global. 2015.

3. Paul Zonneveld, Andrew Slaughter. An integrated approach to combat cyber risk: Securing industrial operations in oil and gas. Deloitte Global. 2017.

4. Deloitte Global. Taking aim at value survey: Avoid overconfidence and look again at risk. 2017.

5. Deloitte Global. COSO’s ERM framework update comes with strategic risk advantage. 2017.

6. Deloitte Global. 2017 oil and gas industry executive survey: Trends show a pause in industry confidence. 2017.

7. Lindsey O’Donnell. Insecure SCADA system blamed in rash of pipeline data network attacks. 2018.

8. Naureen S.Malik, Ryan Collins, Meenal Vamburkar. Cyberattack pings data systems of at least four gas networks. Bloomberg. 2018.