Industry's Leadership, and Coordination with Government, is What Prevents Cyberattacks

Jessica Lutz
Posted December 20, 2018

With the release of the U.S. Government Accountability Office (GAO) report on pipeline cybersecurity, conducted at the request of Senator Cantwell and Congressman Pallone, it has become apparent that there is lingering confusion about the security of natural gas and oil pipelines. So, let’s clear things up: industry is deeply engaged in efforts to understand the threat, coordinate with cybersecurity experts across the board, and stay ahead of our adversaries. Our industry utilizes best-in-class international cybersecurity standards, close collaboration with government, and proven frameworks that – in contrast to prescriptive government-imposed standards or regulations – are the best ways to stay ahead of emerging threats and bolster the cybersecurity of natural gas and oil companies and the energy infrastructure they operate.

Government standards and regulations can quickly become outdated. Our industry is responding to threats in real time. Beyond the fact that the methods we use have been proven, time and again, they afford companies the necessary flexibility and agility to respond to a constantly-changing cyber threat landscape – something that just isn’t possible when resources must be dedicated toward static rules that are quickly made obsolete.

The GAO report affirms what we’ve been saying all along - natural gas and oil companies recognize that their assets are the targets of a growing number of increasingly sophisticated cyberattacks. We recognize that these attacks are perpetrated by a variety of attackers including nation-states and organized international criminals. These attacks pose risks that could compromise the viability of a company and the critical services our industry supplies to the nation - we take this very seriously.

What the report leaves out is the fact that our industry works closely with the government agencies responsible for cybersecurity throughout the full natural gas and oil value chain – from Coast Guard regulatory oversight in maritime and maritime-facing facilities to Transportation Security Administration (TSA) regulatory oversight of pipelines, as well as information sharing with the U.S. intelligence community via the Department of Homeland Security/National Cybersecurity & Communications Integration Center, plus the Department of Energy, FBI and others – all to ensure collaboration and communication at every point. 

Beyond industry’s work with government, companies are also continuously sharing with each other cyber threat indicators and other security information through Information Sharing and Analysis Centers (ISACs) established in accordance with federal law – and participate in peer-to-peer learning through trade associations – to bolster individual companies’ cyber capabilities and provide critical lines of defense.

Our companies also engage premiere cybersecurity firms that specialize in protecting and defending critical infrastructure systems, utilizing some of the best talent in the world. This isn’t a passive operation; most, if not all, of the largest industry companies manage cybersecurity as an enterprise risk – the highest designation – like safety or geopolitical forces with oversight from Boards of Directors and Senior Executives. Like I said, we take this very seriously.

There appears to be a misconception between cyber threats and vulnerabilities in the calculation of risk to natural gas and oil pipelines. There is no denying that the natural gas and oil industry – as with most modern industries – faces cyber threats on an ongoing basis. But the natural gas and oil industry’s reliance on proven risk management-based frameworks and public-private collaboration, rather than prescriptive regulation, is the most effective and robust method of bolstering the cybersecurity of our industry companies and the critical infrastructure they operate.

It is essential that companies be afforded the necessary flexibility and agility to respond to the increasing sophistication and adaptiveness of cyber adversaries, and that government and industry continue to partner to share cyber threat intelligence and strengthen cyber defenses. We agree with Senator Cantwell - our nation's energy assets are critical to the safety, security and economic well-being of the country. This is precisely why we continue to protect it, in the most effective way possible.