Facebook Google Plus Twitter LinkedIn YouTube RSS Menu Search Resource - BlogResource - WebinarResource - ReportResource - Eventicons_066 icons_067icons_068icons_069icons_070

Tenable Blog

Subscribe
  • Twitter
  • Facebook
  • LinkedIn

Colonial Pipeline Ransomware Attack: How to Reduce Risk in OT Environments

Colonial Pipeline Ransomware Attack: How to Reduce Risk in OT Environments

It's time for Operational Technology (OT) environments to pursue a more proactive approach to cybersecurity by making cyber maintenance as much of a routine practice as the mechanical maintenance of systems and equipment.

A major supplier of oil and gas to the U.S. East Coast was taken offline on May 8 after a reported ransomware attack. The attack on the 5,500 mile Colonial Pipeline, which supplies 45 percent of the oil and gas used on the East Coast, is just the latest to target the oil and gas sector, which is considered one of 16 critical infrastructure areas identified by the U.S. Department of Homeland Security

It is not surprising that a shutdown or interruption of a pipeline would gain major media attention. But the attack also begs the question: how exposed to attacks is our critical infrastructure?

Colonial Pipeline ransomware attack how to secure critical infrastructure

Source: Colonial Pipeline

The changing operating technology paradigm 

While the operational technology (OT) required in oil and gas operations was once isolated and "air-gapped," today these systems are increasingly connected to IT infrastructure and to the internet, opening up new attack paths. This convergence creates an environment in which any and all aspects of oil and gas operations could be vulnerable to attack from either the IT or the OT side, opening up the possibility of lateral movement. 

Additionally, many ransomware attacks use Active Directory (AD) to perform lateral movement and privilege escalation after initial penetration and new malware increasingly  includes codes to target AD misconfigurations. AD has become the favored target for attackers to elevate privileges and facilitate lateral movement through leveraging known flaws and misconfigurations. Unfortunately, most organizations struggle with Active Directory security due to misconfigurations piling up as domains increase in complexity, leaving security teams unable to find and fix flaws before they become business-impacting issues. 

The attack against Colonial Pipeline is just the latest in a series of recent activity against oil and gas operations around the globe, including:

  • Saipem, an Italian oil and gas industry contractor, which fell victim to a December 2018 cyberattack hitting servers based in the Middle East, India, Aberdeen and Italy.

  • A cyberattack on a shared data network, which forced four natural gas pipeline operators in the U.S. to temporarily shut down computer communications with their customers in April 2018.

  • A cyberattack against a U.S. natural gas facility, which concurrently encrypted both the IT and OT networks, locking access to the human machine interface (HMI), data historians and polling servers. The pipeline was forced to shut down for two days in February 2020.


Regulatory compliance does not equal security

In our experience working with OT environments, we often find organizations assuming that regulatory compliance is the same as security. While we are by no means suggesting this was the case at Colonial Pipeline, we do believe it's worthwhile for all organizations in the sector to consider taking a more expansive view of their cybersecurity strategy. 

There are five safety and security standards relevant to the oil and gas industry, all of which call for organizations to have a base layer of security in place. This layer includes asset inventory, security management controls and a vulnerability management system. While we support a regulatory approach and believe compliance is laudable, we consider adherence to these guidelines as only the beginning of a sound cybersecurity strategy.

Here's why: the promulgation, enactment and enforcement of regulatory standards cannot keep pace with the rapidly expanding attack surface, and the speed with which attackers adapt to it. Thus, we cannot assume "compliance" means the organization has achieved "security." We must look well beyond compliance if we hope to keep critical infrastructure secure and prevent attacks like the one that has affected Colonial Pipeline.

5 safety and security standards relevant to the oil and gas industry

API Standard 1164 - Content unique to pipelines not covered by NIST CSF and IEC 62443.


National Institute of Standards and Technology (NIST) cybersecurity framework for improving critical infrastructure cybersecurity (NIST CSF) - Pre-eminent framework adopted by companies in all industry sectors; Natural gas and oil companies increasingly orient enterprisewide programs around NIST CSF.


Department of Energy cybersecurity capability maturity model - Voluntary process using industry-accepted best practices to measure the maturity of an organization's cybersecurity capabilities and strengthen operations.


International Electrotechnical Commission (IEC) 62443 - Family of standards for industrial control systems (ICS) security; widely adopted by production segment of natural gas and oil industry; applicable to any type of natural gas and oil ICS

International Organization for Standardization ISO 27000 - Leading standard in the family providing requirements for an information security management system (ISMS).


How to disrupt OT security threats

Ironically, one of the least desirable times to deal with a cyberattack is when it is happening. Over the coming days and weeks, we will undoubtedly learn more details about the course of this attack, as well as the cost and disruption it caused. If critical infrastructure organizations have any hope of getting out of the cyber firefighting mode of having to react to attacks, they will need to instead focus on preempting attacks by disrupting them before they happen. 

Many industrial environments, including the oil and gas industry, are very familiar with performing routine maintenance on their equipment. Whether it is changing out a bearing, filter or fluids, maintenance is performed to avoid a catastrophic equipment failure due to what's known as "running to failure." Regular maintenance saves money and aggravation and avoids the diversion of resources. 

So, why aren't organizations performing the same type of regular maintenance on the cybersecurity of their OT systems?

Taking a "maintenance" approach to OT infrastructure means performing the appropriate cyber hygiene on the programmable logic controllers (PLCs), distributed control systems (DCSs), HMIs and other OT devices that run these machines. Performing regular cyber hygiene can reduce OT threats by stopping risky behavior, closing "ports of entry" and reducing the amount of vulnerabilities that can be exploited.

Reducing threats before they happen requires:

  • achieving visibility across the entire attack surface — including IT and OT systems; 

  • deploying deep security measures at the device and network level; and 

  • re-establishing control through managing configuration changes. 


Organizations need appropriate cyber hygiene in both their OT infrastructure and their Active Directory to reduce their cyber exposure and ensure that attack paths are cut off before attackers can succeed in escalating privileges, traversing the network and launching their ransomware attempt. These efforts can help all critical infrastructure and manufacturing operations avoid having to respond to a security crisis that can stop operations and potentially put human lives at risk. 

Learn More

Related Articles

Are You Vulnerable to the Latest Exploits?

Enter your email to receive the latest cyber exposure alerts in your inbox.

Try for Free Buy Now
Tenable.io FREE FOR 30 DAYS

Enjoy full access to a modern, cloud-based vulnerability management platform that enables you to see and track all of your assets with unmatched accuracy. Sign up now.

Tenable.io BUY

Enjoy full access to a modern, cloud-based vulnerability management platform that enables you to see and track all of your assets with unmatched accuracy. Purchase your annual subscription today.

65 assets

Choose Your Subscription Option:

Buy Now
Try for Free Buy Now

Try Nessus Professional Free

FREE FOR 7 DAYS

Nessus® is the most comprehensive vulnerability scanner on the market today. Nessus Professional will help automate the vulnerability scanning process, save time in your compliance cycles and allow you to engage your IT team.

Buy Nessus Professional

Nessus® is the most comprehensive vulnerability scanner on the market today. Nessus Professional will help automate the vulnerability scanning process, save time in your compliance cycles and allow you to engage your IT team.

Buy a multi-year license and save. Add Advanced Support for access to phone, community and chat support 24 hours a day, 365 days a year. Full details here.

Try for Free Buy Now

Try Tenable.io Web Application Scanning

FREE FOR 30 DAYS

Enjoy full access to our latest web application scanning offering designed for modern applications as part of the Tenable.io platform. Safely scan your entire online portfolio for vulnerabilities with a high degree of accuracy without heavy manual effort or disruption to critical web applications. Sign up now.

Buy Tenable.io Web Application Scanning

Enjoy full access to a modern, cloud-based vulnerability management platform that enables you to see and track all of your assets with unmatched accuracy. Purchase your annual subscription today.

5 FQDNs

$3,578

Buy Now

Try for Free Contact Sales

Try Tenable.io Container Security

FREE FOR 30 DAYS

Enjoy full access to the only container security offering integrated into a vulnerability management platform. Monitor container images for vulnerabilities, malware and policy violations. Integrate with continuous integration and continuous deployment (CI/CD) systems to support DevOps practices, strengthen security and support enterprise policy compliance.

Buy Tenable.io Container Security

Tenable.io Container Security seamlessly and securely enables DevOps processes by providing visibility into the security of container images – including vulnerabilities, malware and policy violations – through integration with the build process.

Try for Free Contact Sales

Try Tenable Lumin

FREE FOR 30 DAYS

Visualize and explore your Cyber Exposure, track risk reduction over time and benchmark against your peers with Tenable Lumin.

Buy Tenable Lumin

Contact a Sales Representative to see how Lumin can help you gain insight across your entire organization and manage cyber risk.