Two stories point to the upside and downside of digital transformation in the energy sector. On the negative side, this week, the U. S. Government Cybersecurity and Infrastructure Security Agency (CISA) issued an alert about its response to a cyberattack affecting control and communication assets on the operational technology (OT) network of a natural gas compression facility. According to the alert, “Impacted assets were no longer able to read and aggregate real-time operational data reported from low-level OT devices, resulting in a partial Loss of View for human operators.” The victim’s emergency response plan did not specifically consider cyberattacks, and the decision was made to implement a deliberate and controlled shutdown to operations that lasted two days, resulting in a loss of revenue and productivity, after which normal operations resumed.
In a separate—more positive—story, Shell’s online employee training program on AI is one part of the company’s wider digital transformation and adoption of AI to improve processes, cut costs, and generate additional revenue, as profiled in the Wall Street Journal. Employees across the company are being trained to harness the power of AI.
The CISA alert is a reminder of the growing risks facing the downstream energy sector as OT and IT have increasingly merged in the past five years, and the threat surface has grown exponentially in recent years. Traditionally kept separate, the merging of OT—the machines, systems, and networks used to generate, transmit, and distribute power—with IT, brought about by digitized operations, has introduced risks that have not yet fully been reckoned with. Industry surveys like this are a warning directly from industry experts about the operational disruption risks to critical infrastructure due to cyber and the need for greater focus on security.
Shell considers itself an early adopter of AI in the energy sector. Satya Nadella applauded Shell’s adoption of AI dating back to 2018. “What’s happening at Shell is pretty amazing,” he said. “They have a very deliberate strategy of using AI, right across their operation... from the drilling operations to safety in... Shell Retail stations.” Shell prominently advertises the benefits of AI in aiding its predictive maintenance program across its operations to limit downtime due to equipment failures. ExxonMobil openly espouses the immense financial benefits of digital on its production. In February 2019, the Houston-based company announced a partnership with Microsoft, stating in its press release, “...a new partnership with Microsoft Corp. will make its Permian Basin operations the largest-ever oil and gas acreage to use cloud technology and is expected to generate billions in net cash flow over the next decade through improvements in analyses and enhancements to operational efficiencies.”
There is no doubt that digital transformation has brought significant revenue and cost savings benefits to the energy sector for companies like Shell and ExxonMobile. But, the CISA alert is a reminder of the downside risks of these benefits. In examining cyber governance performance across all major industry sectors last year, Cyberhedge ranked the energy sector as the worst performing sector. These rankings take into account financial constraints companies face relative to cyber threats on a per sector basis and suggest the energy sector has work to do to better secure its AI and other digital transformations.