High Monitor
Remote oil and gas sites face risk through links and vendor access
Industrial CyberDragos · oil and gas
What happened. Upstream oil and gas sites rely on satellite, cellular and radio links. Dragos found 29% of oil and gas cases had poor IT/OT segmentation. The group VOLTZITE compromised cellular gateways across US oil and gas infrastructure.
Who is affected. Oil and gas operators, especially upstream sites such as wellheads, gathering systems and offshore platforms that use remote links and contractor access.
What to do. Review remote-access paths to unattended sites, including shared credentials, standing VPNs and third-party connections, and check how well IT and OT networks are separated.
Editor's reading
Forasset ownerOT security leadleadership
- Purdue level
- L3.5
- L2
- L1
Why: Cellular gateways and contractor remote access form the link into field devices and SCADA traffic, placing the risk at the remote-access layer and the control layers.
- Are you exposed?
List every cellular gateway and third-party remote-access path into field sites, and check whether each is segmented from the control network.
- If you cannot fix it yet
- Replace shared credentials and standing VPN accounts with individual, time-limited contractor access.
- Segment cellular gateways from the control network with a firewall that allows only known traffic.
- Watch for
- Remote sessions to unattended sites from unknown accounts or outside agreed maintenance windows.
- Unexpected configuration changes or new connections on cellular gateways at field sites.
- ATT&CK for ICS
- T0886Remote Services
Inferred from the facts above, not stated by the source. Check it against your own site before acting.
Source: Industrial Cyber (opens industrialcyber.co)
More on Dragos Oil and gas