Energy, Oil & Gas and Utilities
Protect Supply, Safety and the Grid.
Security for power, oil and gas and utility operators whose control systems now connect to the wider network.
Executive Summary
- 01OT security protects physical processes, so every control must be proven safe for operations before it goes live.
- 02Segmentation, brokered remote access and passive monitoring do most of the work where devices cannot be patched.
- 03Tested response plans, agreed with operators in advance, decide whether an intrusion becomes an outage.
ENERGY & UTILITIES · Risk Drivers
OT/ICS intrusion, exposed remote access, IT/OT convergence.
- Primary Attack Vectors
- OT/ICS intrusion, exposed remote access, IT-to-OT pivoting
- Operational Consequences
- Supply disruption, safety incidents, economic impact
In Depth
Security in Energy, Oil & Gas and Utilities, Explained
Why OT Differs from IT
Industrial control systems were built to keep processes running safely for decades. Availability and safety outrank confidentiality. Programmable logic controllers, remote terminal units and engineering workstations often run firmware that the vendor must certify before any change. Patching may need a planned outage, and some devices cannot be patched at all. Security therefore relies on compensating controls: isolation, restricted protocols, tight access and monitoring. Every control is tested against one question first: could it interrupt the process or blind an operator? Controls that fail that test do not go live.
Segmentation and Controlled Access
Segmentation turns a flat network into defined zones. IEC 62443 describes zones and conduits: groups of assets with shared security needs, and the controlled paths between them. A demilitarized zone sits between corporate and control networks, so nothing crosses directly. Remote access runs through hardened jump hosts with multi-factor authentication. Vendor sessions are approved, time-limited and recorded. Firewalls permit only named protocols between named systems. The aim is simple: an intruder who lands on a business laptop should find no route to a controller.
Monitoring Without Disrupting Process
Monitoring in OT is mostly passive. Sensors read mirrored traffic from switches and never inject packets into the process network. They decode industrial protocols such as Modbus, DNP3 and IEC 61850, build an asset inventory, and learn normal communication patterns. Alerts fire on new devices, unexpected commands, firmware changes and engineering-station activity outside maintenance windows. Analysts correlate these with enterprise logs to spot an intruder moving from IT toward control. Response steps are agreed with plant operators beforehand, because isolating a link can itself affect supply.
A control network should never be reachable from a business laptop, a vendor password or an unexamined remote session.
Threat Scenarios
What It Looks Like in Practice
Exposed Remote Access
How It Shows Up
A vendor VPN or remote desktop service is reachable from the internet, often with shared or default credentials. Logins appear from unfamiliar locations.
Response
Remove direct exposure, enforce multi-factor authentication and brokered sessions, then review historical logs for earlier misuse.
IT‑to‑OT Pivot
How It Shows Up
Credential theft or ransomware on the corporate network is followed by logins to a jump host or historian.
Response
Close the affected conduits, isolate zones in agreement with operations, and hunt for reused shared accounts.
Unauthorized Logic Change
How It Shows Up
A controller program download or firmware change occurs outside a maintenance window and matches no ticket.
Response
Verify with the process engineer, compare against known-good project backups, and restore trusted logic.
Unmanaged Contractor Device
How It Shows Up
A laptop or USB device appears on the control network and shows up as a new asset in the inventory.
Response
Quarantine the port, inspect the device, and enforce media controls and contractor device checks.
| Scenario | How It Shows Up | Response |
|---|---|---|
| Exposed Remote Access | A vendor VPN or remote desktop service is reachable from the internet, often with shared or default credentials. Logins appear from unfamiliar locations. | Remove direct exposure, enforce multi-factor authentication and brokered sessions, then review historical logs for earlier misuse. |
| IT‑to‑OT Pivot | Credential theft or ransomware on the corporate network is followed by logins to a jump host or historian. | Close the affected conduits, isolate zones in agreement with operations, and hunt for reused shared accounts. |
| Unauthorized Logic Change | A controller program download or firmware change occurs outside a maintenance window and matches no ticket. | Verify with the process engineer, compare against known-good project backups, and restore trusted logic. |
| Unmanaged Contractor Device | A laptop or USB device appears on the control network and shows up as a new asset in the inventory. | Quarantine the port, inspect the device, and enforce media controls and contractor device checks. |
Regulatory & Operational Challenges
Operators must protect OT that cannot be patched or restarted on demand.
Critical-infrastructure obligations under Act 1038 add assurance and reporting duties to operational pressure.
Relevant DAAKYI Capabilities
Services for Energy, Oil & Gas and Utilities
Delivery Approach
Priority Capabilities Across GUIDE, SECURE and OPERATE
GUIDE
OT risk and maturity assessment.
SECURE
OT segmentation, secure SCADA.
OPERATE
OT monitoring, incident response.
Methodology
The Method, Step by Step
- 1
Scope and Inventory
Define the sites, processes and safety limits in scope. Build an asset inventory from walkdowns, network captures and engineering records, covering controllers, field devices, HMIs, historians and remote links. Unknown assets are the first finding, because they cannot be defended or patched.
- 2
Assess Risk
Map threats and vulnerabilities to consequences such as lost generation, halted pipeline flow or a safety event. Rate each by operational impact, not only technical severity. Compare current controls with IEC 62443 and NIST SP 800-82 practice to expose gaps and rank them.
- 3
Design Containment
Define zones and conduits, place the demilitarized zone, and specify remote-access brokering. Choose compensating controls for unpatchable devices. Every design is reviewed with operations and vendors, and tested, where possible, in a maintenance window or lab before reaching live systems.
- 4
Deploy Monitoring
Place passive sensors at zone boundaries and critical switches. Tune detection against a learned baseline, then connect alerts to the security operations workflow. Write playbooks naming who may isolate a link, who approves it, and which manual operating modes are available at each site.
- 5
Exercise and Improve
Run tabletop and technical exercises that include operators, engineers and management. Test restoration from offline backups of controller logic and configurations. Record lessons, update playbooks, and repeat assessment as the environment changes. Reporting duties under Act 1038 are rehearsed alongside technical steps.
Deliverables and Roles
What You Receive, and Who Does What
| Deliverable | Purpose |
|---|---|
| OT Asset Inventory | Gives a verified list of controllers, field devices, servers and connections to defend. |
| Risk and Maturity Report | Ranks gaps by operational consequence and shows current maturity against a recognized standard. |
| Zone and Conduit Architecture | Documents the target network design and the permitted paths between zones. |
| Detection Use Cases | Lists the OT-specific alerts to be monitored and the evidence each one needs. |
| OT Incident Playbooks | Sets out who decides, who acts and how operations continue during containment. |
| Role | Responsibility |
|---|---|
| Plant or Operations Manager (Client) | Approves any control that touches the process and defines safe operating limits. |
| CISO or Security Lead (Client) | Owns OT risk acceptance and regulatory reporting decisions. |
| OT Security Engineer (Provider) | Designs segmentation, remote access and compensating controls that suit the plant. |
| Security Analyst and Responder (Provider) | Triages OT alerts, leads containment with operators and preserves forensic evidence. |
Maturity Model
Where Organizations Typically Stand
Stage 1
Ad Hoc
Assets are poorly documented, networks are largely flat, and vendors connect through unmanaged channels.
Stage 2
Defined
An inventory exists, the demilitarized zone is in place, and remote access has named owners and approvals.
Stage 3
Managed
Passive monitoring runs, alerts reach analysts, and response playbooks have been exercised with operators.
Stage 4
Optimized
OT risk feeds enterprise risk reporting, and design changes follow measured findings from exercises and incidents.
Frameworks and Regulation
The Standards That Shape This Work
IEC 62443
Defines zones, conduits and security levels for industrial automation and control systems. It gives asset owners, integrators and vendors a shared language for requirements.
NIST SP 800-82
Provides guidance for securing OT, including architecture, risk and control selection that respects reliability and safety needs.
NIST CSF 2.0
Its six functions (Govern, Identify, Protect, Detect, Respond and Recover) help structure OT programs and report maturity to executives.
Ghana Cybersecurity Act, 2020 (Act 1038)
Provides for designation and protection of Critical Information Infrastructure and for incident reporting, which shapes assurance and escalation in operators' OT programs.
Buyer Guidance
Choosing the Right Provider
What to look for
- Look for engineers who have worked in plants and understand safety limits, not only network diagrams.
- Look for passive-first monitoring that supports the industrial protocols you actually run.
- Look for remote access designs that record and time-limit every vendor session.
- Look for response plans that name operations staff as decision makers alongside security staff.
Questions to ask a provider
- How do you validate that a control will not disturb a running process?
- Which industrial protocols and vendor platforms can you decode and monitor?
- How do you handle devices that cannot be patched or restarted?
- How do you support incident reporting duties while containment is still under way?
Technical Detail
For Architects and Security Leads
Securing Vendor Remote Access
Vendor remote access is a frequent path into control networks, so treat it as a managed service. Terminate all vendor connections in the demilitarized zone, never on a controller network directly. Require individual accounts and multi-factor authentication, and retire shared passwords. Broker sessions through a jump host that records keystrokes and screens, and release access only for an approved work order with a start and end time. Disable file transfer by default and scan anything allowed through. Log every session to central storage outside the control zone. Review vendor accounts regularly and remove those without active maintenance contracts.
Detecting Unauthorized Logic Changes
Controller logic is code, and unauthorized changes are a high-value signal. Keep known-good project files and firmware hashes in offline storage under change control. Monitoring watches for program downloads, mode changes from run to program, and writes to critical setpoints from hosts that are not approved engineering stations. Each alert is matched to a maintenance ticket. No ticket means escalation to the process engineer. Periodically compare live controller logic with the stored baseline, where the platform supports it, to catch changes that bypassed the network sensor. Treat any mismatch as an incident until proven otherwise.
Business Outcome
Safe, reliable supply and resilient operations.
Glossary
Key Terms
- Zones and Conduits
- IEC 62443 terms for groups of assets with common security needs and the controlled channels between them.
- Purdue Model
- A reference model that layers enterprise systems, supervisory systems, controllers and field devices to guide separation.
- Historian
- A server that stores process data over time and often bridges the control and business networks.
- Safety Instrumented System
- An independent system that brings a process to a safe state when limits are exceeded.
FAQ
Questions Sector Leaders Ask
DAAKYI Intelligence
Ask Kasara About Energy, Oil & Gas and Utilities
Kasara, our AI assistant, answers from DAAKYI's published content and can connect you with a specialist.
Next Step