Exploring cybersecurity adaptation assessment criteria in the oil and gas industry

Abstract

Cybersecurity is a pillar of Industry 4.0 that guarantees the safe and secure application of other pillars, such as Internet of Things (IoT), 3D printing, Simulation, and augmented/virtual reality. Nonetheless, cybersecurity management has been paid less attention in energy sectors, such as the Oil and Gas Industry (OGI). However, this paper contributes to cybersecurity adaptation assessment in OGI by proposing a literature-based, comprehensive hierarchical structure of the corresponding criteria, sub-criteria, and applications. In addition, Fuzzy Analytic Hierarchy Process (FAHP) is employed to derive the local and global weights of six identified criteria and 26 selected sub-criteria based on the judgements of several cybersecurity experts in a case study from the Iranian OGI. The results showed that the ICS and OT Security, and the cybersecurity governance and compliance are the most and least significant OGI cybersecurity management assessment criteria, with 37.52% and 4.74% of overall significance, respectively. In addition, the vulnerability management and patching in ICS/SCADA systems, and the network segmentation and IT–OT boundary protection are the most significant sub-criteria, with 20% and 11% global weight, respectively. Furthermore, several recommendations to mitigate the encountered limitations of OGI cybersecurity adaptation assessment are proposed for future work.