Offshore oil and gas rigs are at significant risk of cyberattacks, according to a new report from the Government Accountability Office.
The network of 1,600 offshore oil and gas rigs supplies a significant amount of U.S. domestic energy.
“A cyberattack on these facilities could cause physical, environmental and economic harm. And disruptions to oil and gas production and transmission could affect supplies and markets,” the report reads.
The report found significant security weaknesses in the operational technology (OT) used by rigs to monitor and control machinery that could let cybercriminals control them remotely.
The report focuses on old OT equipment used on many rigs, pointing out that a lack of software updates leaves them unprepared to deal with cyberattacks.
“Some legacy devices do not have the capability to log commands sent to the devices, making it more difficult to detect malicious activity,” the report reads. “Further, older legacy systems often rely on unsupported operating systems that no longer receive modern software security patches to address vulnerabilities.”
SEE ALSO: China massively outguns U.S. in increasingly bellicose cyber shootout
The GAO’s report asks the Interior Department’s Bureau of Safety and Environmental Enforcement to increase efforts to safeguard U.S. offshore energy cybersecurity.
“Since recognizing the need to take action in 2015, the scale and scope of the cybersecurity risks have continued to increase, creating even greater urgency for the bureau to respond,” the report concludes. “However, BSEE has struggled to address cybersecurity risks to offshore oil and gas infrastructure and only recently has taken steps to start a new initiative.”
The GAO is encouraging the bureau to create a cybersecurity policy that includes “(1) risk assessment, (2) objectives, activities and performance measures, (3) roles, responsibilities and coordination and (4) identification of needed resources and investments.”
The report comes a year after one of the biggest cyberattacks on a U.S. offshore oil rig, the Colonial Pipeline. A ransomware attack caused the pipeline, a system that originates in Houston and supplies energy to millions of Americans, to shut down to contain the attack.
