OTVista
Book a demo

OT cybersecurity for oil, gas and process industries

Process plants operate hazardous materials under continuous control. Cybersecurity work must respect process safety, long turnaround cycles and a heavy reliance on vendors and integrators.

Industry sheet
Sector
Oil, gas and process industries
Representative systems
5
Typical challenges
5
Example
Illustrative

Industry context

Covers:

  • Upstream production
  • Pipelines and midstream
  • Refining
  • Chemicals and petrochemicals

Process industries depend on distributed control systems running continuously for years between turnarounds. Safety instrumented systems provide an independent layer of protection, and their independence from other networks is a security concern as well as a safety one.

Remote facilities such as wellpads, pipeline stations and terminals add telemetry links and limited on-site staff.

Reference architecture

Site B: Gas processing facility

A DCS-controlled process with a separate safety instrumented system zone and a pipeline RTU. Select a zone to see its role, key risks and recommended controls.

Site B Gas processing facilityA DCS-controlled process with a separate safety instrumented system zone and a pipeline RTU.
Site B: Gas processing facility OT reference architecture (Oil, gas and process) L4 L3.5 L3 L2 L1 L0 Corporate WS, Enterprise IT Corporate WS ERP, Enterprise IT ERP Email, Enterprise IT Email Edge router, Enterprise IT Edge router Historian mirror, Plant DMZ Historian mirror Remote access, Plant DMZ Remote access Patch / AV, Plant DMZ Patch / AV DMZ switch, Plant DMZ DMZ switch DCS servers, Operations DCS servers Historian, Operations Historian Engineering WS, Operations Engineering WS Domain ctrl, Operations Domain ctrl Core switch, Operations Core switch Operator console, Supervisory Operator console Operator console, Supervisory Operator console Alarm mgmt, Supervisory Alarm mgmt Asset mgmt, Supervisory Asset mgmt Control switch, Supervisory Control switch Safety controller, Safety (SIS) Safety controller Safety controller, Safety (SIS) Safety controller DCS controller, Process control (BPCS) DCS controller DCS controller, Process control (BPCS) DCS controller Pipeline RTU, Process control (BPCS) Pipeline RTU Control net, Process control (BPCS) Control net ESD valve, Field instruments ESD valve Pressure TX, Field instruments Pressure TX Flow meter, Field instruments Flow meter Control valve, Field instruments Control valve Compressor, Field instruments Compressor Enterprise ITIT Plant DMZSL 2 Firewall: HTTPS, RDP via gatewayHTTPS, RDP via gateway OperationsSL 2 Firewall: OPC, historian replicationOPC, historian replication SupervisorySL 3 Firewall: DCS control networkDCS control network Safety (SIS)SL 3 Data diode: Read-only status to DCSRead-only status to DCS Process control (BPCS)SL 3 Vendor control protocol Field instrumentsSL 2 Assessment scope
Enterprise ITDMZOT operationsCritical controlField / safety

Tap a zone for its risks and controls, or a device for its security requirements.

Illustrative reference architectures, simplified for clarity. Security levels shown are example targets. Not live data.

Representative OT systems and dependencies

  • Distributed control systems (DCS)The core of plant control, often from one primary vendor.
  • Safety instrumented systems (SIS)Independent protective layers whose integrity must be preserved.
  • SCADA and telemetrySupervision of pipelines, wellpads and remote stations.
  • Historians and advanced applicationsData platforms that often bridge OT and business networks.
  • Analyzer and package systemsVendor-supplied packages with their own controllers and access needs.

Common cybersecurity challenges

  • Safety-related dependenciesSecurity measures must not compromise SIS independence or availability.
  • Legacy equipmentSystems running unsupported operating systems until the next turnaround.
  • Vendor accessMany package vendors and integrators requiring remote support.
  • Remote facilitiesUnmanned or lightly staffed sites with constrained communications.
  • Operational continuityVery limited opportunities for change outside planned turnarounds.

Relevant assessment areas

  • DCS and SIS network separation
  • Vendor and package system access
  • Legacy system compensating controls
  • Historian and DMZ architecture
  • Backup and recovery of control configurations
  • Turnaround-aligned remediation planning

Relevant OTVista services

Planning security work around a turnaround

Illustrative example

Situation

A refinery has identified several security gaps on legacy control servers but has only one major turnaround in the next three years.

Result

Interim risk is reduced immediately, and outage-dependent work is planned with the turnaround team instead of competing with it.

Structured approach

  1. Rate each gap by risk and by whether it needs an outage to fix.
  2. Define compensating controls that can be applied while running.
  3. Bundle outage-dependent changes into the turnaround work scope.
  4. Track residual risk until the turnaround is complete.

This scenario is a hypothetical example of a common situation in the sector, not a description of OTVista client work.

Questions from oil, gas and process industries teams

How does cybersecurity relate to process safety?

A cyber incident can affect process safety, so the two disciplines should coordinate. Cybersecurity risk assessment can consider safety consequences, while the process safety function remains responsible for safety analysis.

What can be done for systems that cannot be patched?

Compensating controls such as tighter segmentation, restricted access, application allowlisting and monitoring can reduce risk until the system can be upgraded.

From the blog

Latest OT security insights

All posts

Discuss OT cybersecurity for your operations

Tell us about your sites, systems and priorities, and we'll suggest a practical starting point.

Request a consultation