TRANSMISSION ACTIVE

// FREQ: GOVCON EPISODE: 022 STATUS: SECURE

022 OT Attacks, AI Risk, and Data Security in the Oil and Gas Industry

The most important fact about the Colonial Pipeline attack is the one most people forget: the ransomware never touched the pipeline. It hit the billing and IT systems — and half the East Coast's fuel supply still shut down for six days, because the company couldn't prove the two worlds were separated. Fresh off a panel at the Data Driven Oil & Gas USA 2026 conference in Houston, the CISO breaks down the three forces converging on the energy sector right now: OT attacks crossing from IT into the systems that physically run operations, the AI rush wiring operational data straight into the control room, and the data security discipline that decides whether an operator rides the wave or wipes out. Because in critical infrastructure, the gap between the governance slide and the segmentation on the network isn't a fine. It's a pipeline shutdown.

JUMP POINTS //

00:32

OT Attacks Are Crossing the IT/OT Line

The dominant critical-infrastructure pattern of 2026: ransomware and wiper activity crossing from IT networks into operational technology — the systems that physically run wells, pipelines, and refineries. Industrial organizations now absorb nearly half of all ransomware and wiper activity, because OT was built for reliability, not security, and it’s increasingly connected to the internet.

03:32

Unsophisticated Attackers Are Still Winning

CISA, the FBI, the DOE, and the EPA issued a joint advisory warning that even unsophisticated actors are breaching oil and gas ICS and SCADA — succeeding through default credentials and exposed remote access. Underneath them, nation-state actors are quietly pre-positioning: getting in, establishing persistent access, mapping operations, and waiting for the opportune moment.

09:19

The Three Universal Marching Orders

Close the gap on OT-crossover attacks with three moves that work in any sector: get internet-facing assets off the public internet behind MFA and jump hosts, segment your network so a breach can’t spread laterally, and build detection that can actually find an intruder who’s already inside.

12:16

The AI Rush and IT/OT Convergence

Straight from the Data Driven Oil & Gas USA 2026 panel: the sector sees $200–400B in projected AI value by 2030, but only 15% of organizations are true AI leaders. AI is hungry for the data that lives in OT — so the industry is bridging the two worlds, and every connection built to feed a model is a path an attacker can travel the other way.

19:28

Case Study — The Colonial Pipeline Attack

One legacy VPN account with no MFA. 100GB of data stolen in two hours. Ransomware that hit only the IT and billing systems — and still forced a six-day shutdown of half the East Coast’s fuel supply, because Colonial couldn’t prove the OT side was clean. The IT/OT convergence lesson in its purest form.

24:31

Securing Your Data — The Marching Orders

Three actions to avoid becoming the next case study: fix the identity and exposed-access gaps Colonial left open, govern your operational data as a security asset instead of just an AI input, and segment IT from OT while pressure-testing the shutdown decision through real functional exercises.

// INCOMING SITREP

The episode covers why IT/OT convergence is the defining risk. The companion Sitrep is the operator's build-plan — how to architect the segmentation, data governance, and shutdown-decision discipline that would have stopped Colonial. Read the SITREP dossier.

ACCESS THE BRIEF »

TRANSMISSION LOG //

A Special Briefing From the Energy Sector

This is a special edition of Status: Secure. The CISO just returned from speaking on a panel at the Data Driven Oil & Gas USA 2026 conference in Houston, so this transmission goes deep on the energy sector — specifically the three forces converging on oil and gas right now: OT attacks crossing from IT into the systems that physically run operations, the AI risk reshaping the industry as it races to adopt, and the data security discipline that separates the operators who ride the wave from the ones who wipe out. And while the focus is energy, the core lesson reaches every organization that connects physical operations to an IT network — which, in 2026, is nearly everyone.

OT Attacks Are Crossing the IT/OT Line

The dominant critical-infrastructure attack pattern of 2026 is ransomware and wiper activity crossing from IT networks into OT — operational technology, the systems that physically run the wells, the pipelines, and the refineries. Industrial organizations now absorb nearly half of all ransomware and wiper activity, and the rise of ransomware-as-a-service has supercharged the problem: attacking OT no longer requires a sophisticated lone actor or a nation-state. You can now pay a service provider to run the attack for you. When an attack reaches OT, it doesn’t just lock files — it can halt physical production.

Why is OT so exposed? Because it was built for reliability and uptime, not security. These are the hardware devices sitting right on the pipes, the wells, the utility lines. For decades, an operator physically walked up to them to make changes. Now they’re connected to the network — and increasingly to the internet — for remote access by staff and vendors. They’re legacy systems, hard to patch, poorly segmented from IT, and full of default settings a field engineer never changed.

That last point is the quiet scandal of the sector. CISA, the FBI, the Department of Energy, and the EPA issued a joint advisory warning that even unsophisticated actors are successfully probing oil and gas ICS and SCADA systems — succeeding through default credentials and exposed remote access. Field engineers install these systems and leave the factory settings in place, because they’re operators, not security staff — and the default credentials are publicly known. When CISA sounds the alarm about unsophisticated attackers, the message is that the basic attacks are still working. That’s a verdict on the defense, not the attacker.

The Nation-State Layer: Pre-Positioning

Beneath the opportunists sit the nation-state actors, and their 2026 behavior is quiet pre-positioning: get in, establish persistent access, map the operations through patient reconnaissance, and wait for the most opportune moment. In December 2025, an actor compromised OT and ICS across Poland’s energy sector — renewable plants and a combined heat and power plant — entering through vulnerable internet-facing edge devices and deploying wiper malware that damaged remote terminal units, the actual equipment in the field.

CSIS reported this year that Iran has shifted from episodic, symbolic attacks to sustained pre-positioning — sitting inside energy, water, and transportation networks to create latent risk they can trigger during a future crisis. Imagine an adversary pre-positioned across multiple utilities simultaneously, waiting for a single geopolitical trigger to act on all of them at once. The chaos that could create is the entire point of the strategy.

And here’s why this reaches every sector, not just energy: the exposed edge device and the flat, unsegmented network that lets an unsophisticated ransomware actor reach OT is the exact same door a nation-state actor walks through to pre-position. The playbook is sector-agnostic. Healthcare has connected medical devices on the same networks as IT. Manufacturing and logistics run ICS. Even a corporate building has connected HVAC and access-control systems. Energy is simply where the consequences are most physical and most visible.

The Three Universal Marching Orders

For any organization with an operational footprint, three moves close the gap on OT-crossover attacks and the pre-positioning behind them:

Get your internet-facing assets off the public internet.

Nearly every one of these incidents started with an exposed, internet-facing device. Inventory everything reachable from the public internet — especially anything touching operations — and put it behind MFA and jump hosts. Remote access is a legitimate operational need; a public IP protected by a manufacturer’s default password is not remote access, it’s an open door.

Segment your network so a breach can’t spread.

The reason an IT compromise becomes an OT catastrophe is flat network architecture — once an adversary is in, they move laterally across everything. With real segmentation, you can lock down a compromised zone and keep the rest of operations running. Segmentation is what shrinks the blast radius when, not if, something gets in.

Make sure you can detect an intruder who’s already inside.

Pre-positioning works because the adversary is quiet and most organizations only watch the perimeter. Many operators have monitoring and logging on paper — but no one is watching, no alerts, no rules, no one investigating. Assume someone may already be inside and build the visibility to find them. Even an old-school honeypot — a decoy “crown jewel” asset — will surface an intruder who’s already resident.

The AI Rush and IT/OT Convergence

The back half of the briefing came straight from the conference floor. The entire agenda in Houston was AI and data — predictive maintenance, drilling optimization, reservoir modeling, AI-driven completions, and OT data feeding decisions back into the control room. The sector sees enormous value: a projected $200 to $400 billion in cumulative value AI could bring to oil and gas by 2030. But the number that should stop every executive is this — only about 15% of organizations qualify as true AI leaders. The other 85% are experimenting, and many are bolting AI onto data and networks that were never secured for it.

Here’s the structural problem. For decades, oil and gas ran two separate worlds — IT for the business, OT for the physical process, often air-gapped, frequently reporting to entirely different executives. AI collapses that separation, because AI is hungry for data and the most valuable data lives in OT. So the industry is connecting OT to IT, to the cloud, to AI platforms — bridging the two worlds to feed the models. That convergence is the entire value proposition of data-driven operations. It is also the entire security problem. Every connection you build to move OT data toward an AI model is a path an attacker can travel in the opposite direction — from IT, into OT, into the physical process.

AI multiplies the risk two ways. First, it widens the attack surface — every new pipeline from an operational sensor to a cloud model is a new door. Second, when you “close the loop” and let AI-driven decisions act on operations, corrupted data or a poisoned model doesn’t just give a bad answer — it can drive a bad physical action. AI in an operational environment turns a data-integrity problem into a safety problem. And there’s a sharper edge still: AI ruthlessly exposes the weak controls you already have. Over-permissioned accounts that sat harmless for years become live exposures the moment an AI assistant will happily surface data to anyone authorized to ask.

Riding the Wave Without Wiping Out

The panel’s framing was “riding the AI wave” — moving fast without wiping out. The wave is real and it isn’t going away, so the question is what separates the operators who ride it from the ones who go under. The answer: segmentation and governance are the surfboard, not the drag. The organizations that ride it well build their connections deliberately, with control over what data flows where and who can touch it. The ones who wipe out connect everything to everything to move fast — and build the adversary a highway into the control room.

Going fast and going secure are not opposites here. The same disciplined data architecture that makes an AI model reliable is what keeps it from becoming an attack path. You don’t have to choose between riding the wave and securing it — but you do have to build the board before you paddle out.

Case Study: Colonial Pipeline

To ground all of this, the episode walked the case study every energy executive half-remembers — and the details are the whole lesson. In May 2021, the DarkSide ransomware group got into Colonial Pipeline’s network through a single compromised VPN account — a legacy account with no MFA and a password harvested from an unrelated breach. One credential, no MFA. Once inside, they moved laterally thanks to the lack of segmentation, stole roughly 100GB of data in about two hours, and deployed ransomware that encrypted the corporate IT systems.

Here’s what most people get wrong: the ransomware hit Colonial’s IT network — billing and business systems. It never compromised the OT network, the actual pipeline control systems. And yet Colonial proactively shut the entire pipeline down anyway — because they didn’t know, which tells you they lacked the monitoring and segmentation to prove the OT side was clean. Out of caution to stop the spread, and because the billing systems needed to sell and move fuel were down, an IT-side attack took down physical operations across half the East Coast’s fuel supply without the attackers ever touching a control system. That is the IT/OT convergence lesson in its purest form.

The consequences: a six-day shutdown, fuel shortages and panic-buying across 17 states, gas over $3 a gallon for the first time since 2014, a presidential emergency declaration, and a $4.4 million ransom paid because the CEO — who later testified before Congress — didn’t know how deep the compromise went. The experts’ verdict: preventable. Two basic measures would have stopped it — an access review that would have caught and killed the dormant account, and MFA on that VPN.

And the forward-looking point that ties it to the AI conversation: Colonial happened in 2021 with relatively limited IT/OT connection. The AI rush is deliberately increasing that connection at every operator, building far more pathways between the business network and the operational one. If a lightly connected 2021 network produced Colonial, the densely connected, AI-fed networks being built right now raise the stakes dramatically — unless the segmentation and governance are built deliberately.

The Marching Orders: Securing Your Data

The episode closed on data security — because the first thing DarkSide did at Colonial, before encrypting anything, was steal 100GB of data. Three actions to avoid becoming the next case study:

Fix the Colonial failure first: identity and exposed access.

Don’t let another company’s emergency go to waste. Run the access review, enforce MFA everywhere, and kill dormant and legacy accounts. These are the exact controls that would have stopped Colonial.

Govern your operational data as a security asset, not just an AI input.

Before operational data flows into a model, establish access controls and integrity protections — know who can touch it, prove it hasn’t been tampered with, and control where it goes. Attackers exfiltrate data as their first move; the AI rush concentrates that data and wires it to operations, making governance a security control, not just an AI enabler.

Segment IT from OT and pressure-test the shutdown decision.

This is why you run business continuity and DR functional exercises — not a room full of people talking through a plan, but a real test that creates stress and forces the hard call: We have IT ransomware, we can’t instantly confirm OT is clean — do we shut down or not? That is the exact decision that cost Colonial six days.

OT attacks are crossing from IT into the physical world, the AI rush is widening the attack surface faster than the sector is securing it, and Colonial already showed us how it ends. The opportunity in front of oil and gas is real — hundreds of billions of dollars of it — and so is the risk, because every connection built to reach that value is a connection an adversary can travel the other way. Mission success starts with closing the gap between the AI strategy and the security practice — between the governance on the slide and the segmentation on the network.

Go Deeper: The Operator’s Build-Plan

This episode covers why IT/OT convergence is the defining risk of the AI era in oil and gas. Our companion Sitrep is how you fix it — the operator’s build-plan behind these marching orders: architecting real IT/OT segmentation with a Purdue-style boundary, closing the identity gaps Colonial left open, governing operational data as a security asset, and pressure-testing the shutdown decision before an incident forces the question. If this briefing gave you the landscape, the Sitrep gives you the blueprint.

Trust but verify your own posture. Fix the identity gaps Colonial left wide open. Govern your operational data as a security asset. Segment IT from OT before you ride the wave. Execute the standard.

// DECODED TRANSCRIPT

Access the full text logs of this transmission for compliance and review purposes.

00:00:01:06 – 00:00:07:19
Actual
Welcome to Status Secure, the weekly Cyberthreat briefing for executives who refuse to operate in the blind.

00:00:07:21 – 00:00:20:08
Actual
Hosted by the watcher six collective, uniting former Army Special Forces and Naval Special Warfare communications operators alongside an industry leading CISO nominated for cybersecurity. Woman of the world.

00:00:20:10 – 00:00:27:05
Actual
We cut through the noise and give you the operational intelligence you need for mission success in a hostile digital environment.

00:00:27:07 – 00:00:28:10
Actual
The enemy is listening.

00:00:28:13 – 00:00:32:05
Actual
Is your status secure?

00:00:32:07 – 00:00:52:21
Actual
Welcome to Status Secure. Today we are running a special briefing. CSO just got back from speaking on a panel at the Data Driven Oil and Gas USA 2026 conference in Houston. So we’re going to deep dive on the energy sector. We’re covering the OT attacks across in, crossing from I.T networks into the systems that physically run operations.

00:00:53:02 – 00:01:13:02
Actual
The AI risk reshaping oil and gas as the whole industry races to adapt to it. And everything you need to know about data security in an operational environment. So let’s start with OT. What is happening right now in 2026 with attacks on operational technology. And why shouldn’t why should an organization that isn’t an energy company still be paying attention?

00:01:13:02 – 00:01:38:09
CISO
Yeah. So you know you know, you mentioned it. The attacks of crossing the it ot line. Right. The dominant critical infrastructure pattern of 2026 is ransomware and wiper activity that crosses from IT networks into OT. And so the operational technology, the systems that physically run like the wells, the pipelines, and then we find misfortune nets, threat data found industrial organizations job nearly half.

00:01:38:09 – 00:02:00:10
CISO
So around 45% of ransomware and wiper activity in that measured window. Ransomware as a service. And this is where it gets this is where it’s really causing problems, right? Because before, you know, it would be like a lone attacker, right? A bad actor, maybe a nation state. Now, is ransomware the service you can pay these back actors to actually attack.

00:02:00:12 – 00:02:25:04
CISO
So expanded into OT environments where data theft, extortion and operational disruption now converge into one playbook, right? So when an attack reaches OT, it doesn’t just lock files, it can halt physical production. And so, you know and it’s. And why is that why why is OT so exposed. Right. Because OT was built for reliability and uptime not security.

00:02:25:05 – 00:02:45:21
CISO
These are dead. These are they’re hardware devices that sit right on the pipes, on the walls, right on their utility lines. And and people used to have to go to them to turn them on to make changes. Right. But now they’re connected it to, you know, the, the network and sometimes to the internet. So, you know, it’s increasing.

00:02:45:21 – 00:03:10:06
CISO
So these are legacy systems hard to patch, poorly segmented from it and increasingly connected to the internet for remote access by staff and vendors. And so CTIa, the FBI, the Department of Energy and the EPA issued a joint advisory warning that even unsophisticated hackers are successfully probing ICS instigated systems in the oil and natural gas sector, succeeding through default credentials and exposed remote access.

00:03:10:07 – 00:03:32:02
CISO
And when I tell you I’m not, I I’ve known organizations where you have a field engineer. Right. These aren’t I these aren’t cybersecurity folks. These are field engineers. They go the install the system, and then they leave all the default settings on them, right. For access. So so you know, so it’s easy it’s easy to because you know what the default credentials are for those devices.

00:03:32:08 – 00:03:52:18
CISO
When CTF that sounds the alarm about unsafe, unsophisticated attackers. We’re not even talking about sophisticated ones. These are unsophisticated attackers. The real message is that the basic attacks are still working, and that’s a verdict on the defense. And then you have nation state, nation state. And what they’re doing is pre-positioning. So underneath the opportunists are the nation state actors.

00:03:52:18 – 00:04:28:00
CISO
And then behavior 2026. It’s quite it’s quite pre-positioning. What does that mean. Means get in establish persistent access. Right. So they’re in and they’re constantly in. And then starting to map right. Doing reconnaissance and mapping your operations and then waiting for an opportune time, the most opportune time. So in December of 2025, an active compromise on an icy asset across Poland’s energy sector renewable plant, combined heat and power plant entering through vulnerable internet facing edge devices and deploying wiper malware that damage remote terminal units.

00:04:28:02 – 00:04:54:14
CISO
The, you know, these are the actual equipment on the field. So CSI, as reported this year that I ran has shifted from episodic attacks. Right. So it’s attacking to create, you know, to to create damage, to sustain Pre-positioning. So they’re sitting in our system, like at their end, they’re just sitting there inside energy water transportation network specifically to create meeting risk for future crises.

00:04:54:14 – 00:05:17:02
CISO
So they’re waiting. They’re waiting for the right time. And and just imagine if they’re in multiple, you know, multiple, you know, energy water. I hate the our infrastructure. What kind of attack. They do it all at the same time. Think of the chaos right that they can create. So you know so why does this hit every industry and not just, you know, oil and gas?

00:05:17:04 – 00:05:42:17
CISO
Because they expose edge devices and the flat and segmented network that lets you anticipate ransomware attacks, which is the exact same door that they walk through to physician. And this pattern is not dependent on a sector. Right? It it’s health care, finance, government energy. It’s just where the consequences are most physical and most visible. And because you remember colonial Pipeline, right?

00:05:42:19 – 00:05:45:17
CISO
When they when they got attacked and they had ransomware.

00:05:45:19 – 00:05:47:18
Actual
Yeah. And we’re going to get into Colonial Pipeline.

00:05:47:18 – 00:05:48:05
CISO
Yeah.

00:05:48:06 – 00:06:07:15
Actual
Yeah, yeah, yeah. And so you brought up something that, I had a conversation with an executive at a tech startup, a big one. And, let’s, let’s call it U.S. based startup. Right? And when the thing started happening with Iran in the US, Iran just started these. They’re sophisticated attacks, but it’s sort of like, not what you would think, right?

00:06:07:15 – 00:06:26:16
Actual
Like, they’re not like, okay, now this is where we’re going to hit America. We’re really going to make the country hurt. It’s more of like, we’re just going to hit these US based companies, and we’re just going to do these broad stroke attacks that are very sophisticated. But as you said, it’s odd, right? Because it’s not like we’re going to go take out this as like a piece of, you know, a war tactic.

00:06:26:16 – 00:06:46:15
Actual
It’s just it’s this stuff. And thankfully this, you know, the person I spoke to in the company, the organization that this happened to, they have a really sophisticated cyber team in house, that was able to mitigate that threat. And that’s kind of something you talked about. It’s it’s sort of this odd byproduct of their, their they maybe they have this plan.

00:06:46:21 – 00:07:06:18
Actual
They know what they’re going to do, but they’re just sitting on it, you know, and they’re just kind of waiting for a reason to do something. And even though the dots don’t connect like this isn’t necessarily supporting their war efforts or whatever, but it’s just something that you just kind of never know if someone’s just sitting there. They’ve already pre-positioned themselves, and they just need that one little thing to happen for them to, to execute their attacks.

00:07:06:20 – 00:07:26:08
Actual
And even though we’re focused on energy today, like we said, this isn’t just an energy problem, right? So that it’s not crossover and that pre-positioning playbook reach, it reaches to every sector. My guess before we because we are going to do a deep dive into oil and gas. Give us like that universal version. What does every organization in in the industry do about this.

00:07:26:09 – 00:07:27:06
Actual
Well.

00:07:27:08 – 00:07:56:23
CISO
You know, first you need to understand that this is in every industry, right? Because if you’re running physical operations, which we’re talking about building automation, medical devices, manufacturing, any connected operational equipment has OT and or OT adjacent footprint. And the same, you know, and this is the same convergence with that oil and gas has you know, I don’t know if you’ve heard about the term convergence, but it’s the convergence of, you know, cyber security and physical security, right?

00:07:57:01 – 00:08:17:07
CISO
So a health care has connected medical devices on the same network. Is it manufacturing and logistics run ICS? Even a corporate building has like connected Hvac and access control systems. The lesson is, you know like you run everything remote. Now, that way you don’t have to walk around all of your, you know, all around everywhere to every single device.

00:08:17:11 – 00:08:34:21
CISO
So the lesson energy is learning the hard way that an IT breach becomes a physical problem when the two worlds aren’t separated. I mean, this applies to every, you know, to every organization that connects operation equipment to its IT network. And in 2026, that’s how we win.

00:08:34:23 – 00:08:51:04
Actual
Yeah. And I guess if I’m being a dummy on this one and I’m going, hey, I’ve got this product over here and I installed this product on this thing. Right. But in order to make work happen, we also have these vehicles. But we’ve really ensured this product is secure. But we’re kind of ignoring the vehicles that run the operations or, you know, something of that nature.

00:08:51:06 – 00:09:07:02
Actual
And it can maybe seem like it doesn’t need security or it’s sort of like maybe not, you know? But we’ve got our systems and our computers and our network. You know, we have security here. But like this product we’re installing on this Hvac system and all this stuff, maybe, maybe we kind of aren’t thinking of it from that perspective.

00:09:07:03 – 00:09:19:20
Actual
Right. So so for those listening this week and maybe they’re in that world, they have like, you know, a physical aspect to what they do. How can we close the gap on these OT crossover attacks and the pre-positioning behind them?

00:09:19:21 – 00:09:46:08
CISO
Yeah, I mean, there’s three things that you can do right away, right? The first thing is get your internet facing assets off the public internet. Think, you know, sitting behind MFA. You should always do MFA now, especially if it’s, you know, internet facing MFA and put them you know, behind jump host because nearly every one of these incidents Poland and the CS Advisee the positioning campaign started with exposed internet facing device.

00:09:46:09 – 00:10:07:05
CISO
Right. So inventory everything reachable from the public internet and then and especially anything touching operations or control systems. And I know that people want remote access in order to, you know, in order to do work. And so you don’t have to travel, you know, and that’s part of that’s part of it, you know, the advantage of technology, right?

00:10:07:05 – 00:10:29:05
CISO
But put in your controls, make sure you have MFA, put them behind jump host, not a public IP and a default password from the manufacturer that everybody knows. Single highest leverage actually against both the opportunities and the state actor. Second segment your network. So we can’t spread. There’s so many flat network architectures out there because and you know, people are going to get upset when I say this.

00:10:29:05 – 00:10:49:17
CISO
But you know that’s kind of lazy. That’s lazy networking. You know, you know, the reason an IT compromise becomes an OT catastrophe is really because of your flat network architecture, right? If you segment it and you knew you were compromised in one network, you could you could lock that network down and then the rest of your operations would be fine.

00:10:49:19 – 00:11:14:15
CISO
But when you have a flat architecture, they can move laterally all over your, you know, your network into all of your devices. Okay. So that segmentation is what shrinks the blast radius, you know, when not if something gets in. Okay. And then third, make sure you can detect an intruder who’s already inside Pre-positioning works because the adversary is quiet and most organizations only watch the perimeter.

00:11:14:17 – 00:11:36:14
CISO
Okay. You need monitoring that catches anomalous internal behavior. And in operational environments, detection that actually understands the systems involved, not just it too is pointed at ot. I I’ve seen companies they they say oh we have monitoring and logging. And then when you look you know they do. But nobody’s watching. There’s no alerts, there’s no walls right. To look for suspicious activity.

00:11:36:16 – 00:11:57:19
CISO
And then there is, you know, nobody’s nobody actually investigating. So I always assume that someone may already be inside and build the visibility to find them. You know, create a honeypot. That’s one of the things that’s an old school thing, but it’s like, create it, create, create a, you know, a system that just looks like gold. Okay. The system is our, you know, our critical asset.

00:11:57:23 – 00:12:04:16
CISO
We have to protect it. They’ll go after it. And when you see somebody in there that’s not supposed to be, you know that that’s a bad actor.

00:12:04:18 – 00:12:35:04
Actual
Got it. And you know now you know transitioning. Let’s transition to oil and gas specifically because that entire sector is racing to adopt AI. And and of course then the risks that are associated with that. So convert it in OT networks for example. So you sat on a panel last week at the data driven Oil and Gas, conference in Houston in a room full of energy executives asking or maybe wanting to know how fast they can maybe securely employ or deploy AI across their operations.

00:12:35:10 – 00:12:48:07
Actual
So with that, as a set up, you were, you were in the room. So walk us through kind of the conversation, the risk, and you know, what’s actually happening in that sector and what what really is the security around what’s actually going on.

00:12:48:10 – 00:13:13:17
CISO
Sure. So, you know, the the entire agenda is AI and data, predictive maintenance, drilling, optimization based report modeling and AI driven, completions of data feeding decisions back into control. Basically, they’ve been collecting data now right, since it started putting sensors into their data systems. So they have all this data and they want to feed that data back into the control room to make decisions.

00:13:13:19 – 00:13:37:19
CISO
And she sees enormous value when she notes, I did a projected 200 to 400 billion in cumulative value that I could bring to the sector by 2030. But here’s a number that she’d stop every executive. That same report found only about 15% of organizations qualify as two AI leaders. The other 85% are expanding, and many are, bolting AI onto data and networks never secured for it.

00:13:37:21 – 00:14:07:08
CISO
I tell you, I AI doesn’t doesn’t. It creates a different kind of risk. But it one of the things it does really well is it exposes, your already weak controls. Okay. So if you over permission like before okay. So you our mission user accounts and lets those users actually go look they’re not going to know. Now I, I will find it won’t give that person information that they asked for that they didn’t know they were authorized to have because they were over permission.

00:14:07:10 – 00:14:40:05
CISO
Okay. So it not conventions. For decades, oil and gas had two separate worlds I.T which and business systems, email data and OT the technology that physically runs wells, pipelines and refineries often air gapped AI changes that because AI is hungry for data and the most of our data lives in OT, I can tell you you go to most most organizations, you know, in this sector, you’ll see that there’s a separate there’s a separate IT department and a separate OT department.

00:14:40:05 – 00:15:04:19
CISO
And they report to different executives. Right? Yeah. So they have different objectives and goals. So the industry is connecting OT to it to the cloud and to AI platforms, bridging the two worlds to feed the models. So the technology is converging is is connecting with the OT and IT. They’re not saying that organizations that convergence is the entire value proposition of data driven operations.

00:15:04:21 – 00:15:27:02
CISO
It is also the entire security problem. And we can you build to get OT data to an AI model is a new path. An attacker can travel in the other direction from it into OT, into the physical process. So why I multiply the West two distinct exposures twice? I widens the attack surface. Every new pipeline from an operations center to a cloud model is a new door.

00:15:27:04 – 00:15:45:22
CISO
Second, when you close the loop that AI driven decisions flow back into control room to act on operations, which was a real team at the event. Corrupted data or manipulated model doesn’t just give a bad answer, it can drive a bad physical action. The risk isn’t only that someone steals your data, it’s that someone influence what your AI tells your operations to do.

00:15:46:04 – 00:16:12:20
CISO
AI in an operation, right? It turns a data integrity problem into a safety problem. So you think about that if you’re relying on I like you know, we talked about health care a little bit about that. But in, in, you know, in this industry, if you allow AI to decide when to, when to balance your grid, when to open and close, you know, you know, manufacturing of oil, just imagine.

00:16:12:20 – 00:16:43:10
CISO
Right. You know, what happens if it’s bad. So you know let’s talk about the vocabulary. So ot operational technology in systems running physical operations ICS and skater the industrial control right. The industrial control and supervisory systems inside ot it ot convergence. The bridging of those worlds that AI is accelerating edge devices, the internet facing equipment at remote sites that keep showing up as the entry point, and data governance treated at the event as an AI enabled enablement topic.

00:16:43:11 – 00:17:13:09
CISO
But really, the foundation of whether your AI can be trusted at all. I mean, there’s a lot of terminology. Again, every sector has their own way, like, you know, you can’t get away from that. Everybody loves acronyms for some reason. But and they love their own language. But you just have to understand that this problem, you know, you know, if it crashes all of the, you know, all of the sectors, it multiplies your risk because now it exposes and it exposes your data.

00:17:13:14 – 00:17:29:17
CISO
If you don’t have your controls in place, if your IT systems get infected. Now, your OT systems are also, you know, at risk and vice versa. So it just opens up your, you know, your your exposure. And you have to understand that.

00:17:29:19 – 00:17:50:03
Actual
So on that point you know okay. So we see the problem maybe right. We see the threat. And that’s it’s like okay. Right. And so so the framing or your your panel like the title was riding the AI wave. And so basically moving fast without wiping out. Right. So we’re the wave is here. We’re going to write it, you know, and we understand that there’s a risk right.

00:17:50:07 – 00:18:01:13
Actual
So in that sector, let’s say from a security perspective what separates these organizations that can kind of ride this wave well, as opposed to the ones that are going to get on and then wipe out all set.

00:18:01:15 – 00:18:27:14
CISO
You know, segmentation and governance. You know, you can think of those as your surfboard as you’re riding this way, not the drag. The wave is real. AI is is here and is not going away. And it’s just getting more and more. So I an oil and gas is happening, right? And one of the security should not, you know when the security is, when you are not the organizations that ride it well treat secure data governance and its segmentation as the surfboard.

00:18:27:16 – 00:18:49:05
CISO
So you need to learn how to ride that surfboard. And on any wave they build the connections deliberately with control over what data flows where and who can touch it. So that control you need to control. Like I can the data that it can that that has access to the ones who wipe out connect everything to everything to move fast.

00:18:49:07 – 00:19:12:17
CISO
I told you, I will expose, you know, expose your holes, will expose your vulnerabilities and the build and the, you know, and build the adversary a highway into the control room. So if you move too fast and you don’t put in your, segmentation, your governance, might, you know, about actual use that the point I kept making on the panel is going fast and going secure are not opposites here.

00:19:12:23 – 00:19:30:06
CISO
The same discipline data architecture that makes your AI reliable is what keeps it from becoming an attack path. You know, you don’t have to choose between riding the wave and securing it, but you do have to build the board before you paddle out. And this is, you know, the fundamentals I talk about, you know, you know, security, hygiene, security controls.

00:19:30:06 – 00:19:40:15
CISO
I mean, these don’t these are the same then that you got to be better at doing them thing. That way your surfboard is stronger and can withstand, you know, the waves. Sure.

00:19:40:16 – 00:20:00:16
Actual
And you know, we’re kind of talking about what’s happening now. What are some potential threats, all these things. But let’s kind of ground it a little bit. So let’s let’s go into a case study. And you mentioned it earlier on the Colonial Pipeline incident. So but can you explain to us when these attacks actually happen in this industry, what, what what can actually happen?

00:20:00:17 – 00:20:19:20
CISO
Yeah, sure. That’s you know, I mentioned it earlier, Colonial Pipeline, you know, you know, I mean, this is this this happened in May of 2021, you know, the dark side of last year where the the dark side, we had some a group got into Colonial Pipeline network. They through a separate breach. They had a compromised VPN account.

00:20:19:20 – 00:20:40:18
CISO
Right. Because that VPN account was, legacy accounts. It didn’t have MFA on it. It had a password that they had actually harvested from a, you know, a separate breach to one credential. No MFA. But once they were inside, they moved laterally because, you know, the lack of segmentation stole roughly 100GB of data in about two hours. Right?

00:20:40:18 – 00:21:03:07
CISO
That’s all it took. And deployed ransomware that encrypted the corporate IT systems dealing and operations. And so here’s what most people get wrong. The ransomware hit Colonial’s I.T network, the billing and business systems. It did not compromise on network the actual pipeline control system but colonial okay. So this is where you have to you know, you have to really have a plan and test, right?

00:21:03:07 – 00:21:34:10
CISO
That’s why business continuity testing, right. Exercising your your business continuity plans including a ransomware scenario is so important. Okay. So they got into their IT network. They did not compromised the OT network. So the actual pipeline control systems, but colonial proactively shut the entire pipeline down anyway because they didn’t know, right? They didn’t know. So which tells me that they had, you know, that they did not have good monitoring.

00:21:34:10 – 00:21:58:01
CISO
Right? They did not have a good, you know, handle on their cyber security controls and operations. But so out of caution to stop the ransomware from spreading into OT and because the billing systems need to actually sell unless your were down so an IT side attack took down physical operations. Of course half the east coast fuel supply without the, you know without the attack which I would touching the control systems.

00:21:58:02 – 00:22:25:05
CISO
That is the it ot convergence less in its purest form. Okay. So it went down now OT went down. Okay. Yeah. So that is you know when that that’s that’s the reality. So when I o t I clearly you know I cleanly separated and it compromise becomes an ot shut down but the attacker engineered it and not you know that was it was a six day shutdown fuel shortages and panic buying across 17 states.

00:22:25:10 – 00:22:46:10
CISO
Gas prices over $3 a gallon. This is when gas wasn’t that expensive, right? But it went over 3000 gallon, the highest since 2014. A presidential emergency declaration, a $4.4 million ransom paid because, as the CEO testified, they didn’t know how deep the compromise went or how long recovery would take. Did you hear that? The CEO testified that means he had to go to court.

00:22:46:10 – 00:23:08:14
CISO
He had to go, didn’t he didn’t say he had to go and testify in front of like, you know, I’m sure you know, in DC, right? Because again, look at the impact to, you know, 17 states. How many people was at that. The experts verdict act award. Right. The attack was preventable and the basic protection measures were in place.

00:23:08:20 – 00:23:09:07
Actual
Yes.

00:23:09:09 – 00:23:29:12
CISO
I mean, it was as simple as two things. One, you know, access, review of accounts. There was a legacy account. They could have if they had done a real access review, they would have deactivated account because it was a legacy account. You know, it didn’t have MFA on it. Right? So if they had just turned on MFA and on that VPN account.

00:23:29:14 – 00:23:50:23
CISO
Right. You know, those are two very simple things. And they didn’t do it. So that’s why they were found like, you know, that it was preventable. And when when white decides that something like that was preventable, now you’ve got fines and and poems which are basically action, you know, like remediation actions that you have to take to now connect it to where the actors had it.

00:23:50:23 – 00:24:23:19
CISO
Colonial was 2021 with relatively limited it ot connection and an IT breach still forced forcing ot shut down the. I wish we just discussed is deliberately increasing it in ot connection at every operator building far more you know, building far more pathways between the business network and the operational one. If a flat might be connected 2021 network reduce colonial the densely connected I said networks being built right now raise the stakes dramatically unless the segmentation and governance are built, you know, deliberately.

00:24:23:22 – 00:24:43:06
Actual
Yeah. And I’m going to kind of take this and move on to our next topic because there’s a there’s a part of this example from the Colonial Pipeline incident. Incident, which was in the beginning where they they took 100GB worth of data. Right. And so we’re, we’re going on this episode is the data security in oil and gas.

00:24:43:10 – 00:25:03:13
Actual
Okay. So we covered those OT attacks, covered AI risks. And we walked through colonial with that stolen data. Right. And so what are three things every oil and gas organization maybe, you know, should execute to secure that data to make sure they’re not the next case study. While they’re doing the whole, you know, right in the AI wave.

00:25:03:15 – 00:25:26:09
CISO
Sure. Yeah. It’s worth fixing colonial failure. Right. I mean one firm them it don’t let a good a good emergency go to waste. Right. So you know learn the lessons of the company so that doesn’t happen to yours. Fix the colonial failure. So which is identity and exposed access. Do that first. And you know we talked about that.

00:25:26:09 – 00:25:46:14
CISO
So I’m not going to but you know but there’s a lot of controls around your accounts. Put them in place. Make sure they’re actually working a second that when your operational data as a security asset, not just an AI input, the data governance, you know, it’s so important. A lot of organizations, you know, have been trying to do data governance for for years.

00:25:46:18 – 00:26:06:12
CISO
You need to be, you know, with AI because AI is all data driven. You have to be better at that. So before operational data flows into a model, establish access controls, integrity protections, put those controls in place, know who can touch it, prove it hasn’t been tampered with, and control where it goes. Colonial proofs, attackers actual state data as the first move.

00:26:06:14 – 00:26:28:23
CISO
Yeah, I mean, anybody who gets in, they want your data, right? Because number one, that’s how they went. They, you know, they ransomware, not just your operations but also your data. Hey, if you don’t pay us this, we’re going to put it out on the internet, right in the dark web. We’re going to sell it, right, you know, and then third segment it from OT and pressure test the shutdown decision.

00:26:29:01 – 00:26:48:13
CISO
And again this is why you have business continuity exercises and tests. You have Dr.. You know, function do functional exercises. Don’t just sit together in a room and talk about what you’re going to do after you do a functional test and, you know, go through the steps, make sure that, you know, you create some stress for the folks and make decisions.

00:26:48:13 – 00:27:00:07
CISO
Are we going to shut down everything right? Even even then, we don’t know if they’re if it’s compromised, like walk through those decisions and what does you know. And what does that mean? What you know, what’s the real impact there.

00:27:00:13 – 00:27:23:15
Actual
Yeah. What attacks are crossing from it into the physical world. Right. The AI Russia’s widening the attack surface faster than the sector may be securing it. And the Colonial Pipeline already showed us how it can go. Right. You get an I.T breach, data stolen, have the country’s fuel supply shut down, so on and so on. So the opportunity in front of oil and gas is real and the risk is real.

00:27:23:15 – 00:27:45:04
Actual
There’s a lot of dollars attached to that mission. Success starts with closing the gap between the AI strategy and the security practice, between the governance on the slide and the segmentation on the network. Trust, but verify your own posture. So what you mentioned trust that you have a good plan, but then go put it into practice and verify that that plan actually works.

00:27:45:04 – 00:28:01:16
Actual
That works for you. And so let’s let’s fix those, gaps that we saw in the colonial case study. And then let’s make sure that that situation doesn’t happen to us. So let’s go ahead and execute the standard and we’ll see you next week.

00:28:01:18 – 00:28:05:11
Actual
Mission. Success isn’t about luck. It’s about preparation.

00:28:05:13 – 00:28:08:12
Actual
You’ve heard the Intel. Now go put it to use.

00:28:08:14 – 00:28:15:22
Actual
If you need to verify your security posture. I’ve established a secure line at watcher 6.com/secure.

00:28:16:00 – 00:28:19:00
Actual
Go there to get the briefing the enemy doesn’t want you to have.

00:28:19:02 – 00:28:22:08
Actual
We’ll see you next week. Until then, keep your head on a swivel.

JOIN "THE WATCH" //

Receive critical SITREPs, Industry Alerts, and Threat Indicators sent directly to your inbox.

By submitting this form, you agree to our Terms & Conditions and Privacy Policy.

SILENCE THE NOISE. AMPLIFY THE SIGNAL.

INTELLIGENCE IS USELESS IF YOU AREN'T LISTENING.

Join The Watch to receive New Episode Alerts, Strategic Breakdowns, and Guest Intel delivered to your inbox.