For regions outside of conflict or piracy hot spots, cyber security is a primary security risk, according to Dryad Global Analyst Andrea Peniche.

“Importantly, though, this is mostly due to the lack of physical threat from belligerent or criminal actors rather than a larger prominence of cyber threats,” Peniche told Rigzone.

According to the analyst, the larger risk to many offshore oil rigs is that from physical threat. Peniche noted, however, that “while these physical threats encompass the primary threat offshore oil must contend with, cyber security does occupy a secondary place within security considerations”.

The Dryad Global analyst highlighted that offshore oil and gas rigs primarily use the same internet as anyone else to provide communication. The security of this connection is “extremely critical, but not necessarily more than anybody else”, Peniche outlined.

“What is critical is how they have their onboard systems configured. Does someone have access outside of the rig to mechanical rig operations that could cause an environmental disaster (i.e. accessing the drilling mechanism),” Peniche said.

“This accessibility depends on how their different cyber aspects are connected; mechanical functions, communications, information systems,” Peniche added.

“However, a cyber-attack gaining control of drilling mechanisms with the intent of manipulating drilling is more of a terroristic or state actor threat rather than one that would come from regular hackers,” the analyst continued.

Regular cyber-attacks are more likely to either look for information or hold systems ransom as their intent is usually limited to gaining money and their capabilities are also limited to easier systems to hold for ransom, Peniche noted.

“There is a potential for ransom if these mechanical systems are hacked, but they are very hard to bring back online,” Peniche said.

According to Peniche, the targeting of rigs “with terroristic intent” remains low.

“A cyber security attack on drilling mechanisms would … likely cause a major environmental disaster that does not just target the drilling company but would likely also involve massive repercussions for states,” Peniche said.

“For this reason, in the short- to medium-term, this type of cyber security attack is less likely than one on regular computer systems and communications,” Peniche added.