Cybersecurity Preparedness for Oil, Gas and Petrochemical Operations

PETRONAS leverages ISA/IEC 62443

PETRONAS, Malaysia’s national oil and gas company, is a dynamic global energy group with presence in more than 100 countries. According to Sharul A. Rashid, PETRONAS GTS head of technical excellence and group technical authority for instrumentation and control, the enterprise-wide cybersecurity program for PETRONAS started in 2018.

“A five-year roadmap toward building an institutionalized capability in OT cybersecurity was crafted and subsequently approved in 2019,” said Rashid. “The institutionalized capability-building program was established mainly to create a culture of cybersecurity and to ensure the ongoing suitability and competence of personnel commensurate with the risk to critical infrastructure. The organizational objectives were: responsibilities; workforce controls; knowledge, skills and abilities; and awareness.

At that time, the task force consisted of Sharul, principal instrument and control (I & C) engineers Azmi Hashim and Michael Ng Chien Han, and senior I & C engineer Ping Yang. All four men helped shape and steer the PETRONAS OT cybersecurity program.

In November 2020, PETRONAS became a founding member of ISAGCA. By February 2021, it started attending ISAGCA Government Relations—Asia Pacific meetings. “We learned that ISAGCA aspired to designate and reference the ISA/IEC 62443 standard in a country’s law and regulatory policy. So, for Malaysia, we started our efforts to support that,” said Rashid.

OT Risk Management for PETRONAS is based on the ISA/IEC 624443-3-2 Standard, said Ng Chien Han. “Cyber risk of an OT system is established by evaluating the business impact of that system, if it is compromised, and the likelihood of that compromise happening. Business impact is evaluated from the lens of how it affects people, environment and assets, as well as the company’s reputation. The likelihood is established via control compliance in addressing threats from a cyber security threat register,” he explained.

In September 2023, “PETRONAS reached a milestone by—for the first time—executing a cybersecurity risk assessment as part of the engineering design stage of a capital project,” Rashid added. “Through the risk assessment, the Security Level Target (SLT) of each OT system of the project was established. This exercise provided the EPCC (Engineering, Procurement, Construction, and Commissioning), OT, and OT vendors with detailed security specifications for the systems being designed. The specifications to be delivered are from the ISA/IEC 62443-3-3 system security requirements and security levels standard in addition to the PETRONAS technical standards,” he explained.

PETRONAS has made good use of the wide range of cybersecurity resources that ISA offers (see sidebar). “Utilizing the ISA/ IEC 62443 standards in engineering design has helped advance cybersecurity discussions with the OT vendors in delivering secured-by-design OT systems. It has also helped PETRONAS as a tool to strengthen the cybersecurity awareness and practices of its partners and collaborators,” said Rashid.