trending Market Intelligence /marketintelligence/en/news-insights/trending/xqep4mn5rjvuh5yeorp-qq2 content esgSubNav
In This List

US oil, gas industry argues against 'prescriptive' cybersecurity rules

Podcast

Next in Tech | Episode 49: Carbon reduction in cloud

Blog

Using ESG Analysis to Support a Sustainable Future

Research

US utility commissioners: Who they are and how they impact regulation

Blog

Q&A: Datacenters: Energy Hogs or Sustainability Helpers?


US oil, gas industry argues against 'prescriptive' cybersecurity rules

The U.S. oil and natural gas production, transportation and distribution infrastructure is resilient and well-defended against cyberattacks, industry groups argued in a report aimed at staving off "prescriptive standards or regulations" by the Trump administration and Congress.

"Reliance upon voluntary mechanisms including proven frameworks and public-private collaboration, rather than prescriptive standards or regulations, is the best way to bolster the cybersecurity of natural gas and oil companies and the energy infrastructure they operate, and to afford the necessary flexibility and agility to respond to a constantly changing cyber threat landscape," the groups said.

The report is "a reminder to the administration and policymakers on Capitol Hill that the natural gas and oil industry — an industry that provides cleaner, more reliable energy — is committed to investing its own capital to maintain and safeguard its infrastructure," the report added.

The Natural Gas Council, comprising the major gas industry associations, and the broad membership of the Oil and Natural Gas Subsector Coordinating Council, an official body that interacts with federal agencies involved in industry security, released the report Oct. 31.

The Trump administration, in its support for the coal and nuclear power industries, has called into question the readiness of the oil and gas industry to deal with physical and cyber threats. In comments that rankled the gas pipeline industry, President Donald Trump said at a charity dinner in West Virginia in July, "You bomb a pipeline, that's the end of the pipeline. With coal, that stuff is indestructible."

The oil and gas groups highlighted key points for policymakers in their report. Computer and web-based threats "are not new or unique to pipelines," the groups said. "They are present across the energy system, including at coal and nuclear plants."

The groups said the gas system from its upstream end in the production fields to the downstream end at the burner tip is resilient because it is geographically diverse; flexible; and full of fail-safes, redundancies and backups. Pipeline companies have security to protect against "cascading failure" of their systems, including mechanical controls that cannot be overridden through a malicious computer operator. Oil and gas companies ensure that the cybersecurity programs for their information technology and industrial control systems adhere to the best standards, including the National Institute of Standards and Technology framework and standards on industrial automation and control systems.

The five full members of the Natural Gas Council are the American Gas Association, the American Petroleum Institute, the Interstate Natural Gas Association of America, the Independent Petroleum Association of America and the Natural Gas Supply Association. The leader of the council, formed in 1992, changes every year, and the Natural Gas Supply Association heads it in 2018. The groups collectively represent almost all companies that produce, transport and distribute gas consumed in the U.S.

The Pipeline Safety Trust, a safety advocacy group, does not focus on cybersecurity, so it chose not to comment on the report's technical aspects. "From a non-technical standpoint, I would say we hope they are right and they are well-prepared for cyber attacks, although I bet Equifax and Yahoo thought they were ready, too," said Executive Director Carl Weimer.

A recent survey of CEOs representing the entire energy sector indicated that only about half consider their industry to be well-prepared for a cyberattack. An S&P Global Market Intelligence sweep of financial forms filed by Permian Basin oil and gas drillers showed that the companies are concerned about cybersecurity.