Organizations in the energy sector have long been on the outside looking in when it comes to cyberattacks. The rise of sophisticated, Internet-connected SCADA systems and hacktivist groups, however, are subverting this safe position: According to SecurityWeek, a new study shows a clear uptick in gas and oil industry cyberattacks in the last year.

Emerging Issues

The study, conducted in November 2015 by Dimensional Research for security firm Tripwire, revealed a significant change in the cyberattack landscape. Eighty-two percent of respondents said their organization experienced “an increase in successful cyberattacks over the past 12 months.”

More worrisome, perhaps, is the short-term outlook: 53 percent of those asked said the rate of cyberattacks increased by 50 to 100 percent in the past month. And 69 percent of oil industry IT professionals said they were “not confident” in their organization’s ability to detect an attack, let alone mitigate the effects.

There are several caveats here. For example, the survey didn’t distinguish between “typical” network attacks and more serious efforts to compromise SCADA systems, and not all IT pros asked were responsible for overseeing these systems. And despite increasing interest from hacker groups, successful SCADA attacks are few and far between, often because these systems are both physically and virtually separate from other network technology.

As noted by IT Risk Strategist Tim Erlin of Tripwire, however, it’s important for the oil and gas industry to address the rise of successful attacks on information technology (IT) since operational technology (OT) could be next in line; with more than 2.3 million miles of oil and gas pipelines in the U.S., a successful SCADA breach could be devastating.

Capping the Well

So how do energy sector companies shut down attackers? One option is to spend more on industrial control system (ICS) and network security technology. As noted by a recent MarketsandMarkets report, the oil and gas security and service market is on an upswing, with spending set to reach almost $34 billion by 2020.

But this spend may be too little, too late: According to Energy Voice, cybercriminals recently managed to cut off electricity for more than 80,000 Ukrainian customers by hacking the country’s energy grid. American companies are no better protected, and the current rise in cyberattacks makes it clear that criminals are actively looking for new targets.

The takeaway here? Throwing money at the problem isn’t a solution. Instead, gas and oil industry companies need to treat both IT and SCADA systems as critical infrastructure assets and assume both could be under attack at any time. Following this assumption is the need to actively monitor both IT and OT environments for strange access behaviors, odd commands and suspicious code. If found, attacks should be sandboxed, analyzed and their data shared with other energy sector enterprises to help ward off future attacks.

Cyberattacks are on the rise in the energy sector; capping this well means giving cyber defense the same priority as physical safeguards.