Cybersecurity in the Oil and Gas Industry

The energy sector, which includes the oil and gas industry, is vital to the United States’s economic growth and national security. In March 2023, the Office of Cybersecurity, Energy Security, and Emergency Response noted that the country's “critical infrastructure is facing an unprecedented level of cyber threat” [1]. Cybersecurity is also vital to keeping energy sources such as electrical, nuclear, oil, and gas running. For example, the US Department of Energy works with oil and gas operators to protect critical energy infrastructure from current and future threats.

What are the risks of cybersecurity in the oil and gas industry? Continue reading to explore the answers and learn more about how to start a cybersecurity career to help safeguard the critical infrastructure associated with this industry. 

Why cybersecurity is important in the oil and gas industry?

Like other industries, oil and gas production relies on computers for various operational procedures, including analyzing geographical data, executing drilling operations, safely operating wells, and transporting products for consumer use. 

The oil and gas industry also relies on proprietary information for uninterrupted operations, including protecting industrial control systems. Protecting these assets is important because the sector provides critical energy infrastructure worldwide.

The oil and gas industry also contributes to a nation’s security, fueling economic growth and job creation and helping to keep people and society stable. However, gaps in the production and distribution of oil and gas can conversely threaten production and the lives of people who rely on the energy produced by oil and gas to survive.

What are the risks of cybersecurity in the oil and gas industry? 

The sector relies on complex systems for everything from extraction and refinement to transportation and delivery, increasing potential vulnerabilities at every touchpoint. The oil and gas industry in the US and worldwide has already experienced successful cyberattacks on companies, proving that cybersecurity issues threaten the industry. 

Let’s look at a few examples to highlight the industry's risks.

In 2022, a cyberattack on northern European companies disrupted cargo movement from a significant refining hub in the Netherlands' Amsterdam-Rotterdam-Antwerp (ARA) region to 11 terminals in Germany. The attack came at a time when inventory was already low in Europe, and prices were reaching record highs, putting added pressure on oil and gas markets on the continent.

The ransomware attack was similar to one on an oil and gas company in the US a year earlier. The 2021 attack on Colonial Pipeline shut down 5,500 miles of pipeline as the company attempted to contain the attack. The shutdown led to fuel shortages along the East Coast. Joseph Blount Jr., the company’s CEO, later confirmed to the US Senate’s Homeland Security and Government Affairs Committee that Colonial Pipeline paid a $5 million ransom to regain control of the files held “hostage” by the cybercriminals who attacked its IT network [2].

Cybersecurity careers in the oil and gas industry

The demand for skilled professionals continues growing and will likely continue rising to meet evolving threats. Depending on your interests and skills, you can find various cybersecurity-focused job options in the oil and gas industry. The following list offers a few cybersecurity career options to consider.

1. Cybersecurity engineer

Average annual base salary: $118,972 [3]

Requirements: Typically, a bachelor’s degree in computer science, engineering, business, or information technology at a minimum 

Cybersecurity engineers plan and build systems used to protect electronic information. You might identify potential threats to systems and software and implement potential fixes to protect against hacking, cyber threats, and other security issues.

2. Cybersecurity analyst

Average annual base salary: $104,683 [4]

Requirements: Bachelor’s degree in computer science or information technology

A cybersecurity analyst monitors a company or organization’s IT infrastructure to evaluate threats that could penetrate the network. You might also investigate ways to build the company’s network security and protect it from possible attacks. This position is an entry-level job that can help you get experience in cybersecurity. 

3. Network administrator

Average annual base salary: $79,673 [5]

Requirements: Typically, a bachelor’s degree in computer science or a similar area of study; some employers may accept a postsecondary certificate or associate’s degree

Network administrators install and maintain computer networks and computer systems for the oil and gas company they work for. You might upgrade and repair networks, evaluate system performance, or diagnose and fix problems.

4. Cybersecurity architect

Average annual base salary: $137,876 [6]

Requirements: Usually, a bachelor’s degree is a minimum requirement in engineering, computer science, or a similar subject 

A cybersecurity architect designs the systems needed to prevent and defend against cyberattacks and other intrusions on a computer system. You can also test the system for vulnerabilities or supervise security teams. As a cybersecurity architect, you help safeguard the oil and gas industry from threats and implement robust cybersecurity frameworks. 

5. Penetration tester

Average annual base salary: $104,123 [7]

Requirements: Bachelor’s degree at a minimum in an area of study like engineering or computer science

A penetration tester simulates attacks on a computer system to test it for vulnerabilities and weaknesses. You might work for a company or organization to test out various parts of its systems and give feedback on issues that could become liabilities for the company or places where they may need to build security for more protection.

6. Data protection officer

Average annual base salary: $78,368 [8]

Requirements: A bachelor’s degree in computer science, information security, or a similar subject

A data protection officer sets up the systems protecting a company or organization’s information. The position is required under the General Data Protection Regulation (GDPR) in the European Union but is also becoming more prevalent for companies based in the US. Given the amount of sensitive data that oil and gas companies handle, including data related to employees and the business itself, the sector has a growing need to protect its data. 

7. Incident response manager

Average annual base salary: $85,360 [9] Requirements: Bachelor’s degree in information technology, computer science, or a similar subject

An incident response manager oversees a team responding to cyberattacks and computer crimes by investigating breaches and countermeasures. You may also be responsible for preventative work, such as identifying weaknesses and suggesting ways to protect systems from vulnerabilities.

How to start with cybersecurity in the oil and gas industry

Growing operations, increasing technology adoption, and a mix of remote assets and inadequate cybersecurity controls leave the oil and gas industry vulnerable to cyber criminals. If a cybersecurity career interests you, consider these essential qualifications: 

Education: You will likely need a bachelor’s degree in a technology-focused major, such as electrical or computer engineering, industrial systems engineering, computer science, or multidisciplinary engineering technology. Some positions may also require an advanced degree.

Work experience and skills: It’s vital to build work experience and acquire skills for a career in cybersecurity. You may want to consider getting an internship or gaining experience in the computer science field before moving into a cybersecurity job.

Certifications: Certifications in a specific area can help you build demonstrable skills, potentially giving you a competitive edge. For example, you could pursue options like a Certified Information Systems Auditor (CISA) or a Certified Ethical Hacker (CEH). 

Starting your cybersecurity career

Embracing evolving technologies and digitization leaves the oil and gas industry increasingly vulnerable to cyberattacks. Today’s bad actors want more than just data. They also want to wreak havoc on sensitive, critical infrastructure and gain physical control of the systems. 

Continue learning about cybersecurity with courses on Coursera, many of which provide resume-boosting credentials and opportunities to build in-demand skills. For example, you could check out Foundations of Cybersecurity with Google to work towards a Google Cybersecurity Professional Certificate. The program covers topics such as understanding security ethics and learning about tools used by cybersecurity experts. You can also learn more about Cybersecurity Attack and Defense Fundamentals Specialization with EC-Council on Coursera, which reviews information security attacks and the different steps of a computer forensic investigation.