Anatomy of World Class Cyber Security and the #1 Threat for Oil & Gas Teams

By Michael Hotchkiss, Director of DevOps, W Energy Software

Plan for the worst, and hope everyone else is doing the same.  In the world of cybersecurity, planning for the worst means thoroughly assessing your vulnerabilities, creating a response plan, implementing security controls, and continuously testing them.  The news flow brings many of the bigger cybersecurity breaches to our attention but there are attempts every second of the day across networks worldwide that are successfully thwarted.  That’s because security professionals like myself, CIOs, and IT professionals are disciplined in our approach to planning for the worst.  It’s both an art and a science.

When I hear about large publicly traded companies getting compromised, I immediately wonder what could have gone wrong with the company’s IT Security Policy, which is a living breathing document that encompasses the measures an organization puts in place to defend against threats and, importantly, respond to different “what if” scenarios.  Ransomware is an inevitability these days.  No matter how it gets on the network, impacted organizations should always have a plan to rapidly recover, including routine backups to restore systems to a safe point.  And when I see it taking a week or longer to recover, that just tells me that the company’s IT team neglected to test backups to make sure they’ll work when needed.

Malware and hackers are a very real threat to businesses and individuals.  The data pipelines and systems of the digital oilfield are no exception.  As we move from one news story to the next about the latest cybersecurity attack, I wanted to take a moment to share what W Energy Software is doing to safeguard customer data and what the top threats are for oil & gas teams.

How We Protect Customer Data

W Energy Software delivers software as a service, or SaaS, hosting 100% of our solutions and customer data on the world-class Amazon Web Services (AWS) cloud.  When your solution is delivered as a SaaS solution, reliability of the security apparatus that protects customer data is wholly the responsibility of the vendor.  That’s why W Energy Software takes cybersecurity so seriously.

The world is ever-changing, threats continuously arise.  You don’t have control over that.  But we do have control over our data infrastructure and responses to known and unforeseen threats.  Here’s a look at what goes into W Energy Software’s world-class cybersecurity and the battled-hardened best practices that enable my team and our clients to continuously guard against hacks, malware, and other undesirable situations.

• Storage and encryption – Each client’s data is completely isolated, protected with bank-grade encryption, and only accessible over the web using Secure Sockets Layer (SSL).
• Third-party audits – Our clients benefit from SOC 1 compliant physical and digital infrastructure, which W Energy Software has extended to provide additional application-level controls using technologies such as AWS Web Application Firewall (WAF) and AWS Shield.
• Business continuity – Robust disaster recovery options using technologies such as AWS Simple Storage Service (S3) and Cross-Region Replication.
• Superior knowledge – Every W Energy Software DevOps team member has achieved a minimum of AWS Certified Solutions Architect – Associate, demonstrating extensive expertise of AWS virtual computing and platform services.
• Employee training – Security education starts on day one for every W Energy Software employee, requiring all staff to demonstrate their knowledge of security best practices.
• Continuous testing – We never assume that our code and data backups are stable, which is why we test every backup from our platform to ensure integrity.
• Documented policies – From training and security controls to audits and response plans, our IT Security Policy is meticulously maintained to meet evolving threats head-on.

There are a lot of moving parts to a well-oiled cybersecurity machine.  We just want our clients to know that W Energy Software is the right solution with the right security and right hosting.

Before You Open Your Next E-mail

The #1 threat to your organization’s digital security are endpoints, i.e., employees, contractors, anyone with authorized access to your networks.   Threats include the usual – viruses, trojans, worms, and other types of malware.  The anti-virus software on your PC is one form of endpoint security.  Over the years, bad actors have realized there is money to be made by taking a worm (a self-replicating program that infects a network) and adding code that will disable systems and lock up your business files.  You have to pay big to get it back, which is why it’s called ransomware.

How ransomware gets into your network is an insidious act.

Phishing is a commonly used way to deliver ransomware and you likely get phishing attempts by e-mail almost every day.  the bad actors disguise their payload with brands you know or even people you trust.  Open any of the attachments or click a link to a shady destination and they are in.  Your computer is compromised and then it spreads.

It gets worse.  Most phishing attempts are not targeted, some hacker has spammed thousands of people at once.  It’s a brute force method, which is why there’s a growing threat from spear phishing.  Spear phishing singles people out by directly pursuing and researching valuable targets.  These types of e-mail might be well written, have your name and mention a friend or colleague.  A follow-up by phone can build trust even more, increasing the chance that you’ll open the attached file or website.

Oil & gas organizations should be aware of whale phishing too.  Same idea as spear phishing but the hacker is targeting your leadership and the C suite, all valuable prizes not just in terms of holding operations hostage but also in terms of proprietary data and competitive advantage.

Endpoint security should always be first in line.  Cybersecurity is essential in the digital oilfield and every other industry and it’s not an occasional project – it should be part of your daily operations.  At W Energy Software, it is built into our DNA