This week’s Pipeliners Podcast episode features a rebroadcast of Episode 237 featuring host Russel Treat walking through how each individual pipeliner should think about pipeline cyber security as it relates to supporting their operation. The episode centers on three key areas of threats, understanding, and mitigation.

Russel goes into deep detail about cybersecurity threats, the importance of understanding what the nature of the environment is, and how to have healthy cyber hygiene. In this episode, you will learn the language of cybersecurity professionals, as well as how to reduce your chances of being cyber attacked by controlling your personal risk and personal mitigations by identifying phishing, using VPNs, and having proper password management.

Pipeline Cyber Security: Show Notes, Links, and Insider Terms

• Listen to other Pipeliners Podcasts episodes that discuss cybersecurity.
• ISA develops widely used global standards; certifies professionals; provides education and training; publishes books and technical articles; hosts conferences and exhibits; and provides networking and career development programs for its members and customers around the world. ISA created the ISA Global Cybersecurity Alliance (isa.org/ISAGCA) to advance cybersecurity readiness and awareness in manufacturing and critical infrastructure facilities and processes.
  • The ISA99 standards development committee brings together industrial cyber security experts from across the globe to develop ISA standards on industrial automation and control systems security. This original and ongoing ISA99 work is being utilized by the International Electrotechnical Commission in producing the multi-standard IEC 62443 series.
• NERC (North American Electric Reliability Corporation) is a not-for-profit international regulatory authority whose mission is to assure the effective and efficient reduction of risks to the reliability and security of the grid.
  • CIP (Critical Infrastructure Protection) plan consists of 9 standards and 45 requirements covering the security of electronic perimeters and the protection of critical cyber assets as well as personnel and training, security management, and disaster recovery planning.
• NIST (National Institute of Standards and Technology) is a physical sciences laboratory and a non-regulatory agency of the United States Department of Commerce. Its mission is to promote innovation and industrial competitiveness.
• Ransomware is a type of malware that threatens to publish the victim’s data or perpetually block access to it unless a ransom is paid.
• DOT (Department of Transportation) is a cabinet-level agency of the federal government responsible for helping maintain and develop the nation’s transportation systems and infrastructure.
• FBI (Federal Bureau of Investigation) is the domestic intelligence and security service of the United States and its principal federal law enforcement agency
• PHMSA (Pipeline and Hazardous Materials Safety Administration) is responsible for providing pipeline safety oversight through regulatory rule-making, NTSB recommendations, and other important functions to protect people and the environment through the safe transportation of energy and other hazardous materials.
• FERC (Federal Energy Regulatory Commission) regulates, monitors, and investigates electricity, natural gas, hydropower, oil matters, natural gas pipelines, LNG terminals, hydroelectric dams, electric transmission, energy markets, and pricing.
• EPA (Environmental Protection Agency) is an independent organization within the federal U.S. government designed to take measures to protect people and the environment.
• DHS (Department of Homeland Security) is the U.S. federal executive department responsible for public security.
• Cyber Hygiene is actively keeping your cyberspace clean and clear of anything attempting to gain access to your credentials by using protection tools and tactics. 
• Incident or Exposure is any unauthorized event that could lead to a deviation from normal operation or unauthorized access
• Risk is the likelihood that an attack, incident, or exposure that could occur, and the severity of that impact related to your systems or your organization. Risk is the combination of likelihood and consequence. 
• Threat is the thing that can take advantage of, use, or cause a vulnerability, either intentional or unintentional.
• Vulnerability is a set of conditions that create a weakness that the threat can use and take advantage of.
• Exploit is the means by which a vulnerability is taken advantage of.
• Attack is the result of that exploit or the consequence of a successful exploit.
• Attack Vector is the means or the environment in which it takes place. That could be physical, operational, cyber, etc. 
• Social Engineering are the things you do in order to facilitate or create a vector.
• Zero day attack is an attack between the time a new software vulnerability is discovered and “released into the wild” and the time a software developer releases a patch to fix the problem.
• Cylance develops antivirus programs and computer software that are designed to prevent viruses and malware.
• Phishing is a technique for attempting to acquire sensitive data, such as bank account numbers, through a fraudulent solicitation in email or on a website, in which the perpetrator masquerades as a legitimate business or reputable person.
• VPN (Virtual Private Network) extends a private network across a public network and enables users to send and receive data across shared or public networks as if their computing devices were directly connected to the private network.
• Stuxnet is a type of virus known as a computer worm that targets SCADA systems. It is commonly referred to as the first cyber weapon.
• Colonial Pipeline Cybersecurity Incident: In May 2021, a cyber attack was launched against Colonial Pipeline that eventually resulted in the payment of $4.4 million to resolve the attack. The attackers gained access to Colonial’s systems and data through an unmonitored VPN by stealing a single password.

Pipeline Cyber Security: Full Episode Transcript

Russel Treat: Welcome to the Pipeliners Podcast, episode 383, sponsored by the American Petroleum Institute, driving safety, environmental protection, and sustainability across the natural gas and oil industry through world-class standards and safety programs.

Since its formation as a standard-setting organization in 1919, API has developed more than 800 standards to enhance industry operations worldwide. Find out more about API at api.org.

Be sure and register for the 2025 API Pipeline Control Room and Cybernetics Conference and Expo occurring April 28 to 30th at the Marriott in Downtown Austin, Texas.

This is a valuable opportunity to collaborate and network with more than 800 industry professionals who are working to sustain, transform, and secure essential energy needs across the globe. Visit api.org/pipeline for more information and to register.

[background music]

Announcer: The Pipeliners Podcast, where professionals, Bubba geeks, and industry insiders share their knowledge and experience about technology, projects, and pipeline operations. Now your host, Russel Treat.

Russel: Thanks for listening to the Pipeliners Podcast. I appreciate you taking the time. To show the appreciation, we give away a customized YETI tumbler to one listener every episode.

This week, our winner is Philipp Umlauf at Phillips 66. Congratulations, Philipp. Your YETI’s on its way. To learn how you can win this prize, stick around till the end of the episode.

If you can’t tell by listening to me, my voice is still not right. I’m recovering from a rather nasty sinus infection. Rather than make you guys listen to this particular voice, I decided to look back through the catalog and pull an episode forward.

Episode 237 was “What Every Pipeliner Should Know About Cybersecurity.” It’s one of our most listened to episodes, and I think it’s still pertinent.

This week, Russel Treat, CEO of EnerACT Energy Services joins us to talk about what every pipeliner should know about cybersecurity. Of course, I’m Russel Treat, and yes, this is a conversation with myself.

The purpose of this podcast episode is to share some information on cybersecurity. I’ve done a fair number of episodes on this topic. Mostly, it’s been more about cybersecurity as it relates to pipeline operations. What I wanted to do was an episode that was really more targeted to the individual and what should pipeliners know about cybersecurity.

I actually did this presentation for an association meeting a number of months ago. It was very well-received. There was a lot of Q&A after. Hopefully, this will stir up some thinking. Terms of framework here for this conversation, it’s just me, of course. I’m going to be talking about threats, understanding what the nature of the environment is, and then mitigations.

Cybersecurity has been around since around 2000. The first real committee formation trying to write a standard for cybersecurity was by the ISA in 2002, when the ISA99 committee was formed. It was after the first notable cybersecurity incident that occurred in 2001.

Between 2002 and about the end of 2005, not a whole lot of activity. 2007, ISA issued their first cybersecurity standard. They revised it in 2008. There was a couple other organizations. Most notably NERC CIP came out in 2010. NERC CIP is really targeted primarily to power generators, but there are a number of gas utilities that have adopted it as their cybersecurity approach as well.

In 2010, there was a major cybersecurity incident with a hack called Stuxnet. Some of you may recall this. It was all over the news. It was reported that this particular cybersecurity attack was targeting the Iranian nuclear power program.

Very specifically, it targeted the code in the PLCs that controlled centrifuges. It masked the fact that it was manipulating how those centrifuges were working. It was the first industrial targeted cyber hack.

Following Stuxnet and beginning in about 2013, there began to be a large number of cybersecurity hacks. You can search for this. There’s a whole bunch of them. It was in 2015 that the first power grid hack targeted Ukraine and shut down the Ukrainian electric power grid.

In about this time frame, NIST published its Cybersecurity Framework. The NIST framework is probably the framework most used, particularly in industrial cybersecurity. The threat environment after Stuxnet, a few years later, just really began to escalate.

At this point, if I were to track all this, put it on a timeline, there’s so much going on you couldn’t put it on a timeline. The environment has materially changed over the last 10 years.

Of course, more recently, everybody’s heard about the Colonial incident. I don’t know that everybody understands what occurred there. We certainly know the impact, that Colonial Pipeline was shut down for about a week and had major impact on the gasoline market in the Northeast because Colonial Pipeline delivers about 35 percent of the refined products to the Northeast market. It was a big impact.

The actual hack was a piece of ransomware known as DarkSide. Let me do a couple of definitions for those that might not know. Ransomware is designed to do two things. It’s designed to lock you out from your data, and it’s designed to extract money to give you the keys to get back to your data.

In the Colonial Pipeline incident, Colonial actually paid a fairly significant multimillion dollar ransom. While much of that was recovered — we don’t really know how because that’s not been publicly released — it still was a fairly substantial ransomware hack. You can read a lot more about that.

What’s important for us to know about DarkSide and the Colonial incident is it had major impact shutting down a major pipeline, had major impact on the availability of gasoline and the price of gasoline in that market. There was a multi-agency response. DoT, FBI, PHMSA, FERC, EPA, DHS, they were all involved in the response to this incident.

What many people may not know is that this is not the first time that a ransomware attack has taken a piece of energy infrastructure offline. I’m aware of several. I know that others are probably aware of more. It’s just the first time that it was significant enough to make the national media.

The other thing to understand about the threat and what’s going on with the threat is that it’s no longer individual hackers or one person who’s surfing the dark web, downloading tools, and executing exploits. We’re actually getting to the point where it’s nation-state actors. It’s a major initiative.

Each of the large countries has cybersecurity programs. While I have nothing that I can state or point to to prove this, I would be comfortable stating that we’ve been engaged in a cybersecurity war for some time, with other nations, and that some of these organizations that are doing these exploits, they have lots of resources to do these exploits.

The particular details on Colonial, while I don’t know all the specifics, I know some. It was related to an Internet-facing device and a username/password that had not been removed off the device but where those credentials had been used by that user, other places. Those credentials had been grabbed, if you will, through another hack.

One of the things to be aware of as we talk about all of this is that most of us who have credentials that we’ve used to access Internet websites, there’s a fairly good chance, high chance, that those credentials have been captured through a hack, one of the many hacks of credit card companies, retailers, and so forth.

It’s quite likely that your credentials have made it into the dark web and that people might be using those credentials to try and access things. That’s one of the key things I think is a takeaway from this conversation.

I want to talk a little bit more about DarkSide and ransomware in particular, just so that people understand how these things work. The whole methodology, the whole method, of these kinds of ransomware attacks is some human being has to open up access to the secure network. There’s a lot of ways that’s done.

The most common, most of us are familiar with now, is called phishing. Phishing is where I send an email to you. I make that email look correct and official. I put a link in it and ask you to click on that link.

When you click on that link, what you do is you actually provide permissions, to that link or that external party, to do things. You may be giving somebody permissions outside of your system that you didn’t want to give them.

That’s really what phishing is all about. It’s about sending you an email that looks real, getting you to click through and do something. Then that’s used as an opportunity to create an opening in your security and get in and do something.

The other method is exploiting remotely accessible accounts and systems. Basically, that’s using VPNs, logins to switches, logins to remote desktop. Basically, I’m going to identify an Internet-facing point in your network. Then I’m going to use your credentials without your permission to gain access.

There are tools out there for hackers that enable them to automate that process and use known, good username/passwords that they’ve exploited through other types of hacks, so using your credentials nefariously.

The other thing that’s possible is virtual desktop infrastructure. All this is things I do to get access to your network that are outside of proper permission. In other words, I’m going to exploit your permission. This is why people are asking you to change your passwords frequently. This is why they’re doing multi-factor authentication. It’s to eliminate these kinds of hacks.

What happens is once an exploiter has gained access to the network, they put this ransomware. They inject this code into your network. It starts to encrypt files. It can also grab and export data. It’s a double-extortion tactic.

One is “I’m going to lock your information away from you so you can’t access it.” The other is “I’m going to grab your information and threaten to put it into the public domain,” so a threat for loss of your data and a threat of disclosure of your data.

If you have confidential information, like credit card information or healthcare information or banking information, that’s inside your network, the goal or one of the threats of these perpetrators is to make a threat because their goal is to collect the ransom.

It’s also interesting to note or important to note that some of these perpetrators are using remote desktop access to maintain a persistent presence on networks they’re targeting. A lot of us use remote desktop.

We make pretty extensive use of it in our companies as a mechanism to control who has access. All that is getting into my network. It’s getting into my network with credentials that allow me into the network.

This makes things like setting least use credentials, meaning I’m only going to give you the permissions that you need to do your work. I’m not going to give you elevated permissions. Those kinds of things are super-critical.

Hopefully, this sets a little context around what is the threat landscape and what’s going on, helps us understand why IT is bothering us and making it harder for us to access our tools to do our work. The primary reason they’re doing that is to make it harder for the perpetrators to access the tools and do their work. Anyways, that’s the threat landscape.

Another thing I want to do is I want to do a little decoding. It’s important to understand the language that cybersecurity professionals use. It helps us communicate about situations and communicate about what we’re doing to what I call my cybersecurity hygiene, so what I’m doing to keep myself clean and free from any hangers-on that are trying to get access to my credentials or that sort of thing.

The first definition is incident or exposure. That’s any unauthorized event that could lead to a deviation from normal operation or unauthorized access. For example, if you have credentials and you know those credentials got stolen, then you’d want to report that as an incident.

Likewise, if you inadvertently clicked through something and saw behavior that didn’t look correct or you got an email that didn’t look correct, you want to report those kinds of things. Those are all incidents or exposure. They’re all something that looked weird, for lack of a better term. That’s a technical term there, weird. They look weird.

Another technical term is risk. Risk is the likelihood that an attack, incident, exposure could occur and the severity of that impact related to your systems or your organization.

For those of us in pipelining, and particularly those in integrity management, it’s the same thing. It’s the likelihood of an event, a negative event and adverse events, the likelihood, number one, and number two, the consequence of that exposure or the severity of the impact. It’s the same thing. Risk is the combination of likelihood and consequence.

Threat, so threat’s a generic term in this domain, and it’s really saying the thing that can take advantage of use or cause a vulnerability, either intentional or unintentional. It’s the threat source, threat agent. These are the same terms that can be used interchangeably, but it’s a way to say, “That’s a problem.”

The next will be vulnerability. Vulnerability is a set of conditions that create a weakness that the threat can use and take advantage of, could be a technical weakness, a procedural weakness, or a human weakness.

Then there’s exploit. An exploit is the means by which a vulnerability is taken advantage of. Think of the exploit as the attack. You have a threat. You have a vulnerability. Those two things come together and get actioned, and that’s an exploit. An attack is the result of that exploit. Another way to think of that is the attack is the consequence of a successful exploit.

The attack vector is the means or the environment in which it takes place. That could be physical, it could be operational, it could be cyber, could be a website, etc. It’s like, “What was the source of the exploit that caused the attack?” Hopefully that’s a little helpful.

Ultimately, all of this is about risk management. I like to think of this whole cybersecurity conversation, it’s like putting locks on things. Locks don’t keep thieves out, but they definitely slow thieves down. Thieves are not dumb. They’re going to evaluate, “How hard is it to get through the locks, and how valuable is that thing I can get to if I get through the locks?”

If I’m logging on to a website and it’s a gaming site and it doesn’t have any of my financial information on it or any other identifying information, just a username/login combination, that’s fairly low-risk. If I’m talking about a control system for a multi-state pipeline, that’s fairly high-risk. If I’m talking about the cash transaction part of a banking site, that’s extremely valuable.

There needs to be a correlation between the level of protection and the level of consequence or potential loss associated with a successful exploit. Ultimately, this whole conversation in cybersecurity is about risk management.

How do we mitigate this? What a lot of people probably don’t realize is 95 percent of all successful cyber attacks are caused by a human error. You can say virtually all.

When I’ve done this training, I generally ask the question…I have a friend of mine. One of the things he did in a previous career is he did red team work. Red team work is where a company hires somebody to act as a hacker and try to gain unauthorized access to a control system.

This gentleman, he did a number of these, tens of these. I asked him one time, “How often were you successful?” His answer was, “100 percent of the time.” The question was never, “Could he get access?” The question was always, “What would it take to get access?”

He shared some of the things that they would do. I’m not going to talk about all this on the podcast. Oftentimes it involves some kind of what’s called social engineering. Social engineering are those things you do in order to facilitate or create a vector.

In the Stuxnet exploit, that control system around those centrifuges was completely isolated and inside multiple levels of a secure network. The way that the exploit actually got perpetrated is the nefarious code was put on USB drives and left at various places where workers were known to hang out.

One of those workers grabbed one of those USBs, took it inside, and used it to do some files transfers. When that occurred, that exploit found its way into the network and then notified people outside of the network, “Hey. I’m here. Here’s the way to access me.” That’s one example of social engineering, and there are many others.

How do you address this? What are the mitigations? There are all the technical mitigations. That’s things like firewalls, firewall rules, dual-factor authentication, restricted use, all the things that IT bothers us with when we’re trying to get credentials and access to things to do our job. All of that’s being done to make it harder for the adversaries.

Because 95 percent of the hacks are generally because of some kind of human error, the most important thing is for us, as users, to understand the threat and the nature of the threat and, likewise, for us, as users, to make intelligent use of the systems…

In other words, work with the IT and ICS — IT, information technology; ICS, industrial control system — professionals and realize, whenever we ask for more access, we’re creating more risk.

Intelligent use and understanding the threat. For a lot of us, we’re familiar with various kinds of drills. There are companies out there that’ll do spear phishing emails as tests to support education and just see how soft are we in terms of somebody clicking on something they shouldn’t click on.

One of the other things you can do, if you’re so interested, is listen to some of the Pipeliners Podcast and “Pipeline Technology Podcast” episodes. I’ll put this into the show notes. There’s a number of episodes on both the Pipeliners Podcast and on the Pipeline Technology Podcast where we speak to the ICS pipeline operation-specific cybersecurity issues.

The other thing to be aware of is each of us, as a pipeline professional, one of our fiduciary responsibilities is to operate within these systems in a responsible way. I want to talk a little bit about personal risk and personal mitigation. Talked a lot about phishing. Spear phishing doesn’t work if the people receiving the email don’t click through it.

First thing first. If you get an email and it doesn’t look right or it’s from somebody you don’t know, don’t click on it. Don’t click through on any links. You need to be confident that anything you’re clicking through in an email is safe. If you don’t know, don’t click. That’s the first thing.

The second risk is remote work exploits. Because more of us are working from home and more of us are working remotely, we all should have VPN and dual-factor authentication to get on the VPN.

That includes the vendor community, the sales community, anybody who…If I go into a corporate location with my laptop and I connect out to the Internet to get to my email and I have nefarious code on my laptop, I’m a risk to that company.

One of the key things we need to make sure we do is we make sure our personal cyber hygiene is good. One of the best ways to do that, in terms of mitigating remote work exploits, is make sure that you’re always using a VPN and that you use dual-factor to get connected to the VPN.

Dual-factor is I need my username and password. That’s one factor. The second factor is I respond to a text or something of that nature. One part of it is it’s something I know. The other part is it’s something I have.

The other risk is compromised passwords. I talked about this at the beginning of this conversation, about how most of us probably have username/password credentials that have been gathered up through previous hacks. Each of us should have some kind of practice around our personal password management.

Here’s the first one. It’s the hardest. That is, you should have a unique password for every site you access. You do not want to reuse username/passwords across multiple sites.

The reason for that is — that goes to the Colonial incident — if somebody has gained access to that username/password combination, they can just take that username/password combination, go out there, start hitting websites, and say, “Where is this going to give me access?”

These nation-state-size or -resource actors, they have automation to just…Every time they get a good username/password set, they go see, “Where will it give me access?” When they find good access, they put that in a database for use at a future time.

If I, as an individual, make sure I have a unique username/password every place I have a login, if I find out that my credentials have been hacked on a single site, all I have to do is change my credentials on that site. Those credentials are not going to provide access to anything else that I access.

For example, if I’m using the same username/password on Amazon, Hilton Hotels, American Airlines, and my bank, if American Airlines gets hacked, somebody’s got credentials to get into my bank. I can guarantee you those hackers are going to be trying to gain access that way. First thing about passwords is make sure every login has unique.

The second is make sure you’re using complex passwords. There are tools out there that people can use to force passwords, meaning I’m going to try, very quickly, in an automated way, all the password combinations.

If I’m using six letters and that’s all I’m using, that’s a fairly easy password to brute-force hack. If I’m using 16 characters and it’s a combination of numbers and special characters and random lower and uppercase letters, then what happens is the amount of computing time required to hack that password is so large that it’s just untenable.

There are lots of software packages out there that will allow you to securely manage a library of passwords. I would strongly recommend that you get something like that if you don’t have something like that already.

The last risk is what’s called a zero-day attack. A zero-day attack is a known hack that will work but nobody else knows about it. If I find an exploit that works — it’s a weakness in Windows, or it’s a weakness in the Cisco software that’s used to manage their routers or whatever — if I find it and nobody else knows about it, I have what’s known as a zero-day attack.

What that means is all of the things that we put on our computers in the way of antivirus will be ineffective. Because antiviruses, the exploit first has to exist, and then a corrective action has to happen in the antivirus. There’s a lag time between when a zero-day shows up and when there’s an effective mitigation in the antivirus tools.

There are now antivirus tools out there. One of the ones that we use is a product called Cylance, C-Y-L-A-N-C-E. What it does is it goes on your computer and it monitors all the things that could be exploited and reports out anything that’s a change from normal behavior. It’s a way to identify and quarantine a zero-day attack.

Does require some administrative oversight. Any time you install a new piece of software, there’s a chance that Cylance will block something in it, but it is a way to protect against the zero-day.

That’s a whole lot of cybersecurity information. What are the things that I think it’s important all pipeliners know? Number one, human error is the most common reason for any kind of cyber attack. Two, the way that we protect against that is we work with the IT professionals and we make sure we have good cyber hygiene around phishing, uses of VPNs, uses of username/password combinations.

Hopefully, you guys have found that helpful. As always, we’ll link all these buzzwords and such up with the show notes for the episode. If you have questions or want to reach out, please do so. The best way to do that is to reach out to me on LinkedIn. It’s Russel, R-U-S-S-E-L — just one L in Russel — Treat, T-R-E-A-T. I’m easy to find on LinkedIn.

I hope you enjoyed this week’s episode of the Pipeliners Podcast and our conversation with myself. Just a reminder, you should register to win our Pipeline Podcast YETI tumbler. Simply visit pipelinepodcastnetwork.com/win and enter yourself in the drawing.

[background music]

Russel: If you’d like to support the podcast, best way to do that’s to leave us a review. You can do that wherever you listen. You can find instructions at pipelinepodcastnetwork.com.

If you have topics you’d be interested in or would like to know about, please let me know, either on the Contact Us page at pipelinepodcastnetwork.com or reach out to me on LinkedIn. Thanks for listening. I’ll talk to you next week.

[music]