Chemical Engineering June 2022 - 32

Feature Report
An Ounce of Prevention:
Cybersecurity and the CPI
As the frequency and sophistication of industrial cyberattacks continue to rise,
chemical companies can follow guidance from industry and government directives to
help define their organization's specific cyber-risk profile
Matthew Baker
and Rachel
Ehlers
Baker Botts, L.L.P.
C
IN BRIEF
THE RISE OF
CYBERSECURITY
CONCERNS
SPECIFIC RISK PROFILES
FOR THE CPI
CYBERATTACKS IN THE
CPI
INDUSTRY LAWS AND
STANDARDS
THE OUNCE OF
PREVENTION
KEY TAKEAWAYS
ybersecurity risk is a key topic for
all companies, due, in part, to recent
high-profile incidents and a
heightened focus from regulatory
agencies. This is of particular importance
to industrial sectors that use technology for
automation, control and information storage.
Critical infrastructure sectors have increasingly
become the targets of cyberattacks
and cyber espionage, and it is now even
more imperative for organizations in the
chemical process industries (CPI) to identify
individualized cyber-risk profiles and ensure
appropriate safeguards are in place relative
to those risks. As the saying goes: an ounce
of [cyber] prevention is worth a pound of
[cyber] cure.
The rise of cybersecurity concerns
Though all industries face some degree
of cyber risk, the chemicals sector carries
unique vulnerabilities. Computer-based automated
industrial control systems (ICS) are
widely used by chemical plant owners and
operators to manage and run their facilities.
Malicious actors, be they nation states,
business rivals or cybercriminals
intent on
blackmail, are deploying
a range of tools - both
new and old, common
and extraordinary - to
exploit vulnerabilities resulting
from increased
interconnectedness
between operational
technology (OT) and
information technology
(IT) systems (Figure 1).
Successful exploitation
of these vulnerabilities
can create
business disruptions
and inhibit the use of
equipment. They can
32
also result in the theft of proprietary information,
such
as chemical formulations,
customer data or personal information, and
ultimately cause significant damage - system
damage, reputational damage or even
physical damage or safety risks, depending
on the process. Threat actors see CPI organizations
as high-value targets precisely
because of the potential cost, both financial
and reputational, to the owner or operator
should production stop or sensitive data
be stolen.
Furthermore, although cyber incidents are
becoming more sophisticated, the tools and
tactics that attackers use to access systems
remain relatively constant. Some of the
most common attack vectors include: social
engineering attacks, such as email phishing;
exploiting unpatched software vulnerabilities;
and compromising remote desktop
protocols or other external-facing network
ports. Nevertheless, a few troubling trends
are emerging. For example, upon gaining access
to a system, threat actors often spend
considerable time dormant and undetected,
often gaining intelligence on system architecFIGURE
1. The increasingly interconnected nature of CPI facilities and global enterprises
can introduce potential vulnerabilities for cyber threats
CHEMICAL ENGINEERING WWW.CHEMENGONLINE.COM
JUNE 2022
http://WWW.CHEMENGONLINE.COM
Chemical Engineering June 2022

Table of Contents for the Digital Edition of Chemical Engineering June 2022
