Hydrocarbon Processing - December 2022 - 11

Executive Q&A F. SANJAY
Eaton
Creating trusted environments
ered every day and having strong cybersecurity
protections may not be enough
when attackers shift their attention to
suppliers. The security of a network or a
system is only as strong as its weakest link.
I'd like to underscore two critical lessons
from recent cyberattacks: first, people
are typically the weakest link when it
comes to cybersecurity; and, secondly,
the likelihood of a cyberattack is grossly
underestimated.
The investigative report of a recent
FRANK SANJAY is the Manager of the Product
Cybersecurity Center of Excellence at Eaton,
and a member of the ISA Global Cybersecurity
Alliance. He helps customers by driving Eaton's
" Secure by Design " philosophy in various
intelligent products, providing technical
guidance to global product engineering
teams for implementing cybersecurity. Sanjay
leverages hard-earned practical expertise from
more than 17 yr of hands-on cybersecurity
assessments, technology risk management and
leading highly technical cybersecurity teams.
pipeline breach revealed that attackers
exploited an employee's compromised
credentials. The employee was using the
same credentials for the corporate network
and his personal account. The personal
account was compromised and the
pipeline attackers gained access to that
information and abused it, eventually
halting operations.
The mistaken belief that cybercrimiHydrocarbon
Processing
(HP)
sat
down with Frank Sanjay (FS), Manager
of the Product Cybersecurity Center of
Excellence at Eaton, an intelligent power
management company. In this interview,
Sanjay discussed why addressing cybersecurity
risks is imperative for downstream
refining and petrochemical industries, as
well as how to focus on supply chain cybersecurity,
leveraging emerging cybersecurity
standards to mitigate risk.
HP: What are some of the
key lessons to learn from
recent cyber incidents?
FS: We see malicious cyber activities
increasing. New vulnerabilities are discovnals
need to possess highly sophisticated
skills results in underestimating the likelihood
of a cyberattack. It is often forgotten
that highly sophisticated hackers are
monetizing their skills, offering malware
that can discover vulnerable networks and
selling devices accessible on the internet.
Malicious actors are building tools that
significantly lower the bar for the technical
skills needed to carry out a cyberattack.
A recent advisory by the Cybersecurity
and Infrastructure Security Agency
(CISA) warns about the industrial control
systems attack framework Pipedream,
underscoring the rising cyberthreat to the
energy sector around the world.
HP: What does the hydrocarbon
processing industry (HPI) need
to change in response to recent
cyber incidents?
FS: Executive attention is needed because
cyber risk is not just technology
risk-it is a business risk. Traditionally,
cybersecurity has been treated as a technology
problem, and information technology
(IT) teams often have the responsibility
to mitigate cyber risks. However,
cybersecurity goes far beyond IT.
At Eaton, we believe that cybersecurity
must be viewed from an organizational
perspective, just like quality and safety.
Businesses must engage broader stakeholders,
including operational technology
(OT), supply chain, legal, finance, human
resources and marketing functions.
The implications for cyber breaches are
far-reaching and wide, so it is important to
plug security holes everywhere. IT teams
cannot remediate this problem alone.
In many companies, cybersecurity is
an afterthought. We need to treat cybersecurity
and cyber threats as a risk to be
managed and owned by organizations'
senior leaders and supported by leaders
at every level. Cybersecurity needs to be
part of an overall corporate strategy and
should be embedded deeply into organizational
operations.
At Eaton, we have taken an enterprisewide
approach that promotes the highest
level of defense against emerging cybersecurity
threats. Cybersecurity is part of
our DNA and an integral consideration,
with protocols placed on the people, processes
and technologies within our Secure
Development Lifecycle (SDLC) process.
The process integrates security checkpoints
at various phases of product creation.
Security within SDLC spans from
inception through to deployment and
maintenance, enforcing cybersecurity
best practices via training, threat modeling,
requirements analysis, implementation,
verification and ongoing support.
HP: What are the major
technology cyber risks?
FS: While many OT risks must be addressed,
I believe organizations need to
focus on a few critical areas.
First, ensure all remotely accessible
network connections are managed securely.
This starts with the discovery of all
the remote access points into a company,
the removal of unnecessary connections,
Hydrocarbon Processing | DECEMBER 2022 11
Hydrocarbon Processing - December 2022

Table of Contents for the Digital Edition of Hydrocarbon Processing - December 2022
