American Oil and Gas Reporter - December 2017 - 78

SpecialReport: Insurance Update

Insurance Mitigates Cyber-Related Risk
Lawrence J. Bracken II,
Michael S. Levine
and Geoffrey B. Fehling
ATLANTA-In today's interconnected
society, cyber breaches are inevitable. As
the saying goes, it is not a matter of if,
but when, an organization will be breached.
This is particularly true for businesses in
the energy sector, which is one of the
most frequently targeted industries for
cyber attacks. From producers to pipelines
and refineries, energy companies' computer systems are increasingly at risk of
becoming the target of a sophisticated
and targeted cyberattack, making cyber
risk mitigation paramount.
Oil and gas companies face unique
cyber risks, including a broad array of
direct and indirect losses that can accompany a cyber breach. Companies can
mitigate these risks by employing sound
operational and incident response practices
in conjunction with adequate cyber in-

surance and comprehensive traditional
insurance policies such as pollution liability
and general liability policies. An effective
insurance program should minimize coverage gaps when pollution events, property
damage, bodily injury or business interruptions result from cyber attacks.
A 2017 survey of cyber security risk
managers indicated that implementing
cyber security measures in the U.S. oil
and gas industry lags behind the growth
of digitalization in oil and gas operations.
One report estimated that three of four
oil and gas companies fell victim to at
least one cyber attack last year, as hacking
efforts against the industry became more
frequent and sophisticated.
Technological advancements, while
necessary and important for operational
purposes, may exacerbate the risk of
compromised computer systems. For example, implementing computer-controlled
offshore platforms requires offshore-toonshore communications and other

processes, which are often controlled by
onshore personnel using networked computers. This remote system, while likely
improving safety and decreasing costs,
provides opportunities for would-be hackers to target critical communications, supervisory and support systems.
The complex supply chain further
complicates matters, as each party or innovative technology in the chain presents
a new attack vector or potential "weak
link" for hackers to exploit. In fact, the
most robust encryption and sophisticated
firewalls offer little protection if an
operator or a vendor, supplier or customer
is using a less sophisticated cyber security
system. The complex nature of the oil
and gas industry, which relies on a combination of state-of-the-art technology
and outdated hardware that is often decades
old, also makes cyber security more challenging because of the difficulty of balancing old and new technologies.
Three of the most worrisome attack
vectors include manipulating stock information to dynamically change pricing
information, hacking burner management
systems to engineer oil tank explosions,
and manipulating temperature or pressure
measurements on remote plant equipment
to trigger breakdowns in remote facilities.
Other potential losses include plant shutdowns, service interruptions, facility shutdowns, compromised product quality, undetected spills, bodily injury resulting
from equipment malfunctions, and release
of personally identifiable information,
trade secrets or other financial data.
The bottom line is that new technological features and the interconnectedness
of many operations not only improve efficiency, but also create new and enhanced
risks. Some cyber risks are not limited
solely to lost data or productivity, and
may even result in more serious environmental liability, property damage, or
bodily injury arising from physical damage
or malfunctioning equipment. A robust
insurance program that insures resulting
liability and property losses is an important
part of risk management and mitigation
efforts in the event of a cyber event.
Insuring Residual Risk
The cyber threat landscape has developed so rapidly that it is insufficient to
rely solely on traditional "prevention"
strategies, such as implementing robust

78 THE AMERICAN OIL & GAS REPORTER

http://www.bitco.com

American Oil and Gas Reporter - December 2017

Table of Contents for the Digital Edition of American Oil and Gas Reporter - December 2017