With 25 years’ experience in Information Technology, Rishi has been part of many transformational initiatives. Recently, he deployed one of Canada’s largest cloud interconnect platforms and standardized global security communications, supporting a shift to hybrid multi-cloud for Husky Energy. Rishi has recently joined Check Point as a National Strategist and Evangelist, Office of the CTO.
For CISOs navigating cyber security complexities in the oil and gas sector, this conversation can serve as a compass. In this interview, Check Point Security Architect Rishi Muchalla offers invaluable insights, tactical wisdom and best practices that can shape and enrich infrastructure. Don’t miss this must-know material.
1. Would you like to provide an overview of the critical cyber threats and challenges faced by the oil and gas sector?
The oil and gas sector continues to be plagued with a high volume of threats, typically due to fact that their attack surfaces are so broad. A complex digital infrastructure, from IT, to industrial OT, to retail, makes cyber security a material challenge. In addition, IT teams are just starting to wrap their arms around the OT environment and build relationships that were weak or non-existent in the past. As the digitization of OT systems continues, an increase in cyber risk will be a challenge that will need to be addressed through further collaboration.
2. Across the past few years, we’ve seen several high-profile cyber attacks on this sector. What were some of the lessons learned and how have they influenced the development of new strategies, if at all?
Human error and neglect continue to be a major factor in breaches. Misconfigurations can be an entry point for cyber security attacks. New strategies should include the use of artificial intelligence to ensure errors are caught and remediated. Another takeaway would be to leverage Zero Trust Network Access principles and ensure that multi-factor authentication is used to prove the identity of users.
3. What kinds of cyber security solutions are oil and gas industry professionals keen to implement at this time?
Most organizations are taking a cautious approach by starting with solutions that improve visibility and bring new capability. Accepting new data from previously unmanaged assets enables organizations to make informed decisions and manage vulnerabilities.
4. What challenges are many oil and gas companies facing when it comes to building cyber resilience?
We see several challenges, but two come up quite often. First, is the fact that many of the OT assets are aged and not designed with cyber resilience at the forefront. The second challenge is understanding what needs to be network connected and what systems should remain 'as is'. It’s the old saying of “just because you can, doesn’t mean you should”.
5. Could you share some real-world examples or case studies of successful cyber resilience initiatives within the oil and gas sector?
Although there may be no fully implemented cases of Zero Trust covering an entire Operational Technology environment, there are generally adopted principles of ZTNA across most IT environments.
6. Based on your observations and experiences, what are your recommendations for practitioners in the field?
Reflecting on my 20+ year career, the one thing I can say for certain is that a best of breed approach to building cyber resilience is not easy. Organizations would benefit from adopting a cyber security mesh model and leveraging a vendor that can provide a holistic and consolidated approach to protecting all attack surfaces and threat vectors.
7. How can artificial intelligence and machine learning enhance cyber security measures for oil and gas operations?
In my opinion, AI and ML bring speed and accuracy, unachievable through humans, to a full stack of security tasks, improving uptime for critical service providers. As tasks are automated, humans recover cycles to focus on higher value items like innovation and creativity!
8. In the oil and gas sector, supply chain resilience is critical. How can organizations ensure the cyber security of their supply chain partners?
This will require continued collaboration amongst the regulators and I feel the globalization of security regulations will push us further down this path, especially as the oil and gas sector embraces new technology.
9. How can oil and gas companies stay ahead of regulations and maintain a strong cyber security posture?
That’s a great question. Regulations in this industry are complex, but the security environment doesn’t need to be. A strong cyber security posture begins with the right security strategy. A shift away from best of breed stacks that do not share threat intelligence with one another is a good first step. Look at vendors that provide 0 day threat prevention, autonomous response, continuous compliance and real-time monitoring across all attack surfaces.
10. Is there anything else that you would like to share with the CyberTalk.org audience?
Yes, as a final thought, I believe security solutions need to incorporate speed and accuracy never previously possible until AI and ML. In tough economic and geo-political times, businesses can no longer afford extended downtimes, impact to profitability or damage to brand and reputation.