Actions to mitigate the spread of COVID-19 are forcing organizations in the chemicals and performance technologies industry to increase their reliance on remote access and fewer on-site operational staff, raising cyber security concerns. We talked to Paul Harnick, KPMG’s Global Head of Chemicals, about how the sector is looking to bolster cyber defenses despite the impact of depressed oil prices on capital.

How are the cyber operations of U.S. chemical companies impacted by COVID-19?

Like business and technology leaders worldwide, chemicals Chief Information Security Officers (CISOs) are concerned about keeping their workforce healthy, while at the same time ensuring cyber operations are maintained to protect their information and operational technology (IT and OT). The mantra of “when, not if” attempts will be made to attack systems applies now more than ever.

With COVID-19 leading to disruption throughout the supply chain, many chemical organizations areimplementing a laser focus on cash and working capital and rapidly reviewing their capital spending for the year ahead. Despite the urgent need to maintain security, cyber projects are among those being delayed or cancelled. The operations side of the house is looking to go leaner, with plant turnarounds being reduced or delayed as more social distancing protocols are put in place, resulting in a potential increase in risk to safety and the security of OT landscape.

Finally, older populations are considered to be at a higher risk of complications from the virus. The potential impact of COVID-19 on chemical plant operations is heightened given the average decades-long experience of the plant workforce and the senior engineers with deep business knowledge.

What are the specific cyber concerns for chemical industry IT and OT?

As bad actors seek to take advantage of the situation during this period of reduced operational strength, we anticipate an increasing number of phishing attacks. In fact, the U.S. Federal Bureau of Investigation is warning of an increase in cyber attacks related to COVID-19, including fake CDC and phishing emails,1 and cyber experts in the UK noted that online attacks are increasing and evolving.2 Indeed, cyber adversaries are already taking advantage of the situation, and phishing emails related to COVID-19 are surging along with their malware payloads.3 Typically, the attack vector is through corporate IT, then down into the industrial zone once the bad actor has identified the account of an employee involved in both IT and OT.

Meanwhile, plant systems—including distributed control systems (DCS), supervisory control and data acquisition systems (SCADA) and programmable logic controllers (PLC)—rely on their proprietary vendors to provide support, traditionally on site or from suppliers’ offices. Now stay-at-home orders and social distancing measures are forcing supplier personnel to work remotely, adding even more “hops.” This has impacted a range of activities, from normal maintenance to dedicated projects and, importantly, system security and patching.

How is the industry dealing with increased cyber risk, while at the same time managing the wider COVID-19 challenges?

Every organization is at a different level in its maturity, operational response capabilities and functional security organization. That said, most organizations have invoked their business continuity plans (BCPs) given COVID-19 travel and social distancing restrictions, and they are operating on a skeleton crew in the office. This works for most “corporate” employees who can function remotely with a laptop and VPN access.

However, the risk is potentially increasing at the plant operations level as staffing levels are reduced and remote working is ramped up, pressuring the IT and OT teams that manage those operations. And as mentioned, critical service partners such as DCS, SCADA and PLC providers now also need to operate remotely. Where supply chain contracts already allowed remote access for these outside companies, access is now likely to be even more remote through the vendors’ VPN networks—one further step removed. Security infrastructure at suppliers will also be under additional load as remote workers won’t have traditional access to IT security tools and resources in the offices, elevating the risk of compromise.

In order to accommodate the need for remote work, chemicals organizations are having to increase remote infrastructure usage. However, that means more “holes” in the firewalls in both corporate and OT systems that require monitoring by the cyber security team, and an increased risk that malware, if successfully deployed in an environment, could impact safety, production and operational integrity. Unfortunately, the economic realities of COVID-19 will no doubt continue to have effects on the operational delivery of cyber, as traditional security projects become subject to harsh budgetary reviews.

Meanwhile, from a health and safety perspective, plant operations will look to limit the exposure of workers, including by organizing shifts to keep the same, smaller teams of engineers together to limit widespread COVID-19 exposure, equally where possible they will leverage multiple control rooms (including the training rooms) to reduce exposure and load in the nerve center of plant operations. However, this presents a potential headache should the virus impact one of the teams. Should the virus continue to spread among the workforce, current BCP operations will need to be further adjusted, though in the short term this shift-matching process should provide tactical relief. However, economic pressures (both supply and demand) will necessitate a rethink of operations in the medium term, along with increased pressure for plant turnarounds and maintenance windows (which traditionally have up to three times more staff on the floor) that allow for security patching as well.

Given concerns around the more at-risk older employee demographic, some organizations are kicking off accelerated, extensive documentation of plant operations and critical knowledge from engineers and other key employees. The documentation effort is often in conjunction with a review of the operational safety processes, which focuses on capturing the alarm management logic for plant operations and the need for alarms to be in place.

What considerations should chemical companies keep top of mind as they protect their operations and ensure their BCP plans are as robust as possible?

  • In the short term, consider the need to continue operating with reduced staffing under the BCP longer than anticipated. However, now also is the time to start updating the BCP in light of potential longer-term disruptions, and stress test the BCP for scenarios where multiple disruptions occur at the same time.
  • Accelerate any planned security reviews, including a review of remote access arrangements and procedures for the OT organizations (looking for security quick wins for those who have remote access into the plant environment from the outside) and look at any OT hardening that can be done tactically.
  • Consider whether security operations are robust and able to handle both the IT and OT layers, and where possible, increase the capability of the organization to “look for bad” on the networks.
  • Review the OT risks around delayed patch deployments and the potential vulnerabilities those delays will cause, ensuring that you have compensating controls in place (e.g. ensuring the Safety Instrumented System (SIS) is still islanded from the rest of the network).
  • Plan and conduct remote penetration testing activities to check and secure facilities, especially plant-side VPNs. (The concerns are now that this will need on-going change and expansion, without resources to manage, police changes and continually monitor).
  • Operational efficiency reviews: Conduct BCP/Disaster Recovery reviews with a focus on critical documentation to put “knowledge in heads” on paper and a look at a potential streamlining of plant procedures.
  • Assess ways to help shore up defenses with quick wins, such as BCP or ops documentation reviews, process reviews, and toolsets risk remediation. Ensure best practice sharing across the organization and look to provide appropriate resources to help address the increasing confluence of risk.

By keeping these consideration in mind, along with ensuring regular cyber-readiness reviews, chemical organizations can help keep plants safe and secure while likely developing a number of new, effective ways of working that can be used again in the future.

KPMG Global Energy Institute

The KPMG Global Energy Institute (GEI) is a worldwide knowledge-sharing form on current and emerging industry issues. Launched in 2007, the GEI interacts with over 30,000 members through multiple media channels, including audio and video webcasts, publications and white papers, podcasts, events, and quarterly newsletters. Subscribe today to begin receiving valuable insights covering critical business topics and industry issues by visiting Global Energy Institute.