Comprehensive Risk Classification and Mitigation in the Petroleum Cyber-Physical Systems of the Oil and Gas Industry

ABSTRACT


INTRODUCTION
The product chain of an oil and gas firm is frequently separated into three parts: upstream, midstream, and downstream.The terms upstream and midstream apply to crude oil transportation and storage by pipelines, trains, ships, or trucks, respectively.Finally, completed goods are produced downstream.Industry 4.0 enables the integration of multiple industrial technologies into ICT, remotely maintains Supervisory Control and Data Acquisition (SCADA) systems [1], and supervises operations in real-time via actuators and smart sensors [2].ICS is also utilized to monitor machinery and provide real-time process monitoring [3].
Cyber-physical systems (CPS) have been employed in a range of oil-related tasks, where CPS optimization approaches can aid in petroleum exploration, production, and management [4].
Most oil and gas production facilities are situated in remote locations with challenging weather.For these systems, it is especially important that monitored metrics are communicated through the air, fixed (optic or copper) lines, or satellite.It's also crucial to have remote control of equipment that is installed on-site, such as valves, pumps, hydraulic and pneumatic control systems, safety instrumented systems (SISs), emergency stop systems, and fire detection apparatus.Since all of the systems are run by software, external remote services may act as attack surfaces for intruders aiming to get access to internal network resources from faraway places.Furthermore, remote operations are frequently managed by digital systems, which are susceptible to cyberattacks including hacking, phishing, and malware.One important issue is that hackers may get unauthorized access to the distant system and cause damage or disruption.
Khan et al. [5] released research on dependable IoT-based architectures for the O&G industry.They provide alternative architectures for functional applications in both upstream, middle, and downstream oil field services, as well as security concerns.
The energy industry confronts a wide range of risks and hazards that could interrupt critical supply lines, hurt the environment, or even trigger a financial catastrophe, necessitating dealing with and addressing the problems.In literature, the focus is on cyber-physical attacks.There are very few academic works that specifically address cyber security issues in the oil and gas industries.Nonetheless, some publications address various cyber security dangers to this industry.Hacquebord and Pernet [6] survey risks to the oil and gas industry and present a study of known hacker groups and their cyber-attacks against the oil and gas industry.It issued a survey on (O&G) as cyber threats in the study of Dragos [7] and cataloged cyber organizations and state actors that attack (O&G) facilities.Lobo [8] produced a comprehensive cyber risk technical evaluation tailored for the upstream subsector of the oil and gas industry, and they present an extensive analysis of threats, common assaults, and even catalog an enormous list of upstream cyber-security events.In the study of Radmand et al. [9], they propose a taxonomy of wireless sensor network cyber-security threats in the O&G industries, and they present common wireless network security criteria and link them to probable attacks on wireless networks utilized in O&G ICS.It focuses solely on wireless technologies.The US Department of Energy issued Risk Management Guidance for Energy Infrastructure, which applies to the O&G field [10].In the study of McLaughlin et al. [11], the SCADA system and its detailed architecture were described.The SCADA communication protocols, critical control system protection, and security assessment are also presented.
According to Sergiopoulos et al. [12], there has been no systematic method for documenting, charting, and categorizing cyber security breaches in the oil and gas sector.Furthermore, the historical record highlights the vulnerability of the oil and gas operational technology infrastructure to cyberattacks.
In the petroleum field literature, there is a paucity of risk modeling and feasible mitigation strategies.Also, there is no classification of the full possible risk in the O&G sector.There are currently two categories of risk: 1) risks that are internal or external, and 2) general classifications that include natural disasters, geopolitical conflicts, and operational incidents.These ratings do not address every potential risk and do not emphasize every aspect or cause of risk.Also, there are simply reports, instructions, and guidelines, with no systematic and comprehensive compilation of all relevant hazards and risks.
This study contributes to: 1) risk classification for the entire industry of O&G. 2) classification in terms of the fact that the cyber-physical system is the most important component in the O&G industry and that these hazards are either physical, cyber, or connected to permissibility and authorization for O&G companies.3) proposes a security approach for securing oil and gas zones.The goals of this study are: (1) Recognize potential risks in the oil and gas industry and provide systematic classification.
(2) How to bridge the gap between the risk's awareness and defense by proposing a security solution that led to the mitigation of impact and aid for protection against risks, which is a multifaceted security approach that is divided into three parts.
The paper is organized as follows: Section 2 describes risk classification and distinguishes two types of classification.The first is for the entire (O&G) business, which is based on aspects such as HSE, human, business, and security.The second classification is related to the cyber-physical system in the O&G area.Also, the significance of risk identification and classification, along with some empirical data and a case study, are presented in this section.Section 3 gives an overview of mitigating the impact of risk in petroleum CPS.Section 4 proposes a multifaceted security approach for securing oil and gas zones, which includes three phases, and some challenges for implementing oil and gas standards are highlighted.The discussion and conclusion are presented in sections 5 and 6.

RISK CLASSIFICATION
The petroleum and natural gas industries are complex environments that include onshore and offshore industries, upstream and downstream pipelines, and more.These organizations are all part of the same industry, yet each has its own set of risks and potential hazards to avoid.This industry remains vulnerable to a wide range of risks, including natural disasters, geopolitical tensions, operational incidents, cyberattacks, unauthorized access, etc. Existing classifications are: 1) internal and external risks; and 2) classification in general: natural disasters, geopolitical tensions, and operational incidents.These ratings are in-depth, do not highlight all aspects and causes of risk, and do not cover all risks that may occur.This is why every area of this industry should have comprehensive coverage and analytical studies of concerns, risks, and threats.Through this research, we offer a general classification of the risks that threaten this field, which can be a principle for analytical studies on which each domain is based separately, such as marine oil, land petroleum, or transport.We also propose a classification that is related to the petroleum physical cyber systems, which are the result of integrating the smart technological industry with the petroleum industry.
Our proposed classification is: (1) Risk classification for the entire industry of O&G.
(2) Classification in terms of the fact that the cyberphysical system is the most important component in the O&G industry and that these hazards are either physical, cyber, or connected to permissibility and authorization for O&G firms.

Risk classification for the entire industry of O&G
The field of oil and gas is considered one of the largest vital sectors, which is the backbone of major economies in the world and is linked to the environment and the ocean because its extraction and production are hard work in a difficult environment that may be mountainous, marine, or in rugged areas.Operation in this field is based on human, material, and equipment factors.Our classification of risk is based on those aspects: environment, human, business, and security.

HSE (Health, Safety, and Environment) risks
Health.The O&G sector uses and exposes workers to a variety of large and dangerous products, equipment, and materials.The most typical workplace dangers that affect a worker's health are: (1) Highway car incidents cause 4 out of every 10 workplace fatalities for employees.
(2) According to the OSHA IMIS Database, 3 out of every 5 fatal on-site incidents are caused by being struck by, caught in, or caught between moving objects (such as moving or falling machinery, moving vehicles, high-pressure lines, etc.) [13].
(3) Explosions and Fires: This industry works with combustible gases and vapors like hydrogen sulfide and well gases that can escape from trucks, production equipment, or surface equipment (shale shakers).
(4) Chemical exposure occurs in restricted places such as petroleum storage and other tanks, mud pits, reserve pits, and other dug locations where workers typically operate.Workers are exposed to both health hazards, such as asphyxiation, and harmful chemical products.
Safety.Safety risks may be related to extraction activities, equipment, or humans.As per the United States Department of Labor, oil and gas extraction activities are associated with certain safety risks [13], such as human accidents, vehicle accidents, explosions and fires, equipment hazards, and electrical hazards.
Personnel operating on offshore (O&G) facilities, as well as seafarers in general, are potentially exposed to the unpredictability of wind and sea conditions, vessel motion, noise, vibration, poor air quality, hazardous chemicals, intense physical labor, and cramped workspace [14,15].
Environment.There are four stages of oil and gas exploration and production [16]: (1) A geological and geographical survey is required to determine the potential of an oil well for commercial viability.
(2) Exploration is a critical step for determining rig placement, exploratory drilling, plugging the well, destroying production wells, and so on.
(3) One of the major stages is development and production, which involves platform commissioning, pipeline installation, production drilling, pipeline maintenance, and so on.
(4) Decommissioning is the ultimate stage of oil and gas production.When the well is drained, this includes removing the platform and plugging the well.
All of these stages have a direct impact on the environment [16].Examples include the impact of seismic surveys on aquatic species and the interruption of fisheries.Pollution emissions are affected by rig placement during the exploration stage.Development and production have an impact on operational discharges, accident spillage, and physical disturbances.emissions from operations, other impacts: (1) In the Arctic region and in areas of the sea ice cover, there are untapped potentials for exploration, and there are difficulties and obstacles in extracting hydrocarbons [17].
(2) The use of seismic surveys for exploration has sparked worries about their effects on marine life due to the loud noise they generate.This noise can evict marine species from their habitat, alter their behavior, muddle safety related to equipment and human communication, induce stress, and, at close ranges, even harm their hearing systems [17].
(3) Oil leak incidents occur during oil exploration and transportation in the offshore petroleum industry.The worry with oil leaks is that they cause enormous contamination in the ocean, which causes a variety of economic and environmental issues [18].
According to the United States Department of Labor, oil and gas extraction activities pose: specific environmental and safety risks [13], such as hazardous chemicals, hydrocarbon gases and vapors (HGVs) and low oxygen environments, temperature extremes, and naturally occurring radioactive material (NORM).
(1) Climatic risk: The volume of petroleum operations will be influenced by meteorological circumstances.For example, borehole operations are extremely dangerous when it rains or snows, while petroleum operations are extremely risky when it is extremely hot.
(2) Geologic risk: The structure and complexity of the petroleum pool, its abundance and reserves, its nature, its burial depth, its initial formation pressure, its permeability, its active porosity, its cave and fault conditions, and its underground rock hardness will all have an impact on how well the petroleum operation goes.

Security risks
Cyber.Expanded automation, expanded computer network connectivity, and increased use of cloud computing services expose O&G companies to increasing cyber-security vulnerabilities.
In the study of Mahmoud et al. [19], cyber-attacks are classified as denial of service (DoS) assaults, deception attacks, and replay attacks.In the O&G field, attacks are directed at the operating domain [20].The majority of attacks in this sector are denial of service (DoS) attacks, which endanger system availability by flooding the connecting device with requests to jam communication channels and prevent valid requests [21].In 2012, one of the world's largest oil firms was the victim of a massive cyberattack.Shamoon, a debilitating wiper infection, made tens of thousands of the company's computer servers inoperable [22].Another illustration of the Black Energy malware, which evolved from a trojan to a new piece of malware delivering the KillDisk payload, is a piece of malware that has evolved through time.It targeted the power plant Prykarpattya Oblenergo as well as other Ukrainian electricity distribution companies [23].However, we cannot overlook the ransomware attacks that are increasingly prevalent in multiple sectors.Techniques such as network traffic or system call analysis can be used to detect this type of attack upon its appearance [24].
Piracy.Piracy is regionally based [25], and it is influenced by a number of factors such as unpredictable political environments, ineffective governments, a lack of economic development, poverty, and the capacity to reward in order to prosper [26].By 2007, attacks on offshore infrastructure and piracy had become common in the Gulf of Guinea [27].The offshore petroleum industry has also been impacted by pirate activity off the east coast of Africa.
Terrorism.Oil-producing nations are more susceptible to terrorism because oil installations are prime targets for terrorist attacks that aim to have a greater impact and disrupt the external interests of powerful nations.It makes use of data from the oil industry and terrorist attacks [28].

Human risks
Employees.Quality, operational level, cultural level, personnel age composition, and overall quality are important for the employee in the O&G organization.The lack of these characteristics is the main cause of the risks caused by human errors.Many studies suggest that drilling events are caused by people and that human error has played a substantial role in the prevalence and severity of the consequences [29].
Managers and organizations.Petroleum operations will be impacted by the management skills, charisma, and leadership of managers.These characteristics also relate to organizational risk.Petroleum operations will be impacted by these elements, such as illogical organizational structures, inadequate staffing, and irrational responsibility distribution.Organizational risk will have an impact on the operating period and can impact the economic effectiveness of the company.
Lack of training.Engineers and staff are frequently untrained or undertrained in cyber security [30].

Business risks
Financial risk.Oil and gas are products, and their prices are significantly more volatile than those in other markets.In addition to the actual price of raw materials, the underlying expenses of harvesting and refining natural resources have a considerable impact on their pricing.Furthermore, petroleum operations have a long cycle, a broad geographical dispersion, a huge number of personnel, and a large quantity of funds.
Economic and market risk.Taxation is a key tool for the government to manage oil and gas production, supply, and demand, which directly influence the level of profits of petroleum enterprises.
Supply and demand shocks are a risk for oil and gas firms, especially because energy facilities require large amounts of capital and time to ramp up to full capacity.Concerns have been raised about any disruption in the global supply of oil and gas (O&G), which might have an impact on oil prices and, by extension, the global economy [31].

Physical risks for petroleum CPS
Physical hazards are those that threaten facilities, equipment, and the human factor and cause physical damage to them, such as destruction, burning, and vandalism.In the oil and gas industry, we consider that any damage that may be caused to facilities, storage equipment, storage levels, and transportation equipment is physical damage [32].In this context, we can mention the most important physical risks as follows: Tank attacks.The treated gas and water are held in settling tanks until they may be exported.The oil tank level spoopng Attacks are outfitted with level control sensors that send data to avoid tank overfilling.The major purpose of this approach is to deceive sensors into reporting that the tank level is lower than it actually is [31].
Wellhead production data exfiltration.By using malicious software such as trojans on hacked control station workstations, an attacker could gain access to sensitive information such as wellhead production data.The use of Domain Generation Algorithms (DGA) in creating communications between bots and their Command and Control (C&C) servers is one example that led to obtaining sensitive information [32].
Drone attacks.Physical attacks are also a problem; just recently, a drone attack on the world's largest refinery crippled 5% of the world's global oil supply [33].

Cyber risks for petroleum CPS
Numerous threats were faced upstream, such as during the exploration phase, when malware entered through network storage nodes to steal competitive seismic data for an offshore field that was up for bid.As in the development phase, a predeployed rogue program begins dictating drilling parameters, resulting in well deviation and other well integrity difficulties.Through the production and abandonment phases, a masked worm in SCADA arbitrarily adjusts the speed of motor pumps, resulting in suboptimal production and well damage.
Cyber-attacks are occurring on the industrial control systems (ICS) of O&G firms, putting worker safety, reputation, and operations, as well as the environment, at risk.Whether hackers use spyware to target field bidding data, malware to infect production control systems, or denial of service to block the flow of information through control systems, they are becoming increasingly sophisticated and, particularly concerning, launching coordinated attacks on the industry.In this sense, the following are the most well-known cyber risks: (1) Denial-of-service (DoS) attacks: Unavailability attacks in ICS components can render O&G systems inaccessible if vulnerabilities are successfully exploited [34].
(2) Command Injection: Common network attacks on ICS include blocking or replaying command or reporting messages (DoS) [35].
(3) Data exfiltration: Data exfiltration is the unlawful disclosure of sensitive or confidential information.Data exfiltration can be committed by either an outsider or an insider of a company [36].
(4) Data tampering: An offensive operation may occur within another offensive operation, and the intention is to obscure the larger operation, mislead the data, and deceive the defender [37].It is called data tempering, and we consider it an indirect attack.

Authorization risks for petroleum CPS
This danger is tied to both human and material factors.Any human access to facilities and the use of any material not allowed in the field of exploitation, production, or discipline.Even unauthorized access to data can be used to abuse the lack of cryptography in protocols or communication channels.
Internal authorization and access (employees).
(1) Employees' lack of threat awareness, coercion or blackmail, or even the sale of company security information on the dark web for profit can raise network vulnerability and constitute a critical risk.In 2017, for example, an employee in the Middle East used a USB drive to download and watch a movie on a critical infrastructure computer.The user was unaware that this activity resulted in the distribution of malware later called Copperfield by Nyotron, the company in charge of detecting it.Data leakage, network scanning, and remote control of an ICS workstation were all caused by Copperfield [38].
(2) A risk exists due to the lack of strong authentication and authorization procedures for personnel and any software entities.
(3) Many studies believe that drilling events are caused by humans and that human error has played a significant role in incidence and consequence aggravation.
External access (third parties or foreign and attackers).Third-party SCADA systems must be monitored for dependability risks such as firmware changes, misconfigurations, open ports, communication failures, equipment faults, and others.
The risks here revolve around the possibility of operating these systems remotely, through strangers from the company, or through professional attackers.External remote services may serve as attack surfaces for adversaries seeking to get first access to internal network resources from distant locations [39].
Using the TRISIS framework, Xenotime created a disruption at an O&G plant in Saudi Arabia in 2017.This malware was designed to attack the Triconex safety controllers [7].It employed backdoor malware to shut down the facility's industrial systems.
Table 1 summarizes the most significant and well-known risks associated with the CPS and system structure in the oil and gas industry.
Many studies have cited events and accidents in the O&G industry; we categorized this event using our proposed risk classification in petroleum CPS.Table 2 shows some O&G industry events.-Layer of Processing: The dynamic properties of the intended ICS model must be followed by the ICS procedures [52].
-Sensors: Spoofing attacks that result tank overfill and containment breach -Temperature or pressure sensors: Data tampering attacks -PLC, safety instrumented system, and actuators: DoS attacks -PLC, pumps, actuators: Command injection attacks -controlled simulated attacks: can target all hardware in all layers -Explosion, loss of life, environmental damage -Bad product quality, revenue loss.

Significance of risk identification and classification
Many case studies in the literature that focus on risk analysis and assessment in the oil and gas sector, such as in the studies of Shah et al. [63], Khadem et al. [64], and Zand [65], have proved that risk identification and resource allocation are the basis of the risk management process and the key to the protection action plan.According to Shah et al. [63], constructing new oil and gas pipelines (OGPs) without studying the potential risk factors (RFs) that influence the safety of these pipes creates time and expense overruns in these projects.In the field of oil and gas, to prevent project failure, it is vital to appropriately manage the related risks [64].Reducing future delays and cost overruns in oil and gas projects involves conducting risk analysis and developing risk management measures [65].
Creating safe and secure systems in the oil and gas industry requires detecting and categorizing all types of risk.Risk classification facilitates the definition of roles and duties within the oil and gas organization, as well as the identification of vulnerable regions and their causes.This simplifies risk minimization and protection.The aim of this study is to identify potential risks in the oil and gas sector and to offer a methodical classification based on findings from published research as well as guidelines and reports.
The current risk classification in the literature fails to take into account all relevant industry aspects and elements, such as in the study of Zand [65].The authors conducted a case study to highlight some of the most critical risk elements associated with oil and gas projects, as well as recommendations for risk reduction.The argument is based on publicly available material and covers two independent projects in Iran and Qatar.Furthermore, they provided a framework that suggests recognizing and evaluating risks as early in the project life cycle as is feasible.The types of risk introduced in the study of Zand [65] are construction, operational, regulatory, and financial.They overlooked the human element, as well as the organization's overall safety and security.
In reality, human, material, and equipment aspects are the foundation of operations in the oil and gas sector and power the global economy while being encircled by the natural environment.All activities in the oil and gas sector should be carried out safely and securely.Based on those factorsenvironment, human, business, and security -we categorize risk.Table 3 shows the findings of published papers in each risk class.It is worth noting that the majority of studies focus on cyber security concerns and HSE risks rather than other types of risks.

Figure 1.
The rank of cyber security risk for many countries

Empirical data
According to the Federal Service for Ecological, Technological, and Atomic Supervision's (Russian Federation) analysis, there will be 36 risk events in the oil and gas sector (for Russia) between 2021 and 2022, with a total of 285 firms [68].According to the Allianz Risk Barometer report [69], business interruption and supply chain disruption are ranked as the second greatest risk at 34%.It ranks second only to cyber events (34%), highlighting the significance of the digital economy, the threat of ransomware and extortion, and the rise of cyber-based conflicts.The report notes the close relationship between cyber risk and business interruption.Figure 1 presents the rank of cyber security risk for many countries.
The second classification offered in this study is for CPS, in terms of the fact that the cyber-physical system is the most essential component in the O&G firm and that the risks are either physical, cyber, or related to permissibility and authorization for O&G enterprises.Figure 2 depicts some events in the oil and gas industry; the event information is reported in Table 2.

Case study
Our paper suggested HSE as a risk class for the global oil and gas industry.We use the Qatar Petroleum Organization's Health, Safety, and Environmental Conservation and Protection Policy [70] as a case study.

Figure 2. Some events in the oil and gas industry
We consider that the identification of fears and risks aids in the use of appropriate mitigation solutions and treats the kind of danger and weakness with the appropriate protection and solution.This is the case for Qatar Petroleum (QP), which considers HSE as a type of risk and The QP HSE Regulations for Contractors are documents that address the management of HSE in QP contracts and consist of procedures for managing HSE in contracts and guidelines that outline the overall process while also providing tools, templates, and guidance to QP professionals.Table 4 presents a brief summary of QP HSE regulations for contractors.

Defining Objectives Identifying HSE Risk Mitigation and HSE Rules
To develop and explain the minimal HSE requirements that contractors, workers, and subcontractors must meet while working for QP in order to ensure workplace safety, safeguard the health of all affected parties, and protect the environment.
-Requirement s identification (health, safety) for personal and material requirement, environment requirement.
-Hazard Identification -Risk Assessment and Control.
-Maintain all guarding devices provided by the manufacturer of equipment/machinery to protect personnel from the inherent hazards connected with the operation of spinning machinery.Guiding systems include pulley and v-belt coverings, as well as a grinding disc guard.-Protect humans from harm by creating and maintaining effective defenses against the radiation dangers that arise from these sources.
-List of other rules in the study of Balogun and Andaila [70].

RISK MITIGATION IN THE OIL AND GAS INDUSTRY
History has shown that oil and gas OT infrastructure is susceptible to cyberattacks.Many surveys, such as the study [62], emphasize dangers and risk reduction in different ways and with different goals.Alcaraz and Zeadally [71] discuss CPS vulnerabilities and prospective threats, as well as mitigating remedies.They presented a testbed for finding vulnerabilities in SCADA protocols in the study of Sayegh et al. [49].
An overview of ICS security and protocol-related (Modbus/TCP, DNP3, IEC 61850) and sensor/actuator vulnerabilities is presented, along with recommended security solutions to mitigate their risk [72].
Most statistics indicate that operator error or illegal activity is what causes accidents.Therefore, the petroleum industry should improve staff education and engage in a variety of inspection, advocacy, and communication activities.
Malware mitigation, intrusion, and anomaly detection are suggested for security and privacy in the study of Chen et al. [73].To lower the danger of permitted access, facilities should put strong authentication and authorization procedures in place for all software entities and their workers.
In the study of Marzooq and Rashid [74], they studied ways to raise safety awareness and showed how a person's consciousness and behaviors have a big impact on their safety, actions, and capacity to deal with risks at work.
The O&G industry is strongly encouraged to adhere to standards.In order to make the methods understandable to design engineers, they illustrate IEC61508 compliance in oil and gas applications with an emphasis on steam turbines and provide a strategy for reliability analysis of intricate safetystructured systems [75].
The National Institute of Standards and Technology (NIST) explained by Stouffer et al.The study [47] how organizations should design and implement security programs and security strategies for the Industrial Control System (ICS).It highlighted how existing IT security knowledge, programs, and practices should be coordinated and integrated into new programs.It was suggested that the unique needs and characteristics of ICS technologies and surroundings be taken into account.It is also suggested that organizations regularly examine and update their ICS security plans and procedures to reflect changes in technologies, operations, standards, and regulations, as well as particular facility security demands.
There is a widespread belief among security experts that it is impossible to defend the perimeter of their IT systems, and the focus is shifting from defense to detection and rapid response.The energy sector is vulnerable to a variety of threats that can have serious consequences for operations, safety, and the environment.Some defense approaches and risk management strategies concentrated on basic gaps in the literature and frequently discovered reports from real-world cyberattacks.In the previous part, we classified existing risks in the oil and gas industry into physical, cyber, and authorization categories.To lower each category of risk, we recommend combining associated safety and health standards, as well as cyber and environmental norms and regulations.The most important standard is ISO 20815:2008, an international standard for production assurance and dependability management in the petroleum, petrochemical, and natural gas industries.It includes production assurance principles in drilling, exploitation, processing, and transportation systems and operations.
We can summarize the most important measures, proposals, and recommendations in the field of protecting gas and oil facilities in the following group of points, which we have arranged according to their importance from our point of view: (1) Identify and classify safety and security concerns in O&G firms.
(2) Identify the weaknesses and causes of vulnerability and responsibility.
(3) Setting the safety and security objectives.
(4) Develop a safety and security plan, combining safety with security standards.
(5) Industrial control system availability and integrity are assured with a strong and modern cyber strategy.
(6) Early detection of attacks and managing time for response and defense.
(7) To prevent physical manipulation, employ hardware security safeguards.
(8) Incorporate end-to-end encryption and embedded security in all processes.
(9) Implement authentication and access control mechanisms.
(10) Every facility must implement appropriate network segmentation.
(11) Assure employee training and raise their awareness.

Secured oil and gas zone
A secured zone is a collection of logical or physical assets that all have the same security criteria within the oil and gas organization.A zone has a distinct boundary with other zones.A zone's security policy is often implemented by a combination of measures located both at the zone's perimeter and within the zone.Zones can be hierarchical in the sense that they can be made up of subzones (ANSI/ISA-99.00.01-2007,Security for Industrial Automation and Control Systems, Part 1: Terminology, Concepts, and Models, 29 October 2007).

Phases of the proposed security approach
This subsection proposes a multifaceted approach, which is divided into three parts.The first part identifies systems, architectures, and risks in the oil and gas zone.The second phase involves integrating industrial Next-Generation Firewalls (NGFW) for SCADA and ICS systems.The third phase involves incorporating oil and gas industry standards into the security life cycle of oil and gas zones.Figure 3 depicts the security approach, which focuses on the following security goals: (1) Securing the zone perimeter.
(2) Protect the oil and gas zone from common risks.
(3) Prevents unauthorized access and reduces access to data and resources.

Phase one: Identifying systems, architectures, and risks in the oil and gas zone and gaining visibility over assets
This phase includes recognizing and describing locations, types, quality, and total assets, as well as having complete visibility over OT assets such as field devices, SCADA systems, and network visibility.Also, a complete collection of data and specifications for all PLC, RTU, DCS, and SCADA devices, as well as operating systems and related vulnerabilities, is presented in Table 1.
The segmentation of networks and using various technologies are the most utilized strategies for vulnerability mitigation and control in the sphere of oil and gas [76].We separated the petroleum zone into systems (ICS, SCADA) to boost its security, as mentioned in Figure 3.The objective behind system identification is to partition the system into discrete security subzones and add layers of protection to separate the system's most critical components.Figure 3 presents ICS and SCADA components.
Regarding risk identification as a key task in this phase, we classified risk for petroleum CPS in Section 2 as physical, cyber, and authorization risks.

Phase two: Using Industrial Next-Generation Firewalls (NGFW) for SCADA and ICS systems
A firewall is a network security device that monitors and restricts network traffic based on predefined security rules (Wikipedia).The idea of using industrial NGFWs for secure systems in the oil and gas zone is the cover of the technology's subzone (ICS, SCADA).Next-Generation Firewalls (NGFW) are industrial threat security firewalls that provide visibility, control, and automatic real-time analytics detection.The firewall's objective is to reduce the risk of unwanted access (or network traffic) and adhere to the philosophy of minimum permission and continuous surveillance of all traffic.

How is integrating industrial NGFWs into SCADA and ICS Systems?
Large, complicated systems, such as aged industrial machinery and dispersed networks, can be found in ICS/SCADA environments.In order to design an acceptable solution, it is necessary to analyze the needs and complexity of the ICS and SCADA environments before implementing firewalls.
The ICS and SCADA environments should only allow users to access the designated areas.When moving to a different network level, safeguarding the access by incorporating a firewall on each side prevents unauthorized access.Figure 4 shows ICS and SCADA, which are divided into network levels and are based on the ISA-99 standard.We employed an industrial NGFW with an integrated transparent mode.Traffic is reviewed against ASA firewall policies, such as access rules, in this mode, and any traffic identified for blocking by these policies is dropped.A subset of the traffic is then inspected per FirePOWER inspection policies, and any traffic marked for blocking is deleted.
The implementation of the suggested NGFW integration is based on the following steps: (1) Divide ICS and SCADA into network layers based on the ISA-99 standard.
(3) Logging and inspection of SCADA protocols and ICS by Next Generation SCADA protocols include Distributed Network Protocol Version 3 (DNP3), which can use TCP, UDP, or both.Another option is Modbus/TCP.c) The Open Platform Communications Unified Architecture (OPC UA).
(5) Configuration tasks are completed via the management client.
(5) Deep Packet Inspection.To maintain cyber security and the security lifecycle, the following actions should be completed: (1) Upgrading antivirus signatures.
(2) Applying security updates to Windows servers.
(3) Using intrusion detection systems (IDS) that can detect malicious or suspicious network activity.

Phase three: Integrate oil and gas industry standards into the security life cycle of oil and gas zones
Organizations in the oil and gas industry are increasingly having to deal with many kinds of threats.We proposed in this phase to integrate oil and gas standards into the security life cycle of oil and gas zones.We previously classified risks in the petroleum industry as physical, cyber, and authorization.Figure 5 (assembled by the authors) depicts the risks and related standards for the oil and gas perimeter.
We divided the oil and gas perimeter into three virtual axes: perimeter access, physical perimeter, and cyber perimeter.This phase proposes the protection of those axes and the key standards that may relate.
Protection of perimeter access.There is a requirement for technological measures that monitor entry into petroleum zones.Physical access or logical access is possible, and the organization should address authorization protection.
All oil and gas companies have rules, laws, policies, guidelines, and directives that help them achieve their security goals and objectives.Securing logical access includes authentication procedures, ACLs inside network components, intrusion detection and prevention systems (IDS and IPS) signatures, and situational awareness tools.
For securing physical access, organizations may use the following common procedures to avoid unwanted physical access to perimeters and system impacts: (1) Forbid unauthorized physical access to critical locations.
(2) Forbid unauthorized physical modification, manipulation, theft, or other removal or damage of existing systems, infrastructure, or communications interfaces.
(3) Forbid unauthorized communication eavesdropping, or other potentially detrimental impact, such as a USB memory device, wireless access point, Bluetooth, or cellular device.
(4) Manage access to the ICS and server rooms.
(6) Employing cameras and motion detectors to monitor entry.
(7) Notifying of any device manipulation, such as power removal, device resets, cabling modifications, or the addition or use of removable media devices.
Protection of Physical Perimeter.It is vital to address the physical protection of the petroleum zone, its components, infrastructure, and humans as part of the overall security of the zone's environment.Many zone facilities' security is strongly linked to safety, with the primary purpose of keeping people out of potentially hazardous circumstances while allowing them to conduct their jobs or carry out emergency measures.Physical security controls are any physical measures mandated by organizational rules and directives in accordance with the oil and gas industry's HSE standards.
The key standards for the protection of the physical perimeter are: (1) ISO 45001/2018: The worldwide standard ISO 45001 for occupational health and safety helps shield workers and guests from illnesses and accidents related to their jobs.
(2) API Standard 780 is employed by pipeline operators, which makes it easier to conduct security risk assessments (SRAs), which are intended to identify and reduce hazards.Approved as a suitable anti-terrorism technology by the Department of Homeland Security (DHS).
(3) HSE guidance on managing Industrial Automation and Control Systems (IACS).
Protection of the cyber perimeter.Communication breakdowns and cyberattacks are threats that SCADA and ICS systems must overcome to maintain their safety and dependability.In order to guarantee that SCADA systems in the oil and gas sector are reliable and safe, Gosnadzor [68] offered an examination of the fundamental security and reliability design process.To ensure the design of safe SCADA and ICS, as well as secure operation in oil and gas zones, the IT and OT security lifecycles in the oil and gas sector should be maintained and accorded with a set of security standards.
The key standards of cyber security are: (1) The NIST Cybersecurity Framework is the preeminent framework utilized by organizations across all industries; natural gas and oil companies are increasingly focusing enterprise-wide programs on the NIST CSF.It was used to strengthen critical infrastructure security.
(2) (ISO) 27000: The most well-known standard in the family, it specifies the standards for information security management systems.
(3) ISO 9001: Quality Management System.(4) The International Electrotechnical Commission's (IEC) 62443 is a leading set of standards for industrial control systems (ICS) security.It is widely used in the oil and gas sector and may be used for any kind of ICS.
(7) NIS Directive (EU) 2016/1148.To carry out this phase: (1) Safety procedures and processes need to be defined, including safety procedures for various operations within the perimeter, such as drilling, transportation, and refining.Develop an emergency response plan for various eventualities, such as spills, fires, and accidents.Provide employees training on safety measures and risk awareness.
(2) Compliance: Implement local and international HSE rules and perform regular audits and evaluations.
(3) Measurement: Create customized methods to monitor HSE performance and conduct regular inspections, assessments, and audits.

Challenges
Integrating several oil and gas standards into the security life cycle of zones presents substantial challenges.There is a link between applying safety and cybersecurity requirements and Petroleum and Gas Authority legislation and controls.
(1) Objectives and methods: Aligning standard objectives and procedures is a challenging task.HSE standards are focused on standardizing, preventing, and mitigating the impacts of material and hardware failures or systematic errors that can lead to hazardous occurrences and accidents that endanger the environment and human health.The cybersecurity standard focuses on preventing or mitigating the effects of acts that may jeopardize the confidentiality, integrity, or availability of information or systems.The organization standard focuses on preventing or minimizing unwanted access to systems and data within the oil and gas perimeter using access rules, regulations, and laws.
(2) Standards compliance and application should ensure that cybersecurity measures do not impair functional safety performance or vice versa.Some security measures or techniques, such as encryption or authentication methods, may boost security while also adding delay or complexity to the reaction time or availability of the safety function.
(3) It is critical to undertake a holistic review throughout the lifecycle phases to guarantee that oil and gas standards are integrated and consistent with one another.Close collaboration and coordination are required among the various stakeholders involved in the design, implementation, and testing of industrial systems [77].It also necessitates ongoing monitoring and enhancement of both functional safety and cybersecurity.

DISCUSSION
The oil and gas sector faces a variety of hazards, with cyber being one of the most critical due to the industry's reliance on increasingly interconnected IT and OT systems.For Addressing these difficulties and improving oil and gas cybersecurity are vital for protecting critical infrastructure and systems, ensuring safety, and ensuring the industry's operational continuity.We attempted to close the gap in this field by implementing a thorough risk classification for the domain of oil and gas and highlighting existing mitigation and industry best practices.
The security of assets and key infrastructure in the oil and gas industry is challenging, and no clear and practical solution can truly carry and guard against all risks in this field.
In this study, we presented a multifaceted security approach that is divided into three parts, the first of which is the reconfiguration and assessment of infrastructure that may exist in the oil and gas zone.
The second phase will focus on integrating new-generation industrial firewalls into SCADA and ICS systems in the oil and gas industry.This integration aids in the segmentation of the network of zones into levels so that each one can be secured and separated from the others.Firewalls, strong perimeter defenses, intrusion detection and prevention systems (IDS), and secure network topologies can all help to protect critical systems from unauthorized access.
The final phase focused on meeting and strengthening several oil and gas standards, which can significantly aid in managing ever-changing threats.
The proposed security approach's purpose is to protect vital infrastructure, provide business continuity, avoid cyber threats, manage various risks, and monitor and regulate activities in zone networks.

CONCLUSION
Industrial cyber security is critical for removing many of the main risks associated with the oil and gas industry's new trends and difficulties.To mitigate risks, it is critical to raise awareness of all types of existing dangers.This paper provides a risk classification for the entire industry of O&G and a classification of risk related to the petroleum cyber-physical system.Both risk classifications seek to aid in the establishment of a framework for assessing the complete risk profile of the oil and gas industry, as well as cyber risk connected to CPS in particular.Such profiles could be used to simplify the careful provision of cyber-related insurance coverage for oil and gas facilities.
The paper also bridges the gap between the risk's awareness and defense by presenting long-term mitigations that aid in protection against risks.The proposed security approach ensures the security of the oil and gas perimeter.This approach considers the interconnectivity of physical and digital components within the oil and gas zone, seeking to comprehensively protect all parts within this perimeter.
The proposed solution is a multifaceted security approach that includes the configuration and evaluation of potential infrastructure in the oil and gas zone as an initial phase.In the second phase, the oil and gas industry's SCADA and ICS systems are integrated with industrial new-generation firewalls.that facilitate the division of the zone network into distinct and secure levels and shield vital systems from unwanted access.The final phase concentrated on achieving and reinforcing compliance with oil and gas standards, which can greatly help in handling constantly evolving risks.
For future work, we are planning on implementing the strategy of zero-trust in the oil and gas industry.

Figure 3 .
Figure 3. Multifacated security approach for oil and gas zones

Figure 5 .
Figure 5. Risk in oil and gas zones and related standards: 1) Organization standards for authorization risks 2) cybersecurity standards for cyber risks; and 3) HSE standards for physical risks

Table 1 .
Well-known risks associated with the CPS and system structure in the oil and gas industry [47][48][49]ess control or authentication processes in software used in ICSs[47][48][49]

Table 2 .
Events in oil and gas industry opened from within the Gazprom organization, and the attackers had direct access of the Russian gas supplier's full control system.1999CyberChanges in the historical database, PRV not properly designed and failed to open, caused a pressure spike, pipeline rupture, explosion when an automatic valve shut in a 16' Olympic Pipeline Company gasoline in Bellingham, Washington, USA.Three persons were killed, Property damage was estimated to be $58.5 million.1999CyberPDVSAattackonICS and affect reduction in oil production 2002 Cyber Critical alarms, control instrumentation at British Petroleum's (BP) Texas City refinery presented erroneous indicators, failing to notify operators to the excessive amount of volatile hydrocarbons in the raffinate splitter tower.This caused an explosion that killed 15 people, forced the refinery to close for a year, cost BP $1 billion damages.2005AuthorizationAlarmsandcommunicationson the Baku-Tiblisi-Ceyhan pipeline in Turkey were disrupted, causing over-pressurization and the leaking of more than 30,000 barrels of crude oil.2008PhysicMrMario Azar, an IT consultant who was dissatisfied not hired for post in Pacific Energy Resources' Networks Operations Centre (NOC) in Long Beach, California, but who keeps access rights, stopped the leak detection system on three offshore sites.A single NOC can control up to 50 oil platforms, allowing for a centralized approach.
A Night Dragon attack disabled proxy settings, used remote tools to steal sensitive data, operational production systems (ICS), financial docs pertaining to field exploration, bidding data on the assets.2011AuthorizationShamoonvirus was used to launch a cyber attack against Saudi Aramco, causing damage to at least 30,000 machines.It propagated rapidly and wiped out entire systems while distorting the master boot record, rendering the computer useless.The strike attempted to disrupt Saudi oil and gas production and prevent resources from flowing to international markets.It had no direct influence on oil production, refining, transportation, or safety operations.2012CyberTelevent,a provider of remote administration, monitoring technologies to the energy industry, was the target of an advanced persistent threat that infiltrated its internal firewall and security mechanisms.2012 Authorization Cyber attacks were launched against dozens of Norwegian energy corporations, including Statoil.The attackers have not been recognized, and their intentions are unknown.

Table 3 .
The findings of published papers in each risk class