Controlling the route into offshore industrial systems

The challenge

Offshore oil and gas maintenance can require removable media to move between people and industrial control systems. Security needed to support those tasks while controlling what entered the environment and recording how media was used.

I defined the security architecture and operating guidance for this exposure route within a wider energy-services programme.

What I did

• Designed the maintenance workflow. OPSWAT MetaDefender Kiosk and Core supported inspection of organisationally supplied media at designated stations. The procedure defined four scanning checkpoints: before use, between systems, at shift change and after disconnection.
• Made use traceable. Usage records captured the system, time and purpose of each connection. User identification and scan reports connected inspection results with maintenance activity; policies governed how content was handled.
• Defined administration and response. The design connected OPSWAT Central Management, BeyondTrust privileged support and IBM QRadar monitoring. Security, operational technology (OT) and infrastructure teams had defined responsibilities for station management, controlled administration and escalation.

The outcome

The engagement produced an OT media-control architecture and operating procedure combining scanning, usage records, controlled administration and monitoring integration.

Maintenance teams had a defined process for necessary media transfers, while support teams had responsibilities for maintaining the service and investigating issues. The value was a practical control around an operational dependency, supported by traceability and ownership.

This complemented the hybrid security architecture and vulnerability-management programme, with controls adapted to industrial maintenance.