Security for Oil and Gas: anatomy of defending OT networks against ransomware, sabotage and espionage

Why oil and gas became a priority target for cyber attacks

The oil and gas sector concentrates three characteristics that make it one of the most coveted targets for cyber adversaries: high economic value, national criticality and dependence on industrial automation systems designed decades ago, when the internet and the cyber threat were not part of the risk model. A refinery, a pipeline terminal or a production platform is, at once, a billion-dollar financial asset, a piece of the country's critical infrastructure and an environment where a control failure can cause physical, environmental and human harm. This combination attracts everyone from financially motivated ransomware groups to state-sponsored actors interested in espionage and in pre-positioning for sabotage.

The fundamental difference between protecting a bank and protecting a refinery lies in the nature of what can go wrong. In traditional IT, the worst case is usually data leakage or the unavailability of a service. In OT (Operational Technology), the worst case is the loss of control over a physical process: a valve that should close and does not, a tampered pressure sensor, a bypassed safety interlock logic. That is why, in the oil and gas sector, the classic information-security triad — confidentiality, integrity and availability — is inverted: process availability and integrity come first, and any defense action must be designed so as not to create, in itself, an operational risk.

What is at stake when OT is compromised

Another factor that raises the risk is IT/OT convergence. To gain efficiency — real-time telemetry, predictive maintenance, executive dashboards, ERP integration — companies connected industrial networks that were historically isolated (air-gapped) to the corporate network and, by extension, to the internet. This convergence brought real business value, but it also opened paths that did not exist before. Today, the vast majority of intrusions in OT environments do not begin in OT: they begin in IT, through phishing, a misconfigured VPN, a leaked credential or a compromised supplier, and only then move laterally into the industrial environment. Defending the sector requires accepting this reality: the IT→OT frontier is the real battlefield.

The five threats that most affect refineries, pipelines and platforms

Threats to the oil and gas sector are not abstract. They follow observable patterns, and understanding each vector is the first step to defending. Decripte structures the defense around the five most relevant risks for the sector, described below.

1. Attacks on the OT systems of refining and pipelines

SCADA systems, PLCs (Programmable Logic Controllers), RTUs (Remote Terminal Units) and DCS (Distributed Control Systems) control the physical heart of the operation: distillation-column temperature, pipeline pressure, terminal flow rate, valve opening. Many of these devices use industrial protocols with no native authentication — Modbus, DNP3, classic OPC — designed for reliability, not for security. An attacker with network access to the OT segment can, in theory, send commands that change setpoints or disable alarms. The most dangerous attack does not bring the system down: it keeps it up while subtly manipulating the logic. That is why OT defense prioritizes segregation and visibility within the control network itself.

2. Ransomware with an operational shutdown

Ransomware is today the threat of greatest economic impact for the sector. Even when the malware reaches only the corporate network, the company often decides to stop the operation as a precaution — because it cannot guarantee that OT was not affected. This preventive shutdown, in a refinery or a pipeline terminal, costs millions per day and can have knock-on effects on supply. The attacker's goal is exactly that: to use the criticality of the process as extortion leverage. OT visibility is what allows NOT stopping unnecessarily, taking the leverage away from the criminal.

Three vectors complete the picture. Espionage and theft of strategic data: seismic data, reserves, process formulas and bidding strategies are extremely high-value assets, silently exfiltrated by competitors or state-sponsored actors, often over months without tripping the operation. Cyber sabotage: the pre-positioning scenario, in which the attacker keeps latent access to OT waiting for the moment to cause physical harm — explosions, environmental leaks, supply shortages — is the most serious threat in terms of national security. Supplier compromise: automation integrators, equipment manufacturers and maintenance companies have privileged remote access to OT, and compromising a supplier with an account without MFA is often easier than attacking the plant directly — granting the same access.

The OT security model Decripte applies: zones, conduits and the Purdue model

The backbone of industrial defense is segregation. The international reference standard for automation security is the IEC 62443 series, which organizes the environment into zones (groups of assets with the same criticality level and security requirement) and conduits (the controlled communication channels between zones). Overlaid on this logic is the Purdue Model, which stratifies the operation into levels: from Level 0 (physical sensors and actuators) to Level 4/5 (corporate network and internet), through process control (Levels 1-2), supervision (SCADA/DCS) and an industrial demilitarized zone (IDMZ) between OT and IT.

The industrial IDMZ: the frontier that prevents IT→OT migration

Most serious incidents happen because there is no real frontier between the corporate network and the control network. The IDMZ is that frontier: no traffic should cross directly from IT to OT. Telemetry data that must reach the ERP passes through intermediate servers (data brokers, replicated historians) inside the IDMZ, so that a compromise in IT has no direct path to the PLCs. When Decripte takes on an environment, mapping and hardening this frontier is one of the first priorities.

It is important to stress what segregation is NOT: it is not simply placing a firewall between IT and OT and considering the job done. Real segregation means each zone has its own policy, that the conduits carry only strictly necessary traffic, that monitoring exists inside each zone (not just at the edge) and that remote access — the attackers' preferred vector — is strictly controlled, mediated by jump hosts and audited.

Anatomy of an intrusion into the OT network of a refinery (anonymized real-world example)

Imagine a mid-sized refinery with a corporate network converged with the OT network for real-time telemetry. The attack does not begin in OT — it begins, as almost always, in IT. A spear-phishing email aimed at a process engineer delivers an implant that establishes remote access to their workstation. The workstation, being on the corporate network but having connectivity to the OT engineering workstation (a firewall exception created years earlier 'to make maintenance easier'), becomes the bridge. From there the attacker performs silent reconnaissance: maps the historian, identifies the PLCs, observes the Modbus and OPC protocols in transit. The goal is ransomware with an extortion component through the threat of a shutdown.

What failed and what saved it

What allowed entry was the classic combination: successful phishing, absence of MFA on the engineer's account and an IT→OT firewall rule that should never have existed. What averted the catastrophe was Decripte's OT monitoring: the anomalous traffic between the engineering workstation and the PLCs — mass configuration-read commands that matched no maintenance window — triggered an alert in the SOC. Detection happened in the reconnaissance phase, before encryption and before any process manipulation. The full timeline is detailed in the case-study section below.

How Decripte responds to an industrial incident without stopping the plant

Incident response in OT environments follows a different logic from traditional IT. The principle governing every decision is process safety: no containment action can create a physical risk greater than the attack itself. This means, for example, that isolating OT from IT is almost always safe and desirable, but shutting down a SCADA server or a PLC can push the process into a dangerous state. That is why Decripte works side by side with the plant's operations and engineering, never in isolation.

Surgical containment, not mass shutdown

The first containment action in an OT incident is to cut off propagation at the right point: typically, isolating the corporate network from the control network by reinforcing or closing the IDMZ conduits, while OT keeps operating in a safe, monitored mode. The attacker's path is isolated without shutting down what keeps the plant stable. In parallel, compromised accounts are revoked, third-party access is suspended and the command traffic to the PLCs is inspected in real time.

After containment comes eradication — removing the attacker's access completely, not partially. Poorly done eradication is the most common reason for recurrence: the attacker comes back because a secondary implant, a service account or a supplier access was forgotten. Decripte only declares eradication complete after a forensic analysis that reconstructs the entire access chain. Next, recovery restores systems from validated backups and reintegrates zones in a controlled way, monitoring every step. Finally, the lessons learned become concrete improvements in architecture and detection.

The role of the 24x7 SOC in oil and gas defense

In a sector where the attacker can remain silent for months before acting, continuous detection is what separates the company that discovers the adversary in the reconnaissance phase from the one that discovers it when the ransomware has already detonated. Decripte's 24x7 SOC monitors the IT and OT domains simultaneously, correlating events: an anomalous login on IT followed by unusual traffic toward OT is the kind of signal that, in isolation, goes unnoticed, but that, when correlated, triggers immediate investigation.

The SOC is not just technology — it is a team of analysts who understand the industrial context. Detecting Modbus or DNP3 is different from detecting HTTP traffic: it requires knowing what is normal behavior for a refining process, which maintenance windows are legitimate and which setpoints make sense. This specialization is what reduces false positives to a level where the real alerts are not lost in the noise. The SOC feeds Incident Response directly: when something real happens, there is no context handoff — the same ecosystem that detected already delivers the investigation to the containment team. This continuity is what makes the containment SLA of up to 1 hour feasible.

Compliance and governance: ISO 27001, LGPD and the sector's frameworks

Security in the oil and gas sector is not only technical — it is also regulatory and contractual. The operation is subject to a growing set of governance requirements, and demonstrating security maturity is increasingly a condition for partnerships, public contracts and insurance. Decripte structures compliance so that it reinforces real security, rather than becoming just paper for an audit.

On the LGPD: although the sector's focus is protecting the industrial process, there is a relevant volume of personal data — employees, providers, contracts — subject to the General Data Protection Law and to oversight by the ANPD (National Data Protection Authority). An incident that exposes this data creates a notification obligation and potential sanction. Decripte treats LGPD compliance as part of the security program, integrating it into the incident response plan so that, in the event of a leak, communication to the data subject and to the authority happens within what the law requires.

Pentest with an OT scope: finding the flaw before the attacker finds it

Pentest in the oil and gas context requires extra care. A poorly conducted intrusion test in an OT environment can, in itself, cause an operational incident. That is why Decripte conducts industrial pentests with an adapted methodology: active and aggressive tests are restricted to IT and the IDMZ, while the OT assessment prioritizes architecture analysis, configuration review, segregation validation and passive tests. The goal is to map the path a real attacker would travel — typically from IT to OT — and demonstrate where the frontier fails.

What an oil and gas pentest reveals

Each finding comes with a recommendation prioritized by real risk to the process, not by generic CVSS severity. A vulnerability that opens a path from IT to the PLCs of a critical unit deserves more attention than a nominally high-severity flaw isolated in a segment with no operational impact. This contextual prioritization is what turns the pentest report into an executable action plan.

Where to start: from the free diagnosis to the complete program

The worst time to discover the fragility of your OT architecture is during an incident. The best is now, under controlled conditions. Decripte offers a path of gradual adoption that starts at no cost and evolves according to the maturity and criticality of the environment.

From the diagnosis, the program is structured on the right fronts for your risk: 24x7 SOC for continuous detection across IT and OT, Incident Response with a containment SLA of up to 1 hour to ensure that, when something happens, containment is fast and surgical, Pentest with an industrial scope to find the flaws before the adversary, and Compliance to give governance and regulatory backing to the whole. To talk to a specialist and design the scope, use decripte.io/start or the form at /contato.

Anatomy of an intrusion into the OT network of a refinery (anonymized real-world example)

How Decripte responds to an incident in an oil and gas environment

Industrial incident response follows a non-negotiable rule: no containment action can create a physical risk greater than the attack itself. Every step is coordinated with the plant's process engineering.

1. Triage and IT/OT correlation: the SOC validates the alert, correlates IT and OT signals and quickly determines whether the incident touches the control network or is restricted to the corporate one.
2. Process-safety assessment: before any action, the team assesses the physical impact of each containment option together with operations — shutting down a SCADA server can be more dangerous than the attack.
3. Surgical containment: the attacker's path is isolated at the right point, typically closing the IDMZ conduits between IT and OT, without shutting down what keeps the plant in a safe state, within the containment SLA of up to 1 hour.
4. Access revocation: compromised accounts are disabled, supplier and third-party accesses suspended and the command traffic to PLCs is inspected in real time.
5. Complete eradication with forensics: reconstruction of the access chain to remove all persistence mechanisms — secondary implants, service accounts, forgotten accesses — avoiding recurrence.
6. Controlled recovery: restoration from validated backups and gradual, monitored reintegration of the zones, with IT/OT connectivity resuming only through the hardened conduits.
7. Communication and compliance: management of regulatory obligations (LGPD/ANPD when personal data is exposed) and structured communication to stakeholders, with a documented chronology.
8. Lessons learned and hardening: the root causes become concrete improvements in architecture, access policy and new detection rules in the SOC.

How Decripte structures security for oil and gas

The sector's defense rests on four integrated pillars, which cover prevention, detection and response without leaving OT without visibility or the plant exposed to operational risk.

Recommended plans for Oil and Gas

Frequently asked questions

Sector terms

OT (Operational Technology)

Operational technology — the set of hardware and software that monitors and controls physical industrial processes (PLCs, RTUs, SCADA, DCS). Unlike IT, its priority is availability and process safety, not data confidentiality.

SCADA

Supervisory Control and Data Acquisition — a supervision and data-acquisition system that lets operators monitor and control industrial processes (refining, pipelines, terminals) from control centers.

IEC 62443

A series of international standards for the security of industrial automation and control systems. It defines the zones-and-conduits model that structures the segregation between industrial and corporate networks.

Purdue Model

A reference model that stratifies the industrial operation into levels, from Level 0 (physical sensors and actuators) to Level 4/5 (corporate network and internet), with an industrial IDMZ separating OT from IT.

IDMZ

Industrial demilitarized zone — a controlled frontier between the corporate network and the control network, which prevents direct IT→OT traffic and blocks the migration of a compromise from IT to the industrial systems.

PLC

Programmable Logic Controller — a device that executes the control logic of physical processes (valve opening, pressure and temperature control). Many use protocols with no native authentication, such as Modbus.