performing-oil-gas-cybersecurity-assessment

Evaluate IT/OT network segmentation, RTU communication encryption, access controls, continuous monitoring, and patch management against TSA SD-02 requirements. The assessment produces compliance checks with status ratings and gap descriptions mapped to each directive section.

Use passive traffic capture on WAN and serial gateways to confirm unauthenticated DNP3 or cleartext IEC 60870-5-104 rather than active probing. Safety instrumented systems like Triconex should only be observed passively, and any active scans should run inside maintenance windows with operations present.

The assessment covers API 1164 for pipeline SCADA security, TSA Security Directives SD-01 and SD-02, IEC 62443 for industrial control systems, and the NIST Cybersecurity Framework for critical infrastructure.

No, it is scoped to operational technology environments such as SCADA, DCS, and safety systems. It explicitly excludes IT-only corporate network assessments, physical-only security reviews, and environmental compliance assessments.

Flow computers often accept unauthenticated Modbus writes that can alter meter factors and flow calculations, enabling financial fraud at custody transfer points. The assessment confirms read-only behavior by passively observing whether any host issues function codes 06 or 16 to the flow computer.