Conceptual system dynamics model and system archetypes on security improvement in integrated operations for the oil and gas industry

Abstract

The oil and gas industry are moving into Integrated Operations which will reduce costs, increase production and extend the lifetime of mature fields. They are going to achieve this through better utilization of drilling and production data, and close collaboration between offshore and land based personnel. Traditional offshore operations (e.g. drilling production, delivery, etc.) are going to be controlled by onshore control centers, using ICT solutions, and in collaboration with sub contractors and other business partners. This new way of working creates new work processes that have great information security implications. A security incident such as a hacker attack or a virus can for example lead to loss of control of systems or failure of control systems. Some implications can be costly downtime, injuries or loss of life. A conceptual model of a generic oil and gas company has been created and simulations have been run showing the behavior of the system when incidents happen. These incidents affects the resilience of the system, and if severe or if the company does not have proper management policies in place, the system can move into an undesirable state. The main conclusion is that it is important for management to keep a focus on and allocate enough resources for pro active work such as information security. This is especially valid when the system has been hit by an incident and its resilience can be weakened. If not done correctly the system can go into an undesirable state of under performance. These insights are shown in system archetypes.