Oil & Gas IT — SCADA Security · OT/IT Convergence · California Operations

IT security prioritizes confidentiality, integrity, and availability — in that order. OT security inverts the priority: availability comes first because a stopped pump or closed valve has immediate physical and financial consequences. OT systems were designed for reliability over decades, not security, which means they often run legacy operating systems with no patch cycle, cannot tolerate active network scans, and may crash if subjected to standard IT security tools. OT security requires passive monitoring, protocol-aware firewalls, and change management processes synchronized with production schedules rather than IT release calendars.

The core principle is passive-first monitoring. We never use active network scanning tools like Nmap or vulnerability scanners against live OT networks — they can crash PLCs and RTUs. Instead, we deploy passive sensors that observe network traffic without injecting packets. Asset discovery is done through traffic analysis, not probing. Firewall rules and network segmentation changes are staged, tested in equivalent lab environments, and executed during planned maintenance windows coordinated with your operations team. Patch management follows your turnaround schedule, not an IT calendar.

Following the Colonial Pipeline attack, TSA issued Security Directives (SD-02A through subsequent revisions) requiring: identification and protection of critical cyber systems; implementation of specific access control and monitoring measures; development of a Cybersecurity Incident Response Plan (CIRP); and an annual architecture review cycle. PHMSA coordinates with TSA on these requirements. Operators must also maintain data integrity for safety records required during PHMSA inspections. IT Center aligns your SCADA and IT environments to TSA Security Directive requirements and supports your CIRP documentation and testing obligations.

Vendor remote access is one of the highest-risk vectors in OT environments. We implement Privileged Access Management (PAM) specifically scoped to OT vendor access: vendors receive time-limited, just-in-time credentials that expire automatically after each session; all sessions are recorded with full video and keylogging for post-incident review; access is restricted to specific IP ranges and specific target systems; multi-factor authentication is mandatory; and a human approval workflow is required before each session initiates. This applies to OEM vendors from Honeywell, Emerson, ABB, Yokogawa, Rockwell, Schneider Electric, and any other third party accessing your control systems.

Our ICS-CERT aligned incident response plan activates immediately. First action is network isolation of affected segments to prevent spread to OT zones, while maintaining safety system functionality. We assess whether the attack has crossed the IT/OT boundary. If it has, we invoke your Cybersecurity Incident Response Plan (CIRP) and coordinate TSA/PHMSA notification requirements if you are a regulated pipeline operator. Simultaneously, we begin recovery from immutable backups for historian data and execute bare-metal restore procedures for SCADA servers from clean, validated snapshots. Our goal is safe operational recovery — not just IT recovery.

Yes, from multiple regulatory directions simultaneously. California operators face federal requirements (TSA Security Directives for pipeline operators, EPA Tier II reporting, PHMSA data integrity requirements) plus California-specific obligations including CalOES critical infrastructure protection coordination and CARB continuous emissions monitoring data integrity. DOGGR oversees well operations and requires accurate digital reporting. A cyberattack that corrupts emissions or production data creates regulatory liability beyond the operational impact. California’s SB 327 IoT security law and CPRA data privacy requirements may also apply to connected field sensors. IT Center maps your full regulatory exposure at the start of every engagement.