Identifying and Addressing Trust Concerns in Cyber-Physical Systems for the Oil and Gas Industry

Petroleum Cyber-physical Systems (CPS) are currently used in several operations within the oil industry. Petroleum CPS techniques can help with management, production, and exploration [1].

An oil and gas company's product chain is often split into three segments: upstream, midstream, and downstream. While midstream involves the movement and storage of crude oil via pipelines, trains, ships, upstream refers to the procedures involved in oil discovery and production. Lastly, the manufacturing of completed goods downstream.

The integration of various industrial technologies with ICT is made possible by Industry 4.0, which also uses actuators and smart sensors to manage processes in real-time and remotely maintain Supervisory Control and Data Acquisition (SCADA) systems [2, 3]. Additionally, real-time process tracking and equipment control are provided by ICS [4]. CPS in the petroleum industry is capable of precisely simulating fluid flow throughout the entire reservoir and exploiting large field data remotely acquired at production wells [5].

Identifying the concerns and risks is necessary since the energy sector is vulnerable to several hazards that could damage the environment, or cause an economic meltdown. In literature, many concerns within the oil and gas industry are studied. In the study of Petersen et al. [6], reliability, energy usage, and regulation were among the concerns raised by WSN use. They also determined the technological prerequisites for WSN implementation inside the boundaries of the oil and gas sector. Concerns about infrastructure reliability, accidents, and terrorist attacks are presented in the study of Flouri et al. [7]. For safety concern, Sklet [8] present the definition, illustration, analysis, the improvement of safety obstacles during the offshore oil and gas manufacturing and operational phase.

Addressing trustworthiness and reliability in CPS is one way to reduce fears in the petroleum sector. A majority of contributions handled trust and trustworthiness issues from a security perspective. Oudina and Derdour [9] described a workable and effective MBSE technique for building trust in CPS, offering direction for the reliability analysis procedure. In the study of Anwar and Ali [10], A technique focused on trust to safeguard cyber-physical systems has been proposed. which cited internal trust as elements such as sensors, actuators, and communication networks, and outside trust that is linked to the physical environment of the CPS. In the study of Mohammadi et al. [11], they presented a framework for needs and development techniques that take trustworthiness into account when designing CPS. A trust degree framework for cyber-physical systems is developed and the requirements for each degree are classified. Also, they mentioned the use of this framework in all fields [12].

The confidence in petroleum cyber-physical systems (CPS) and the risks facing the oil and gas sector have been important areas of concern. The focus of the scientific community is on developing a confident and modern CPS. The literature on the petroleum and natural gas industries lacks definitions of concerns and sources of all types of fears, as well as a workable defense strategy. Also, cyber security for oil and gas assets has yet to be extensively studied [13]. There is no defense system that can truly guard against all types of risks while still ensuring the reliability of the petroleum CPS.

Familiarity with fears and fulfillment of requirements should ensure trust as a system quality [12]. Controls against risks that could jeopardize CPS's operations should be built into the system. A set of resources, concerns, risks, or controls should be identified. This procedure is crucial for modeling the security and reliability of CPS [9]. Establishing safe, secure, and trustworthy systems in the oil and gas sector involves identifying and categorizing trust concerns. It is simpler to identify susceptible areas and their causes, as well as to define roles and duties within the oil and gas organization, owing to the classification of concerns. This makes the process of mitigating risk easier.

The goal of this paper is to analyze trust concerns and outline the whole collection of trust fears and needs that lead to the development of the intended trust quality in CPS from the early design phase. Each concern class is a collection of qualities that may be related to one or more aspects, such as human, business, functional, or trustworthy. The specification of the properties set for each fear type reveals the interconnectivity of the categorized trust concerns. The study also addresses the classification of trust concerns in the energy industry and shows how concern identification can aid in risk mitigation.

The remainder of the paper is: Section 2 gives an overview of trust in cyber-physical systems. Section 3 presents the classification of trust concerns for cyber-physical systems. In Section 4, the trust concerns for cyber-physical systems in the O&G industry are presented. Section 5 shows how concern identification can help with risk mitigation. Section 6 presents the paper's conclusion.

Trust, as a quality of CPS, is based on a set of functional and non-functional properties and judgments. Whereas the requirements are a translation of the concerns and are avoided and mitigated by achieving the necessary properties of the system, our classification of trust concerns is based on the combination of many aspects:

3.1 Functional concerns

CPS combines computing and physical operations, with physical operations being supervised and managed by networks and embedded computers. In the CPS, diverse equipment are connected via wireless networks. Groups of sensors and actuators are used to establish communication. Therefore, concerns about CPS functionality are related to a variety of aspects and components, including communication, controlling, sensing, and devices.

Functional concerns included: Functionality, physical, communication, control, actuation, sensing, and environment.

· Functionality: The concerns are related to the services provided by a CPS. Some functions are solely physical CPS attributes.

· The communication concerns are related to the exchange of information between the CPS and other entities.

· The controlling concern is about the ability of CPS to control a property of a physical part.

· As critical components of the CPS, actuators and their associated concerns deal with how the CPS can affect change in the physical world.

· The sensing concerns are related to how CPS exploits the physical information collected by sensors to bridge real and cyber spaces.

· Interaction of CPS functionality with the domain and industry environment.

3.2 Human concerns

The human is the important actor that confirms the trustworthiness of CPS, and its requirements ought to be in accordance with the needs of the user [12]. The fear is that when utilizing the system, the user will be made aware of any discrepancies between the system's development and their requirements. This could cause the user to lose faith in the system and ultimately reject it. Human concern includes the following attributes:

· Interaction: How humans interact with the complexity of CPS. The interfaces improve the learning and human interaction.

· Usability: How CPS is used by humans.

· Satisfaction: How CPS achieves its functional goals successfully and the contentment of users (ISO 9241-210).

3.3 Business concerns

The business is liable for the foundational aspects and expenses required for CPS development, as well as the cost of training staff members. Accreditation is mandatory for the cyber physical system to ensure its regulation. Time to market is another business concern because it is tied to the availability of CPSs and their deployment.

· Regulation: regulation and accreditation requirements.

· Time to market: the length of time needed to bring a CPS from need realization to deployment.

· Cost: foundational or monetary requirements by the CPS throughout its development cycle.

3.4 Trust concerns (trust as a qualities)

According to the trust degrees framework [12], we divided the set of trust concern into three subsets (security, trustworthy, trust).

3.4.1 CPS security concerns

(1) Safety concerns about capacity of the CPS to guarantee that there won't be any disastrous effects on the lives, health, property, or data of stakeholders, or the natural environment.

(2) Security concerns about the capacity of the CPS to guarantee that every one of its procedures, systems, and services is shielded from unauthorized and unintentional access, alteration, harm, loss, or use, either internally or externally. As security sub-properties:

· Confidentiality: Maintaining approved access and disclosure limitations.

· Integrity: Protection against improper system change or destruction, including non-repudiation and authenticity.

· Availability: The ability to access and use a system in a timely and dependable manner.

3.4.2 CPS trustworthy concerns

(1) Privacy concerns about the CPS's ability to prevent entities (humans, computers) from accessing data that is created, stored in, or transited through a CPS or any of its elements; privacy plays a vital role in enhancing the credibility of the system. Users have access to and control over their personal information.

(2) Performance: The ability of the CPS to reach needed operational targets and the quality that characterizes how well a service performs. The extent to which a system or element performs its intended activities within specified restrictions, like quickness, precision, or memory utilization (IEEE-610.12) [15].

(3) Dependability: a grouping of sub-properties (Accuracy, Availability, Robustness, Reliability, Scalability, and Maintainability). The capability is supported by the service it provides. A proper and predictable execution was performed as expected. There are various aspects to dependability, including:

· Availability: Ready for application

· Reliability: Uninterrupted provision of services

· Safety: Not experiencing disastrous effects on the environment

· Confidentiality: Absence of information distribution that is not authorized

· Integrity: Absence of inappropriate information tampering

· Maintainability: Ability to adapt and change

· Compatibility: Concerns about the connectivity between hardware and software from various sources without requiring changes

3.4.3 Trust concerns

(1) Usability fears about the ability of CPS to be effectively employed to satisfy operational objectives and user needs (adapted from ISO 9241-210.) Complex systems combining physical and cyber components make it harder to meet usability norms.

(2) Correctness entails system behavior that complies with user requirements, such as user expectations on trustworthiness and standards.

Table 1 presents the related properties for each concern type.

Some properties can be part of and related to many concerns at the same time, such as performance and dependability, which are related to functional and trustworthy concerns. The interconnection of concerns is presented in Figure 1.

Each type of concern is a set of properties, and the merger of this trust concern can be presented as the union of many groups of trust properties that should meet to guarantee the trust quality in CPS. Our proposed formula is expressed as follows:

· Ct: The total of trust concerns

· Cf: Functional concerns (properties of CPS required by functional concern)

· Cb: Business concerns (properties of CPS required by business concern)

· Ch: Human concerns {properties of CPS required by human concern}

· Ctr: Trustworthiness concern as quality {properties of CPS required by trustworthiness concern that divided into three subset: Secured, trustworthy, trusted}

$C t=C b \cup C h \cup C t r \cup C f$             (1)

The multiplicity of concerns is defined as the union of groups. The composition of a set of concerns is interpreted as the sum of the properties required by each concern in the set.

· Sp: Set of properties

· P: Property

· n: Total number of trust properties

$S P=\sum_{k=0}^n P$              (2)

Table 1. The related properties for each concern type

11.png

Figure 1. Concerns intersection

5.1 Overview

Risk analysis and effective mitigation are not widely addressed in the literature. There are only reports, directives, and guidance, with no systematic and large collection of all pretentious threats and all kinds of risks in the petroleum industry. Stergiopoulos et al. [37] Stated that the O&G industry has not yet had a systematic method for mapping, cataloging, and categorizing cyber security threats. They also provided evidence that oil and gas OT infrastructure is susceptible to cyberattacks, as demonstrated by historical events.  However, many surveys highlight the risks and the mitigation of those risks in different ways and with different targets, such as the study of Stergiopoulos et al. [37]. The weaknesses, possible dangers, and mitigation measures for CPS are detailed in the study of Alcaraz and Zeadally [38]. An experiment designed to find weaknesses in SCADA protocols was introduced by Sayegh et al. [39]. According to another survey, testbeds are usually used to demonstrate data acquisition for production and maintenance, as well as to establish security in energy systems [40]. Miller and Rowe [41] reviewed industrial systems by conducting real-world cyber-security incidents against SCADA systems and classifying the attacks, attack methods, and potential impact. A survey of vulnerabilities linked to ICS security, protocols (Modbus/TCP, DNP3, IEC 61850), and sensors/actuators was provided by Krotofil and Gollmann [42]. Security solutions were also suggested to mitigate these risks.

5.2 Some mitigation directives and reports

One recommended best practice is the European Parliament and Council's directive (EU) 2016/1148, which is about "concerning measures for a high common level of security of network and information systems across the Union" [43]. Furthermore, the European Union released a regulation on cyber security certification for information and communications technology [44] 2019/881 of the European Parliament and of the Council.

Other important documents include the European Parliament's 2012/18/EU directive (SEVEZO-III) [45], which underlines fundamental principles for dealing with threats and repercussions from many types of situations, including cyber-attacks on industrial systems.

Some key reports also place a strong emphasis on the digitalization of the oil and gas sector, as well as the use of IoT and smart meters to automate monitoring and control. [46] Provides an illustration of the current global picture, including notable cases, their repercussions, general hurdles, and some mitigation measures, Deloitte [47], and PWC [48], and concentrating explicitly on the O&G sector. Assessing vulnerability to prioritize cyber investments was advocated by Deloitte [47].

For industrial control system (ICS) security, the National Institute of Standards and Technology (NIST) detailed in the study by Stouffer et al. [49] how firms should establish and implement an ICS security program and ICS security plans. It outlined how programs should be aligned with and integrated with current programs, policies, and expertise of IT security. It is frequently recommended to create particular requirements for ICS technology and its surroundings. It is also advised that businesses evaluate and revise their ICS security policies and processes periodically to account for modifications to norms, laws, practices, technology, and facility security requirements.

5.3 Some mitigation strategies

5.3.1 Mitigation for human fears

According to the majority of statistics, operator error on the part of the human or illegal operation causes mishaps. As a result, the petroleum sector ought to enhance employee training and take part in a range of promotion, assessment, and outreach initiatives.

5.3.2 Mitigation for safety fears

It is strongly advised that the O&G industry adhere to standards. In order to make the approaches understandable to design engineers, they illustrate IEC61508 compliance in OIL and GAS applications, with a particular emphasis on steam turbines, and provide a methodology for reliability analysis of complex safety instrumented systems [50].

Marzooq and Rashid's study [51] explored strategies for increasing awareness of safety-related concerns and shown how people's consciousness and behaviors greatly influence their safety, actions, and ability to manage hazards at work.

5.3.3 Mitigation for security fears

Security and privacy, intrusion and anomaly detection, and malware mitigation are proposed by Chen et al. [5]. Organizations should implement strict authentication and authorization procedures for all program units and all employees to reduce the risk of authorized access.

Some suggested methods for reducing the risks in ICS include adding firewalls to ICS interfaces to protect against a variety of concerns [52] and keeping an eye on the safeguarding environment that surrounds the systems is an important technique for supporting conventional network protection and authorization mechanisms, including the design and implementation of security.

5.3.4 Other mitigations

Stergiopoulos et al. [37] suggested more approaches that are used in the oil and gas industry to mitigate and control vulnerabilities. These include updated and patched field equipment, reliable procurement procedures, and measures against tampering. Securing the network and employing many technologies, including network segmentation, penetration testing, encryption, and internal auditing.

How can the identification of concerns help to mitigate risks and enhance the CPS' trustworthiness in the O&G industry?

The identification of potential risks that could affect user trust and the implementation of appropriate policies to reduce the threats play key roles in maintaining and monitoring system quality and trust characteristics.

In the study by Oudina et al. [53], a long-term mitigation security strategy for the oil and gas perimeter is described. is a holistic security approach that starts with the possible infrastructure configuration phase in the oil and gas zone. In the second stage, industrial new-generation firewalls are integrated with the petroleum SCADA and ICS systems. The last phase focused on establishing adherence to oil and gas standards, which can be very helpful in managing risks that are continuously increasing.

3.png

Figure 3. Initial Stage in the development of a general security and confidence plan

Experts in the field of oil and gas consider good practices in all phases of the development life cycle of oil and gas projects as a tool to lower risks. For this reason, the identification of concerns in this industry is a mandatory task for risk management as well as defense and mitigation strategies.

Classifying fears is the first step to understanding the risks surrounding the system, as well as the first step to identifying risks and their causes. Risk classification facilitates the identification of areas of vulnerability and their causes, as well as the definition of duties and responsibilities in the oil and gas organization. Assuming that this classification is thorough and aware of all immediate threats and all factors and aspects related to them directly or indirectly, following the previous steps, the stage of setting the security and confidence objectives for the system and the organization will occur. Then it is feasible to find the security spots that were previously deemed loopholes and weaknesses. The necessary security measures and strategies, as well as how to employ them, should be identified. Also, don't forget to provide essential supervision and learning for the human element involved in this task at this stage. Figure 3 displays our proposal as an initial and partial stage in the development of the general security and confidence plan for the oil and gas cyber system.

Trustworthiness can be ensured by constantly checking the system's characteristics, proper operation, and compliance with all requirements of those involved with it, as well as by constantly guarding against risks and implementing policies to mitigate and reduce expected and unexpected attacks. Furthermore, robust security measures requiring highly specialized scientific competencies must be implemented.