performing-oil-gas-cybersecurity-assessment

This skill covers conducting cybersecurity assessments specific to oil and gas facilities including upstream (exploration/production), midstream (pipeline/transport), and downstream (refining/distribution) operations. It addresses SCADA systems controlling pipeline operations, DCS for refinery process control, safety instrumented systems for hazardous processes, remote terminal units at unmanned wellhead sites, and compliance with API 1164, TSA Pipeline Security Directives, IEC 62443, and NIST Cybersecurity Framework for critical infrastructure.

설치로 이동

저장소: autohandai/community-skills
최근 소스 활동: 2026년 3월 16일 00:59
감지된 SKILL.md 언어: 영어
스타: 10
포크: 3

설치 방법

기본적으로 소스를 먼저 확인하는 Prompt가 선택됩니다. 직접 명령으로 전환하거나 로컬 사본을 다운로드할 수도 있습니다.

소스 파일 검토

설치 여부를 결정하기 전에 SKILL.md와 SkillsMP에 표시된 보조 파일을 읽어 보세요.

검색으로 돌아가기 설치로 돌아가기

Performing Oil & Gas Cybersecurity Assessment

When to Use

When conducting a cybersecurity assessment of a refinery, pipeline, or production facility
When preparing for TSA Pipeline Security Directive compliance (SD-01, SD-02)
When assessing cybersecurity posture against API Standard 1164 (Pipeline SCADA Security)
When evaluating the security of remote wellhead SCADA systems and satellite communications
When a merger, acquisition, or regulatory audit requires a comprehensive OT security evaluation

Do not use for IT-only corporate network assessments of oil and gas companies, for physical security assessments without a cyber component, or for environmental compliance assessments.

Prerequisites

Written authorization from facility management and operations team
Understanding of oil and gas operations (upstream, midstream, downstream processes)
Familiarity with API 1164, TSA SD-01/SD-02, IEC 62443, and NIST CSF
Passive monitoring tools for OT network traffic capture
Access to network diagrams, SCADA architecture documentation, and safety studies (HAZOP)

Workflow

Step 1: Scope Assessment Based on Facility Type

Oil and gas facilities have unique characteristics based on their operational segment that affect the assessment approach.

# Oil & Gas Cybersecurity Assessment Scope
facility:
  name: "Gulf Coast Refinery"
  segment: "Downstream"
  capacity: "250,000 barrels per day"
  regulatory: ["TSA SD-02", "API 1164", "IEC 62443", "NIST CSF"]

assessment_areas:
  process_control:
    description: "Refinery DCS and SCADA systems"
    systems:
      - "Honeywell Experion DCS - main process control"
      - "Yokogawa CENTUM VP - hydrocracker unit"
      - "Triconex SIS - emergency shutdown systems"
      - "Allen-Bradley PLCs - utilities and tank farm"
    protocols: ["Modbus/TCP", "OPC UA", "HART", "Foundation Fieldbus"]

  pipeline_scada:
    description: "Pipeline SCADA for crude receipt and product dispatch"
    systems:
      - "ABB RTU560 - pipeline RTUs at pump stations"
      - "GE iFIX SCADA - pipeline control center"
      - "Flow computers - custody transfer metering"
    protocols: ["DNP3", "Modbus RTU over serial", "IEC 60870-5-104"]
    communications: ["Licensed radio", "Leased line", "Satellite (VSAT)"]

  safety_systems:
    description: "Safety Instrumented Systems and fire/gas detection"
    systems:
      - "Schneider Triconex 3008 - process SIS"
      - "Honeywell FSC - fire and gas"
      - "Combustion turbine protection systems"
    criticality: "SIL 2/3 rated - highest priority"

  remote_access:
    description: "Vendor and operator remote access to OT"
    methods:
      - "Citrix-based remote access to SCADA terminals"
      - "VPN to vendor support for DCS maintenance"
      - "Satellite communication to remote pump stations"

  physical_security:
    description: "Physical security integration with cyber"
    systems:
      - "Access control systems (badge readers)"
      - "CCTV with IP network connectivity"
      - "Perimeter intrusion detection"

compliance_mapping:
  tsa_sd_02:
    - "Implement network segmentation between IT and OT"
    - "Develop and maintain a Cybersecurity Implementation Plan (CIP)"
    - "Establish a Cybersecurity Assessment Program"
    - "Report cybersecurity incidents to CISA within 24 hours"
    - "Implement access control measures for critical OT systems"
  api_1164:
    - "Risk-based cybersecurity program for pipeline SCADA"
    - "Asset identification and classification"
    - "Network security and access control"
    - "Personnel security and training"
    - "Incident response and recovery"

Step 2: Assess Pipeline SCADA Security

Pipeline SCADA systems have unique challenges including long-distance communications over untrusted media, unmanned remote sites, and custody transfer integrity requirements.

#!/usr/bin/env python3
"""Pipeline SCADA Security Assessment Tool.

Evaluates security of pipeline SCADA systems against
API 1164 and TSA Pipeline Security Directive requirements.
"""

import json
import sys
from dataclasses import dataclass, field, asdict
from datetime import datetime


@dataclass
class AssessmentFinding:
    finding_id: str
    category: str
    severity: str
    title: str
    description: str
    affected_systems: list
    regulatory_reference: str
    remediation: str
    timeline: str


@dataclass
class ComplianceCheck:
    requirement_id: str
    description: str
    standard: str
    status: str  # compliant, partial, non-compliant
    evidence: str
    gap: str = ""


class PipelineSCADAAssessment:
    """Pipeline SCADA security assessment per API 1164 / TSA SD-02."""

    def __init__(self, facility_name):
        self.facility = facility_name
        self.findings = []
        self.compliance_checks = []
        self.finding_counter = 1

    def assess_network_architecture():
        
        checks = []

        
          architecture_data.get():
            .findings.append(AssessmentFinding(
                finding_id=,
                category=,
                severity=,
                title=,
                description=(
                    
                    
                    
                ),
                affected_systems=[, ],
                regulatory_reference=,
                remediation=,
                timeline=,
            ))
            .finding_counter += 

        
         architecture_data.get()  :
            .findings.append(AssessmentFinding(
                finding_id=,
                category=,
                severity=,
                title=,
                description=(
                    
                    
                    
                ),
                affected_systems=[, ],
                regulatory_reference=,
                remediation=,
                timeline=,
            ))
            .finding_counter += 

        
          architecture_data.get():
            .findings.append(AssessmentFinding(
                finding_id=,
                category=,
                severity=,
                title=,
                description=(
                    
                    
                    
                ),
                affected_systems=[],
                regulatory_reference=,
                remediation=,
                timeline=,
            ))
            .finding_counter += 

     ():
        
          metering_data.get():
            .findings.append(AssessmentFinding(
                finding_id=,
                category=,
                severity=,
                title=,
                description=(
                    
                    
                    
                    
                ),
                affected_systems=[],
                regulatory_reference=,
                remediation=,
                timeline=,
            ))
            .finding_counter += 

     ():
        
        tsa_requirements = [
            ComplianceCheck(, ,
                           , , ),
            ComplianceCheck(, ,
                           , , ,
                           gap=),
            ComplianceCheck(, ,
                           , , ,
                           gap=),
            ComplianceCheck(, ,
                           , , ,
                           gap=),
            ComplianceCheck(, ,
                           , , ,
                           gap=),
            ComplianceCheck(, ,
                           , , ,
                           gap=),
            ComplianceCheck(, ,
                           , , ,
                           gap=),
        ]
        .compliance_checks.extend(tsa_requirements)

     ():
        
        report = []
        report.append( * )
        report.append()
        report.append()
        report.append()
        report.append( * )

        
        report.append()
         sev  [, , , ]:
            count = (  f  .findings  f.severity == sev)
             count:
                report.append()

         f  .findings:
            report.append()
            report.append()
            report.append()
            report.append()
            report.append()

        
        report.append()
        report.append()
        report.append( * )
         c  .compliance_checks:
            icon =   c.status ==     c.status ==   
            report.append()
            report.append()
             c.gap:
                report.append()

         .join(report)


 __name__ == :
    assessment = PipelineSCADAAssessment()

    assessment.assess_network_architecture({
        : ,
        : ,
        : ,
    })

    assessment.assess_custody_transfer({
        : ,
    })

    assessment.check_tsa_compliance()
    (assessment.generate_report())

Key Concepts

Term	Definition
API 1164	American Petroleum Institute standard for Pipeline SCADA Security providing a risk-based framework for cybersecurity of pipeline control systems
TSA Pipeline Security Directives	Mandatory cybersecurity requirements issued by TSA for pipeline operators including SD-01 (reporting) and SD-02 (implementation)
Custody Transfer	Transfer of ownership of petroleum products between parties, requiring metering system integrity to prevent financial fraud
DCS	Distributed Control System used in refineries for continuous process control with redundant controllers and operator stations
Remote Terminal Unit (RTU)	Field device at remote pipeline sites that collects sensor data and executes control commands, communicating via radio/satellite
Safety Integrity Level (SIL)	IEC 61511 rating for safety instrumented functions, with SIL 1-4 defining probability of failure on demand
HAZOP	Hazard and Operability Study identifying potential hazards in process design; cybersecurity should be integrated with HAZOP results

Tools & Systems

Dragos Platform: OT cybersecurity platform with specific detection for oil and gas threat groups (XENOTIME, KAMACITE, ERYTHRITE)
Claroty xDome: Comprehensive asset discovery and vulnerability management for oil and gas OT environments
Nozomi Guardian: Network monitoring with support for pipeline protocols (DNP3, Modbus, IEC 60870-5-104)
Honeywell Forge Cybersecurity: OT security platform designed for Honeywell DCS environments common in refineries

Output Format

Oil & Gas Cybersecurity Assessment Report
==========================================
Facility: [Name]
Segment: Upstream / Midstream / Downstream
Date: YYYY-MM-DD
Standards: API 1164, TSA SD-02, IEC 62443

FINDINGS:
  Critical: [N]  High: [N]  Medium: [N]  Low: [N]

COMPLIANCE STATUS:
  TSA SD-02: [N]% compliant
  API 1164: [N]% compliant
  IEC 62443: [N]% compliant