Tag Archives: energy and utilities

Pro-Growth Signs in Washington Present Opportunity for Power and Gas Capital Investments

Posted on by

By Tyler Chase, Managing Director
Energy and Utilities Industry Leader

 

 

 

Power utilities trying to gauge what the future regulatory landscape will look like are likely getting frustrated with the political cacophony in Washington. Yet judging by legislative activities in Congress and some of President Trump’s executive orders to date, pro-growth and job-creation policies are clearly top-of-mind among the nation’s lawmakers. For organizations that have been putting off capital programs to expand or upgrade facilities and infrastructure, the business-friendly tone could signal a chance to launch these deferred capital investment programs.

As we pointed out in our Flash Report on the new administration’s first 100 days, Trump reversed a handful of Obama administration memoranda, reports and executive orders that were largely considered by the industry to be red tape bogging down capital investment. Among other actions, Trump eliminated multiple policies that built climate change considerations into federal decision-making and ended White House guidance on energy, infrastructure and other proposed projects. Additionally, in mid-May the Senate Committee on Homeland Security and Government Affairs advanced several bills aimed at regulatory reform that could affect utilities. One of these bills, the Senate version of the Regulatory Accountability Act, would require agencies to develop new regulations in the most cost-effective way possible and has the broad support of power, utility and other industrial organizations.

It is still too early to predict how much of Trump’s proposed agenda will ultimately end up as policy, but clearly the need for new and continued investment in the power and gas sectors is not diminishing. According to the American Society of Civil Engineers (ASCE), which this year gave U.S. energy infrastructure a D+, most of this country’s electric transmission and distribution lines date to the 1950s and 1960s, have a 50-year life expectancy, and were not designed to meet today’s energy demands. ASCE also anticipates a $177 billion funding shortfall for generation facilities and infrastructure through 2025.

Meanwhile, increasing the mix of power generation sources to include wind, solar, geothermal and hydrothermal alternatives, along with a retirement of coal-fired plants in favor of natural gas-fueled facilities, requires expansion investment to ensure the transmission grid’s reliability. As we mentioned in our 100 days Flash Report, Trump policies may ultimately relax federal emphasis on renewable energy sources like wind and solar, but that won’t curtail state mandates for more alternative generation or the progress that utilities are making in that area. A case in point is a 2015 California law requiring utilities to procure 50 percent of their energy from renewable sources by 2030, an increase from an earlier target of 33 percent.

Similarly, while the Trump administration has loosened coal regulations to make the commodity more competitive, the U.S. Energy Information Administration reported in January that the electricity industry was planning to increase natural gas-fired generating capacity by more than 35 gigawatts through 2018. Successful completion of the expansion surge would mark the largest net addition in natural gas generating capacity since 2005 and follows five years of net reductions in coal-fired generating capacity.

Protiviti’s perspective — proceed with caution

Though excitement may be building as a result of the new winds in Washington, organizations pursuing plant or infrastructure capital improvements need to keep in mind the pitfalls and risks that could derail the projects. Power and gas industries are still heavily regulated, and environmental constraints still exert influence on right-of-way, for example. To avoid risks, utilities need insightful and skillful management over planning and execution, including oversight of contract compliance, utilization of efficient and well controlled processes, and project risk assessments, among other services.

If your organization is planning or embarking upon a large capital expenditure to expand or upgrade its plant or infrastructure, here are some questions to ask before proceeding:

  • Will existing management processes provide sufficient visibility into decisions that impact project costs?
  • How are project risks identified, communicated and mitigated throughout the project lifecycle?
  • Are current resources capable of managing the project’s complexity?
  • Is the team of engineers, procurement staff, construction managers, trade contractors and material suppliers familiar with and comfortable working in a regulated environment?
  • Is the organization prepared to vigorously defend project costs during review by regulators, intervenor groups, and the public?

Some companies may be willing to wait and watch until the uncertainty over the implementation of Trump’s agenda begins to clear. Wall Street is certainly cautious and jitters in the market have given some investors pause. Nevertheless, lawmakers largely appear to be concentrating on economic policies intended to create and promote growth. Given the shape and age of the transmission grid along with the continuing transformation of power generating sources, the time is certainly ripe for a conversation about capital investment projects that position utilities for future growth while bolstering grid reliability.

Protiviti subject-matter experts Jon Critelli and Marius Anelauskas contributed to this blog.

Cyber Vulnerabilities of Energy Companies’ Control Systems Can Be Addressed Safely and Successfully

Posted on by

 

By Tyler Chase, Managing Director
Energy and Utilities Industry Leader

and

Michael Porier, Managing Director
Technology Consulting – Security and Privacy

 

The realization is growing across the oil and gas industry that the major cybersecurity threats to upstream, midstream and downstream data and operations are often aimed at operational technology (OT) systems and equipment – usually older, legacy models – rather than at the information technology (IT) side. Those operational technologies typically include industrial control systems (ICS), supervisory control and data acquisition (SCADA) devices and other related technologies implemented at operational facilities, such as plants, pipelines, terminals and rigs.

A recent survey of more than 300 oil and gas companies found:

  • More than 60 percent of companies have suffered a security compromise in the past year, which exposed confidential information and disrupted OT systems and operations
  • Two-thirds of companies believe risks to OT systems have increased substantially in recent years, and 59 percent believe they face greater risks in OT than in IT
  • Only one-third of companies report that OT and IT are fully aligned in their organizations
  • Just 35 percent rate their readiness to address cyber threats as high
  • Close to half of all attacks on OT are going undetected

These survey findings appear shocking – but they are also consistent with Protiviti’s experience in performing cybersecurity assessments for energy and utility clients, particularly evaluating their OT systems. We often find unprotected field terminals with inadequate physical security of connection points, live ports that lack deterrents, and an absence of intrusion detection capabilities. We also commonly see flat networks that are not segmented to appropriately segregate the OT systems from the corporate network environment, making it easier for potential hackers to exploit vulnerabilities across the organization.

Obviously, OT systems with any of these shortcomings present significant cybersecurity risks for the energy and utilities industry. The threat is multiplied by the fact that energy and utilities organizations are deemed critical infrastructure, whose exploitation can have devastating effects to broad geographic regions affecting multitudes of people.

More and more ICS/SCADA technologies allow for the capability to connect (via IP) to the broader corporate network infrastructure. While this provides for certain efficiencies, it can also expose oil and gas systems to unprecedented risks that occur when the previously isolated OT systems are linked to sophisticated IT networks so data can be shared, managed and analyzed.

Despite this newfound connectivity, the industry has remained stubbornly reluctant to challenge legacy OT systems from a vulnerability perspective, for fear of creating interruptions or process errors. This reluctance often leads to a failure to adequately test or update systems to optimize security and minimize cybersecurity risks.

The concerns are legitimate, but only up to a point. In our experience, there isn’t sufficient justification to hold OT systems “off limits” for cybersecurity evaluation and upgrades, given the high potential for targeting by sophisticated opponents and the alarming numbers cited in the survey. To this end, assessments should still be performed, but they must incorporate a series of precautions designed to assure both operational continuity and a complete threat risk review. These precautions include:

  • Well-defined rules of engagement, including identification of the types of reports and system information to be compiled prior to conducting a vulnerability scan
  • Performing security evaluations in a test, rather than production, environment
  • Collaboration with both engineering and IT security personnel to define the scope of the review engagement
  • Reasonable limitations on initial tests so sensitive systems can be excluded if needed to allow for the development of workarounds
  • Establishment of clear lines of communications so any network or system irregularities are reported and evaluated during testing

Working within these parameters, the end goal of testing the security control environment of the ICS/SCADA environments should achieve the following:

  • Evaluate the key security risks prevalent in the ICS/SCADA network architecture
  • Identify the network vulnerabilities and test the connectivity to the enterprise network
  • Assist with the development of a vulnerability management program specific to the ICS/SCADA infrastructure

Ideally, what energy and utilities companies want is to ensure they have an ICS/SCADA environment that can function in a secure and effective manner, and that they can be highly efficient in detecting and responding to breaches and attacks. This requires technical expertise, collaboration between departments, appropriate planning, and leveraging vulnerability assessments to periodically test security.  Testing these systems requires more work, but it is not impossible, and it should not be considered “out of the question.” In fact, testing is an essential practice to preserving the integrity of any critical system.

Data Security Alarms Should Be Sounding for Oil and Gas

Posted on by

By Tyler Chase, Managing Director
Energy and Utilities Industry Leader

 

 

 

Oil and gas industry executives don’t need to see a new Wikileaks story about secret CIA hacking tools or hear more about the electronic penetration of presidential campaigns to understand the seriousness of a potential digital hack to their operations.

But it’s a large step from knowing a risk exists to being ready for it. Achieving confidence in the ability to manage such risk can involve substantial new investments and operational adjustments, even for an industry accustomed to meeting regulatory, operational and market challenges.

Protiviti’s recently released 2017 Security and Privacy Survey indicates that oil and gas companies are facing their cybersecurity challenges in ways similar to other industries. The survey’s main findings include:

  • Nearly one in five companies cannot confidently identify or locate their “crown jewels,” or most valuable data assets, because they lack an effective enterprisewide data classification scheme and policies.
  • How well companies manage their vendors’ security practices marks a notable difference between top security performers and the rest.
  • Companies with a high level of board engagement in information security issues rate considerably higher than those without such involvement in nearly all facets of information security best practices. These companies also report a higher level of confidence in their ability to prevent an opportunistic data breach.

These findings largely correspond to what we have seen among our own energy clients. One difference we have noticed, however, is that energy companies tend to have little to no formal documentation on testing of security incident response plans, compared to other industries. This could mean that energy executives have not substantiated a basis for the same level of breach-prevention preparedness as some other industries. I would argue that as a critical infrastructure, they should.

Although Protiviti energy clients indicate they are committed to security, we see about the same 38-percent level of compliance with implementation of the five core information security policies identified in the Protiviti survey: acceptable use, records retention/destruction, data encryption, information security, and social media policies.

In addition, energy companies, specifically those in exploration and production (E&P), have been hesitant to invest in tools to identify where their “crown jewels” are stored, apparently on the basis that many do not feel their company is much at risk because it does not retain much sensitive data. However, many common processes at E&P companies (i.e., escheat and royalty owner payments) do involve sensitive information protected by state privacy laws (e.g., individual tax ID numbers are actually Social Security numbers). Further, company confidential information, such as reservoir data, land acquisition data, and merger and acquisition activity, would be considered data that requires identification and protection. Very commonly, even where these processes are mostly manual, this information is digitized (e.g., scanned documents) or entered into a system. If the company does not know what data exists and where, it will have a difficult time protecting it.

Energy executives and boards would be wise to ask themselves some worst case scenario questions and know the answers now rather than having to discover them under fire later:

  • If our data assets were compromised, could they be reconstructed, and how long would it take?
  • If field operations were disrupted by an attack on the operational control system, how much revenue would be lost per week? Per month?
  • If competitors or counter-parties were able to learn confidential details of our strategies and plans, where would our company be most vulnerable?

The bottom line is that what you don’t know, such as where your critical data is, can, and eventually will, hurt you. With all issues of cybersecurity, it’s only a matter of time.

Alyssa Brister and Luis Castillo from Protiviti’s Technology Consulting practice contributed to this post.

Will Hiring Hackers Help Energy’s Cybersecurity Efforts?

Posted on by

 

Tyler Chase

cal-slempBy Tyler Chase, Managing Director
Energy and Utilities Industry Leader

and Cal Slemp, Managing Director
IT Security and Privacy Practice Leader

 

The chief cybersecurity engineer for a major industrial process company advocated not long ago that oil and gas companies hire hackers to improve their cybersecurity defenses. At an annual European-Middle East-Africa user group conference in The Hague last October, Eric Knapp urged attendees to drop their negative perceptions and put hackers to work on their teams.

Knapp’s advice followed a presentation of survey findings stating that 82 percent of oil and gas industry respondents have experienced an increase in successful cyberattacks over the past 12 months. Executives of European petrochemical companies SARAS and SABIC estimated that cyberattacks cost businesses up to $400 billion per year.

Several weeks earlier, the World Energy Council (WEC) issued a report that, among other conclusions, found that the demand for cyber specialists is growing twice as fast as for all other IT jobs. The WEC cited research linking recent high-profile security breaches to a shortage of almost one million skilled cybersecurity professionals.

Our perspective:

The idea of leveraging “hackers” needs to be put into context. Many organizations have resources (internally or through consulting firms) who mimic the activity that various types of real hackers execute to illegally break into a company’s IT infrastructure. These “white hat” penetration testers are excellent at testing infrastructures, applications, networks and databases. The use of trained personnel who act as hackers but have written agreements and rules of engagement can make a lot of sense for an organization and is worth considering.

However, cybersecurity, much like other strategic initiatives, cannot be addressed with technology resources or tools alone. It requires a joint effort among departments and employees of all levels. In the same way that police cannot solve all crimes by themselves (despite being the “experts”), cybersecurity professionals need the knowledge and assistance of everyone in the organization. Employees who have been educated on matters of cybersecurity become empowered and thus an extension of the security program.

Finding the similarities between cyber risks and existing risks (e.g., safety) can help translate this subject to nontechnical resources. Many of the lessons learned with regard to overall risk management through more traditional departments, such as internal audit or compliance, can be applied to cybersecurity. Sharing data points that are already being collected by these departments can add value to analyzing security threats. At an even higher level, sharing information across the industry in cyber intelligence groups (CIGs) can allow firms to collaborate on specific threats and solutions, and share data that can add value to their overall threat analyses.

Is hiring “hackers” the answer to the cybersecurity challenge? It’s not quite that simple. White hat hackers certainly have a key skill set organizations need to face the growing threat of cyber crime, but the ultimate success of an organization lies in how well the leadership empowers the overall enterprise to combat cyber risks together.

Luis Castillo of Protiviti Technology Consulting contributed to the development of this content.

 

Fewer Oil Companies Are on the Edge of Bankruptcy — Is This Really Good News?

Posted on by
In this Industry Perspective series, we offer the views of Protiviti leaders on developments and news in specific industries. The perspective below focuses on Energy & Utilities.

 

Tyler Chase

robert-patrickBy Tyler Chase, Managing Director, Energy and Utilities Industry
and Robert L. Patrick, Director, Corporate Restructuring and Recovery

 

 

A recent update from Debtwire states that 135 oil companies headed for bankruptcy is good news compared to the 180 companies that were on the Debtwire list in January. According to the article, oil prices have recovered from their lows around $26 a barrel and are now hovering around $50, which has helped some companies stabilize. Most of the companies on Debtwire’s list have already eliminated jobs and closed plants, so the industry appears to have hit bottom, the article claims.

Our perspective:

It may be prudent for oil company management teams and investors to hold back on optimism-based strategies for the present time.

Oil market fundamentals and the U.S. economic outlook portend, at best, flat results for the foreseeable future. That said, and as crazy as it might sound, the energy industry was the highest performing industry in 2016, so those that have had positions in energy stocks have benefitted. However, investors who are willing to accept the oil market- and company-specific dangers inherent in placing capital into distressed oil and gas companies should not be looking for immediate returns in 2017.

Those who have been waiting for the industry to “hit bottom” before pulling the trigger on new investments, acquisitions or expansions might want to add this decreased trend of bankruptcies to other recent optimistic news (for example, an energy-friendly federal administration, oil stabilizing around $50/bbl, OPEC cutting production) as an indicator that the industry is headed in the right direction.

Bottom line: Even if a lower number of oil companies appear to be headed for bankruptcy, the industry’s stress is likely to continue and companies will need to continue to strengthen their profit-and-loss monitoring and forecasting, risk management analysis, and strategic planning processes.