Valmet ensures cybersecurity in refineries from ground up
Valmet ensures cybersecurity in refineries from ground up.
The earliest decisions in a new oil and gas refining project often have the longest impact
Choices involving automation, supplier access, and long-term support can be difficult and expensive to change once the process has been commissioned, yet they will continue to affect reliability, maintenance and operational risk for years. OT cybersecurity is now one of those foundational decisions.
In many industrial projects, however, OT cybersecurity is still treated as something that can be handled later, after the main technology selections have been made and the system design is already moving toward detailed engineering or commissioning.
That approach simply does not work anymore. As industrial systems become more connected and cybersecurity requirements continue to expand, decisions made late in the project can create compliance issues, increase costs, complicate commissioning and leave plant owners with security gaps that are much harder to address after startup.
Oil and gas refineries rely heavily on Operational Technology because the Distributed Control System (DCS) and associated automation can extend through almost the entire refining process. That may include crude handling, distillation, cracking, reforming, hydrotreating, blending, storage and product transfer, along with pumps, compressors, valves, instrumentation, analysers and other equipment. In many refineries, the automation system is involved in nearly everything that happens from the time crude enters the facility until finished products leave it.
However, that also creates cybersecurity concerns as refiners connect more systems for remote support, process optimisation, analytics, cloud applications and other digital technologies.
In many regions, OT cybersecurity is moving beyond a matter of technical preference. Responsibilities are becoming more defined on both sides of the industrial environment. Suppliers must provide products that meet security requirements, while critical infrastructure operators must manage cybersecurity risk throughout their operations.
This shift is creating a particular challenge in Engineering, Procurement and Construction projects, where EPCs are often responsible for bringing together the many suppliers required to deliver a complete oil and gas refinery or other industrial asset.
In these projects, the EPC may be responsible for defining the cybersecurity requirements during the project and making sure suppliers meet them. However, once the plant is handed over, the owner is responsible for operating the system securely and maintaining that security over time.
It is like first making a product and then putting the quality in afterwards. It doesn’t work that way. Cybersecurity needs to be taken into consideration from the star.
Cost of late cybersecurity decisions
Once the system architecture is already established, new cybersecurity requirements can be difficult to accommodate without creating additional complexity. Compliance may require new components, changes to existing interfaces and workflows or exceptions that leave the overall system more difficult to operate and maintain.
The cybersecurity requirements also continue after the project is complete. Although the EPC may still deliver the project on time, any compromises made during design can remain with the owner for the next 20 to 30 years. This is particularly important in OT, where industrial systems cannot be patched, modified, or rebooted with the same freedom as conventional IT systems.
In an OT system, a known vulnerability may remain open for some time before the patch can be installed. Software updates in an industrial control system are rarely immediate. Before anything is installed, the automation supplier must determine whether the update applies, test it against the control system, and confirm that it will not interfere with operations.
Even after that work is completed, the plant may not be able to install the update until the next scheduled outage or maintenance window. Until then, the vulnerability remains, which means some other form of protection is required.
This is where support after commissioning becomes critical. Valmet, a worldwide provider of process technologies, automation systems and services, for example, can continue to manage that risk through patch assessment, vulnerability management, monitoring, endpoint protection, and lifecycle support for its automation systems.
OT/IT integration raises the stakes
With modern automation platforms like Valmet DNAe, cybersecurity is built into the underlying architecture. The platform was developed to support IT/OT convergence, with industrial-standard interfaces and edge technology providing connectivity from field-level sensors through to cloud applications. This allows data to move across the system and supports the use of digital intelligence and AI-based tools at different levels of the operation.
Communication and data management are organised through the Trusted Information Framework, or TIF, which forms the foundation of the Valmet DNAe Distributed Control System. Security measures including authentication, role-based access control, encryption, endpoint protection and audit trails are incorporated into that framework.
The company’s services are designed to support the entire cybersecurity lifecycle. This includes determining which patches are required for specific automation systems, testing those patches before they are recommended to customers, and supporting deployment when the operating schedule allows. It also includes vulnerability monitoring, antivirus protection, network detection, secure access management, backup and recovery planning, compliance reporting, and periodic testing as long as the system remains in operation.
Today, cybersecurity belongs in the earliest project conversations because the decisions made during design will remain with the oil and gas refinery long after commissioning. When those questions are left until the end, the refinery may still operate as intended, but securing and maintaining it will usually become more difficult and more expensive.
