Why Wasn't Saudi Aramco's Oil Production Targeted?

The recent cyber attack against Saudi Aramco resulted in the destruction of thousands of servers and hard drives. Replacement costs along with incident response fees had to have exceeded US$15 million dollars. While it's true that oil production and distribution were not affected, it may be because they weren't targeted.

It's not because Saudi Aramco's network security prevents such attacks from happening. I'm sure that the company has done everything that it can to implement best practices but that's not enough to stop a dedicated attacker. And today, with the amount of open source data on SCADA exploits available combined with the alleged existence of hostile insiders working for the company, it could have been easily done. So why didn't it happen this time?

Saudi Aramco is a state-owned company so an attack against it is equivalent to an attack against the Kingdom of Saudi Arabia. If the outcome of a cyber attack is principally financial with some disruption to business processes, then it will probably be treated as a criminal matter. If the attack resulted in a disruption of oil production and/or delivery, it would almost certainly be treated as an attack against a military objective (see Section 4 "Attacks Against Objects" of the Tallinn Manual on the International Law Applicable to Cyber Warfare for an indepth discussion of this legal term of art).

Iran is a possible suspect in the Shamoon attack and had it targeted one of Aramco's SCADA systems, then what was probably a warning to Aramco not to increase its oil production would almost certainly have been treated as an act of war instead. The IRGC which is in command of Iran's cyber warfare units would know that. Whether it was the IRGC or a proxy Iranian hacker group working on their behalf, Iran knows better than to do anything that would interrupt the world's oil supply.

UPDATE (14SEP12): I've edited this post to correct some errors in my original post regarding the types of operating systems used at Aramco.

Add to Cart View detail

Operations Security at Saudi Aramco? Zero.

The world's largest oil producer Saudi Aramco has apparently suffered a cyber attack according to this announcement on its Facebook page:

Saudi Aramco Responds to Network Disruption  

On Wednesday, Aug. 15, 2012, an official at Saudi Aramco confirmed that the company has isolated all its electronic systems from outside access as an early precautionary measure that was taken following a sudden disruption that affected some of the sectors of its electronic network.  

The disruption was suspected to be the result of a virus that had infected personal workstations without affecting the primary components of the network. Saudi Aramco confirmed the integrity of all of its electronic network that manages its core business and that the interruption has had no impact whatsoever on any of the company’s production operations. 

The company employs a series of precautionary procedures and multiple redundant systems within its advanced and complex system that are used to protect its operational and database systems. Saudi Aramco IT experts anticipate resuming normal operations of its network soon.

What's shocking in terms of operational security (OPSEC) is that Aramco employees are publicly commenting on the event and adding information that wasn't disclosed in the announcement, such as:

• (name and position deleted): "My hard disk crashed, not cool"
• (name and position deleted) "I lost everything I did for this week too"

Besides poor OPSEC, Saudi Aramco has other major issues with its network security. Oil companies, like power companies, should have air-gapped networks which isolate their industrial control systems from their business networks as well as from the Internet. That appears not to be the case based upon the wording in Aramco's announcement - "the company has isolated all its electronic systems from outside access as a precautionary measure ...". If the systems responsible for its production operations were air-gapped, there'd be no reason to take such draconian measures. On the other hand, the company appears to be relying on McAfee as their security vendor which means that the House of Saud doesn't understand that their anti-virus vendor should never be relied upon for best practices in the area of network security nor should an AV vendor be trusted to perform incident response.

Add to Cart View detail