What to Do in the Wake of the Colonial Pipeline Hack

When a high-profile cyberthreat hits (and even halts) oil and gas companies, it shows the need for deeper discussions of cybersecurity in the increasingly connected world. For operations-based companies like Colonial Pipeline, these types of attacks can target more than just business systems like email servers. They have carefully designed and intricate systems that control pump stations, actuate electronic valves, and constantly report temperatures and flow rates back to a hub pipeline management system. These operational systems are meant to be separate and safe from business systems, but every system has vulnerabilities.

If refineries feeding the Colonial Pipeline continue at their current rate of production, what’s the impact? Without the Colonial Pipeline to carry the raw and refined products, things begin to back up, and fast. It’s been reported that two refineries on the Gulf Coast have already reduced fuel output due to the pipeline’s inability to move product. In addition, refineries are scrambling to secure barges and vessels to act as storage units for the production in process. Leading up to summer driving season, it will come faster.

How fast? Picture Lucy and Ethel in the iconic scene in “I Love Lucy” at the candy factory as they try to keep up with wrapping all that candy coming down the conveyor. The conveyor increases the flow, and they struggle to find places to put the candy, eventually shutting down the factory. The same is occurring with refineries in the Colonial Pipeline incident -- except shutting down and restarting refineries isn’t simply a matter of turning off a switch and turning it back on.

Why Colonial and Why Now?

Media headlines reveal answers to the “Why Colonial?” question:

Highlighting the volume, the geographic importance, and the economic impact in one set of bullets covers the “why Colonial” question. But another question remains: why now?

One potential answer could be that the period prior to Memorial Day signals the beginning of summer and, with that, the reformulation of gasoline to handle driving in the summer weather. This means that blending operations and inventory operations are at a natural “shift” that relies on storage and pipeline capacity to swap out feedstocks and components for the summer driving season. With crude inventories still in decline, the summer demand could put a strain on gasoline inventories. The backup is also prompting panic buying and fuel hoarding by consumers in the Southeast and East Coast, with gasoline prices rising well over $3/gallon. However,  the US Environmental Protection Agency (EPA) issued expanded waivers of summer fuel quality requirements of gasoline to parts of 12 states and the District of Columbia. The Department of Transportation also allowed the transport of overweight loads of fuel in 10 southeastern states to allow supply without the use of the pipeline network.

How Does This Impact Business Partners?

Cyberattacks don’t just impact a single organization. It’s one of the energy industry’s worst kept secrets that they’re behind the curve of digital transformation. Amid the pandemic almost every organization has “tightening the belt”, and in most cases that meant furloughs or layoffs. Combine a leaner organization with tools that may only be capable of supporting normal operations and the challenge becomes even greater.

The problem is multifold, and it starts (or ends, depending on your point-of-view) with the consumer:

Gasoline and diesel demand -- From retail gas stations to industrial and commercial customers, demand can be ratable in a normal early summer season. Throw in the variable of more people returning to a daily commute as states ease pandemic-related restrictions along with the potential for panic buying based on the news cycle, getting the demand right can be a challenge. If an organization still uses back-of-the-napkin demand planning or simple two- to four-week historical forecasts they could be in for a real challenge. Even if the demand planning is more sophisticated, it also needs to be integrated to the next level up the chain, supply planning and scheduling.

Supply planning and scheduling -- Knowing what demand needs to be met in a timely manner is a key part of supply planning and scheduling. If the supply group must wait for the demand input or has to “work” the data after receiving it to get a usable format, valuable time can be lost in key situations. And the supply group also needs to know up-to-date inventories, both in tank and in transit, across a range of products. As recently as five to seven years ago, intra-day inventory tracking was a spreadsheet operation, making it very challenging to collaborate and share information across supply areas during an upset event. Organizations require the technology and processes to access up-to-date inventory data without relying on spreadsheets saved on network drives. This is true across the supply chain -- from the source at refineries or primary supply locations to the lowest level (terminal or tank).

Refining -- These production centers are the source of supply. If there isn’t normal pipeline capacity to take away production, on site storage will fill up quickly. That leaves two options -- cut run rates to produce less, which is what we’ve seen, or find another transportation or storage solution. Both of those involve working with supply and trading organizations to share how much of what products will need to be moved when and where. In normal operations that may be a simple task that appears to have a low value, but disruptions do just that -- disrupt the normal process. Digital transformation isn’t the only path to a robust process that can flex to operational changes, but it can play a huge role in making a lean workforce run effectively in atypical business conditions.

Trading -- Working closely with supply planning and refining, the trading organization needs to know where to focus its efforts. Where’s supply going to be unable to replenish in time and a spot purchase is needed? Does refining need floating storage or a product sale to keep from overrunning storage capacity and keep run rates up? Are runs rates being reduced so an inbound crude purchase needs to be offloaded? A system-wide view of supply and demand along with the key price information (commodity, logistic, and derivative) is crucial to making decisions quickly as new information is released, and markets change.

The world today is interconnected, not just digitally but in the physical world as well. Companies need to put significant importance on both the ability to defend against cyberattacks, as well as operational robustness to respond to disruptions caused by attacks on key business partners. The most recent Colonial Pipeline cyberattack incident can be used as a business case for those organizations that are only dipping their toes in digital transformation -- how do potential operational cost impacts compare to the investment in the people, processes, and technology needed to run the business in distressed situations?

What Can Be Done To Prevent Such Cyberattacks?

While cyberattacks at the scale of the Colonial Pipeline incident are rare, the organizations perpetuating the attacks are getting more and more creative and sophisticated. With critical infrastructure such as pipelines, power generation systems, and water treatment plants at risk on a regular basis, plans must be put in place to mitigate risks at every level.

At a minimum, companies should:

In addition, these infrastructure companies may not have costly, dedicated security resources to monitor cyberattacks 24x7, but there’s no guarantee that a full-time security team could prevent all these attacks. The Colonial Pipeline cyberattack was initiated by an organized crime group seeking money; not necessarily seeking to disrupt the pipeline infrastructure.

Strong preventive measures, escalated cybersecurity education, and constant monitoring, and vigilance will help mitigate or identify future cyberattacks. Educated users and a robust cybersecurity plan must be part of the solution.

Rob Roberts is a Director in Opportune LLP’s Process & Technology practice. Rob has over 20 years of experience in the energy industry (upstream, downstream, oilfield services) focused on the delivery of mid-to-large-scale ERP implementations involving process optimization, system integration and application automation. His focus has been on the architecture, design, and implementation of cross-functional solutions, including process integration, mobility, and business analytics. He has been involved in multiple full life cycle system implementations from pre-sales and system planning to implementation and support. Prior to joining Opportune, Rob was responsible for ERP and technology services for multiple private consulting firms.

Steve Roberts is a Director in Opportune LLP’s Process & Technology practice. Steve has over 20 years of experience consulting in the energy industry providing clients with trading and risk management process and system implementation, supply chain optimization, asset acquisition integration, and business analytics. Prior to joining Opportune, Steve worked at Andersen Consulting and Accenture in the energy practice. Throughout his career, Steve has worked with integrated supermajor oil companies, midstream energy companies, merchant refiners, and global banks. Steve holds a B.S. in Chemical Engineering from Texas A&M University.

Glenn Hartfiel is a Director in Opportune’s Process & Technology practice. Glenn has over 25 years of experience providing clients with strategy, architecture, project management, and assessment across all areas of information technology (IT). His primary focus areas include M&A, IT operations, interim CIO services, enterprise infrastructure design, security architecture, and operations management. Prior to joining Opportune, Glenn worked at Sirius Solutions where he managed complex projects, including e-discovery litigation, M&A, and IT integration projects for various clients.