Oil Giant Aramco Drills Down on Saudi ICS Security

Aramco, the national oil company of Saudi Arabia, says that it's exploring ways of strengthening cyber protections for Aramco's industrial assets and infrastructure, as well as those critical to Saudi Arabia more broadly. 

Specifically, Aramco is looking to boost security for operational technology (OT) environments, and will be working with Dragos, a cybersecurity firm, to open a Saudi Arabia-based academy to provide training for that area.

"Our work with Dragos serves to accelerate our country's Vision 2030 objectives to foster economic relations with global partners and advance our digital economy," said Ahmad Al-Khowaiter, executive vice president of technology and innovation at Aramco, in signing the deal. 

The initiative comes a decade after Aramco infamously experienced a devastating malware attack that infected 35,000 of its computers for several hours. The incident led Aramco's IT team to sever the connection of every company computer and data center, making day-to-day operations impossible apart from oil production analog activities.

Industry Collaboration Drives OT Cyber-Readiness

The training partnership with Dragos showcases the benefits of industry collaboration, according to ESET global cybersecurity advisor Jake Moore.

"Industrial systems have long been at risk from cyberattacks, so this impressive move highlights how industries are able to future-proof their businesses by protecting themselves with collaboration," he says.

Moore adds that OT training "should never be underestimated or overshadowed," and called cybersecurity upskilling a "significant asset" for industrial companies like Aramco. 

Hollie Hennessy, senior analyst at Omdia, praised the effort to make ICS/OT security more accessible to organizations in the Middle East, noting that providing specialist training helps with some of those organization's biggest challenges.

"OT/ICS organizations struggle to communicate effectively across different parts of the business, do not always have adequate training for internal stakeholders, and, of course, are troubled by the skills gap — which is even more prevalent in an area where OT professionals and engineers (which are also difficult to come by) are often responsible for cybersecurity," she says.

She adds, "ICS/OT cybersecurity is also often less mature than in the IT world, and so organizations need varying support at different stages of their journey and often cybersecurity services to help manage, assess, and develop."