Oil and gas rigs: what defenders should inspect first

Inspect remote access first, then the boundary between corporate and control networks, then systems that can no longer be patched, then vendor connections, then recovery. That order follows NIST's guidance for operational technology and puts the paths an outsider can use ahead of everything else. It applies to rigs, platforms and pipelines alike.

This is a general review checklist, not a statement about any real site or incident. Sources are NIST SP 800-82 Rev. 3 and the ISA/IEC 62443 series overview. Oil and gas is named by ISA as one of the process industries the 62443 standards address. We did not review sector-specific rules for offshore or pipeline operations, so confirm those with your regulator.

1. Where can someone log in from outside?

Remote access is where many reviews should begin, because it is a way in that exists by design. NIST's guide recommends multi-factor authentication for remote access to OT, and notes that OT components often include remote access capabilities so operators can work from elsewhere.

Look for:

• A list of every remote path: vendor tools, operator remote desktops, cellular modems, satellite links.
• Whether each one uses multi-factor authentication.
• Whether any vendor account is shared or has no owner.
• Whether anyone can reach an OT device directly from the internet.

If you find a path nobody can explain, close it until someone can.

2. How is the control network separated?

NIST recommends logical separation between corporate and OT networks, for example stateful inspection firewalls or unidirectional gateways, and a DMZ so there is no direct traffic between the two. It also recommends a layered topology with the most critical communications in the most secure layer.

Check whether corporate systems can reach controllers directly, and whether a laptop plugged into a field network can see everything. Draw the real network, not the intended one. The gaps between those drawings are the findings.

3. Which systems cannot be patched?

NIST says OT lifespans can exceed 20 years and many legacy systems run software no longer supported by vendors. When controls cannot be applied, it says the program should be tailored and compensating controls used. List each unsupported system, what it controls, and what compensating control is in place, such as isolation, restricted logins or disabled unused services.

For systems that can be patched, NIST notes that patches need testing under field conditions and outages must be planned in advance. Ask who tests, and how long a critical fix takes from release to installation.

4. Which vendors and contractors can connect?

A third party with network access is a supply chain path. Review each vendor's access method, accounts, hours and scope. ISA/IEC 62443 includes a part on security program requirements for service providers, and another on secure product development for suppliers. Use those as a vocabulary when you ask vendors what they commit to.

Ask each vendor for a software bill of materials for the equipment they supply. CISA describes an SBOM as a nested inventory of software components. You will need that list the next time a library vulnerability is disclosed and you have to answer where it runs.

5. Can you recover?

NIST's guide covers designing critical systems for graceful degradation, redundancy, and keeping backups. Check that configuration backups for controllers exist, are recent, are stored away from the control network, and have been tested by restoring one. Check that operators have a manual procedure for the loss of a system, and have practiced it.

6. What do the logs say?

Look for audit trails on OT remote access and on any engineering workstation. NIST recommends tracking and monitoring audit trails. Check who reads them and how fast a strange login would be noticed. A log nobody reads is only a record for the post-mortem.

What are the limits?

A review like this finds structural gaps. It does not test the control system's behavior, and active scanning of OT networks can disrupt sensitive equipment, so coordinate any testing with operations and the vendor. Safety comes first: NIST calls it an overarching priority for OT security.

What to do

1. Inventory every remote access path and require multi-factor authentication on each.
2. Map the real boundary between corporate and control networks and fix direct paths.
3. List unsupported systems with their compensating controls.
4. Review each vendor connection and request SBOMs for supplied equipment.
5. Test restoring a controller backup and rehearse a manual fallback.
6. Name an owner for OT audit logs and set a review routine.

Quick check

Sources

• NIST SP 800-82 Rev. 3, Guide to Operational Technology (OT) Security
• ISA/IEC 62443 series overview
• CISA, Software Bill of Materials (SBOM) and VEX

Last reviewed: 18 October 2026.