We have come up with an OT Security Policy and are working on the procedures: Shital Jiwane, CISO, BPCL

Bharat Petroleum Corporation Limited (BPCL) is an Indian government-owned oil and gas explorer and producer, and has its headquarters in Mumbai. BPCL is India’s second-largest government-owned downstream oil corporation, whose operations are overseen by the Ministry of Petroleum and Natural Gas. It has achieved the status of Maharatna status, putting it in the category of government-owned entities in India with the massive market capitalisation and consistently high profits and also. 

Shital Jiwane, CISO, Bharat Petroleum Corporation Ltd (BPCL) is at the forefront of this Maharatna’s IT and OT security. 

Here, Jiwane shares her views in the area of cybersecurity and OT (Operational Technology) vulnerabilities within the industry. 

Talking about the cyber security challenges, Jiwane said, “BPCL is spread all across India and has more than 250 locations operating from the length and breadth of the country. There are multiple systems at all these locations, though our main system remains centralised. Maintaining cybersecurity at all these location devices is challenging, at the same time, asset inventory location is also an area of concern. Secondly, with the advent of cloud the perimeters are diminishing. Many of our services are available in the cloud, we do use some infrastructure such as security, service, SAAS, PAAS; so maintaining security at all these at a particular level is a bit challenging.“       

Speaking about connecting IT security to OT, Jiwane said, “Whenever we get any request of connecting IT to OT, we do some sort of risk assessment, which is a must. Also, we have come up with an OT Security Policy and we are working on the procedures so that we can have the processes in place. Few OT vendors have also come up with their own OT solutions but each of these vendors do not allow the other vendors to enter their domain, which is definitely a challenge. But, we are trying to carry out some assessment through a third party network, as a pilot project, and if it is successful then we shall do it on a regular basis.”

She added further by saying, “In the case of OT security, these are proprietary protocols, though some of us are wary that if something goes wrong with one’s system, then complete responsibility has to be taken, and that is also a challenge. With a heavy investment already undertaken, we cannot have the risk of the system going down because an unplanned shutdown would result in a bad name for the entire organisation.”

Jiwane finally commented by saying, “OT systems are not like IT systems wherein every 5 or 6  years one needs to change it. OT systems have a far bigger lifespan which ranges from anywhere between 15 to 25 years. We have planned another solution for a major unexpected system shutdown; at that particular moment security assessment can be done, so that there won’t be any challenge to the already running plant as such, and it can be managed during the shutdown with appropriate updates.”