Operational Technology (OT) Security | George Eapen | nullcon Interviews

### Overview In this nullcon interview, George Eapen discusses his role as Global CISO and Head of Cybersecurity for Petrofac, an $8 billion London-headquartered multinational in the oil and gas sector employing close to 12,000 people. He outlines the primary responsibilities of a CISO—protecting the organization against external threats and insider risks while maintaining regulatory compliance—and explains how these priorities shift fundamentally between traditional sectors such as banking and the oil and gas industry.

### Key Topics - **Role of the CISO Across Industries**: While the core mission of guarding against internal/external threats and ensuring compliance remains constant, the critical assets vary. Banking CISOs focus heavily on data confidentiality, customer-facing applications, and IT system availability, whereas oil and gas focuses on industrial operations and harsh physical environments. - **Operational Technology (OT) Environments**: Managing cybersecurity across onshore and offshore sites presents distinct challenges compared to standard enterprise IT, largely because these environments rely on legacy, operational systems. - **Workforce Awareness and Cyber Discipline**: Employees serve as both the first line of defense and the first point of failure. Fostering a company-wide cyber culture through training ensures field personnel understand appropriate operational actions, such as handling USB drives safely around older systems. - **Prevent, Detect, and Respond**: Traditional security strategies heavily prioritize prevention, but organizations must balance investment across prevention, detection, and response as the threat landscape and technological solutions evolve.

### Technical Details - **Compensating Perimeter Controls**: Because operational technology systems deployed on rigs and production sites are often legacy and difficult to replace or modify directly, organizations implement compensating security controls around the perimeter to protect critical infrastructure. - **Removable Media Handling**: In OT settings where legacy systems are common, physical media such as USB drives are frequently required for operational tasks. Security training focuses on instructing staff on proper boundaries and safe handling when interacting with these sensitive systems.

### Takeaways - Cybersecurity cannot rely solely on a dedicated security team; every employee must maintain baseline cyber discipline and awareness. - Securing legacy OT in challenging onshore and offshore environments requires strong perimeter compensating controls coupled with human-layer defenses. - Security strategies must balance investment across prevent, detect, and respond capabilities rather than relying exclusively on upfront prevention.