Securing Oil, Gas and Utilities in a Region Undergoing Rapid Digitalisation

Securing Oil, Gas and Utilities in a Region Undergoing Rapid Digitalisation – Gulf energy and utility operators are connecting decades-old control systems to cloud analytics, remote operations centres and smart grids. That digitalisation brings faster, cheaper operations and new attack paths. Regulators in Saudi Arabia and the UAE now set OT-specific requirements, and operators with legacy equipment should start with visibility, segmentation and remote access control.

What Has Digitalisation Added to the Attack Surface in Energy and Utilities?

Oil, gas, power and water operators across the Gulf have invested heavily in digital operations. ADNOC runs its Panorama digital command centre in Abu Dhabi, Saudi Aramco operates a Fourth Industrial Revolution Center in Dhahran, and utilities such as DEWA have rolled out smart meters and grid automation across Dubai. Production data that once stayed inside a plant now flows to central operations rooms, analytics platforms and engineering partners around the world.

Each of those connections is useful, and each is a potential path into systems that control physical processes. Remote monitoring links, cloud data pipelines, wireless sensors on pipelines and vendor support connections all reach further into operational networks than anything that existed when most of the region’s facilities were built. The UAE Cyber Security Council has said the country faces hundreds of thousands of attempted attacks a day, with critical sectors among the main targets.

The region also has a history that makes the risk concrete. The Shamoon malware wiped around 30,000 workstations at Saudi Aramco in 2012, and in 2017 the TRITON malware targeted a safety system at a Saudi petrochemical plant. Operators now need security that understands control systems as well as networks, which is why many combine internal teams with specialist OT security services when they extend digital programmes into plants and substations.

Which OT Systems Were Never Meant to Be Networked?

Much of the equipment running Gulf energy infrastructure was designed for isolated networks and long lifecycles. The table below shows how digitalisation has changed the exposure of the most common system types.

System	Original design assumption	What digitalisation added	Main risk
Distributed control systems	Closed plant network, local operators	Links to central operations centres and analytics	Remote access to process control
SCADA for pipelines and grids	Private radio or leased lines	IP networks, cellular links and cloud dashboards	Interception or manipulation of field commands
Safety instrumented systems	Fully separate from control networks	Shared engineering workstations and integration	Interference with emergency shutdown
Programmable logic controllers	Trusted local network, no authentication	Connection to wider plant and corporate networks	Unauthorised logic changes
Smart meters and substation automation	Not present in older grids	Millions of networked endpoints	Large-scale disruption through software

The common pattern is that security was never part of the original design, so it has to be added around the systems rather than built into them.

What Do Gulf Regulators Expect From Critical Infrastructure Operators?

Regulation in the region has moved from general cybersecurity rules towards controls written for operational technology.

In Saudi Arabia, the National Cybersecurity Authority issued its Essential Cybersecurity Controls in 2018 and followed them with the Operational Technology Cybersecurity Controls (OTCC-1:2022), which set requirements for asset management, segmentation, remote access, monitoring and incident response in industrial environments. Energy and utility operators that fall under NCA oversight are expected to show compliance.

In the UAE, the UAE Information Assurance Regulation sets the national baseline for critical sectors, and the UAE Cyber Security Council, established in 2020, coordinates national cyber policy. At emirate level, the Dubai Electronic Security Center has introduced an industrial control systems security standard developed with major operators including ENOC, DEWA, Dubai Airports and the Roads and Transport Authority. Abu Dhabi entities follow their own sector requirements alongside the national framework.

Across both markets, the direction is consistent: operators are expected to know what OT assets they have, separate control networks from corporate IT, control third-party access and be able to detect and respond to incidents in industrial environments.

What Should Operators Prioritise With Legacy Equipment?

Most Gulf facilities cannot replace their control systems to improve security. They need controls that work around equipment expected to run for decades. A practical order of priorities looks like this:

1. Build an accurate inventory of OT assets using passive network monitoring, which avoids disrupting live systems.
2. Segment control networks from corporate IT, following the Purdue model or IEC 62443 zones and conduits.
3. Bring all vendor and engineering remote access through a single controlled, logged gateway.
4. Protect safety instrumented systems with the strictest separation of any asset on site.
5. Add continuous OT monitoring at the boundaries, with alerts feeding a security operations centre.
6. Plan patching and upgrades around scheduled maintenance windows, using compensating controls in between.

This order reflects what reduces the most risk for the least disruption. Visibility comes first because every other step depends on it, and segmentation follows because it limits how far an intruder can travel through systems that cannot yet be patched.

Digitalisation will keep expanding across Gulf energy and utilities as operators pursue cost savings and national transformation targets. The operators that secure it well will be those that treat each new connection into the plant as a security decision, made jointly by engineering, operations and security teams before the link goes live.