DUBAI, United Arab Emirates, Nov. 20 (UPI) -- Middle East oil and gas companies need to beef up their defenses against cyberattacks, security specialists say, with the Persian Gulf particularly vulnerable because of the high concentration of energy resources in the turbulent region.
One of the industry's main vulnerabilities against what British cybersecurity expert Tareque Chodhury called "an invisible enemy" is its reliance on outdated computer technology that can be easily penetrated.
Cyberattacks on the industry's infrastructure are projected to cost damages totaling nearly $2 billion by 2018, according to a report by the market intelligence firm ABI Research of New York.
A recent report by the U.S. technology consulting firm Booz Allen Hamilton stressed that up to 90 percent of computers worldwide with intellectual, monetary or strategic value are infected with undetected malicious software, or malware.
"Every major computer system of consequence most likely has malware in it, placed there by an adversary," cautioned John McConnell, former director of the U.S. National Security Agency and now vice chairman of Booz Allen Hamilton, during a visit to the United Arab Emirates this month.
"So much of the world's oil production happens here and the pursuit of technologies to make it more efficient," he said. "When you increase that level of automation and use of information technology, it only increases the vulnerability."
But he said that companies remain reluctant to allocate significant funds to enhance detection and prevention of cyberattacks. Ideally, he observed, 5-10 percent of a company's IT budget should be spent on cyber security.
Concerns about the vulnerability of the gulf's oil and gas industry skyrocketed in 2012 after Saudi Arabia's state oil company, Aramco, the largest energy production corporation in the world, was blacked out in an Aug. 15 cyberattack blamed on the kingdom's longtime regional rival Iran.
Some 30,000 terminals were disabled in seconds, their memories burned up.
Fortunately, Aramco's oil operations are separated from the company's internal communications system, so the damage did not affect the production rate of around 10 million barrels a day.
If it had been disrupted, that would have caused economic shock waves around the globe and possibly sent the price of oil soaring past the doomsday level of $200 per barrel.
The attack on Aramco, which U.S. officials say involved an Iranian virus identified as "Shamoon," was followed by another that targeted Qatar's RasGas, a joint venture between U.S. oil giant Exxon Mobil and state-owned Qatar Petroleum which operates the world's largest natural gas field.
This was less damaging and the emirate's gas exports were not affected. But the attacks were seen as retaliation for a suspected U.S. cyberstrike against the Iranian National Oil Co. in May 2012 that shut it down for a time.
Among the facilities affected were production platform in the gulf and the giant export terminal on Kharg Island in the northern sector of the waterway. Kharg usually handles around 80 percent of Iran's oil exports.
That was the first known cyberattack on an energy target.
The opening digital salvo in this Silent War was unleashed on June 22, 2009, against Iran's nuclear program using a computer virus known as Stuxnet, which has since been attributed to the United States and Israel as part of their efforts to sabotage Tehran's contentious nuclear project.
Since then, the intensification of the cyberconflict and rising political tensions in the Middle East have raised fears about the growing use of viruses to target critical national infrastructure in the region, particularly the energy sector that is the economic mainstay of most of the gulf states, including Iran.
McConnell warned that Iranian hacktivists have been increasingly active over the last 18 months, targeting the United States -- mostly hitting banks in retaliation for U.S.-led sanctions on Iran over its nuclear program -- and Saudi Arabia.
Moscow's Kaspersky Lab, one of the world's most prolific cybersecurity outfits, recently reported that between June and September it had detected 1.2 million Internet-borne malware attacks on computers via browsers in the United Arab Emirates, a major oil producer, that affected 26.4 percent of users.
A Booz Allen Hamilton report released in October stressed that as oil and gas companies in the region modernize their computer systems and open their networks to external contractors and vendors they're exposing themselves, often inadvertently, and need to build security barriers.
