This survey of IT and OT security professionals at energy, oil and gas companies was conducted in March 2018 by Dimensional Research.

1. ICS Security in the Energy Industry
A Survey of IT and OT Security Professionals at Energy, Oil and Gas Companies
The study was conducted in March 2018 by Dimensional Research. Respondents included
151 IT and OT (operational technology) security professionals at energy, oil and gas companies.

2. Yes
91%
No
9%

3. 48%
56%
59%
62%
64%
71%
38%
35%
37%
31%
30%
26%
13%
9%
4%
7%
6%
3%
Compliance-related fines
Physical damage to our infrastructure
Safety of employees working with
infrastructure
Impact on company reputation
Data exfiltration/stolen data
Operational shutdown or customer-
impacting downtime
Very concerned Somewhat concerned Not concerned

4. 90%
70%
10%
30%
Equipment malfunction or failure
Catastrophic event
Yes No

5. Yes
65%
No
28%
I don't know
7%

6. 7%
40%
53%
56%
Other
We need time to go through the
decision-making process
They just need more information on
the threat
Once there is a significant attack
against us, they'll invest more

7. Increased
more than we
would have
otherwise
59%
Decreased
what we had
planned
8%
No change,
although we
were aware of
these threats
32%
We didn't know about these
threats 1%

8. 11%
44%
45%
Stuxnet
Trisis/Triton/CrashOverride/Indus
troyer
Ransomware

9. Lack of
budget and
investment
62%
Do not have
talent and
expertise
22%
The technology involved is too
complex
16%

10. 7%
10%
14%
34%
35%
Computer security
Physical security
ICS device security
Network level security
We use a multilayered approach

11. tripwire.com | @TripwireInc