Building a Resilient World:

Welcome to the official blog of the ISA Global Cybersecurity Alliance (ISAGCA).

This blog covers topics on automation cybersecurity such as risk assessment, compliance, educational resources, and how to leverage the ISA/IEC 62443 series of standards.

The material and information contained on this website is for general information purposes only. ISAGCA blog posts may be authored by ISA staff and guest authors from the cybersecurity community. Views and opinions expressed by a guest author are solely their own, and do not necessarily represent those of ISA. Posts made by guest authors have been subject to peer review.

All Posts

How PETRONAS Leverages ISA/IEC 62443: An Interview with Sharul Rashid

We recently conducted an interview with Sharul A. Rashid, PETRONAS Group Technical Authority and Custodian Engineer of Instrument and Control, to talk about how his company leverages the ISA/IEC 62443 series of standards, how the standards are advocated within the Malaysian government, and how the company implemented standards-based operations technology (OT) cybersecurity training.

Editor’s Note: PETRONAS is a Malaysian oil and gas company established in 1974 and wholly owned by the Government of Malaysia. The corporation is vested with the entire oil and gas resources in Malaysia and is entrusted with the responsibility of developing and adding value to these resources. PETRONAS is ranked among Fortune Global 500's largest corporations in the world.

How did PETRONAS come to the decision to implement ISA/IEC 62443 across its operations?

We implemented ISA training because we realized that our company, PETRONAS, has an ever-increasing threat of cyber-attacks. We realized that both IT and OT personnel must work together, and we applied an IT-OT convergence strategy in action. We quickly built up and nurtured our best performing team in this area as a high-level, IT-OT converged cybersecurity taskforce, guided by the ISA/IEC 62443 standards’ sustainable, international best practices. As part of this program, competency and capability building was one of our primary agenda points.

Once PETRONAS decided to implement ISA/IEC 62443, what steps did your leadership take to ensure that your teams were prepared and knowledgeable about the standards?

The journey towards an enterprise approach cybersecurity program for PETRONAS started in 2018. We quickly crafted a four-year roadmap towards building an institutionalized capability in OT cybersecurity, which was approved in 2019.

The institutionalized capability building program was established mainly to create a culture of cybersecurity and to ensure the ongoing suitability and competence of personnel, commensurate with the risk to critical infrastructure and the following organizational objectives:

  • Responsibilities
  • Workforce Controls
  • Knowledge, Skills, and Abilities
  • Awareness

As part of the competency, we stipulated that cybersecurity task force members need acquire Cybersecurity Fundamental Specialist (CFS) ISA/IEC 62443 and Expert Level (Risk, Design, and Maintenance) training. Before selecting ISA/IEC 62443 cybersecurity training for OT, we had reviewed other OT cybersecurity trainings available in the market.

We decided on ISA training due to its leadership in developing widely used global standards. Based on this, ISA trainings were selected and had been approved by our management to be a part of the institutionalized capability four-year roadmap for PETRONAS.

How is PETRONAS able to coordinate ISA training within your company? What did the landscape look like for the company before the implementation of ISA training, and what does it look like now?

Since PETRONAS is a member of the ISA Global Cybersecurity Alliance (ISAGCA), we received a 40% discount, which requires at least more than 60 pax per single PO. With our internal advertisement and promotion of the program, we were able to get 73 nominations/pax, thus we went ahead with the proposal for procurement of the program in a single purchase from our top management. It was approved as part of the Institutionalized Capability Building Program. On personal capacity, I took the four complete training modules online and had been certified as a “Expert” back in 2020. I found the modules, combined with the lab, to be very relevant to OT.

With our staff trained in ISA/IEC 62443, we are now able to communicate our cybersecurity goals more effectively to our stakeholders and vendors. Knowledge in the standards have also helped us shape the cybersecurity governance framework of our organization.

How did the various teams approach the training? Was there any pushback or difficulty in implementation?

The company acknowledged our effort to educate the staff in cybersecurity. Along with ISA/IEC 62443 trainings, we had supplemented with other trainings such as the PETRONAS cybersecurity project for OT, short trainings on human defense/firewall, and more. More than 1,000 manhours were spent conducting awareness training in accelerating this cybersecurity maturity culture in the workplace.

For new IT personnel joining the PETRONAS cybersecurity project for OT, they attended onboarding programs to ensure that they understood very well the criticality and priority of the OT environment. We are also extending the awareness training to the frontline, such as panel operators and boardmen who are monitoring and controlling OT assets via distributed control systems (DCS) 24/7, 365 days a year.

There was hardly any pushback. The management team at PETRONAS understood the importance of the awareness training on cybersecurity and gave full cooperation to enable staff to be trained.

What does it mean to be “all in,” so to speak, on ISA/IEC 62443 within the company?

With combining ISA trainings with other relevant trainings, I believe that PETRONAS is moving forward in the right direction towards our goal of enhancing our cybersecurity culture. With this implementation, I believe that PETRONAS has a commitment to shape and steer ISA/IEC 62443 among ISAGCA end user companies at the international level. We at PETRONAS are making a continuous effort to collaborate on this initiative.

How does PETRONAS collaborate with the Malaysian government in related to enforcing ISA standards? What does this look like on both the company and government side?

We are progressing well in advocating the government of Malaysia towards the use of ISA/IEC 62443 cybersecurity standard for OT assets. Once the standard is approved to be used as part of the Malaysia standard, it may be adapted on a voluntary basis for any company operating in Malaysia. We are continuously campaigning on the awareness of the standard for OT cybersecurity, and will continue to promote its usage.

Editor's Note: Sharul Rashid would like to express his thanks to his OT Cybersecurity core team: Principal Instrument & Control (I&C) Engineers Azmi Hashim and Michael Ng Chien Han, along with Senior I&C Engineer Tan Ping Yang, who have helped shape and steer the OT Cybersecurity program for PETRONAS. He also would like to express his appreciation to the rest of the PETRONAS team who have put dedicated energy and effort in delivering this program.

Steven Aliano
Steven Aliano
Steven Aliano is the Content Marketing Specialist for ISA & ISAGCA.

Related Posts

Protecting Vital OT Infrastructure: Key Strategies for OT Penetration Testing

Operational technology (OT) cybersecurity faces significant challenges in maturing its operations and pro...
Mohannad AlRasan May 24, 2024 4:44:16 PM

How to Implement Cybersecurity Automation in Education

Every industry today needs to take cybersecurity seriously. That said, some sectors face more dangers tha...
Zac Amos May 17, 2024 4:04:28 PM

How Machine Learning Revolutionizes Automation Security with AI-Powered Defense

The terms “AI” and “machine learning” are often used interchangeably by professionals outside the technol...
John Funk May 10, 2024 3:16:51 PM