Oil-gas Sector
6 articles covering oil-gas OT/ICS security
U-Boot Vulnerabilities in Industrial Control Systems: Embedded Firmware Security in 2026
U-Boot is the dominant open-source bootloader for embedded Linux devices — including industrial routers, RTUs, PLCs, and SCADA components. Vulnerabilities in U-Boot's FIT image parsing and boot verification logic have direct implications for OT device firmware integrity and secure boot trust chains.
IEC 61850 Substation Automation Security: Attack Surface and Hardening for Power Grid Operators
IEC 61850 is the dominant protocol for digital substation automation — and it was designed for operational reliability, not security. GOOSE messages carry no authentication. MMS sessions use optional TLS that most deployments skip. This analysis covers the threat model and practical hardening for utilities and grid operators.
ICSA-26-181-02: FUXA SCADA CVE-2026-13207 -- Path Traversal to Unauthenticated RCE
ICS-CERT advisory ICSA-26-181-02 covers a dot-segment path normalization bypass in FUXA open-source SCADA software that allows unauthenticated remote code execution. CVSS v4 score 8.6. Deployments in water, energy, and manufacturing are exposed.
Emerson DeltaV DCS: Authentication Gaps, CISA Advisories, and Zero Trust Remediation
Emerson DeltaV is one of the most widely deployed distributed control systems in oil and gas, pharmaceutical, and chemical manufacturing. Legacy DeltaV communication protocols lack authentication, and multiple CISA advisories document workstation-level vulnerabilities. Here's the current security posture and what operators should do.
Oil and Gas Pipeline Cybersecurity: TSA Directives, OT Threat Landscape, and Compliance Requirements in 2026
The TSA's pipeline cybersecurity directives have fundamentally changed the compliance environment for US pipeline operators. This analysis covers the directive requirements, the OT threat actors specifically targeting oil and gas infrastructure, and the technical controls that actually move the needle.
OPC UA Security: Attack Surface Analysis and Hardening Recommendations for Industrial Environments
OPC Unified Architecture has become the dominant interoperability standard for industrial communication — and a consistent target in ICS-focused threat campaigns. This analysis covers the OPC UA threat model, documented vulnerability classes from recent CVEs, known exploitation by nation-state actors, and the hardening steps that reduce exposure without breaking operational continuity.