Aibel

Aibel is a Norwegian engineering, construction and maintenance contractor for the energy industry. Ahmed delivers the OT cyber security and network engineering scope on one of Europe's largest LNG developments, working between the operator, the EPC contractor and the control-system vendors so that industrial systems and corporate IT connect without widening the attack surface.

The brief

Own cyber security and network engineering across more than 25 project packages on a live EPC programme: turn IEC 62443 and the applicable legislation into project requirements, split the scope cleanly between operator, contractor and suppliers, design the segmentation and the interfaces, run the risk assessments, and prove the result at factory and site acceptance before anything is energised.

What was delivered

Requirements and strategy

• Project cyber security requirements built on IEC 62443 (3-2 risk assessment and zoning, 3-3 system requirements and security levels, 4-2 component requirements, 2-4 supplier programme requirements)
• Gap analysis between the IEC 62443 baseline and the legislation that applies to the asset — the EU NIS2 directive and the Norwegian digital-security and power-preparedness regulations — with mitigations agreed with the operator
• OT cyber security strategy and the input to the contract between operator and contractor

Scope split and interfaces

• Scope-split matrix defining who owns what across automation, the integrated control and safety system and OT security — operator, contractor and each supplier
• Barrier limits for company-provided items and external interfaces, with a single holistic IP-allocation and device-naming scheme across every package
• Security architecture and Purdue-model segmentation: zones, conduits, a controlled OT/IT demilitarised layer, and vendor remote-access patterns that leave no standing connections into the plant

Assurance across suppliers

• Cyber security and network engineering run as a multi-discipline activity embedded in project execution rather than a stand-alone sub-project
• Risk assessment workshops with suppliers' engineers for each system and package; IEC 62443 self-assessments and compliance reviews across 25+ vendor packages, findings prioritised by risk
• Project tooling agreed and bounded — asset inventory, vulnerability assessment, ICS intrusion detection, network mapping, hardened engineering laptops, and a portable test kit and lab for acceptance testing

Testing and handover

• Cyber security scope executed in Factory Acceptance Tests and Site Acceptance Tests alongside the automation engineers, so security is verified before shipment and again after installation
• Confidential security documentation identified and access-controlled through storage and transfer; changes handled through the project's change process

Talk to us about similar work