Incident Response Management in the oil and gas industry

Abstract

Incident Response is the process of responding to and handling ICT security related incidents involving infrastructure and data. This has traditionally been a reactive approach, focusing mainly on technical issues. Incident Response Management (IRMA) combines traditional incident response with a proactive learning loop, thus increasing the focus on organisational learning. The IRMA method is comprised of the following phases: - Prepare: Planning and preparation of incident response - Detect and recover: Detection of incidents and restoration to normal operation - Learn: Experience sharing and learning afterwards. The IRMA project has focused on the offshore oil and gas industry, but the results should also be applicable to other organisations in the energy sector or process control industry.