Security Economics for an Engineering, Procurement and Construction (EPC) Company and Their Customer

No ratings

Presented at s4x17 2017 by

Samuel Linares

Industrial companies and critical infrastructures want to have cybersecurity injected in their projects, processes and facilities, and they include “some” requirements in their scopes of work. Automation vendors provide the technology (and sometimes knowledge) for the process, and have different postures on cybersecurity (developing their own cybersecurity offering, partnering with cybersecurity vendors, etc.). EPC (Engineering, Procurement and Construction) companies carry out the detailed engineering design of industrial projects, procure all the equipment and materials necessary, and then construct a functioning facility for their clients ... or at least that's the way it is suppose to work. Cybersecurity has brought a new layer of complexity to the mega-projects, adding new costs and risks to the already costs-sensitive and high risk projects. And cybersecurity "success" is hard to objectively measure. The lack of the right cybersecurity skill sets and capabilities in the EPC bring additional problems to the project, with unclear compliance to the scope of work, scope deviations, hard relationships issues,or hidden costs throughout the years. All of this makes the economics of injecting cybersecurity into an EPC project a big challenge for them. What financial incentives the EPC can identify to view cybersecurity as profitable, or at least, not as a cost black-hole? How EPCs, automation vendors and industrial companies can work together to improve the protection of our industrial processes? What’s the reality in the EPC world? A case will be shared on the reality of cybersecurity in a multi-year mega-project, its challenges, stakeholders, role of the EPC, the automation vendor, etc.