What Are the Vulnerabilities and Risks of Gas Networks?

Before discussing the available vulnerabilities and risks, it is important to know the relationship between vulnerability and risk. Vulnerability is related to a weakness that exists in the system. This weakness can lead to different losses, according to its environment, so risk is the probability that a weakness is misused to attack the system. To manage the risk, it is important to identify the vulnerabilities of «as networks and the risks related to those vulnerabilities, which can be different in dif­ferent environments. In fact, the first step in recognizing risk is identifying the vulnerabilities that exist in a system.

The Vulnerabilities of Gas Networks

Gas networks have always had various types of vulnerabilities. In the past, physical security of the networks could mitigate the risk of physical attacks. Natural disasters can also cause loss to gas networks. Today, with the advent of modern technologies, these vulnerabilities are managed efficiently, but new types of vulnerabilities have appeared that did not exist before. The security of various information systems used in networks is an important challenge nowadays. The Internet has given many attackers the opportunity to try and attack systems, so the number of attacks has increased dramatically. Cyber attacks can lead to significant losses for the system, so they are considered to be a significant threat to the gas networks. Globalization and downsizing are other phenomena that have seriously affected the systems because the management of these risks at the international level is difficult, espe­cially when a great many employees are not as committed to corporations because of downsizing, among other reasons. For more information, the National Petroleum Council has classified the vulnerabilities of gas networks [ 111. In this section, we use the same categorization of vulnerabilities and discuss them more briefly while acknowledging the latest works done in each area. Vulnerabilities that can affect the strength of the system have been classified into the following seven categories.

Vulnerability 1: Information Systems

Vulnerabilities in information systems is considered to be critical today. The infor­mation revolution has made big changes in many different aspects of our lives, and IT has made many changes in businesses. Nowadays, the world is considered a vil­lage in which even faraway places can communicate with each other within sec­onds. Information systems are also developing rapidly and new advances occur every day. These technologies have increased the efficiency of many processes, and most businesses are so dependent on these processes that they cannot function properly without them. In fact, businesses have made themselves so reliant on these technologies that they can be harmed by various threats. Gas networks, like other businesses, now lace significant security challenges. The wide range of vulnerabil­ities include the following:

Manual systems have been widely replaced by the information systems on which the gas companies depend. There are no manual backups for automated processes, so there is no possibility of returning a system to a manual status.. Because of the competitive market, gas industries rapidly welcome new technologies to reduce their cost and increase their efficiency. However, the security of these systems is an important concern.

. The use of joint systems can be considered a type of vulnerability. For example, many companies arc interested in having joint systems for their e-commercc, so a problem in one system can be transferred to other systems as well causing huge losses.

• The information systems have increased access from local to national and international levels; as a result of this wider access, systems are exposed to more electronic- vulnerabilities.

• The IT advances have allowed attackers to attack from almost anywhere. They can attack systems even from home, so it becomes difficult to determine the origins of an attack.

• There is a great competition in software industry market, so most vendors try to offer their products to the market as soon as possible. As a result, many softwares do not have adequate security features. These insecure systems are exposed to different professional attacks and cannot provide enough security. Updating software systems with frequent security patches is critical.

• The gas industries widely use e-commerce, so it is exposed to different virus attacks. Some antivirus programs arc available, but they are reactive and there are more viruses in the IT environment than these programs can handle.

• In the gas industries, most of today's equipment has become automated in order to increase their efficiency. The gas networks are highly reliant on the Internet, intranets, and extranets, or they depend on satellites, fiber-optic cables, microwave, phones, and so on. A disruption in one of these systems can even cause gas networks to fail to respond appropriately to customers because most operations arc done automatically and need these communication systems.

This vulnerability has become one of the most important threats to the gas industries and its risks are rapidly increasing. Currently, the widespread hacking tools that are available are leading to more people, even amateurs, using these tools. Hackers have become more professional and have gained the ability to better exploit vulnerabilities and attack the systems.

Vulnerability 2: Globalization of Economies

According to the Merriam-Webster dictionary, globalization is the "development of ^an increasingly integrated global economy marked especially by free trade, free flow of capital, and the tapping of cheaper foreign labor markets." As a result, each country sees itself not only as a nation but also as part of the world. Gas industries have experienced globalization by foreign ownership and consolidations of multi- ^national corporations, among other events. Most companies try to develop their ser- ^v,ces to an international level. This issue has made dramatic changes in the ^lndustry, especially by changing business models and the mix of various stakeholders. Globalization has increased the complexity of the industry because there are many differences between nations, from cultural to regulatory, and this has made new vulnerabilities for the network. Some of the important vulnerabilities are as follows:

• Globalization has made businesses highly dependent on each other. Gas industries have become multinational. In many countries, such as the United States, foreigners can own the companies. This has made the economics and problems of countries dependent on each other. A problem in one country may have many consequences for others in which they have no control. For example, OPEC decisions can have worldwide effects on the prices.

• Because there are no international standards for security, it is not possible to have world­wide protection. Many countries do not have strong systems, and this inconsistency can affect other countries negatively, even those that have good measures to protect themselves.

Increasing interdependency is part of globalization. Many sectors, such as information systems, finance and banking, and transportation, should work efficiently to support glob­alization, and the management of this added complexity is a real concern.

• One important vulnerability of globalization is related to cultural differences. To some extent, each country is in cultural transition, which can lead to instability. Different work ethics in different countries affect productivity. This instability can have large effects on the industry because investment would be hard to attract because of its high risk.

Vulnerability 3: Business Restructuring

Business restructuring, according to the American Heritage Dictionary of Business Terms, is "a significant rearrangement of a firm's assets or liabilities. A firm's restructuring may include discontinuing a line of business, closing several plants, and making extensive employee cutbacks. Restructuring generally entails a one­time charge against earnings."

The competitive market has made most of the gas companies reduce their costs and downsize their workforces with increasing automation. In the past, employees usually have had strong commitments to a company, but nowadays this commit­ment has lessened because of downsizing, outsourcing, and different social con­tracts, among other trends. Many employees who have left companies are angry about the terms and conditions, and employees who are currently working are not satisfied with their heavy workloads. All of these influences have led employees to pay much more attention to their own welfare rather than the interests of the com­pany and also exploit the vulnerabilities of the system. The following, which is a type of business restructure, has caused various vulnerabilities which are discussed in more detail below:

• Outsourcing is a transaction in which one company sells some of its processes to another company but is also responsible for final services. Outsourcing leads to considerable vul­nerability. Many employees detach themselves as outsourcing occurs, and new employees are usually hired by a contracting company to do their former tasks, sometimes even their former company. These employees are not as committed as full-time employees. И is not uncommon that the contracting company has less-reliable procedures for doing the function. When the critical processes are outsourced, the employees of the contracting company find good information about the procedures. This also creates vulnerability, because the corporation would have serious problems if the contracting company fails for any reason.

д strategic alliance is an agreement between firms of different countries to cooperate on any activity or joint venture that is created from at least two different firms. This matter has shown some vulnerability, especially as related to intellectual property (IP). IP is dif­ficult to protect in a venture or alliance, and it would be more at risk if the companies separate because employees of the joint venture may continue their personal relationships with each other.

Just-in-time logistics is related to the conccpt that material and equipment should be in place at the time they are needed in the process. Just-in-time logistics creates great vul­nerability when the equipment is not delivered in the required time. In fact, this matter makes the corporate very dependent on vendors and transportation infrastructures for timely delivery of the equipment.

Vulnerability 4: Political and Regulatory Concerns

In most developed countries, individual companies take responsibility for invest­ing in infrastructure. These companies naturally seek their own profit. The amount of capital in gas infrastructures is significant and has a long-term payoff period, so investing in infrastructure is really a strategic but difficult decision for these firms to make. Political and regulatory concerns are among the factors that can increase the uncertainty of making these decisions and make decision mak­ing more difficult. These regulations should guarantee the profit of all stake­holders, including consumers, governments, and companies. There exist many examples in which regulations did not consider the profit of the companies very well and caused serious problems for these firms. The increase in the risk of investment in critical infrastructure diminishes the robustness of the system, which is never acceptable. In fact, according to the International Energy Agency [12], governments should play a more important role in reliable delivery of gas to customers by setting clear policies for the whole system instead of just man­aging part of the system.

Pelletier and Wortmann [13] presented a multistage model to evaluate the risk of investment in infrastructures in Western Europe under the uncertainty of trans­port tariff changes. This risk is important to calculate to determine whether or not there is enough motivation for investment, especially after the restructuring of the gas market because of liberalization in Western Europe, which led to the shortening °f gas transport contracts. Jepma |14] and Jepma et al. [15| conducted comprehen­sive studies on the consequences of the tariff differences in gas distribution while considering only the profit of shippers as the objective. According to works on tar- 'fts, differences have made some illogical rerouting in the network, causing a change from the route with the shortest path to the one with the least expenses. As ^a result, congestion may appear in the cheapest route. Apart from congestion, this Problem can lead to the false expansion of the cheapest grid, leading to a subopti- roal network. This phenomenon—congestion and false investment motivation—is known as Jepma effect.

Vulnerability 5: Interdependences of Businesses

Today, most businesses are dependent on others. In other words, they rely on other systems for their operations. In fact, the advent of IT made many businesses highly dependent on each other, such as banking, gas, power, and transportation. Gas net­works are highly dependent on other systems, especially electricity and transportation.

The interdependency of gas on electricity can be seen from two points of view First, IT is playing an important role in gas industries, and it cannot operate unless electricity is provided. In fact, the gas industry would stop operating without elec­tricity. Second, many combined-cycle gas and electricity plants are appearing because of the efficient working of these plants, so the gas company can easily choose, according to the prices of gas and electricity, whether it wants to sell»as as fuel or use it to generate electricity and sell this as the final product. The combined- cycle power plants have increased the interdependency of gas and electricity and have largely added to the complexity of the system. There are many researchers in this field, especially in recent years as these plants have become more popular. Unsihuay-Vila et al. [16] present a model for the expansion of the integrated gas and electricity systems. Whiteford et al. [ I7| assess the risks of the interlinked gas and electricity systems in the United Kingdom, because these plants using gas for the electricity generation are producing about a third of the total demand of electric­ity in the United Kingdom. Arnold et al. |18| introduced a system for controlling the combined electric and gas systems to work more efficiently and to mitigate the risks of interdependency of gas and electricity. Munoz et al. [ 19] designed a model for the combined gas and electricity systems in order to investigate their reliability. Fedora [20] studied the reliability analysis of the linked gas and electricity systems in North America.

The gas industry is also highly dependent on transportation systems. A failure in one of these systems can lead to many problems in the gas industry because just- in-time logistics have become critical in gas delivery.

These interdependencies can cause problems. A failure in one system may lead to failures in all other systems. Outages in one system can lead to outages in other systems. These incidents can even be seen as a natural disaster.

Vulnerability 6: Physical and Human Matters

Gas networks are comprised of complicated and capital-intensive equipment. This equipment and other assets are exposed to many threats and risks. Disruption in each asset has a different effect on the network, so they are ranked according to their potential impact. Some assets have low vulnerability because their damage would only have local disruptions of short duration. Others have medium vulnera­bility because their damage would lead to regional effects with economic losses and even losses in human life. The other assets have high vulnerability because their damage would even have national or international effects and might cause high economic losses and extreme hardship for consumers. Transmission pipelines, compressor stations, and storage and distribution facilities are usually considered among the assets with high vulnerability. Some of these types vulnerabilities are _as follows:

. Underground pipelines are very vulnerable to accidental damage. Although these pipe­lines are marked for easy identification, they are also easily damaged, especially by con­struction equipment.

. The use of equipment has increased considerably, especially because of the advent of IT.

As a result, the loss of equipment would have a severe impact.. Companies try to decrease their inventories of spare pans, so that it can be used to

increase in outage durations in the case of any problem.. Nowadays, the gas industry widely uses automated facilities, and reaching and repairing them when needed can also be time consuming.

There are many risks and threats that use the physical and human matter-vulner­ability, (some of which are human error, pipe breaks, contamination, and employee dissatisfaction) as justification.

Vulnerability 7: Natural Disasters

There is a great number of natural disasters which can cause much damage to the gas infrastructures. Among them, earthquakes, storms, hurricanes, tornadoes, bliz­zards, floods, and volcanic eruptions can be mentioned. In these cases, emergency acts are really needed to mitigate the losses. There are many countries, like United States, which have saved great record in this regard. However, it seems that it is more difficult now, in comparison with the past, to act appropriately when these disasters strike because business restructuring and downsizing led to the resignation of many skilled workers who could be of great help in times of these disasters. Also, the increase of interdependency of the industry on other industries has increased the degree of difficulty in dealing with these problems.

The Risks of Gas Networks

In the previous section, all of the vulnerabilities of gas networks were investigated and some of their probable threats or risks were mentioned. Those vulnerabilities can have different impacts in different environments. In fact, recognizing the vul­nerabilities is a major step in recognizing the risks because the vulnerabilities are the cause and effect of the risks and it is important to reduce the risks to an acceptable level. Natural gas risks have been classified as falling into the following five categories [12]: