The Cyber Doctor’s 7-Day Series
Prescriptions for a Safer Digital Future
Welcome to Day 4 of 7 in this journey through my cybersecurity leadership experiences. These aren’t just projects—they’re stories of high-stakes decisions, human impact, and lessons that continue to shape how I lead.
Today, we enter the energy sector—a world where a 30-second system delay can ripple into national disruption.
Day 4: Securing What Never Sleeps
Cyber Resilience in the Energy Sector—Where Downtime Isn’t an Option
Energy is constant.
Whether it’s lighting a home, fuelling a plane, or powering a hospital, the expectation is the same: always on.
But behind the scenes, energy operations are incredibly complex—and increasingly digital.
When I was entrusted with cybersecurity responsibilities for companies like BAPCO, Tatweer Petroleum, and Qatar Petroleum, I quickly realized one thing:
You don’t just secure a network. You secure a nation’s lifeline.
A Fragile Balancing Act
The first time I visited a control centre at one of the national oil companies, I was struck by how delicate the balance was.
Highly automated systems. Supervisory control over real-time pressure valves. Pipelines running through geopolitically sensitive zones.
And yet, many of these systems—Operational Technology (OT) and IT alike—were never designed to talk to each other, let alone defend themselves.
The question wasn’t if someone would try to compromise the infrastructure.
It was when—and whether we’d catch it in time.
From Vulnerable to Vigilant
We started with a full cybersecurity maturity assessment, covering:
- SCADA systems
- Remote terminal units
- Vendor access pathways
- Legacy OT/ICS networks
- Internal SOC and incident response readiness
What we uncovered wasn’t unique—but it was urgent:
- Insecure remote maintenance connections
- Patch delays across OT environments
- Flat networks with no segmentation
- Vendors with excessive, unsupervised access
But the solution wasn’t to shut it all down.
It was to build resilience within operations—without slowing the business down.
How We Strengthened the Core
- We implemented zoned network segmentation to isolate OT from IT
- We introduced continuous monitoring with threat detection tuned for OT anomalies
- We enforced strict identity and access controls for third-party vendors
- We trained plant engineers—not just CISOs—on cybersecurity hygiene
- We developed incident playbooks tailored for refinery and upstream environments
And we aligned the whole effort with ISO/IEC 62443, NIST CSF, and national energy security mandates.
A Moment I Still Think About
One morning, while reviewing logs, our team detected a command injection attempt on a remote oil distribution terminal.
The automated system flagged it, but what mattered more was that the onsite engineer knew exactly what to do—because we had rehearsed the scenario weeks earlier.
The response wasn’t just fast—it was confident.
That moment validated everything.
Because cybersecurity doesn’t work unless every person, not just every system, is part of the defence.
Why It Still Matters
The world runs on energy—but today, it also depends on the cybersecurity of the systems that deliver it.
Whether you’re in a boardroom or a control room, resilience isn’t a luxury—it’s a responsibility.
We don’t defend just to protect data.
We defend to protect livelihoods, economies, and lives.
Tomorrow, in Day 5 of this series, I’ll talk about what it was like to build cybersecurity ventures across 30+ countries—as a founder, consultant, and risk partner to boards. It’s a story of entrepreneurial grit, global trust-building, and the business side of cyber.
Until then, thank you for reading.
And thank you for standing for resilience—in every sense of the word.
Warm regards,
Dr. Lalit Gupta
The Cyber Doctor
www.cyberdoctorlalitgupta.com
he***@*******************ta.com
