Infraestruturas críticas e guerra cibernética: vulnerabilidades nos sistemas de óleo e gás

Abstract

This academic essay analyzes cybersecurity vulnerabilities in critical infrastructures of the oil and gas sector, focusing on the automatic application of security patches in industrial systems (OT/ICS). The research problem aims to investigate to what extent patch automation can reduce the exposure window to cyberattacks without compromising operational availability. The study contextualizes the threat landscape and real incidents, reviews relevant standards such as Industrial communication networks - Network and system security series of standards (ISA IEC 62443), Pipeline Control Systems Cybersecurity (API 1164) and Guide to Enterprise Patch Management Planning: Preventive Maintenance for Technology (NIST SP 800-40), and evaluates hypotheses on the net effects of automation across different criticality levels. The main practical contribution is the proposal of a risk-oriented decision framework to help managers determine when to adopt automated patching in industrial environments. The findings indicate that automation can be effective for less critical assets but requires strict conditions for critical systems. The research highlights the importance of aligning cybersecurity with operational continuity in strategic sectors.