In recent years, cyber attacks targeting industrial environments have increased in both frequency and sophistication, posing significant risks to critical infrastructure such as energy production. The oil and gas sector is especially vulnerable due to its reliance on complex operational technology (OT) systems, which, if compromised, can lead not only to economic losses but also to severe safety and environmental consequences. This thesis addresses the growing need to understand and evaluate detection capabilities against cyber threats in industrial contexts, focusing specifically on advanced oil drilling simulation environments that emulate real-world operational conditions.
The objective of this work is to investigate how Splunk, a leading platform for security information and event management (SIEM), can be applied to detect, analyze, and respond to cyber attack scenarios in a simulated oil drilling infrastructure. By deploying Splunk to monitor system logs, network traffic, and operational events generated in the simulation, the study will assess its effectiveness in identifying anomalies, correlating indicators of compromise, and providing actionable insights. The outcome of this research will contribute to a deeper understanding of how security monitoring tools can enhance resilience in industrial environments, ultimately supporting safer and more reliable energy operations.
The thesis is supervised together with the NORCE research institute. Due to regulatory and project-specific requirements, applicants holding citizenship from certain countries are regrettably not eligible for this thesis topic.