Industrial control systems in the oil and gas sector are increasingly targeted by sophisticated cyber adversaries, and understanding offensive tactics in that domain is essential for improving resilience. This thesis proposes a systematic, ethical examination of cyber attack vectors and adversary behaviors within a realistic oil drilling simulation environment. By recreating operational scenarios and threat conditions in a controlled laboratory setting, the study seeks to characterize how attacks against supervisory control, telemetry, and associated IT/OT interfaces could unfold, what vulnerabilities and attack surfaces are most likely to be exploited, and how attack campaigns evolve over time in response to system defenses and operational constraints.
The research will employ adversary emulation and threat-model driven experiments—performed only under strict legal and ethical safeguards—to generate a taxonomy of attack patterns, capabilities required, and potential impacts on safety, availability, and data integrity.
The topic is available for two students:
- Analysis that focuses on high-level tactics and modelling rather than on providing exploit recipes.
- Low level script development for selected attack phases
Results will include qualitative and quantitative assessments of attack effectiveness within the simulator, a set of mitigation- and policy-oriented recommendations for operators, and guidance for defenders on hardening priorities and detection readiness. Ethical considerations and compliance with legal frameworks will be integral parts of the thesis methodology and reporting.
The thesis is supervised together with the NORCE research institute. Due to regulatory and project-specific requirements, applicants holding citizenship from certain countries are regrettably not eligible for this thesis topic.