Shamron Case Study

Saudi Arabian Oil Company (Saudi Aramco), NAICS 213112, is the state-owned, national oil company of Saudi Arabia and the world’s largest exporter of crude oil, producing about 12% of the world’s supply. The company was the victim of a cybersecurity breach in August, 2012 that compromised their business infrastructure and caused those operations to be taken completely offline. Fortunately for the company their Industrial Control Systems (ICS), which are computers and applications that control the production of oil, were not affected.
The company’s infrastructure was compromised with malware named “Shamoon” when an employee opened a spear-phishing email and unknowingly allowed the virus to infect the business systems of the company. A successful company performs risk assessments to detect weak points of security and then generates corrective measures to protect its resources. Saudi Aramco decided that their ICS were the biggest assets at risk and chose to protect them at any cost. They did not however, apply the same thoroughness to protecting their business systems. The Shamoon virus proved how costly it is not to protect all assets.
Even though the company acted swiftly to mitigate the effects of the breach, the damage was already done. To shorten the time required to restore the company’s business systems they opted to buy

Senior Vice-president of Downstream for Saudi Aramco, Abdulrahman F. Al-Wuhaib, spoke at the 2014 ASIS Middle East Security Conference and Exhibition and claimed the company previously thwarted thousands of attacks but this specific malware had not been seen before, making advanced detection impossible. “Thankfully, meticulous protection technologies and systems were in place for essential functions, as well as incident response plans for various situations” (ASIS 5th Middle East Security Conference & Exhibition,