Log In
Log In
Led by Senior HSE Engineer Simulacrum
Advanced facility security management from threat assessment and physical security (perimeter, access control, surveillance) through cybersecurity for industrial control systems, digital asset protection, security planning, policies, compliance, crisis management, and business continuity.
Led by Senior HSE Engineer Simulacrum
The question
Security management in oil and gas is about understanding threats, assessing vulnerabilities, and designing proportionate protection. This module covers the security risk assessment process (asset identification, threat identification including insider threat, vulnerability assessment, consequence assessment across five dimensions, and risk ranking), the security management plan integrating physical, cyber, personnel, and procedural security, four regulatory frameworks (ISPS Code, API 780, CFATS, local requirements), and the security culture — every employee responsible for reporting suspicious activity, controlling access, and protecting information.
Outcome
The student can describe the SRA process, describe the SMP components, name four regulatory frameworks, and explain security culture. (Security management fundamentals)
Sub-units
Led by Senior HSE Engineer Simulacrum
The question
Physical security is the first line of defence — multiple independent layers so no single failure defeats the system. This module covers perimeter security (standard and high-security fence specifications, vehicle barriers including HVM, the 6–10 m clear zone), electronic access control (card-based and biometric, visitor registration and escort, contractor screening, vehicle access), surveillance (fixed and PTZ CCTV, video analytics, thermal imaging for night operations, the security control room), lighting standards for CCTV identification (50 lux perimeter, 100+ lux access points), randomised security patrols, and enhanced security for critical infrastructure and product storage.
Outcome
The student can describe defence-in-depth, describe perimeter/access/surveillance systems, state the lighting standards, and describe enhanced protection for critical assets. (Physical security)
Sub-units
Led by Senior Instrumentation & Control Engineer Simulacrum
The question
The control systems are increasingly connected — and connectivity creates vulnerabilities. This module covers four cyber threats (state-sponsored with Stuxnet/Triton examples, criminal ransomware with Colonial Pipeline, hacktivism, insider), the IEC 62443 framework (security zones, conduits, four security levels), five defence-in-depth measures for ICS (network segmentation, role-based access, patch management on staging systems, application whitelisting over antivirus, NIDS/SIEM monitoring), digital asset protection (data classification, encryption, DLP), and the converged physical-cyber security operations centre.
Outcome
The student can describe four cyber threats, describe IEC 62443, describe five ICS defences, describe five digital asset protection measures, and explain the converged SOC. (Cybersecurity and integrated solutions)
Sub-units
Led by Senior HSE Engineer Simulacrum
The question
Security measures are only effective when supported by clear policies, enforced consistently, and subject to audit. This module covers security policy development (scope, objectives, responsibilities, standards), four key procedures (access with anti-tailgating, visitor escort, contractor screening, incident reporting using RCA), regulatory compliance (ISPS PFSO role, CFATS top-screen and SSP, data protection), security auditing across four domains (physical, cyber, procedural, documentation) with five performance metrics, and personnel security including four insider threat indicators and the insider threat programme.
Outcome
The student can develop a security policy, describe four key procedures, explain regulatory compliance, describe the four audit types, and describe the insider threat programme. (Security planning, policies, and compliance)
Sub-units
Led by Senior HSE Engineer Simulacrum
The question
When a security incident occurs — intrusion, sabotage, cyber attack, bomb threat — the response must be swift and coordinated, integrating with the emergency response while adding security-specific elements. This module covers the six-step security incident response (detection through investigation with evidence preservation), crisis management for security events (law enforcement liaison, threat intelligence, legal counsel, media management of security-sensitive information), business continuity for security disruptions (alternate operations centre, reduced staffing, IT DR), lockdown procedures where shelter-in-place may be safer than evacuation, and three case studies — In Amenas, Colonial Pipeline, and insider theft.
Outcome
The student can describe the incident response process, explain crisis management for security events, describe business continuity measures, explain the lockdown procedure, and identify the security failure in each case study. (Crisis management, business continuity, and case studies)
Sub-units