INTEGRATING ZERO‑TRUST ARCHITECTURE INTO INDUSTRIAL CONTROL SYSTEMS FOR RESILIENCE AGAINST RANSOMWARE AND INSIDER THREATS IN OFFSHORE OIL & GAS CRITICAL INFRASTRUCTURE

Abstract

Critical infrastructure — especially industrial control systems (ICS) underpinning offshore oil and gas operations — faces growing cyber threats, ranging from ransomware to insider exploitation. Traditional perimeter‑based defenses have repeatedly proven insufficient: attackers increasingly exploit vulnerabilities both at the network edge and within trusted domains. This paper explores how a comprehensive adoption of zero‑trust architecture (ZTA) tailored for industrial control environments can meaningfully mitigate such risks. Through a systematic literature synthesis, threat‑to‑control mappings, and conceptual modeling, we analyze key vulnerabilities inherent in ICS and critical infrastructure, highlight how ransomware and insider attacks manifest in these contexts, and identify how zero‑trust strategies — including identity-centric authentication, micro‑segmentation, continuous verification, and contextual access control — can address these gaps. Particular attention is paid to the unique constraints and demands of offshore oil and gas ICS: real-time operations, legacy hardware, and physical process dependencies. Our analysis reveals both substantial potential for risk reduction and non-trivial challenges including latency, interoperability, and organizational readiness. We conclude with recommendations for research and phased deployment approaches that balance secure access with operational continuity.