How a business-network attack stopped fuel deliveries

Colonial Pipeline transports petrol, diesel and aviation fuel through approximately 5,500 miles of pipelines serving the eastern United States. On 7 May 2021, the company shut down its pipeline system after discovering ransomware: malicious software that locks files and demands payment to restore access. The FBI subsequently identified the ransomware as DarkSide.

The attack affected the business network, but its consequences reached physical operations. Information technology, or IT, supports activities such as finance and communications. Operational technology, or OT, monitors and controls physical processes. Colonial shut down operations as a precaution against further infection, illustrating how uncertainty about a business-network intrusion can interrupt an essential service without confirmed manipulation of physical equipment. The company began restarting pipeline operations on 12 May. The
US Department of Energy’s incident record reports that Colonial announced the restart of its entire system on 13 May, with product delivery commencing to all markets. Restarting the pipeline, however, did not immediately replenish supplies throughout the distribution network.

The lesson is not that stopping operations was necessarily wrong. It is that cybersecurity decisions can become operational safety decisions before managers understand the full extent of an attack.

Why the effects spread beyond the pipeline

A cascading effect occurs when disruption in one system causes problems in another, which then affects further systems. Colonial’s shutdown interrupted fuel transportation, contributing to local shortages of petrol, diesel and aviation fuel. Panic buying added pressure as consumers sought to secure supplies, depleting stocks at some filling stations. This chain crossed several boundaries. A digital incident prompted an organisational decision; that decision interrupted a physical supply chain; and public behaviour amplified the resulting pressure. The UNECE case study on critical energy infrastructure also describes difficulties organising alternative fuel transportation and disruption to aviation fuel supplies. The response extended well beyond Colonial. This is why CI cannot be understood as a collection of isolated assets. Energy, transport, communications and other services depend on one another, often across organisational boundaries. Disruption can travel through technology, suppliers, organisational decisions and customer behaviour so we must take a socio-technical perspective: examining technology alongside the people, procedures and institutions that shape its performance.

Prepare for (difficult) decisions

For your workplace, the practical question is broader than “Which systems could we lose?”. Start by mapping one essential service. Identify the digital systems, equipment, people, utilities and suppliers it needs. Then establish how long it could continue without each dependency and which losses would force a reduction or shutdown.

Colonial shows why this map must extend beyond direct technical connections. Separating business and operational networks remains important, but organisations also need confidence in that separation and an understanding of the information required for safe operation. Equipment can remain functional while uncertainty makes continued operation unacceptable.

Next, clarify decision-making responsibilities. Who can isolate a network or stop a service? Who decides whether an alternative process is safe? What evidence must operational and security teams verify before restarting? Test those arrangements through a discussion-based exercise involving IT, security, operations, management and communications. Use a Colonial-style scenario: business systems are unavailable, operational equipment appears normal, and the intrusion’s scope remains unclear. Ask participants to identify what they know, what they need to verify and who can authorise the next step.

Include customers and suppliers in the scenario. Colonial’s experience demonstrates that public responses can intensify disruption, while recovery depends on organisations outside the affected operator. Communication should therefore explain what is known, what remains uncertain and when people can expect another update.

Finally, test recovery as an operational task. A restored application is not enough: staff must validate its data, reconnect necessary services and demonstrate that it supports safe delivery. CISA’s Stop Ransomware Guide recommends understanding critical dependencies, testing offline encrypted backups and regularly exercising response and communications plans.

Resilience means continuing the service, not a mere backup

CI resilience means preparing to withstand disruption, limit its consequences, restore essential functions and adapt afterwards. It complements prevention rather than replacing it. The objective is not simply to recover individual systems, but to restore the service that people and businesses need.

That creates several connected challenges. Interdependencies allow disruption to spread across sectors. Multiple stakeholders must coordinate despite different responsibilities and priorities. Human factors (including uncertainty, workload and public behaviour) shape decisions and consequences. Vulnerabilities also extend beyond software flaws. Unnecessary access, unclear responsibilities, untested alternatives and dependence on a single supplier can undermine continuity. Technical controls need support from workable procedures, informed decisions and cooperation across organisational boundaries.

Start with one essential service and bring its operational owner together with an IT colleague and a relevant supplier. Identify the dependency with the weakest fallback, then test that fallback under realistic conditions. Measure success by whether people can receive a safe, dependable service, not simply whether a server comes back online. Even small exercises can turn a broad cybersecurity concern into a significant improvement in overall resilience.

Digital4Security Professional Learning

Develop Your Expertise in Risk Management of Cyber-Physical Systems

The Colonial Pipeline case study highlights why industrial cybersecurity requires more than technical protection. Professionals must understand the relationship between cyber risks, physical infrastructure, organisational decisions and the continuity of essential services.

The Risk Management of Cyber-Physical Systems microcredential from Digital4Security provides an opportunity to develop practical skills in identifying, assessing and managing technology risks across the lifecycle of cyber-physical systems.

Delivered by Politecnico di Milano and CEFRIEL, the course explores established risk-engineering methods, technology risk governance, cyber-risk modelling and business continuity management. Learning is supported by real industrial case studies, practitioner insights and a business continuity management serious game.

What Will You Learn?

Participants will develop their understanding of:

• Technology risk management: Identifying, categorising and prioritising risks associated with operating and digital technologies.
• System safety and risk assessment: Applying methods including Failure Mode Effects and Criticality Analysis (FMECA), Fault Tree Analysis (FTA), Event Tree Analysis (ETA) and Probabilistic Risk Analysis (PRA).
• Cyber-risk modelling: Assessing IT, OT and human-related risks, including cascading effects and interdependencies between systems.
• Human and organisational factors: Understanding their influence on risk management, operational safety and resilience.
• Business continuity management: Conducting Business Impact Analysis, evaluating recovery strategies and developing continuity plans.
• Critical infrastructure resilience: Exploring cyber threats, infrastructure interdependencies and approaches to protecting essential services.

Flexible Learning for Working Professionals

The microcredential is designed to accommodate professional and personal commitments. Core course content is available asynchronously for self-paced study, complemented by optional live sessions.

No specific educational prerequisites are recommended. Assessment consists of a group written assignment (40%) and a final proctored written test (60%).