As public sector units (PSUs) increasingly adopt cloud-based systems as part of their digital transformation, the shift brings both potential benefits and significant cybersecurity concerns, said a senior cybersecurity official from India’s largest oil and gas company.
“The cloud is where most digital technologies are heading, whether we like it or not,” ONGC’s Chief Information Security Officer (CISO) Amal Krishna told Tech Observer, acknowledging both the rewards and risks of the migration. “It’s like placing your most valuable assets in a bank, while also handing over both keys to the vault.”
For Krishna, who is responsible for securing state-owned PSU which is a crucial pillar of the country’s energy security, producing around 70% of India’s crude oil and 84% of its natural gas, this analogy captures the essence of ONGC’s cloud strategy: balancing progress with caution.
For India’s Oil and Natural Gas Corporation (ONGC), a major player in the energy sector, the cloud offers opportunities for innovation and efficiency but also raises urgent questions about data security and control.
The company has already taken significant steps towards digital transformation, notably by migrating to SAP HANA for enterprise resource management. Yet, unlike many modern enterprises that have embraced full cloud environments, the Maharatna PSU has opted to keep this system on-premises to retain “full control over data security.”
Where cloud solutions are essential—such as in analytics, where real-time data processing is vital—ONGC employs a dual-copy approach, maintaining one version on-premises and another in the cloud to mitigate data loss and security risks.
“We have chosen to proceed with baby steps, always with proper security in place,” Krishna said.
Still, the ONGC CISO recognises that this cautious approach may not be sustainable in the long term. “As we move forward, the number of digital tools that are exclusively cloud-based is only going to increase,” he said.
“We will need to find ways to manage these risks while operating within the cloud.” This impending shift, he believes, demands a stronger level of security assurance from cloud service providers.
For ONGC, this means working closely with cybersecurity vendors to ensure that cloud solutions meet the same rigorous security standards the company has long maintained on-premises.
The stakes are high. In the energy sector, any data breach or loss could have serious implications, not just for ONGC, but for national security and the broader economy.
“As a critical infrastructure organisation, we are under heightened regulatory scrutiny,” Krishna pointed out. He added that this challenge is not unique to ONGC—it’s a pressing issue for critical industries worldwide.
The future of secure digital transformation, he argues, will depend on robust, adaptable cybersecurity measures that allow organisations to embrace cloud-based solutions without compromising their foundational principles of security and reliability.
