Data security failures found at Pakistan’s oil and gas licensing body

Pakistan’s oil and gas licensing authority has been found to have significant weaknesses in its data protection and cybersecurity framework, according to a recent audit report that highlights serious risks to sensitive information and critical digital systems.

The report states that the organization lacks comprehensive data security policies designed to safeguard confidential information. It points to the absence of clear procedures governing data access, encryption, and the management of system changes, leaving sensitive records vulnerable to unauthorized access and potential cyber threats.

Auditors also identified the absence of multi-factor authentication, describing it as a critical weakness that increases the risk of unauthorized system access. Without additional identity verification measures, the report warns that the authority’s digital infrastructure remains exposed to evolving cybersecurity challenges.

Another major concern raised in the audit is the lack of automated monitoring systems capable of detecting cyberattacks in real time. The report notes that without continuous monitoring and timely threat detection, security incidents may go unnoticed until significant damage has already occurred.

The audit further reveals that technical and operational data is not adequately encrypted. As a result, confidential information could potentially be accessed by unauthorized individuals during storage or transmission. According to the report, inadequate encryption increases the likelihood of data leaks and could compromise critical information systems.

The review also highlights broader cybersecurity control deficiencies that have placed the authority’s information management systems at risk. Weak governance mechanisms, combined with outdated security practices, have reduced the organization’s ability to protect digital assets effectively.

In addition to cybersecurity concerns, auditors found shortcomings in the management of financial information. The report states that financial records within the management system are not updated in a timely manner, creating challenges for accurate oversight and decision-making.

Serious deficiencies were also identified in the monitoring of financial information submitted by companies operating in the sector. Auditors noted weaknesses in maintaining accurate records and said the existing software lacks the capability to comprehensively monitor company projects and operational progress.

The report also raises concerns over the quality assurance process for technical documentation. Ineffective transcription verification procedures could affect the reliability and accuracy of technical records used by the authority.

Furthermore, the audit found insufficient oversight of technical data related to seismic surveys, including both 2D and 3D seismic information, increasing the risk of data management failures.

To address these issues, the report recommends introducing multi-factor authentication, strengthening data protection policies, improving access controls, implementing comprehensive log monitoring, and enhancing cybersecurity governance. It concludes that the authority must urgently reinforce its cybersecurity framework to reduce information security risks and improve the protection of critical energy sector data.