Industry Insights
Cyber Resilience for Oil, Gas, Energy and Utilities
In energy and utilities, cyber incidents can have physical and national consequences. Building resilience across IT and OT.
Key takeaways
- Web skimming, account takeover and bots are leading threats.
- PCI DSS v4.0 adds requirements for payment page script control.
- Peak trading demands capacity and DDoS planning.
- Customer data protection is a brand issue as well as a legal one.
Threats
- Web skimming — malicious scripts on checkout pages stealing card data.
- Account takeover through credential stuffing.
- Bots scalping inventory, abusing promotions and scraping prices.
- DDoS during sales events.
- Ransomware affecting stores, warehouses and logistics.
Priorities
| Area | Action |
|---|---|
| Payment pages | Script inventory, integrity monitoring and content security policy |
| Accounts | MFA options, credential-stuffing protection, anomaly detection |
| Bots | Bot management at the edge |
| Applications | Secure development and regular testing |
| Data | Tokenisation and minimisation of card and personal data |
PCI DSS v4.0
Version 4.0 introduced requirements such as managing and authorising scripts on payment pages and detecting unauthorised changes to them. Requirements designated as future-dated became mandatory from 31 March 2025.
Peak readiness
Load test before major sales, coordinate with providers on DDoS protection, freeze non-essential changes and staff incident response for peak days.
Customer data in the Kingdom
PDPL governs customer personal data, including consent, retention and breach notification. Minimise what you collect and protect what you keep.
Securing the e-commerce stack
| Layer | Key controls |
|---|---|
| Edge | CDN, WAF, DDoS and bot management |
| Application | Secure development, dependency scanning, penetration testing |
| Third-party scripts | Inventory, integrity checks, content security policy |
| APIs | Authentication, rate limiting, input validation |
| Data | Tokenisation, encryption, minimisation |
| Operations | 24x7 monitoring and incident response |
Loyalty and account fraud
Loyalty points and stored payment methods make customer accounts valuable. Offer MFA, detect unusual redemption patterns and notify customers of account changes.
Stores and supply chain
Point-of-sale systems, warehouse management and logistics platforms are increasingly targeted by ransomware. Segment store networks, protect backups and include suppliers in resilience planning.
How NAZZTEC helps
We assess e-commerce platforms, test applications and APIs, implement PCI DSS v4.0 requirements including payment page script controls, and provide monitoring to protect peak trading.
Next step: talk to our Governance, Risk & Compliance team about PCI DSS v4.0 or see Industry Solutions.
Frequently asked questions
Does using a payment provider remove PCI obligations?
It reduces scope significantly but does not remove it — especially for pages that load the payment form.
How do we detect web skimming?
With script inventory, integrity monitoring and content security policies that alert on unauthorised changes.
Is bot protection worth it for smaller retailers?
If you run promotions or limited stock releases, usually yes.
NAZZTEC Editorial TeamWritten and reviewed by NAZZTEC practitioners. This briefing is general guidance, not legal advice.
