Marathon Petroleum CISO on OT Security Automation and Supply Chain Risks
Marathon Petroleum's CISO, Mary Rose Martinez, discusses the evolving landscape of operational technology security, emphasizing the decline of air-gapped systems and the critical need for robust supply chain risk management.
In an interview with Help Net Security, Mary Rose Martinez, Chief Information Security Officer at Marathon Petroleum, detailed the significant shifts in securing operational technology (OT) environments within the energy sector. As automation increasingly permeates deep into refineries, pipelines, and terminals, Martinez highlighted the surprising realization that traditional air-gapped OT systems are rapidly becoming a relic of the past. This digital transition, mirrored across industries like manufacturing and transportation, necessitates a continuous reassessment of existing security controls to ensure their adequacy and efficacy against emerging threats.
The operational realities of critical infrastructure present unique cybersecurity challenges, particularly when systems cannot be simply patched and rebooted on a schedule. Martinez explained that Marathon Petroleum leverages the Purdue Enterprise Reference Architecture (PERA) model to architect defenses. By implementing appropriate security controls at and between the information and operational technology layers, the company can synchronize security actions with regular operational cadences, thereby mitigating risk without halting essential production processes.
Supply chain risk remains a paramount concern, especially given the inherent dependencies on vendor platforms, third-party models, and remote support tunnels. Martinez pointed out that the greatest risks often lie in areas where visibility and control are minimal. While Marathon Petroleum has more control over its internal environment, it has less influence over the security practices of its vendors and their extended supply chains (nth-party vendors). Mitigation strategies include rigorous due diligence, comprehensive assessments, and leveraging contractual language during vendor evaluations.
Partnerships with key vendors are crucial, fostering collaboration that can lead to input on product security and joint incident response capabilities. This collaborative approach is vital for quickly restoring operations in the event of a security incident. The company also emphasizes the importance of cross-skilling the workforce to bridge potential skill gaps between operational and cybersecurity expertise.
Martinez discussed the evolving nature of the workforce in an increasingly autonomous environment. The goal is to achieve "Calm Technology," where systems are unobtrusive and support human tasks effectively. This requires a democratization of digital know-how and the development of diverse learning pathways to enhance digital fluency across the company. Advancements in technologies like artificial intelligence are helping to lower the barrier to entry for certain digital tasks, but the need for specialized skills remains.
As a critical infrastructure operator, Marathon Petroleum faces growing pressure from government agencies like CISA and the TSA, alongside an evolving threat landscape that includes state-aligned actors probing energy systems. The company continually adjusts its strategies and controls based on threat intelligence and re-evaluates the efficacy of its defenses in proportion to technological advancements.
Partnerships with government agencies are instrumental not only for defending the company but also for adhering to regulatory requirements. These collaborations facilitate the efficient allocation of resources by leveraging provided intelligence and allow Marathon Petroleum to offer valuable input into the development of effective industry security regulations. The ongoing dialogue and information sharing are essential for maintaining a robust security posture in the face of sophisticated threats.