Marathon Petroleum’s CISO on OT security automation, supply chain risk
In this interview with Help Net Security, Mary Rose Martinez, CISO at Marathon Petroleum, talks about what happens to security when automation reaches deep into refineries, pipelines, and terminals.
She explains why the old idea of air-gapped operational technology has faded, how the Purdue model helps her team apply controls without stopping production, and where supply chain risk sits when vendors and their vendors hold the keys. She also covers cross-skilling the workforce and working with government agencies as state aligned actors probe energy systems.
Marathon runs a sprawling footprint of refineries, pipelines, and terminals. As you push automation deeper into those assets, where has the security boundary moved that surprised your team the most?
We have had to make the mindset shift that the traditional concept of air-gapping operational technology (OT) environments is effectively dissipating. OT environments are increasingly becoming digitized and creating exposure for the industrial control systems within them such as programmable logic controllers (PLC), human-machine interfaces (HMI), and supervisory control and data acquisition systems (SCADA).
This situation is not unique to the energy industry. Other industries such as manufacturing and transportation are likely undergoing the same digital transition and increased exposure. As automation permeates deeper into the OT environment, security teams have to perform the commensurate reassessment to ensure the adequacy and efficacy of our protective and defensive controls in place and adjust as needed.
A lot of security thinking assumes you can patch and reboot. A catalytic cracker cannot be rebooted on Patch Tuesday. How does that operational reality change the way you architect defenses around autonomous systems?
Marathon has an unwavering commitment to safe, reliable and environmentally sound operations. To support this from a cybersecurity perspective, we leverage the widely accepted Purdue Enterprise Reference Architecture (PERA) model which helps balance securing the environment with minimizing operational disruption.
When the appropriate security controls are implemented at and between the information and operational technology layers of the model, space is created to synchronize security actions with regular operational cadences while mitigating risk.
Autonomy arrives bundled with vendor platforms, third party models, and remote support tunnels. Which part of that dependency chain worries you most, and what leverage do you have to change a vendor’s security posture before you deploy their technology?
Generally speaking, the greater risks in the supply chain lie where companies have the least visibility and control. We have greater control over how our environment is accessed and least control over our vendors’ products or security practices. These risks extend past third party vendors to nth party vendors further in the supply chain.
Our risk mitigation practices include performing the appropriate due diligence and assessments and leveraging contractual language when evaluating and adding a new product and/or service, and when there are material changes. Forming partnerships with key vendors is valuable as well – whether it results in the ability to provide input on products and services or jointly responding to an event and restoring operations as quickly as possible.
When a process runs itself, the workforce around it changes. Are you seeing skill gaps open up between the people who understand the chemistry and the people who understand the code? How are you closing them so the human backstop stays meaningful?
The concept of Calm Technology remains the goal, where systems are as invisible as possible in support of the human tasks at hand. It is incumbent upon the people developing, securing, and providing digital systems to understand business processes and operations to achieve this. At the same time, some democratization of digital know-how needs to occur.
Technology advancements, especially in artificial intelligence, are helping lower the bar to codification as an example. This does not alleviate the need to cross-skill personnel but may change the skilling needed. Part of our approach is to develop different learning pathways to increase digital fluency within the company that address the various needs and interests of our workforce.
Critical infrastructure operators sit under growing pressure from CISA, the TSA directives, and a threat environment that now includes state aligned actors probing energy systems. How does the move toward autonomy change what you report, what you defend, and what you assume an adversary already knows?
We understand our role and place in the nation’s critical infrastructure, and continually adjust our strategies and controls based on the threat landscape. We also re-evaluate the efficacy of the protective and defensive controls that are in place, proportionate with technology advancements and adjust accordingly.
Our partnerships with the different government agencies remain key in both the defense of our company and adherence to regulatory requirements – from leveraging the intelligence provided to appropriate our resources most efficiently, to providing input into security regulations that are operative and effective for the industry at large.
Download: The ultimate guide to network operations management