Mary Rose Martinez on the High Stakes of OT Security Automation
When automation meets the high-pressure world of oil refining, pipelines, and terminals, security takes on a whole new level of complexity. Mary Rose Martinez, Chief Information Security Officer (CISO) at Marathon Petroleum, has witnessed firsthand the challenges of protecting operational technology (OT) systems from potential threats. In an interview with Help Net Security, Martinez opened up about the reality of OT security automation and the risks that come with it.
Marathon Petroleum’s refineries, pipelines, and terminals rely heavily on automation to maintain efficiency, productivity, and operational uptime. As these systems become increasingly interconnected and automated, the risk of security breaches grows exponentially. Martinez notes that the old idea of air-gapping, or physically isolating OT systems from the internet, no longer applies in today’s interconnected landscape. “We can’t just isolate our systems and think we’re safe,” she says. “That’s just not a viable option anymore.”
The Convergence of OT and IT Security
Martinez emphasizes that the lines between operational technology (OT) and information technology (IT) security are increasingly blurred. As automation reaches deeper into the OT world, traditional IT security measures are no longer sufficient to protect against threats. “We’re seeing more and more threats that are OT-specific, and they’re not just limited to nation-state actors or cyber terrorists,” she warns. “We’re also seeing more targeted attacks from organized crime groups that are looking to exploit vulnerabilities in our OT systems.”
Supply Chain Risk: A Growing Concern
The complexity of OT security automation is further exacerbated by the risk of supply chain attacks. Martinez highlights the importance of supply chain risk management in the face of rising threats. “We’re not just talking about the products and services we receive from our vendors,” she explains. “We’re talking about the entire ecosystem of our operations – from the components used in our equipment to the services provided by our logistics providers.” By understanding and mitigating these risks, Marathon Petroleum aims to minimize its exposure to potential security breaches.
What this means is that companies like Marathon Petroleum must adopt a holistic approach to OT security, one that incorporates automation, supply chain risk management, and a deep understanding of the interconnected nature of their systems. By prioritizing security and taking proactive steps to address these challenges, Martinez and her team are working to ensure the safety and reliability of the company’s operations.
