Marathon Petroleum CISO on OT Security Automation and Supply Chain Risk
Marathon Petroleum’s chief information security officer discusses the evolving landscape of operational technology security and supply chain vulnerabilities. In an interview, Mary Rose Martinez outlines the challenges of integrating automation into industrial environments and the shifting strategies required to protect critical infrastructure. The traditional approach of isolating operational technology (OT) systems has become obsolete as these environments undergo digital transformation. Industrial control systems, including programmable logic controllers, human-machine interfaces, and supervisory control and data acquisition systems, are increasingly connected, exposing them to cybersecurity risks. This shift is not unique to the energy sector, as similar transitions are occurring in manufacturing and transportation. Security teams must continuously reassess their defensive measures to ensure they remain effective in the face of these changes. Automation introduces operational constraints that complicate traditional security practices. For example, critical systems such as catalytic crackers cannot be restarted during routine maintenance windows, necessitating alternative approaches to vulnerability management. To address this, Marathon Petroleum employs the Purdue Enterprise Reference Architecture model, which aligns security controls with operational workflows. By implementing safeguards at the intersection of information and operational technology layers, the organization synchronizes security actions with regular maintenance cycles while minimizing disruptions. Vendor dependencies pose significant risks, particularly when third-party platforms or remote support mechanisms are involved. The complexity of supply chains extends beyond direct vendors, as risks can emerge from subcontractors and sub-subcontractors. Marathon Petroleum mitigates these threats through rigorous due diligence, contractual agreements, and collaborative partnerships with key suppliers. These efforts aim to influence security practices and ensure alignment with organizational requirements. As automation reduces human intervention in industrial processes, workforce dynamics are evolving. The integration of autonomous systems creates a gap between personnel with domain expertise in chemical processes and those proficient in coding or digital systems. To bridge this divide, the company emphasizes cross-training initiatives and leverages advancements in artificial intelligence to lower barriers to technical literacy. Customized learning programs are designed to enhance digital fluency across diverse roles. Critical infrastructure operators face heightened scrutiny from regulatory bodies and threat actors targeting energy systems. Marathon Petroleum adapts its security strategies to account for autonomous operations, continuously evaluating the effectiveness of protective measures against emerging threats. Collaboration with government agencies remains vital for accessing threat intelligence, complying with regulations, and contributing to industry-wide security standards. The integration of automation into OT environments demands a redefinition of security boundaries, supply chain oversight, and workforce development. As industrial systems become more interconnected, the focus shifts toward balancing operational efficiency with robust defense mechanisms.
About Author
English