Motor Oil Group's 6 pillars to security resilience success

Christos Syngelakis

CISO and Data Privacy Officer, Motor Oil Group | LinkedIn

Motor Oil Group is an oil refinery company with 50 years of history and subsidiaries operating in the oil retail and renewable energy sectors in the countries of South East Europe. In an organisation with such a diverse infrastructure and business, when it came to cyber resilience, the biggest challenges to address were legacy systems and mindset.

As our board has been heavily investing in digital transformation over the past five years, the security goals were production resilience, and the minimisation of brand impact and exposure in case of a technological incident. It is part of critical national infrastructure, and any interruption can have broad consequences.

“Moving towards strategic partnerships with vendors simplifies our complexity and maximises the return on investment from every solution. As an example, a cloud service provider is our partner, ensuring scalability and future-proofing further expansion to the cloud.”

Christos Syngelakis | CISO and Data Privacy Officer, Motor Oil Group

The following are the pillars of Motor Oil’s security strategy to proactively anticipate threats, build cybersecurity resilience and effectively support the business:

Leadership buy-in – The CISO reports to the organisation’s CEO. Business goals and objectives are aligned with cybersecurity plans to ensure maximum return on investment and effectiveness

Recognise the problem area – It all starts with recognising where your weaknesses are. Self-awareness is important in critical infrastructure such as oil refineries. Knowing ourselves and our strengths and weaknesses has helped us to be five years ahead of the competition and demonstrate five years of efforts and progress in changing the corporate mindset.

Invest in humans – Humans are the most important part of the change.

Converge information security with operational technology – Have these two domains listen to and respect each other. They are both working for the same common goal, therefore, it is important to speak the same language.

Implement ‘security by design’ – Protect digital transformation initiatives and migration to the cloud. For example, data analytics for predictive maintenance is now done in the cloud, which could expose very critical systems to various threats and vulnerabilities. The goal is to build a security perimeter in a perimeterless world without imposing any overhead, and without any false positives. In our industry, false positives are equal to danger.

Identity management – Use multi-factor authentication as the preferred choice whenever it can be integrated with our systems.

I want to end by acknowledging that one of the biggest challenges for CISOs is burnout. In an always-on environment where there is always something new to learn, as well as a tremendous expansion of technology and requests for new projects, the challenge of finding balance is one of the top issues. This brings me back to point three above – invest in your people and prioritise their mental health.