5 Challenges Every Energy CISO Must Conquer

5 Challenges Every Energy CISO Must Conquer

Speakers: Roya Gordon, CISO in Renewable Energy, GL global renewable energy company

Conference: Black Hat MEA

YouTube: https://www.youtube.com/watch?v=8gKzhhdOg-E

Overview

In an era defined by rapid digital transformation and escalating cyber threats, the energy sector stands at a critical juncture. Roya Gordon, CISO for North America at GL global renewable energy company, delivered a compelling talk at Black Hat MEA, "5 Challenges Every Energy CISO Must Conquer," addressing the unique and pressing cybersecurity hurdles faced by leaders in this vital industry. The presentation delved into the complexities arising from expanding digital infrastructure, increasingly interconnected Operational Technology (OT) environments, and a relentless barrage of sophisticated attacks, often originating from nation-state actors and organized criminal groups.

Gordon, whose responsibilities span over 90 solar, wind, and battery farms, distributed solar systems, and a trading business across the United States and Canada, brought a wealth of practical experience to the stage. Her insights are not merely theoretical but are forged from direct engagement with critical infrastructure security and regular collaboration with fellow energy CISOs from industry giants like Chevron, Shell, and Exxon. This talk is crucial for anyone involved in securing critical infrastructure, offering a candid assessment of the challenges and proposing actionable strategies to enhance resilience, support the ongoing energy transition, and ensure the reliability and safety of systems that underpin modern society.

The core of Gordon's presentation revolved around five distinct challenges: the unreliability of current OT cybersecurity tools, the overwhelming burden of compliance and audits, the inherent complexity of risk management in diverse energy operations, the pervasive skilled workforce shortage, and the persistent issue of limited budget autonomy. For each challenge, she provided realistic solutions and frameworks, emphasizing that while these issues are significant, they are not insurmountable with strategic planning and a proactive approach.

Background

▶ Watch: Unique challenges of an energy CISO (1:15)

The global energy sector is undergoing an unprecedented period of disruption, driven by the imperative of the energy transition towards renewables, the widespread adoption of digital technologies, and the increasing convergence of Information Technology (IT) and Operational Technology (OT) networks. This transformation, while promising greater efficiency and sustainability, simultaneously introduces a vast and complex attack surface that is highly attractive to adversaries. The stakes are exceptionally high, as successful cyberattacks against energy infrastructure can lead to widespread power outages, economic destabilization, environmental damage, and even loss of life.

Historically, OT environments, which control physical processes like power generation and distribution, were largely isolated ("air-gapped") and relied on proprietary, often outdated, technologies. Cybersecurity for these systems was an afterthought, if considered at all. However, the push for greater efficiency, remote management, and data-driven decision-making has led to increased connectivity between OT and IT networks, exposing critical industrial control systems (ICS) to the same internet-borne threats that have long plagued IT. This convergence has created a unique set of cybersecurity challenges that traditional IT security approaches are often ill-equipped to handle.

Roya Gordon underscored that many of the problems faced by energy CISOs stem from this fundamental difference between IT and OT. For instance, OT systems prioritize availability and safety over confidentiality, making patching and downtime highly problematic. The market for OT-specific cybersecurity tools is still maturing, often lacking the sophistication, integration capabilities, and vendor neutrality found in the IT security space. Furthermore, the regulatory landscape is fragmented and burdensome, leading to a "checkbox security" mentality that may satisfy auditors but fail to build genuine resilience. The specialized knowledge required to secure these hybrid environments has also created a severe talent gap, exacerbating the challenges faced by security leaders. Gordon's role as a CISO in the renewable energy sector, coupled with her previous experience as an OT cybersecurity vendor, provides her with a holistic perspective on these intricate problems. Her regular discussions with peers from major oil, gas, and utility companies in Houston highlight that these are not isolated issues but systemic challenges across the energy industry.

Key Findings

▶ Watch: Quantifying and managing cyber risk with business sign-off (8:05)

Roya Gordon's presentation crystallized five paramount challenges that every CISO in the energy sector must confront, derived from her extensive experience and collaborative discussions with industry peers. These challenges extend beyond purely technical concerns, encompassing strategic, operational, financial, and human capital dimensions, underscoring the multifaceted nature of securing critical infrastructure.

1. Unreliable Operational Technology (OT) Cybersecurity Tools: The current landscape of OT security tools is fraught with limitations. These tools often fail to provide a complete and accurate asset inventory, struggle with integration into broader IT security ecosystems, and are subject to significant market uncertainty due to frequent acquisitions by Original Equipment Manufacturers (OEMs), which can compromise their vendor-agnostic appeal and long-term feature roadmaps.

1. Compliance and Audit Overload: Energy CISOs are perpetually burdened by a deluge of local, federal, internal, and external audits. This constant demand for compliance diverts critical resources, fosters a culture of "checkbox security" rather than genuine resilience, and can create a false sense of security based on compliance scores alone.

1. Risk Management Complexity: Quantifying cyber risk for energy operations is inherently difficult due to the presence of multiple, distinct business units (e.g., solar, wind, batteries, trading, upstream/midstream/downstream in oil and gas). A single, monolithic risk management program is insufficient, leading to challenges in building a proper risk appetite among business stakeholders and ensuring appropriate ownership of identified risks.

1. Skilled Workforce Shortage: The energy sector faces a severe deficit of cybersecurity professionals with expertise in OT environments. The absence of dedicated OT cyber security degree programs creates a "unicorn" problem, where finding individuals who possess both plant environment knowledge and advanced cybersecurity skills is exceedingly rare, hindering the ability to adequately staff security teams.

1. Limited Budget Autonomy: CISOs often lack direct control over their cybersecurity budgets, having to compete fiercely with other operational priorities across various departments (IT, operations, legal). This constraint significantly impedes their ability to fund critical security initiatives, implement necessary tools, and achieve strategic security objectives.

These findings collectively paint a picture of an industry grappling with rapid technological change, an evolving threat landscape, and foundational systemic issues that require innovative and strategic solutions, rather than merely tactical responses.

Technical Deep Dive

▶ Watch: Strategies to overcome the skilled cybersecurity workforce shortage (10:50)

The most technically focused challenge identified by Roya Gordon pertains to the unreliable Operational Technology (OT) cybersecurity tools. This segment of her talk delved into the core technical deficiencies and market dynamics that plague OT security practitioners.

The first major issue revolves around achieving a complete asset inventory in OT environments. Gordon, drawing on her past experience as an OT cybersecurity vendor, highlighted that no single tool currently provides 100% visibility. She outlined three primary methods for asset discovery, each with significant limitations:

1. Passive Method: This involves deploying a network tap or mirroring OT network traffic and performing deep packet inspection (DPI). While generally safe as it doesn't interact directly with devices, it only captures about 80% of the inventory. The reason for this limitation is that many Industrial Control Systems (ICS) in an OT environment may not be actively communicating on the network at all times, or they might use proprietary protocols not easily deciphered by generic DPI tools. This leaves a critical 20% visibility gap, requiring significant manual effort to close.

1. Active Method: To augment passive discovery, active scanning involves querying ICS devices directly over the OT network. This method aims to pull additional asset details that passive methods miss. However, it carries substantial risks. Incorrectly crafted packets or an overburdened OT network can lead to device disruption or even failure, which is unacceptable in critical operational environments where availability is paramount. The delicate nature of legacy OT systems makes active scanning a high-risk endeavor.

1. Configuration File Method: A safer approach, this involves extracting asset information directly from device configuration files. This method avoids direct interaction over the network, mitigating the risks associated with active scanning. The drawback, however, is that it is static. Any new devices connected to the environment or changes in existing configurations will be missed unless configuration files are manually and regularly re-pulled, making it unsustainable for dynamic environments.

Beyond asset inventory, Gordon pointed out the pervasive problem of lack of integration between OT security tools and existing IT security platforms, such as Security Information and Event Management (SIEM) systems. CISOs are constantly battling "dashboard fatigue" – the last thing they need is yet another isolated console to monitor. Effective security requires a unified view of threats and assets across both IT and OT domains. Yet, many OT security vendors prioritize flashy visualizations over robust, bidirectional data integration capabilities, creating silos that hinder comprehensive threat detection and response.

A third significant technical and strategic challenge is market uncertainty in the OT security vendor landscape. Gordon highlighted a trend of Original Equipment Manufacturers (OEMs) acquiring promising OT security startups. She cited specific examples:

• Skate Offense was acquired by Honeywell.
• Verve was acquired by Rockwell.
• Nomi Networks was recently purchased by Mitsubishi Electric.

The core technical value proposition of these acquired tools, from a customer standpoint, was their vendor agnosticism – their ability to monitor and secure diverse industrial control systems regardless of the underlying OEM. However, once acquired by a large OEM, their strategic vision often shifts. The features customers initially bought into, and the vendor-agnostic capabilities, may be deprioritized or even phased out in favor of proprietary integrations with the acquiring company's product line. This creates significant uncertainty for CISOs who have deployed these tools globally, potentially forcing them to retool their entire infrastructure within a few years.

To address these technical challenges, Gordon proposed several strategies:

• Assess the level of effort for manual workflows: Understand the 20% visibility gap from passive solutions and budget for the manual or supplementary efforts required.
• Distinguish between vendor partnerships and true integrations: Demand concrete data flow and dashboard integration capabilities, not just marketing-driven "partnerships."
• Diversify technology portfolios: For global organizations, deploy competitive OT tools in different regions or even within different segments of North America (e.g., Canada vs. US). This creates flexibility and mitigates the risk of a single vendor acquisition disrupting global security posture.

While the talk primarily focused on these operational and strategic technical challenges, other technical elements were mentioned in the context of budget and non-negotiables, such as Incident Response (IR) retainers, Managed Detection and Response (MDR) services, and penetration testing. These are considered foundational technical services that CISOs must secure budget for, irrespective of other constraints.

Demo / Proof of Concept

▶ Watch: Smart budget strategies for CISO autonomy and resilience (14:30)

This talk was primarily a strategic and advisory presentation, focusing on high-level challenges and solutions for energy CISOs. As such, it did not include a live technical demonstration or proof of concept of any specific tools, exploits, or defensive mechanisms. The speaker, Roya Gordon, shared practical strategies derived from her experience and discussions with industry peers rather than showcasing specific technical implementations or attack vectors.

Defensive Implications

▶ Watch: Key takeaways: diversification, risk sign-off, budget strategy (18:10)

The insights shared by Roya Gordon offer crucial defensive implications for energy CISOs and their security teams, providing a roadmap to navigate the complex threat landscape.

For Unreliable OT Cyber Security Tools:

• Layered Asset Inventory: Defenders must recognize the limitations of single-tool solutions for OT asset inventory. Implement a multi-pronged approach combining passive network monitoring (for baseline visibility), targeted active queries (with extreme caution and proper testing in non-production environments), and configuration file analysis. Crucially, quantify the visibility gaps (e.g., the 20% missed by passive methods) and allocate resources to manually verify and track these assets.
• Demand True Integration: When evaluating OT security vendors, prioritize proven integrations over marketing-driven "partnerships." CISOs should insist on demonstrations of seamless data flow into their existing SIEMs, SOAR platforms, and other IT security dashboards to avoid creating new operational silos and dashboard fatigue. The goal is a unified security posture across IT and OT.
• Strategic Vendor Diversification: To mitigate the risks of market uncertainty and OEM acquisitions, energy organizations should strategically diversify their OT security tool portfolio. Instead of deploying a single solution globally, consider using different, competitive technologies across various regions or business units. This provides flexibility, reduces reliance on a single vendor's roadmap, and minimizes the impact if a preferred tool is acquired and its features change.

For Compliance and Audit Overload:

• Risk-Based Compliance Prioritization: Shift from a blanket compliance approach to one that prioritizes controls based on their potential financial and operational impact of non-compliance. Focus first on regulations and controls that, if unmet, could lead to significant fines, power generation disruption, or safety incidents.
• Control Mapping and Optimization: Implement a robust Governance, Risk, and Compliance (GRC) framework that maps security controls to multiple regulatory requirements. This allows security teams to efficiently gather evidence for audits, demonstrating how a single control (e.g., "maintain a complete asset inventory" or "have backups") satisfies several overlapping mandates, thereby reducing duplicative effort and resource drain.
• Security Beyond Compliance: CISOs must proactively identify gaps that compliance frameworks do not cover. While compliance is a baseline, it does not equate to comprehensive security. Develop and implement security initiatives that address actual threats and vulnerabilities, even if they are not explicitly mandated by regulations, fostering genuine resilience rather than mere checkbox adherence.

For Risk Management Complexity:

• Tailored Risk Management Programs: Develop distinct cyber risk management programs for each major business unit (e.g., solar, wind, battery storage, trading). Each unit has different assets, threat models, business impacts, and financial implications. A generic program will fail to accurately assess and manage these diverse risks.
• Build Stakeholder Risk Appetite: Proactively educate and engage business stakeholders to build a realistic risk appetite for cyber incidents. Help them understand that cyberattacks are an expected part of the modern operational landscape, much like physical security incidents or legal litigation. This manages expectations and fosters a more supportive environment when incidents inevitably occur.
• Business Ownership of Risk: Crucially, implement a process where business stakeholders formally sign off on accepted risks. This transfers ownership of the risk from the CISO to the business unit, ensuring they understand the potential consequences and are accountable for decisions regarding risk acceptance or mitigation funding. This protects the CISO from becoming the sole "scapegoat" in the event of an incident.

For Skilled Workforce Shortage:

• Proactive Talent Pipeline Development: Engage actively with entry-level professionals and local universities. CISOs should invest time in networking with aspiring cybersecurity talent, speaking at career days, or even serving as adjunct professors. Building relationships with educators helps shape future curricula and creates a direct pipeline from academia into the organization.
• Invest in Upskilling Unskilled Talent: Recognize that "unicorns" are rare. Instead, budget for and invest in training and certifications for individuals with strong soft skills, eagerness to learn, and adjacent experience (e.g., help desk, IT, AI). These individuals can be developed internally into specialized OT cybersecurity roles, leveraging their foundational skills and enthusiasm.
• Strategic Budgeting for Senior Roles: For critical senior positions that require immediate impact, CISOs must be prepared to advocate for increased budget. While internal development is vital, sometimes the need for experienced leadership necessitates a higher compensation package to attract the right talent from a competitive market.

For Limited Budget Autonomy:

• Prioritize Non-Negotiables: Clearly identify and ring-fence budget for non-negotiable security services such as Incident Response (IR) retainers, Managed Detection and Response (MDR) services, and essential penetration testing. These are foundational to a robust security program and should be protected from budget cuts.
• Leverage Capital Expenditures (CapEx): Explore opportunities to fund new tool implementations using CapEx rather than purely Operating Expenditures (OpEx). This can help offset immediate operational budget pressures and spread costs over a longer period, making it easier to justify new investments.
• Document Denied Budget Items on Risk Register: If a critical tool or service request is denied, add it to the relevant business unit's risk register. Document the potential impact of not funding this item and, again, seek business sign-off on the acceptance of this increased risk. This creates transparency and accountability.
• Maintain a "Rainy Day Fund" / Strategic Budget Cushion: Build a strategic cushion into the budget for unforeseen emergencies or inevitable mid-year budget cuts. This "fluff" allows CISOs to quickly purchase emergency tools or absorb cuts without compromising critical services. Gordon's example of strategically timing vendor renewals (e.g., shifting to January renewals instead of July) to create budget flexibility demonstrates a sophisticated approach to budget management.

Key Takeaways

Roya Gordon's talk offered several crucial insights for navigating the complex cybersecurity landscape of the energy sector:

• Diversify Your OT Cyber Security Vendor Portfolio: Avoid single-vendor reliance. Deploy competitive OT tools across different regions or business units to gain flexibility and mitigate risks associated with market consolidation and OEM acquisitions.
• Ensure Business Sign-Off on Risk: Implement a robust risk management program where business stakeholders formally acknowledge and sign off on accepted cyber risks. This transfers ownership from the CISO to the business, fostering accountability and managing expectations.
• Develop a Strong Budget Strategy: Proactively manage cybersecurity finances by prioritizing non-negotiables, leveraging capital expenditures, documenting denied budget items on the risk register with business sign-off, and maintaining a strategic budget cushion for emergencies or cuts.
• Proactively Address the Skilled Workforce Shortage: Build talent pipelines by networking with entry-level professionals, partnering with universities, and investing in upskilling internal talent with strong soft skills, rather than solely seeking elusive "unicorns."
• Move Beyond Checkbox Compliance: While compliance is necessary, it is not sufficient for true security. Prioritize compliance based on financial impact, map controls for efficiency, and actively identify and address security gaps that compliance frameworks do not cover.

About the Speaker(s)

Roya Gordon is the Chief Information Security Officer (CISO) for North America at GL global renewable energy company, a firm based in France. In her role, she is responsible for the cybersecurity posture of the company's extensive North American operations, which include over 90 solar, wind, and battery farms, distributed solar (DSS) installations, and their critical trading business across the United States and Canada. Based in Houston, Texas, Gordon actively engages with her peers from other major energy companies such as Chevron, Shell, Exxon, ConocoPhillips, and Noble, collaborating on shared challenges and strategies. Prior to her current CISO position, she gained valuable experience as a vendor in the OT cybersecurity space, providing her with a unique perspective on the tools and market dynamics of industrial security. Gordon is a frequent speaker at industry conferences, having presented multiple times at Black Hat MEA, where she shares practical, experience-driven insights.