Customer Story
Orchestrating Identity: Repsol’s Vision for Secure and Seamless Transformation
INDUSTRY
Energy
REGION
International
KEY FEATURES
- Identity Analytics highlight exposures
- Identity instrumentation to augment native capabilities
- Out-of-the-box Identity Connectors integrate apps to your IAM stack
Ready to start?
Get a demo →
Customer Story
Orchestrating Identity: Repsol’s Vision for Secure and Seamless Transformation
Business Transformation
Ranked 178 on the Fortune 500 list, Repsol is a global multi-energy provider that strives to lead the energy transition. It has committed to the ambitious goal of becoming a net zero emissions company by 2050.
This goal encompasses a massive transformation and one of the key aspects of that journey is a strong move to digitization. In 2017, the company began its digital transformation process. And in 2018 it launched the Digital Program with a first wave (2018-2022) in which the company embraced a data-driven strategy and culture, adopted and implemented new technologies to enhance their business operations and scale its new ways of working through remote work. As a lever for this ambitious digital transformation program, 80% of its information technology systems, applications and data were moved to the cloud. Now, the company is immersed in its second digitalization wave (2023-2027), where AI is a key enabler to continue transforming the way the company operates.
Importantly, “cybersecurity is an integral part of the transformation pursued by our business. We are fully embedded in it and fully committed to support these goals by adopting appropriate levels of cyber-resilience, aligned with the company risk appetite”, said Javier García Quintela, Repsol CISO.
This goal encompasses a massive transformation and one of the key aspects of that journey is a strong move to digitization. In 2017, the company began its digital transformation process. And in 2018 it launched the Digital Program with a first wave (2018-2022) in which the company embraced a data-driven strategy and culture, adopted and implemented new technologies to enhance their business operations and scale its new ways of working through remote work. As a lever for this ambitious digital transformation program, 80% of its information technology systems, applications and data were moved to the cloud. Now, the company is immersed in its second digitalization wave (2023-2027), where AI is a key enabler to continue transforming the way the company operates.
Importantly, “cybersecurity is an integral part of the transformation pursued by our business. We are fully embedded in it and fully committed to support these goals by adopting appropriate levels of cyber-resilience, aligned with the company risk appetite”, said Javier García Quintela, Repsol CISO.
INDUSTRY
Energy Industry
REGION
International
KEY FEATURES
- Identity Analytics highlight exposures
- Identity instrumentation to augment native capabilities
- Out-of-the-box Identity Connectors integrate apps to your IAM stack
Ready to start?
Get a demo →
Business Transformation
Ranked 178 on the Fortune 500 list, Repsol is a global multi-energy provider that strives to lead the energy transition. It has committed to the ambitious goal of becoming a net zero emissions company by 2050.
This goal encompasses a massive transformation and one of the key aspects of that journey is a strong move to digitalization. In 2017, the company began its digital transformation process. And in 2018 it launched the Digital Program with a first wave (2018-2022) in which the company embraced a data-driven strategy and culture, adopted and implemented new technologies to enhance their business operations and scale its new ways of working through remote work. As a lever for this ambitious digital transformation program, 80% of its information technology systems, applications and data were moved to the cloud. Now, the company is immersed in its second digitalization wave (2023-2027), where AI is a key enabler to continue transforming the way the company operates.Importantly, “cybersecurity is an integral part of the transformation pursued by our business. We are fully embedded in it and fully committed to support these goals by adopting appropriate levels of cyber-resilience, aligned with the company risk appetite”, said Javier García Quintela, Repsol CISO.
This goal encompasses a massive transformation and one of the key aspects of that journey is a strong move to digitalization. In 2017, the company began its digital transformation process. And in 2018 it launched the Digital Program with a first wave (2018-2022) in which the company embraced a data-driven strategy and culture, adopted and implemented new technologies to enhance their business operations and scale its new ways of working through remote work. As a lever for this ambitious digital transformation program, 80% of its information technology systems, applications and data were moved to the cloud. Now, the company is immersed in its second digitalization wave (2023-2027), where AI is a key enabler to continue transforming the way the company operates.Importantly, “cybersecurity is an integral part of the transformation pursued by our business. We are fully embedded in it and fully committed to support these goals by adopting appropriate levels of cyber-resilience, aligned with the company risk appetite”, said Javier García Quintela, Repsol CISO.
"Utilizing the Orchid technology, we can automatically extract the IAM controls for each application- something that has been a traditional blind spot for us- and envision how it will automatically support the latest IAM functionalities, beyond those that are natively supported."
David Corral
Global Head of Cybersecurity Architecture, Repsol
Identity as the New Perimeter
As a result of these fundamental changes, identity rather than location became the cornerstone of access and security. The cybersecurity team at Repsol became aware very early that consolidating access management in a centralized architecture for single sign-on (SSO) and multi-factor authentication (MFA) would be paramount to secure this digital transformation effort, while also implementing cutting edge privileged access management (PAM) practices and tools.
This was a massive accomplishment - serving as a foundational security piece of the strategy - covering the whole value chain, existing and acquired facilities, non-human and human identities, and Repsol 3rd party access.
This was a massive accomplishment - serving as a foundational security piece of the strategy - covering the whole value chain, existing and acquired facilities, non-human and human identities, and Repsol 3rd party access.
Accelerating forward
Repsol has executed that strategy with remarkable pace and achievement, but there is still plenty of room to expand this identity infrastructure across the entire application estate.
Specifically, the Repsol team is leading a three-pronged approach:
1. Centralize the governance of identity and access management across its full lifecycle.
2. Expand and adhere to the standardized methods of authentication, authorization and privilege management already established, with a suitable user experience.
3. Implement new analytics to identify identity exposure.
Overcoming a Key Hurdle
Of course, to make all that happen, a prerequisite is to assess the native identity capabilities and protocols of each application to ensure compliance with modern standards, understand the native authentication and authorization flows to enforce the right identity controls, speed integration into the governance system and, ultimately, efficiently manage identity from start to finish. But, as David Corral, Global Head of Cybersecurity Architecture at Repsol recognized, “there are significant challenges ahead related to the visibility needed in order to enable the integration of some self-hosted and not standard applications. That’s where Orchid Security comes in.”
“Orchid quickly maps the identity flows of an application and highlights potential log-in paths we were not aware before,” he continued, “Utilizing the Orchid technology, we can automatically extract an IAM passport for each application - something that has been a traditional blind spot for us - and envision how it will automatically support the latest IAM functionalities, beyond those that are natively supported."
“Orchid quickly maps the identity flows of an application and highlights potential log-in paths we were not aware before,” he continued, “Utilizing the Orchid technology, we can automatically extract an IAM passport for each application - something that has been a traditional blind spot for us - and envision how it will automatically support the latest IAM functionalities, beyond those that are natively supported."
Redefining the Future of Identity at Repsol
Looking forward towards the implementation of the second digitization wave, and the three-prong approach to reinvent identity and access management, Repsol envisions a stronger security posture even with the greater interconnectedness of internal and even external operations, more precise use (access to just the right and right amount of information for each user) and an enhanced user experience.
.png)
.png)
.png)
