Marine Corps Targets Critical Infrastructure Cyber Threats

The Marine Corps is expanding efforts to secure the operational technology that controls installations’ power, water, fuel and other essential services.

This comes in light of the Pentagon’s Project FORTRESS doomsday plan launched last month, calling for military installations to prepare to operate independently for 90 days should a cyberattack target them.

The service’s facility-related control systems program manager, Jimmy Mahoney, said attacks on critical infrastructure like those in the water sector earlier this year underscore the need for installations to maintain reliable backup power and dedicate personnel to securing the systems that support essential operations.

“We are in a world now where folks are attacking those systems, and we have to get these folks out there now devoted to securing them,” he said Tuesday at TechNet Indo-Pacific in Honolulu.

Mahoney developed the Marine Corps’ Unified Controls Resilience Network (UniCRN), a framework to strengthen the security and resilience of OT systems that manage essential services, including power, water, fuel and HVAC.

The framework includes four priorities: integrating cybersecurity and facility controls specialists into a unified workforce, prioritizing systems critical to mission readiness, conducting continuous security assessments and threat hunts, and implementing a zero-trust architecture that assumes no OT control system is inherently trustworthy.

The Marine Corps is also using an OT test bed that replicates operational networks and devices. The environment allows personnel to test updates, identify vulnerabilities and evaluate new technologies before introducing them into live systems.

Mahoney said the test bed also allows teams to simulate cyberattacks and evaluate defenses, including AI-enabled capabilities, without risking disruptions to physical infrastructure.

“I could run attacks against that, knowing I’m not going to break the operational environment, which you don’t want to do,” Mahoney said. “I could run AI at it if I want and see if I can have mitigations put in place first before I do that out in the physical environment.”

The framework stems from an implementation at Camp Lejeune, where Mahoney integrated cybersecurity personnel with facilities controls specialists to protect OT systems. The Marine Corps is now expanding that staffing model across other installations and regions.

“That marriage of cyber and controls is what makes this work. It is not somebody sitting in a data center doing [risk management framework], checking boxes. It is literally embedding them in the facility’s operations,” Mahoney said.