The El Salvador-based business group, operating in the energy sector, is securing its Operational Technology (OT) infrastructure and data center with Fortinet Security Fabric.
Founded in 2001, Grupo Merelec has established itself in El Salvador as one of the leading energy providers in the Central American market. Since then, it has expanded to 16 companies operating in six countries, from the United States to Colombia. The group has also committed to promoting sustainability in new businesses such as clean energy production through photovoltaic systems.
The organization’s rapid growth and diversification of its businesses led Grupo Merelec to understand the importance of cybersecurity. As a result, the group focused on implementing solutions to protect its operations.
In 2021, the company was seeking security, connectivity and management solutions for a new photovoltaic plant and the renovation of its main data center. With the partner Fortinet, Eccsa, Grupo Merelec boarded on its journey to implement solutions from the Fortinet Security Fabric platform.
José Alfonso Aráuz, Corporate IT Manager, Grupo Merelec, said: “Our business is information-based and we need to protect our data. With Fortinet, we achieve integration and reliability of information with a solution specifically designed for our needs.”
Challenges of an OT infrastructure
The year 2021 brought radical changes to the technological landscape for Grupo Merelec. As part of the group’s operational growth, the organization received approval from local authorities to build a photovoltaic plant in San Miguel, eastern El Salvador.
Grupo Merelec needed to ensure the smooth operation of a sophisticated infrastructure that required hosting LAN connectivity for critical infrastructure, including multiple programmable logic controllers (PLCs), IoT devices, a SCADA system to monitor and manage all collected information, smart meters, and inverters associated with solar panels.
The organization knew it needed a solution to enhance cybersecurity and integrate and centralize infrastructure management. The project had the additional challenge of being deployed in an area with severe weather conditions due to heat and humidity – adding a new layer of complexity.
Taking into account these unique circumstances, Grupo Merelec leveraged the capabilities and expertise of the Fortinet platform in OT environments. The group found a tailored solution for critical infrastructure and OT in the platform and the deployment included FortiGate Next-Generation Firewall (NGFW) to ensure maximum protection of company assets.
With Fortinet, the Salvadoran energy conglomerate has a centralized management and security solution that is more adaptable to industrial systems environments. During their initial evaluation, Grupo Merelec also found another benefit: Fortinet required fewer physical devices than other vendors, yet provided greater integration and security.
“The protocols for our solution were already tested, and many of the security and communication rules used for this type of equipment were predefined. Therefore, there was no need to create new standards, which made the solution more seamless and suitable for the organization’s needs,” added Aráuz.
One of Grupo Merelec’s medium-term plans is to obtain ISO27001 certification, focused on information security. Fortinet’s solutions are aligned with this goal, as the company’s solution includes multiple control points that will enable compliance with this standard.
Modernization with security and connectivity
In 2022, Grupo Merelec and Fortinet initiated their second project: the renovation of the group’s main data center. Over time, it had become too small for their current business needs, so the company had to upgrade its physical infrastructure in terms of connectivity and redundancy schemes. The group also modernized its network management to align with industry best practices.
Prior to Fortinet, Grupo Merelec’s communication network was limited, with links serving only the primary connectivity requirement between the data center and other locations.
The organization lacked network segmentation, meaning there were no dedicated channels to ensure the security and connectivity of critical business systems. Although no security incidents had occurred, there was no visibility or centralized network management, posing a serious future risk.
By deploying FortiGate NGFW and FortiSwitch Ethernet switches, Grupo Merelec immediately obtained faster server connectivity than the previous technology. Utilizing FortiLink, Fortinet’s innovative proprietary management protocol that allows FortiGate to seamlessly manage any FortiSwitch, Grupo Merelec achieved a logical extension of the firewall by directly integrating it into the Fortinet Security Fabric platform.
Within the networks, they also implemented security policies that now ensure secure access to the organization’s core systems running in the data center. Fortinet’s solutions went beyond improving on-premises systems to integrate services running through the Microsoft Azure cloud, many of which are critical.
“With the Fortinet Security Fabric platform, we have all our systems integrated as well as centralized management,” highlighted Aráuz.
Thanks to this, Grupo Merelec no longer relies on makeshift solutions from multiple vendors. They now have a unified infrastructure that is less vulnerable to security incidents.
Furthermore, the network can be outsourced and remotely managed by Eccsa. As a result, Grupo Merelec’s IT team has been able to mitigate infrastructure management risks and shift its internal role. Instead of being a support unit, the IT team now contributes strategically to the business.
Infrastructure for improved security and performance
Currently, Grupo Merelec has a different security approach thanks to the implementation of Fortinet technologies.
“This infrastructure allows us to control aspects that were previously unknown to us. The solutions adapt to our needs, so now we are much more protected against potential attacks at all levels,” said Aráuz.
This change has gone beyond security to enhance productivity and performance, as expected by the organization. Grupo Merelec is already thinking about the next steps.
“Based on our results with Fortinet, we are considering implementing other solutions. I believe it is a comprehensive and user-friendly platform that can help any company,” said Aráuz.
Click below to share this article