Hackers and the Holidays: Strengthening Industrial Cybersecurity

[00:00:00] Emma: The fast pace of the technologies, the vulnerabilities, threats coming in and kind of having to be able to adapt and learn with the times as it's going has been one of really cool things. Something that I've learned that I didn't know it was going to be that fast paced and it's neat, it's a really cool thing.

[00:00:46] Dino: Hi, my name is Dino Busolacchi, and today we have with us Emma Duckworth, who's an OT cybersecurity professional, and OT stands for operational technology, and so welcome, Emma.

[00:01:00] Emma: Thank you, Dino. Happy to be here. First podcast.

[00:01:04] Dino: This is your first one, I thought maybe you'd done a one or two others in our, journey over the last few years, but, right now we're kind of focused on the career path of professionals that are entering into this industrial cybersecurity field, which to some extent, I think is kind of new, cybersecurity has been around for a number of years, decades or two, but, When you come to the plant floor in industrial control systems, it's a fairly new field to enter.

[00:01:29] Dino: So, tell us about your career path and experience up to this point, and why did you choose this field, and what do you think about it so far?

[00:01:38] Emma: Yeah, sure. I probably start with I got my degree in chemical engineering. So I really didn't know about this field being an option when I was going to school from high school all the way through college. I graduated in 2020. So right in the height of the pandemic. Very limited companies were hiring, and I got an opportunity to work as a O. T. Cybersecurity engineer at Delta Technology, and I kind of thought it was going to be temporary at first. I didn't know much about it, but I get some experience on my resume, learn some new skills and see where that led me. But after being there for a little bit. Started to realize I liked that more than what I was doing at school.

[00:02:25] Emma: So now I've been in this field for, I guess, a little over four years now.

[00:02:30] Dino: Well, yeah.

[00:02:32] Emma: It's been a second, but it's been, it's been a good four years. It's been good.

[00:02:36] Dino: So what have you learned about your experience, actually working in the field, right? I mean, you've got field time, you've been working with these technologies with clients. So share a little bit about your field experience in regards to cyber security and in the manufacturing space?

[00:02:52] Emma: Yeah, sure. one of the big things I think I've noticed is how fast paced this field, this career, this industry is not only like the technologies we're working with on a day to day with how many new technologies are popping up or how they have to advance to stay competitive and be able to fight against the threats and the vulnerabilities that are coming in from outside.

[00:03:15] Emma: So you have The fast pace of the technologies, the vulnerabilities, threats coming in and kind of having to be able to adapt and learn with the times as it's going has been one of really cool things. Something that I've learned that I didn't know it was going to be that fast paced and it's neat, it's a really cool thing.

[00:03:35] Dino: That's great. Great. So what is it that you like most about it? Right? I mean, what is the, this industry in this field, make you want to get up every day and go to work?

[00:03:43] Emma: Yeah, I'd say I get asked this question a lot. I feel like as anybody in a career gets asked, what do you like most about your job? But something I find really cool about my job is I get to travel a lot. I get to go to these client sites and we work with a wide variety of clients. So I'm going to different manufacturing plants, to water, waste water, to pharmaceutical.

[00:04:07] Emma: And I get to kind of live in that. How it's made episode almost and work with the client, learn from them while also teaching them about their O. T. Cyber security. So it's kind of a teach and learn aspect every day on the job. And I like being able to teach as well as learn their process. And that's 1 of my favorite parts is being able to see that piece and the different aspects you're looking at every day.

[00:04:32] Emma: And it's not the same day to day.

[00:04:35] Dino: so what kind of technologies do you work with?

[00:04:38] Emma: Yeah, so we have definitely quite a few technologies we're working with. We have our different components. So we have our ideas, our intrusion detection systems that we're working with. So like Clarity, Nizomi, Cisco, where they're going and they're monitoring. These clients that we're working for, they're creating a baseline and then reporting on any anomalies that we're seeing in their environment.

[00:05:00] Emma: But then we also have the IPS, which are the intrusion prevention system. So that's taking it the next step. And now we're able to block any of the communication that's unwanted going into that environment in space. So it just depends on what the client's environment looks like and which technology we're going to bring to the table.

[00:05:19] Emma: And what works best for them.

[00:05:21] Dino: So when you think about cyber security, and you know, a lot of folks, they think that term, which is an IT based Role, But when you talk about OT, it's kind of a different animal, if you will, so what are some of the challenges that you've witnessed working with these different clients and that dynamic between a group that doesn't always work well together, but they have different responsibilities.

[00:05:42] Dino: They have different roles, so what has been some of the challenges you've seen, if any, working in these different verticals, That are pursuing, improving their cyber security posture and their manufacturing environments

[00:05:53] Emma: Yeah, I mean, I think you hit it on the nail. I think that is the exact challenges bringing all of these players to the table. You have your team who has been in charge of cyber security, but now you have this and Plant floor technology that you need to protect, so you need your engineers that they know the asset, they know the processes and you kind of have to have them working together and sometimes that's.

[00:06:15] Emma: Yeah, It's been a struggle with clients because they've never worked together before. So bringing them together with, you also have your networking team and your stakeholders, and it's definitely been a challenge with some clients or just in general, it probably is anywhere bringing everybody together to move these projects forward.

[00:06:32] Emma: So sometimes you'll have a little bit of a standstill while you're trying to figure out who's going to be in charge of who's going to take ownership of this task or this project.

[00:06:42] Dino: for those clients that are entering into this for the first time, right? As far as putting these types of technologies into their manufacturing environment, what have been some of the big, big moments that they witnessed? Or aha moment, What have you seen, as far as once these tools are embedded with the professionals who know how to put them in there and use them, what kind of things have unfolded from there in that realm?

[00:07:04] Emma: Yeah. I mean, we see that. They kind of don't know the internal issues they can be bringing to each other. We've seen it scanning the OT plant floor, and then that's causing disruption to the processes. And that's something I don't realize what's happening. But then the downtime is something we're able to use these tools for put it in and see that a scan was happening.

[00:07:29] Emma: And now we're able to bring these 2 teams together, make an ex, Exclusion list or something like that. So now it's not going to bring down their network or cause disruption to their process.

[00:07:40] Dino: Yeah, that's a great point. It gets back to roles and responsibilities and the right? I call The round peg square hole, Sometimes IT's behavior, the tools that they use, their practices are disrupted to that plant floor. And the plant floor had never really been able to put their finger on what caused that piece of equipment to quit working, you know, mysteriously, right?

[00:08:02] Dino: Because it can't find a mechanical issue. And it's like, well, what happened? Nobody really knows. They're just more interested in getting that machine back up and running versus, going back through the forensics of why did I lose that machine? And it might have been because. Because IT was scanning the network at an inopportune time,

[00:08:17] Emma: I'm sure with your years of experience in manufacturing, you probably had seen that and dealt with it firsthand and

[00:08:23] Dino: guarantee that it goes on, right? Especially if the two aren't working together, and if they don't have the right technologies in place to demonstrate what that, that, interaction looks like in that space, so I get it, So what kind of new emerging technologies are you seeing in this field?

[00:08:38] Dino: I know in four years, it's moved quite a bit, right? I mean, you think about the features and functionalities and capabilities and some of the add ons that these, software companies have added. , what are you seeing in that realm?

[00:08:48] Emma: Yeah, I'd say we're now seeing a lot more of these companies starting to integrate with a secure remote access, either if it's going to be in house or they're using somebody else's, whether it's an OT built secure remote access to be able to, for these vendors or OEMs to remote into their equipment to perform maintenance or whatever it be.

[00:09:10] Emma: And also just the integrations in general to existing IT cybersecurity tools. They're. Starting to really widen and bring that OT into the whole portfolio of cybersecurity as a whole, which I think is good if we need IT to be at the plate. Also OT, it's good to have a little stake in it for both of them that it kind of brings them together a little bit.

[00:09:32] Dino: Yeah, but it's in the remote to your point, because our experience is you usually find several different remote access technologies being used in a single manufacturing facility, right? It's just not one,

[00:09:45] Emma: Mm hmm.

[00:09:46] Dino: several, right? And that doesn't even count the folks that walk into the plant with their own equipment, like an OEM or system integrator who's working on a project or is there to do some type of support warranty or maintenance work.

[00:09:58] Dino: And they just plug their machine into that control system network. Nobody really knows what they're doing, They can't see them. The IT is not monitoring that connectivity or that access. So that is an interesting take on remote access into the environment that the traditional way of getting in there is just not cutting it anymore.

[00:10:16] Dino: And they need to kind of come at it more formalized and more standard approach, that's for sure. We talked about school in the very beginning. we recognize a lot of the universities, who do have technology, computer science, cybersecurity, engineering, programs. But they're not really focused on this OT cybersecurity stuff, I mean, right?

[00:10:33] Dino: I mean, is that something that you haven't seen while you were in school or other, engineers? I know you've, worked with dozens of other engineering folks from a lot of different schools from all around the country. What are you hearing from them?

[00:10:45] Emma: Yeah, I mean, definitely when I was in school and all my colleagues, this wasn't something that was taught, let alone, I didn't even know about it. So I have heard of, it's starting to become a program, I think, at a few universities, which is good. I mean, I think this is something that's going to be a huge field and we need to start educating because we need those professionals that have the experience and the knowledge to go out and work together.

[00:11:07] Emma: With these tools, you can't expect somebody just to come in day one and be able to manage one of these tools and everything be okay right away. So I think schools definitely need to start acknowledging this as the big field and career path that it's going to be. And I think there's enough to learn that they could make a whole program.

[00:11:28] Emma: Also, I think schools probably need to be a little bit more hands on, like when I was in school, I had internships that I would do. And I think that's also a great experience for students and young professionals to go and learn about the industry in the field and have that hands on experience, because sometimes your coursework isn't exactly what your day to day is going to be.

[00:11:50] Dino: engineering schools for primarily internship programs. goal is for you to go actually work in a plant, I mean, don the uniform, as I call it, the PPE, safety shoes, high vis, hard hat, safety glasses. And your internship programs, be it chemical, mechanical, electrical, industrial, puts you in the field while you're in school, right?

[00:12:11] Dino: You know, versus computer science on the IT side, that may not be an opportunity that's presented to them, and not everybody wants to work in the industrial field, as we're aware, but I think those folks that are pursuing those types of degrees are wandering to a plant because that's part of their requirement to graduate, is to get that internship on a plant.

[00:12:32] Emma: that is, yeah, the university I was at it, you did, it was required to have that experience. And I think that is a good experience that you're not just studying the textbooks. You're actually getting that live real experience to know what you're going to be getting into another good thing. But I know St.

[00:12:49] Emma: Louis has it because obviously we've done it, but high school they have the CAPS program and I think it's good to get even high school student like that age group, get them experience and exposure to this like we brought on several interns that were in high school still, and they had half a day where they're in class learning about what The real life world's going to be, but then the second half of the day, they're here intern, interning with us. And I think that's something good. Cause when I was going through high school, I didn't know what I wanted to do. I feel like a lot of kids don't know what they want to do. So it's good to have to go in person, see what it actually is versus just guessing and hoping what the career path is going to look like for you.

[00:13:29] Dino: Well, and, you know, I use this term cybersecurity is a big word, right? It's kind of a boil the ocean kind of term. And those, students in high school, at least they were thinking about cybersecurity, right? They didn't know exactly, what field in this particular case, when they wandered into, our shop, realizing that we were doing cybersecurity, but it was really kind of a different angle for them when they realized what it was, right?

[00:13:52] Dino: Okay.

[00:13:52] Emma: That was different. And he started same time. I did. He's been here four years and he said, I didn't know this was an option, but now is able to tailor his college path around what we're doing. Kind of build his own degree. Almost

[00:14:06] Dino: would you say to, students today, you know, people that are thinking about, either whether it's a career change or those that are going through school, what would you recommend for them to do if this is something that they wanted to pursue? Besides listening to our podcast.

[00:14:25] Emma: Um, I'd say. It's good to go talk. I mean, finding a mentor, somebody you can go talk to. I know a lot of places they bring speakers in where they will talk about their experience or their career path and just pushing yourself to learn what's out there. You need to embrace change in this field and really any field.

[00:14:43] Emma: So kind of embracing what's out there and it's okay to make a career path change. I mean, I use my degree a little bit to the extent of like the technical background, but it's okay to make a change and it might be the best change of your life. You don't know until you do it. So I say it's good to just embrace what can happen and go with the flow.

[00:15:02] Dino: Yeah. so what comes next for Emma? Future wise. I mean, what do you got going on in, your current, job? I know you talked about traveling a lot. and you're part of very large engineering organization, So what are your thoughts in, your current role and where you're headed?

[00:15:17] Emma: Yeah. That's also kind of what I'm trying to figure out at the moment with the big changes with the new company and everything. trying to figure out where I want my career path to go and what that'll look like. So right now I'm still on a technical path, but I've talked to a couple of like my mentors here.

[00:15:34] Emma: And if I want to go into project management or something like that, and it's nice that these big companies where you kind of have the ability to move laterally throughout the company and Still work with the same team, but also expand it. So I'd say I'll let you know, do you know when, when I know,

[00:15:53] Dino: All right, well, any final thoughts, anything that you want to share that we didn't talk about

[00:15:57] Emma: I guess I'm going to shoot that last question back at you. I mean, I've heard plenty of advice and everything from you and the rest of the team. But if you had one piece of advice, what do you think you would give it to the young professionals of say that are looking to pursue this?

[00:16:11] Dino: leadership, I mean, leadership is a key component to this organization, right? And then getting our peers and our colleagues and the management team to really understand, we've still got a little bit of a lift within this organization to really understand. The capabilities and what we can add to their traditional, control systems integration business and how that can be impactful to their business.

[00:16:34] Dino: And so our role and goal is to expand, knowledge within this organization. You know, you've heard the 1 plus 1 equals 3 concept, that's really what it amounts to, because my thought process is that in order for this OT cybersecurity, practice to really, expand is that, it has to come from this OT ecosystem out there, The people who build plants and design control systems and the infrastructure, which those control systems reside on is not necessarily always within the realm of an IT traditional. Activity, it's been at it for a while. They've been doing this for a couple of decades. Organizationally, resources, budgeting, governance, policy, their leadership, the relationship that they have within senior ranks of the company is pretty well solidified.

[00:17:27] Dino: But on the OT side, it's not, Because of the OT, this is new stuff, And it's Assets and processes that they are responsible for making happening every day. Not only from a cybersecurity perspective, but from a safety perspective, from an environmental perspective, and, We have to get better, right?

[00:17:46] Dino: It has to mature. And the OT. ecosystem really has to help start driving this narrative in this messaging through the organization is my view of it right as this continues to grow until you can get to that alignment and collaboration and transparency between I. T. and O. T. Um, to work well together, so each one is getting what they need, be successful.

[00:18:08] Dino: well, Emma, thanks for joining us today. It was a pleasure talking to you as always. Thank

[00:18:13] Emma: Even a couple of minutes.

[00:18:16] Dino: Bye.