Overlooked Risks With IIoT in Industrial Cybersecurity

[00:00:00] Dino: when does anomalies happen when somebody's remoting in and making a change, or there's data that somehow has made its way in there, or somebody opened up a new unsecured port, or somebody installed a new application, or somebody implemented a new protocol in that environment. So, it's being able to track those same attributes from that digital perspective that you chase those attributes in regards to physical, mechanical, Issues that you're trying to to resolve right to get ahead of preventive right to call it preventive maintenance and you need analytic to determine that right?

[00:00:37] Dino: It's the same

[00:00:38] Dino: conversation.

[00:01:08] Craig: Hi, i'm craig duckworth

[00:01:11] Dino: And I'm Dino Boussalaki.

[00:01:13] Craig: what do you want to talk about today? I always come up with stuff.

[00:01:16] Dino: Well, let's talk about the term IOT

[00:01:20] Dino: and how it relates to OT, right? So the Internet of Things, or the industrial Internet of Things, or operational technology on the OT side, how are those assets classified, right? And I would say that,you know, a lot of organizations have started deploying and implementing these OT intrusion detection systems within their manufacturing facilities to obviously get asset inventory. And as you collect that asset inventory via machine learning and AI, it's giving you risk and vulnerabilities and exploits, potential exploits associated with those assets. lot of organizations that have implemented these OTIDS, technologies are not pursuing the broader spectrum of devices within their manufacturing environment.

[00:02:08] Craig: but when you say that, help me understand what you mean. I think, I think Internet of IoT devices, I think, connected devices that have firmware and not an operating system, which is the, by definition, should be those. Are you talking about the cameras and the printers and the scanners? Are you talking something different?

[00:02:31] Craig: Help, help us understand kind of where you're going.

[00:02:33] Dino: One of the ways we describe things right in the enterprise world, data driving data results right in the industrial world in the world. It's data driving connected physical systems that do kinetic things

[00:02:47] Dino: and organizations, via it primarily that are looking at.

[00:02:51] Dino: How do I get a, asset inventory of everything that's connected to the network, right? And they chase, on the IoT side, so you think cameras, you think thermostats, you, you think,printers, right? And those are all, those all become, collectible assets within the environment because of their network, so you can get some information regarding, again, asset inventory, vulnerabilities associated with it, and things that are interacting with those devices. But on the industrial side, there's a lot of assets that are connected to the network that, that are being either overlooked or ignored or do not, the perception is, is it, why is it relevant for me to, to have asset inventory and have visibility to things like drives and motor control centers, right? And AGVs and robots and pumps and things along those, along that nature of classification of assets, right?

[00:03:42] Dino: And so, I guess what I would say is , if you're pursuing printers and you're pursuing cameras and you're pursuing phones because they're connected to your network and you think that those, provide risk and vulnerabilities to your environment, why aren't you pursuing those assets?

[00:03:59] Dino: Right? And there's a disconnect and it's on the control side, right? So you're talking down at the control layer of PLCs that are talking to these devices that are driving physical outcomes. And you and I both know in order to get that level of visibility, you have to have technologies deployed at that level to be able to collect that information.

[00:04:22] Dino: Right? And some organizations aren't driving that deep. And I would also argue that a lot of it is because most of these, initiatives. Primarily driven by I. T. O. T. has some role, but they're not necessarily engaged and involved with the whole scope of what I. T. may be trying to do with that cyber security intrusion detection platform.

[00:04:47] Craig: I don't want to say it's not important because i'm sure in their mind It's important. Maybe they don't recognize the importance of it. You think that they just don't know how to get to it What what do you think kind of driving it?

[00:04:59] Dino: I think that many believe that those machines are isolated. Insulated, right? Not connected, which is not true. Right? The bottom line is that is those machines are connected even for those organizations. They can take a standalone machine center. You still have remote access. You may actually do some physical intervention to connect that machine to the network because you need support from somebody outside, or you have a technician or an engineer who shows up on site.

[00:05:29] Dino: It connects into that level of the network and, and what they're doing in that, in that role, in that realm is, is invisible, right? Because nobody's really watching what they're doing, right? Whether it's a remote access piece in or whether it's a technician getting in or whether the third party's put in their own, cellular device that they've embedded into that gene center so they can remote access into it.

[00:05:51] Dino: So the point being is all devices. That are connected to a network, even if the perception is that it's isolated, they're not. They're just not. At some point, they are connected, whether it's for support reasons, primarily, or because it's connected via PLC. It's connected to the network, but as you and I both know, the PLC acting as a gateway isn't allowing intrusion detection systems to walk across the backplane of the PLC to get to those other devices that are still connected, right?

[00:06:27] Dino: So, whether it be drives, other PLCs, HMIs, motor control centers, AGVs, et cetera, you need to be able to capture those assets, the same reason why you're chasing everything else that you're trying to get onto your, Yes, platform. All

[00:06:43] Craig: yeah, that makes sense.

[00:06:45] Dino: All right. And so the owners of those, the knowledge of those falls in different buckets, right?

[00:06:49] Dino: It falls into the falls into the system integrator falls into different groups within the manufacturing environment, specific to the plant that's responsible for those assets, right? So, it tries to cast the widest net they can with the tools that they have, but you're missing many of them. Right, and IT is not necessarily skilled in how do I intervene.

[00:07:13] Dino: To be able to get to those particular assets down to control layer, right, which is where the, where you have to start working with engineering teams and the OEMs, folks that are knowledgeable. of how that network is designed, how that infrastructure is set up, what the purpose is of those machines, and do you have asset inventory of it?

[00:07:33] Dino: So, you may have a client that says, well, I have Rockwell Asset Center, Rockwell Shop, I got Rockwell Drives, so I have an inventory of my drives. Great, you have an inventory of the drives. Now, tell me the vulnerabilities and risks associated with those, and that's where you get the deer in the headlight look.

[00:07:47] Dino: They don't know. They don't know what vulnerabilities are associated with those assets, right? All they know is I got something that's telling me what in my programs and in my project files that I have these things and I may have an asset inventory of them, right? And most manufacturers, you never run into a plant that's 100 percent one automation technology vendor.

[00:08:08] Dino: So even if you had a Rockwell shop and you're running Asset Center, you're going to have some number of assets. That are not Rockwell that aren't going to be even inventory at the level just to have an inventory of it. So that you know that you have it much less. What are the common vulnerabilities and exposures related to that asset?

[00:08:27] Dino: Right?

[00:08:29] Craig: Well, and and there could be some significant risk of not understanding or ignoring those drives and those Iot or industrial iot assets as you describe them by not looking at the vulnerabilities, especially if they are a A known exploitable vulnerability and the risk to the organization at minimum, it's a blind spot at worst.

[00:08:56] Craig: It could be a huge exposure and could cost millions of dollars of of downtime could cause harm to individuals. There could be a lot of bad things happen for physical system.

[00:09:08] Dino: Well, and the umbrella view of it is, the standpoint, you can't always look at this, like, from a cybersecurity perspective. Right, we talk about process integrity a lot, right? And so these tools are not only providing you, rich content and information regarding cybersecurity, looking for, malware signatures, right?

[00:09:27] Dino: Looking for,vulnerabilities associated with it, but it's also. The things that can be impacting to your production.

[00:09:35] Craig: Go back to OEE and helping helping

[00:09:38] Craig: become more efficient,

[00:09:39] Dino: to track that, that operational efficiency, whether it's OEE or many, several of the other metric the clients may use on managing.

[00:09:48] Dino: How well do I. Avoid unscheduled unplanned downtime. Right? And so, if you have drives that are being impacted by traffic or by a change,are you, are you tracking through that to determine, hey, why is my filler slowing down, and something may be impacting the drives? And so what could that be?

[00:10:11] Dino: It could be somebody in there, making changes. It could be,traffic, unnecessary traffic that's flooding the network that you're unaware of. Again, think of somebody remoting in, think of somebody walking in with their laptop. think of an IT, cybersecurity technology that might have, have, is scanning the network, and probing.

[00:10:28] Dino: we've seen clients that have implemented tools, EDR tools in, in their HMI environment. And, and when that antivirus piece kicks off and scans ensue, it's not only impacting the HMI, but it's also impacting the things around that HMI that it's interacting with, right? And if you don't have disability into that, again, it's not necessarily a cybersecurity threat as much as it is an operational impact that's impeding those machines performing optimally because there's unnecessary activity going on and it's being disruptive.

[00:11:01] Craig: Well, and you look at it from so there's 2 ways to to to look at that 1, the unscheduled unplanned downtime has 2 significant effects. 1, the production of the plant team and to be able to operate efficiently manage those equipment and have smooth operations. The 2nd piece is the financial impact. And if you look at.

[00:11:23] Craig: an organization, what their cost of downtime is, and if you knew what was causing that downtime and you could take preventative measures to prevent it in the future, or have a conversation with, I. T. or someone that is unaware of their actions and what's happening in the. operational side, if you could improve that efficiency by one or two percent, that could have a substantial cost to the bottom line savings that a lot of organizations may not recognize.

[00:12:00] Dino: Well, it kind of goes along the lines, and what I've seen clients, especially mature organizations that have spent the time to put sensors in those environments for thermal, for harmonics, for vibration, looking for anomalies that you can determine, Hey, look, you're starting to see the heat signature go up, or we're starting to see the harmonics change, or we're starting to see more vibration.

[00:12:27] Dino: And what that would, would indicate is that you're getting data, which a lot of clients are chasing the data on the plant floor, right, to determine, hey, I might have another 100 hours or 500 hours of that machine running this way before I got to take it down for maintenance, and it's much more cost effective to do a planned shutdown to be able to go and do that maintenance and replacement , when those, okay.

[00:12:52] Dino: data points, take off around again around. I'm just using thermal and harmonics and vibration. For example, again, from a maintenance perspective, a lot of companies have invested in this technology in order to try to reduce their downtime. Instead of waiting for something just to break and burn up, and then you have a very costly initiative where you've lost product, and now you're going to be down for days or weeks, versus planning for it, because you know that that equipment needs to go through some type of maintenance cycle in order to repair it and make it operable.

[00:13:26] Dino: And so you put those types of sensors down there to collect that. This is the same conversation. Right? It's the same. We're not chasing thermal and harmonics and vibration. What we're chasing is anomalies and behaviors and activities that are disruptive to those same assets, right?

[00:13:46] Dino: So your mindset has to be along those same lines.

[00:13:48] Dino: If you're mature enough to put in instrumentation to be able to collect data to determine how can I most optimally run those machines. you think about your new cars today, they tell you your tire pressure. And they can give you an alert to say where your tires are. Same thing with your oil, right?

[00:14:05] Dino: And many other data points so that you can avoid a costly mistake, right? And get your car to the shop or get air in your tires. It's the same conversation on what organizations have been pursuing that for a number of years. Now we're talking about how do we, from a, from a digital perspective. Look for those thermal harmonics and vibrations that are disruptive to the machine being able to operate the, outside of the physical mechanical issues that might be going on

[00:14:36] Craig: Well, it makes total sense. And then you got the other end of that for those organizations that are leveraging, let's call them lease options for equipment for machine centers where the OEM is responsible for managing, securing and protecting and doing the preventative maintenance that you mentioned on those equip on that equipment.

[00:14:57] Craig: Then you've got, Okay. Remote access into that from the oem. What does that look like? How do they get into that?

[00:15:04] Craig: How often do they

[00:15:04] Craig: get into

[00:15:05] Craig: well,

[00:15:06] Dino: The access, the OEM may be accessing, looking for the thermal and vibration

[00:15:11] Dino: harmonics, the number of hours the machines been running and no one is look, it's been running for 1000 hours. We've got a window here that we need to come in and do some maintenance. Right?

[00:15:22] Craig: Yeah, it's it's no different than the example you gave on the car You know the dealership under a leased vehicle is going to say, okay You need to come in you need to do this at this number whether it's ready for or not They're because they're responsible for that.

[00:15:35] Dino: Your car's reporting on it,

[00:15:37] Dino: right? I mean, there's a, there's a data going to GM, and GM sending you an email telling you, hey, here's what, here it is, right? It's the same conversation, except we're flipping it to the digital aspect of it, right?

[00:15:55] Dino: Digitally, what we're talking about is what's, what is floating around in there consistently?

[00:16:02] Dino: And when does, when does anomalies happen when somebody's remoting in and making a change, or there's data that somehow has made its way in there, or somebody opened up a new unsecured port, or somebody installed a new application, or somebody implemented a new protocol in that environment. So, it's being able to track those same attributes from that digital perspective that you chase those attributes in regards to physical, mechanical, Issues that you're trying to to resolve right to get ahead of preventive right to call it preventive maintenance and you need analytic to determine that right?

[00:16:40] Dino: It's the same

[00:16:41] Dino: conversation.

[00:16:42] Craig: That's the second side of that coin, most of these tools technologies the It side is looking at What is the cyber aspect? How can we better secure and protect the organization from a cyber event from the breaches? And then the opposite side of the coin is you mentioned it earlier the process integrity portion where organizations can become More efficient they can run lean or they can Predict unscheduled downtime, try and do preventative items task to operate more efficiently and most organizations miss that second piece of that because they're so focused on the, cyber aspect.

[00:17:26] Craig: But again, from an organization like ours, that really. Drives down deep into that control layer and understands how the operations work. It's easier to point that out.

[00:17:41] Dino: what we hear a lot is organization. You've heard this. You just heard this last week. You have companies that have gone out and bought these O. T. cybersecurity intrusion detection tools. Right? And yet, when you talk to the O. T. people who may be aware of it. But what value are they receiving from it or benefit because nobody is showing them the power of these tools, the capability of these tools, right?

[00:18:06] Dino: And so they think of it as a cyber security tool, something that is managing and running and nobody's really, walking them through what that tool is capable of providing them. Right, which is something that we do pretty, pretty well, because our goal and role is to get the OT teams that are responsible for these assets to care how those things operate, how they run their production, how they do their maintenance, how they do their day to day activities.

[00:18:32] Dino: They're the ones that need to see the value of what these tools can provide for them, right?

[00:18:37] Dino: And that's the, that's a disconnect. We can talk about IT OT convergence. that OT convergence means Your OT needs to really understand what the capabilities of these technologies are, and right now they don't.

[00:18:49] Dino: It's not, IT can't convey it to them, and at the same time, they're not working with organizations that can help them figure that out, right? And that's why we see the shelfware,happens to these tools turning into shelfware, or the alert fatigue, or people have hit the wall, right? I've been running this tool for a year, I got a lot of information, I don't know what to do next with it.

[00:19:12] Craig: Very, very true.

[00:19:13] Craig: Yep, we see it all the time, organizations should really look at for those that are going down this journey, how do I choose a practitioner partner, if you want to call it that, for example, someone that understands my network, understands my automation, understands my environment, and is proficient and a subject matter expert in tools and technologies that are bringing this cyber process integrity aspect to it.

[00:19:40] Craig: Invisibility and vulnerability management into my environment so I can make business decisions based on that risk And walk down that journey together. It is hard to do it by yourself don't there's no reason to with all of the Individuals like like you and I and our teams that are can do this every single day You know, we're here to help people.

[00:20:04] Dino: There's 2 paths, right? if you're an IT organization , and you have a role and responsibility, you need to start, building relationships with the organizations who supply your, manufacturers with equipment, people who build plants, people who design, control systems. So, from an IT perspective, you're going to have to make some new friends, right?

[00:20:27] Dino: You're going to have to start bringing them in. If that's not the IT's role and goal is to get to that level, then it has to come from the OT side, and the OT side has to get better at this, and they're going to have to mature and leverage these tools and start forging their own, relationships with engineering groups, OEMs, or architectural engineering and construction.

[00:20:49] Dino: You think, why is that relevant and important? Well, if you're building a new plant, Up front during that AEC process, , you're going to want to throw in, how do I build cyber security ready process integrity technologies into my manufacturing facility?

[00:21:07] Craig: It's critical.Dino, this conversation can go on for days, I believe,

[00:21:12] Dino: And we get plenty of examples, it

[00:21:14] Dino: gets hundreds of examples, so, so keep learning,

[00:21:18] Dino: keep listening, Try to find events, that focus in this particular space. and we're starting to see some of that, right? I mean, we're starting to see some of these conferences where you're starting to see a broader blend of IT and OT people, that are participating in, what I want to call this OT cybersecurity journey.

[00:21:36] Craig: we're here to help for any, anybody out there listening, reach out. , we can help guide you. We can partner with you, whatever you need. If you're just looking for advice, we're doing that as well. So we're here. So thanks Dino. Great conversation. Appreciate it.

[00:21:52] Dino: Yep.