Building OT Cybersecurity That Works in the Real World

Full ICSI Ep. 93 DJ & Dino

DJ [00:00:00] There's gonna be technical debt, there's gonna be cultural nuance, there's gonna be all these other issues. And so I led with those three controls.

[00:00:05] [00:00:10] Welcome to the Industrial Cybersecurity Insider. In each episode, we dive into the world of industrial cybersecurity. Join us as we cover the latest trends, innovations, [00:00:20] and practical insights as we talk with leaders. And practitioners across the industry. Gear up and let's get into this week's episode.[00:00:30]

Dino [00:00:35] Hi, I'm Dina Busi, and today I have with me Daniel [00:00:40] Jasky. Did I say that right

DJ [00:00:42] ? Yes.

Dino [00:00:43] No, it's good to see you again. Last time I saw you, we were in Texas when it was hot. It's still hot. Yeah. [00:00:50] Paul's finally getting here. So it's been cooler in, in the, , Missouri area. Yeah. I shared a meme yesterday and it was somebody peering through their blinds, looking at their fall sweaters, because [00:01:00] we can't wear, we can't wear them yet here, so Yeah, still in the nineties, it'll be here soon enough.

Dino [00:01:05] So you've changed roles this year? I did. Coming out of the, the government [00:01:10] sector, right? Your public sector, government sector. And now tell us what you're doing

DJ [00:01:14] Yeah, so I left by choice. , Some people ask that I did leave by choice this year. , You know, I [00:01:20] wanted to help work on some strategy there, and I did.

DJ [00:01:21] I left behind a lot of documentation on the OT front, but of course, they're still pivoting from the FS e, the federal civilian and executive branch work that they've been doing for a [00:01:30] number of years to really focus on that ot. , And it's a huge, huge task. And at the same time, I saw the market really saying, Hey, we have owners and operators every day that really need help today.

DJ [00:01:39] I know that the [00:01:40] strategy stuff is important, and of course it's a passion of mine, but I really wanted to do more executing and I felt I could do that better at an engineering firm actually. , There are a lot of engineering firms in this [00:01:50] market. Like, you know, you know, we, both have them, but I didn't really wanna focus on an MSSP or a, , reseller capacity.

DJ [00:01:55] So our, group has, neither of those. , So at STV we have incorporated [00:02:00] cybersecurity into the standard of care for the engineering practice. And that means it's greenfield, right by design, it's advisory for large upgrades for utilities, going into some of their integrations. , And then of [00:02:10] course, standalone services.

DJ [00:02:11] And those services are kind of. Left of launch, you know, pre keyboard assessments, intel gathering tool rationalization, understanding some of those [00:02:20] ROI questions that are certainly complex and I get to work with all sorts of, , , operators. And ST's biggest footprint is in the rail industry, which is exciting for me because energy gets a lot of [00:02:30] emphasis in the government , and other sectors.

DJ [00:02:31] . And of course energy's important for , everyone, but I really wanted to cut my teeth on the rail operators that we have across St. V. So we're in every, , rail project in the country, which is really exciting. [00:02:40] In some piece, we don't have the whole complex operation of every single project out there.

DJ [00:02:44] I don't wanna overstate our significance, but we, we've been in a lot of them for 25 plus years. ,

DJ [00:02:48] So yeah, working in rail [00:02:50] now, , a lot of water and then some energy utilities as well.

Dino [00:02:54] Yeah. Well, and we've known each other for the last couple of years, and you have a very unique perspective because you came from [00:03:00] one of these technology companies that was rooted in, , OT cybersecurity, and then moved into csa.

Dino [00:03:07] And then back out into [00:03:10] a engineering group, which is kind of the area that I work in. So, what kind of trends have you witnessed in your journey, in this particular field of cybersecurity around industrial [00:03:20] control system world?

DJ [00:03:21] Yeah. The timing for me has always been really lucky.

DJ [00:03:23] When I did leave csa, I saw that there was this kind of. Over investment, I might say, to be honest, in [00:03:30] capabilities. And there was a broader lack of competence and capacity. So when I came to SCV, I said I wanna build a program and I wanna start with competence. I wanna move to capacity, and then I want to talk [00:03:40] capabilities.

DJ [00:03:40] I don't just wanna sling technology and hope that it works. , I think people still need people, which is interesting in a time of the AI boom for our organizations. I think people still need [00:03:50] people. Services are booming and I think the return on investment for these complex single pane of glass. big data solutions essentially is still really important.

DJ [00:03:59] But I think [00:04:00] that we're starting to see some organizations push back on security deployments that are maybe 5% rolled out after a number of years to really understand how do we actually build metrics around [00:04:10] continuous improvement and what does that look like? Not just dollars spent, you know, potential assumed average dollars saved.

DJ [00:04:18] We're getting a little bit further than that.[00:04:20]

Dino [00:04:20] Yeah. Yeah. It's one of the things that we witnessed in the work that we do is a lot of the control systems are very old. I mean, I'm talking 30-year-old stuff, and [00:04:30] it's very common, in the food and bev industry specifically, I mean, I think others, you know, life sciences has probably done a better job of keeping up with, more current.[00:04:40]

Dino [00:04:40] Technology in their manufacturing processes, but in a lot of other industries, not so much. So, you know, knowing that where should they focus their efforts? [00:04:50] Getting back to what you said, because I don't think AI is gonna solve that particular problem. It gets back to the people issue that you mentioned.

Dino [00:04:56] You know, and, and there's just not a lot enough of us [00:05:00] out there at this stage really digging into how we can improve the cybersecurity posture in those manufacturing environments.

DJ [00:05:07] I'm also seeing, so I mentioned some of the advisory work. [00:05:10] I'm seeing a lot of upgrades happening buildings and utilities elsewhere, where the money is actually there, of course, for the purchase and security is now starting to be baked into some of the, , [00:05:20] procurement language and the contracting language.

DJ [00:05:21] And that's a huge win for OT security. Right? So, yeah, it's 30 years old, but hopefully when we replace it we'll do a little bit more on the hardening guidance and some of the, you know, actual [00:05:30] comprehensive. , You know, this is the configurations you want as a baseline to start up lift that tide, but I still think that there are too many point solutions and not enough, you know, due diligence in [00:05:40] that governance process of what do we deploy, why do we deploy it?

DJ [00:05:43] , I actually saw a report recently that had compensating controls considered, , immature for OT security. I thought that was a little [00:05:50] bizarre because sometimes it's the only option and so that actually is quite mature rather than just kind of leaving it. It's natural state, which might be completely insecure and connected.

DJ [00:05:59] , So a couple of different things [00:06:00] to answer your question on focusing efforts, if I'm thinking actual controls, of course it's easy, it's asset management, segmentation and access controls. But I also think we have to kind of, . Have a moment [00:06:10] and pull back from our security stacks and say, do I have too many points solutions and not enough comprehensive due diligence in my governance?

DJ [00:06:17] Have I cherry picked standards and frameworks that on [00:06:20] paper are not actually, meeting my needs? , There was a really good report, I think just a couple months ago. , It's not the one you and I were just talking about from ForeScout. It was actually a report, , looking at the [00:06:30] DOE. So they had the office of the Inspector General that looked at the, .

DJ [00:06:33] Basically the success of the NIST CSF across multiple organizations. And it really found that several sites had not [00:06:40] fully developed and or maintained policies and procedures to help facilitate the design and implementation of the security controls that they thought that they had on paper, essentially.

DJ [00:06:47] , So that was really eyeopening, right? So [00:06:50] we talk about all the time how mature this energy market and energy industry is in terms of ICS cybersecurity, and then you peel back some of the check boxes that they've had. We're not even talking rcip. it might not [00:07:00] really be the case, right? So there's a lot of blind spots, alert fatigue from their actual capabilities, inconsistent, , information sharing and increased operational complexity as a result of some of [00:07:10] their investments rather than the opposite.

DJ [00:07:11] So I know I gave you a lot there, but different trends.

Dino [00:07:14] No, I like the alert fatigue because we see that, right? The events that these tools generate, I mean, is in the [00:07:20] tens of thousands, you know, in a very short period of time, to the extent where, you know, the clients don't even know where to begin on how to resolve 'em.

Dino [00:07:27] In fact, they don't even resolve 'em. They just ignore 'em. Even if they're [00:07:30] known threats in their environment, which you know, is puzzling, you know, where, you know, it would, try to dig into something like that. But when it's baked into these control systems and these [00:07:40] plants. It's just like it gets a little stymied, you know?

Dino [00:07:43] It's back to that blind spot, you know? How do we remove these blind spots in these environments, number one and number two, I [00:07:50] still see a lot of the engineering companies out there. I call 'em disinterested parties, meaning that cybersecurity isn't a priority for them. They figure if the client's not asking for.

Dino [00:07:58] I'm not gonna build a [00:08:00] practice. I'm not going to pursue, , partnering relationships with some of these technology companies, cybersecurity technology companies, and I just go about my, normal day-to-day business of what I've been [00:08:10] providing, you know, my clients

Dino [00:08:11] , for decades.

DJ [00:08:13] Yeah. I mean, and that's why when people say, where should I start?

DJ [00:08:16] Where do I start? How do I start? It's nobody's starting from scratch, right? There's gonna be technical [00:08:20] debt, there's gonna be cultural nuance, there's gonna be all these other issues. And so I led with those three controls. But I really think the most important thing for organizations is to start with interdependence.

DJ [00:08:28] Mapping. Interdependence can be [00:08:30] technological. It can be, oh, we need this signature, right? It can be a process problem. It can be. We have all these people retiring and we don't understand what tacit knowledge they're leaving with. We see that all the [00:08:40] time. We don't talk about that as a form of interdependence for the actual operation and functioning of our critical systems.

DJ [00:08:44] And it is. So that's part of crown jewel analysis, but crown jewel analysis is still just tier one, tier [00:08:50] two systems on paper that are the important What makes those systems run? That typically doesn't extend to, you know, so and so in this department that might have the actual manual knowledge to keep [00:09:00] it running.

DJ [00:09:00] Wrote the standard operating procedures or has the best relationship with the integrator to know who we call, when we call them and why. Yeah. So some of that is continuing to be fleshed out, , but there's no perfect recipe [00:09:10] for it. And so I see people kind of. Again, investing in tools, realizing that that ROI is questionable going back to policies and procedures, and then, you know, there's this kind of limit to how [00:09:20] much you can outsource in terms of understanding.

DJ [00:09:22] Of course, you can outsource the management of everything, but if you don't fundamentally understand what you're protecting, you can't outsource your interdependencies, right? That's the bigger problem. [00:09:30] And so that becomes more of a cultural clash.

Dino [00:09:32] Yeah, on the crown jewels too. 'cause what we try to do with clients, especially if they have multiple sites in their fleet, especially a dozen or more, is what are your [00:09:40] top tier plants?

Dino [00:09:41] And work your way from there back as you call the crown jewels, it can be within the plant. But then, you know, overall looking at the broad spectrum of their manufacturing [00:09:50] operations, which sites can you live without for a shorter period of time versus those that you can't, right.

DJ [00:09:55] Yeah. I wrote a blog for Clarity in the last month or so and it.

DJ [00:09:59] Discussed how [00:10:00] to do interdependence mapping from tier one systems and then actually assigning, , different understanding of how the six scenarios that are laid out in then it's 800 dash 82 revision [00:10:10] three would actually impact those tiered systems so that you could recreate a priority list of which systems to go build compensating controls around, essentially.

DJ [00:10:17] So it's kind of a new methodology or a how [00:10:20] to, it's not, you know. The B'S knees of like, this is how we tackle OT cybersecurity going forward for the rest of our lives. But it actually was inspired from some of the work I did at csa. , I [00:10:30] helped with something called the High Value Asset Program, which is a voluntary program just for the F sub again, , federal civilian and Executive branch, where they would basically do that exact.

DJ [00:10:37] Process of tiering out their systems and [00:10:40] they would not really know how to associate some of those systems that had the interdependence that they required, like HVAC for a critical building, what should be a high value asset. But if you're [00:10:50] not coming from that systems of system thinking, or you don't have any OT people on your team, or you kind of run the risk of saying, well, if everything's critical, nothing is critical.

DJ [00:10:56] You don't really know how to associate some of those. ICS systems with the rest of [00:11:00] your it. And so recently in a lot of the talks I've been giving, I've actually been using the Facebook hack from a couple summers ago. , It wasn't even a hack, it was a, router issue, but it actually shut down [00:11:10] their building access.

DJ [00:11:11] And so they couldn't get into the server room. If you remember this, I think it was summer 2022. , The actual first responders from a information security standpoint couldn't get into the building. So their [00:11:20] badge access readers had problems. And I dug into this and there were a couple different reports that saying that a lot of different things happened with the building and physical access because of how connected things were.

DJ [00:11:28] And of course that was [00:11:30] something that was missed in a type of interdependence mapping when people thought about a critical scenario. And so it's not an OT incident exactly, but it starts to illuminate some of this interdependence where it's [00:11:40] like, of course you can't list everything as being critical, but in the event of emergency, you also can't miss critical interdependencies doing some of that analysis.

DJ [00:11:47] So.

Dino [00:11:49] Yeah, because [00:11:50] I, my position on the first responder in a manufacturing facility is the operator, right? Meaning those machines need to get in a safe state place, you know, before you start breaking [00:12:00] things or disconnecting things, you know? 'cause if you got product in the mix or equipment that's running in a particular operation, somebody's gotta shut it down in a,

Dino [00:12:08] Standard natural fashion. Right. [00:12:10] And, when you look at that piece of it, I think that's one of the things that's missing. You get called it, , like a resource deficit or meaning that they're not really including the local [00:12:20] teams that really understand how those manufacturing facilities operate and run and what's in them in their overall strategy.

Dino [00:12:27] No, we see that a lot when we're working with a global team [00:12:30] that's looking at an overarching cybersecurity plan is. Trying to, bring the plant people into the fold. Because we need them. We need them for [00:12:40] discovery to find out where, where are these panels, where is this network? How is it set up?

Dino [00:12:45] Who are your OEMs? You know, who's remoting in and out of here? , There has to be a [00:12:50] pretty good relationship with the plant to be able to pull this off. And, and what we witness is. That's not happening. So when you look at the, these, , senior leadership teams that are moving [00:13:00] these projects forward and forming their strategy, they're not incorporating the folks at the local level.

DJ [00:13:06] Well, and nothing's going to force them to. That's the other kind of problem. You know, we talked a little [00:13:10] bit about the energy sector and some of their compliance mechanisms, but I've seen some recent calls with water operators where even kind of trying to discuss cybersecurity by design, whether it's an [00:13:20] advisory project for a new build or a replacement.

DJ [00:13:23] People in the engineering world are just, those who don't really speak our common language have said, well, all you need to do is an [00:13:30] OE , review. Right? Like an audit. So that is still that conversation around compliance checklists versus comprehensive security. , Having everyone understand and [00:13:40] get on the same page of what you can do.

DJ [00:13:42] Leading up to an incident, but then we still have people that really push, like pen testing and incident response is kind of a quote unquote starting place for who. That [00:13:50] blows my mind every time I hear that. , You know, there's a lot that can be done by design or by testing or by, you know, building different comprehensive.

DJ [00:13:59] Teams, [00:14:00] right? Some of the, , multidisciplinary, you know, teams within your groups. , But I've actually seen this intentional, I've seen not to call out sectors, but when I was working with cisa, I had a [00:14:10] couple of asset owners I worked with in the chemical sector that had to decided not decentralize their risk management, but instead to distribute that risk and leave it up to each facility and plant because [00:14:20] they thought that that would lead to kind of less of a domino effect than centralizing some of their risk and their policies.

DJ [00:14:25] So. there's this kind of other conversation that I don't think you and I have ever had around [00:14:30] vendor consolidation versus single points of failure. And I think that's a really interesting one when it comes to security policies because you might say, Hey, everyone get on the same page. Here's what we're doing.

DJ [00:14:39] And then you might also [00:14:40] say, and we're deploying this tool everywhere. And then, you know, you might actually create new access points, new targets, not just in the solutions themselves, but you know, how much do you centralize? [00:14:50] How much do you distribute? How much do you own? How much do you push out? Right?

DJ [00:14:53] It's difficult for really large organizations like Food and Bev or Chemical or other manufacturing.

Dino [00:14:59] And that's a great [00:15:00] point and I'd really like to get your perspective on this. 'cause, , I've done a couple podcasts on it where I, I view that the CISO C CIOs don't really have a, good, , , idea of [00:15:10] who's working in their plants, right?

Dino [00:15:11] So if, if you're a large manufacturer, you've probably got 20, 30, 40, 50 different sis and OEMs working in your plants on any given [00:15:20] day based on projects and activities. They don't know who those people are. So what is your thoughts on those CISOs and CIOs becoming more aware of who those [00:15:30] organizations are, what kind of practices do they have?

Dino [00:15:32] What kind of security technology partner relationships do they have? And start making what I call new friends.

DJ [00:15:38] Yeah, it's definitely a major [00:15:40] blind spot. So people always talk about when you're bringing projects together, like who owns the data? Back to our conversation around interoperability, who owns the crisis plan?[00:15:50]

DJ [00:15:50] That's where I would start from a leadership perspective. I don't need to know that if we have cameras here and another technology deployed there and some other type of sensors here, who owns that data [00:16:00] centralization. 'cause I know the answer's gonna be nobody. Right? It's left up in the air. It's, murky.

DJ [00:16:04] Who owns the emergencies, right? Who owns the response? Who knows what scenarios to plan [00:16:10] for and who knows how to get policies and processes off of paper and into action. That's really, again, back to that ROI conversation. That's not something I made up. We've been talking about ROI and security [00:16:20] for years and years and years.

DJ [00:16:21] , We've also said, you know, cybersecurity risk is business risk. We've tried to. Come up with these new catch phrases for a long time, and it really is about interdependence and [00:16:30] interoperability at the end of the day, and those are easy to miss if we're just using, like I said, cherry picked frameworks and foundations and methodologies and baselines.

DJ [00:16:37] It doesn't matter that we have too many to choose [00:16:40] from. It matters that we don't stick with them. We don't evaluate them over time. We put them on paper, we put them on a shelf and we say good work. So I think it is building those relationships again, knowing who owns the [00:16:50] crisis, the when the crap hits, the fan scenarios.

DJ [00:16:53] If there's somebody at every location who is intentionally or accidentally gonna be responsible for that, right? Do they know what [00:17:00] scenarios to plan for and have they, communicated that well back to leadership. And are they able to get policies and processes off of paper and into action? Or are those policies and processes?

DJ [00:17:09] 10, 15 years [00:17:10] old? That's the worst case scenario. Right? And they don't even know where they live or there's so much dust on them. They don't even have the right, you know, like you mentioned, the right integrators than and partners on them. Did they switch? Did they change? Do they have the [00:17:20] right contacts?

DJ [00:17:20] Again, back to standard operating procedures, have they looked at those? Right? Who is responsible when it gets. Questionable. And we've seen, I think three, right In the last week we [00:17:30] had the Bridgestone, Jaguar, , and what was the recent one?

DJ [00:17:32] Even bigger. I can't remember. I thought it was Food and Bev. I do remember Jaguar. I remember Bridgestone Day. Lot of private health. Oh, , Collins Air Force. Air. Air Aerospace. Yeah.

Dino [00:17:32] Yeah. Right. So, well, getting back to that, you know, the disinterested parties is how do you get them interested in being part [00:17:40] of that overall plan and what they're doing?

Dino [00:17:42] Right? Yeah. , And those, I think those, , it leadership, it's, Craig likes using the term, you know, they have the responsibility, but they don't have the authority. Yeah. [00:17:50] And, and we've seen that right? Where the plan's gonna do, what the plan's gonna do, and it really takes a lot to force them to, get on the same strategy and [00:18:00] plan that's trying to be driven by corporate.

Dino [00:18:01] and they've been, regardless of cybersecurity, it's been going on for decades as yes yang and yang and push and pull that goes on between these two groups, right? And, [00:18:10] and that third leg on that stool. You got it, you got ot. That third leg is your OEMs and your system integrators that play a pretty.

Dino [00:18:16] Significant role in the success of these manufacturing [00:18:20] environments.

DJ [00:18:20] When I mentioned you asked, you know, what I would do about it, I said, stop outsourcing things you don't understand before you could manage them. Right? I've said this multiple times. This is not a new, , phrase for me, so sorry for, you know, [00:18:30] regurgitating that today.

DJ [00:18:31] But I'm also starting to see a shift and it's when I totally endorse towards more in-house expertise. Of course I'm a consultant and I provide services, and I provide [00:18:40] best in class services, but not technology. Right. Not a reseller. I am a trusted advisor. I will tell you what you don't wanna hear. I will tell you what you need to know, right?

DJ [00:18:47] But I think we used to entice people [00:18:50] with information sharing and you were gonna get the shiny new threat intelligence some way somehow. It was gonna be, you know, secret, special access to that [00:19:00] information sharing. I am gladly starting to see that Kara and stick methodology kind of fading. , I've seen actually a push back when I was [00:19:10] in government and now out of government as well, that people.

DJ [00:19:14] Kind of hear information sharing and there's, it's a bad taste at this point because there's too many sources. It's not curated for their [00:19:20] sector. It's not, collated. So you might get the same piece of information from four different sources the same day. There's no prioritization to it unless you're already partnering with a tool or capabilities to do that, [00:19:30] or you have an in-house team to do it, or your SOC can do it.

DJ [00:19:32] , So it's not that information sharing is a bad idea or a bad thing. But I don't think it's the carrot that we used to think it was. I actually think building that [00:19:40] in-house expertise and gauging interest in these topics is huge. Because even if you're gonna eventually outsource something, whether it's a service to you or me, or a piece of technology to come in and, you know, [00:19:50] kind of fill a gap or plug a hole.

DJ [00:19:51] You still need somebody in-house who understands that, and that was not the case for the last 10 years. You had somebody that signed the checks and you had somebody that briefed the [00:20:00] board for why they signed the checks, and that was about it. Now you have people that are coming in and saying, you know what?

DJ [00:20:05] I'm gonna build full expertise. I'm going to be able to walk through the NCSF every day. I'm gonna be able to [00:20:10] actually understand some of this NIST guidance on OTI, I know what Relay logic is. I understand the plants. I've walked the shop floors, right. That's totally different. I think even in the last five [00:20:20] years, it used to be, I'm gonna put on a suit and sit on a skiff because I have special access via this group or that group.

DJ [00:20:25] Right? I won't name any 'cause they're great groups and they're providing an excellent service. But I [00:20:30] don't think that that information sharing is the due diligence we needed for vulnerability awareness, and doing something about those threats.

Dino [00:20:35] Yeah, so insightful. It's like you got your finger right on the pulse.

Dino [00:20:39] You know,[00:20:40]

DJ [00:20:40] I have to be careful 'cause I, you know, it's an amazing community, the Intel community. But I used to also say the one thing I borrowed from like military strategy was taking, , an effects based approach to [00:20:50] security rather than a means based approach. And so an effects based approach means if the fake background building that you're sitting in were blown up.

DJ [00:20:57] The effect would be whatever casualties in that [00:21:00] building, right? Not whether it was a bomb, whether it was an insider, whether it was an airplane, you know, the effect mattered. The means was just another means, and I think that's how [00:21:10] we need to think about security. And sometimes in the information space, we focus.

DJ [00:21:13] All of our resources on the means, and it leaves no resources for doing that effects based work that we've been talking about this whole [00:21:20] time. And so it's not necessarily that the Intel community gets it wrong or doesn't package it correctly, it's just sometimes we put all of our stock in that intel and we miss, [00:21:30] Hey, can we get the doors open?

DJ [00:21:31] If we need to get to a rack, can we do that interoperability and interdependence mapping? If not all of the threat intelligence of the world isn't gonna save us from those scenarios that we haven't planned [00:21:40] for.

Dino [00:21:41] Well, and they don't practice for it, right? I mean, if I go into 10 plants, probably 10 of 'em don't even have an incident response plan.

Dino [00:21:48] No. In regards to an attack. Yeah. [00:21:50] Or they've outsourced it. And unfortunately it might be an integrator who doesn't have a cybersecurity team, and they're just kind of hoping to not be called on that retainer. Right. Yeah. and I [00:22:00] don't know how much, , influence, and maybe you can comment on this, that the insurance industry has had, you know, 'cause we've seen clients, , who've been dropped and then having to say, okay, we [00:22:10] gotta get something going on here.

Dino [00:22:11] Right. It's what, just something as simple as asset inventory or they're, they're, you know, their premiums are going through the roof and their coverages are going down. So, do you, think that they have any [00:22:20] impact or influence in this stuff?

DJ [00:22:23] I have a meager background in cyber insurance. I've written a couple reports on it, and when I was at Stanford, I was actually surrounded by actual experts that [00:22:30] studied this, and they actually did, , accumulation risk research for the cyber insurance industry for a reinsurance group.

DJ [00:22:35] That was actually my funding for my role at Stanford as well. , They years ago, [00:22:40] 10 years ago, did not want to become a defacto regulator. I think today the insurance market has become a de facto regulator that's bad for markets, but it's a hardened market. Like you [00:22:50] said, there are more requirements now and there are certain, , instances where a policy will have discounts if you go with their quote unquote best in class [00:23:00] security solutions.

DJ [00:23:00] And so whatever that partnership looks like, I don't wanna call it a kickback, right? I don't wanna get in any trouble, but. They are defacto regulators. If they say, thou must have this [00:23:10] and also purchase from this list, they are now creating security controls that are requirements for operating, right? If they want to continue that coverage.

DJ [00:23:19] But I've also seen the [00:23:20] opposite. I've seen organizations say, well, there's this thing called silent cyber. Where things happen in the digital world, and they're actually covered by other policies on accident because of the [00:23:30] wording, because of, , precedent in the courts. And because we don't have good, you know, legal coverage on cyber yet, right?

DJ [00:23:35] There's not a lot of of data. And so that silent coverage might help you and [00:23:40] or you can take that investment from those policies and reinvest them into your actual security. So I've actually seen some companies saying I'm not going to do both anymore. I don't think that's a great strategy. But if the [00:23:50] market continues to harden where fewer providers are offering coverage and they're actually increasing the verification for that, I think there's a risk that cyber insurance will actually price.

DJ [00:23:59] I've said this about [00:24:00] regulation too. It'll price small and medium businesses out of business, and that's a bad scenario because not only do we not want monopolies right in free and fair markets, we also don't want fewer targets. So another thing [00:24:10] I'll borrow from military background, you probably don't know this about me, but one of my first jobs was looking at nuclear, , policy and risks to cyber command and control.

DJ [00:24:16] I was a nuclear nerd before I was a cyber nerd. , And I used to tell [00:24:20] people like, there's a reason that we keep all of these silos out in the west and other places, and it's not just so we have a second strike capability. And it's not just so that we maintain these arsenals, it's also because if Russia or [00:24:30] another nation were to launch nuclear weapons, they need more targets so that more bombs fall more places than on fewer cities.

DJ [00:24:36] Right. Because then your cities might survive. Same [00:24:40] thing with our industries in cyber, right? There is no bomb capable, right? of a cyber event that's gonna cause a nuclear fallout, right? We figured that out. There's good data on that. There's professors at big universities that [00:24:50] spent years comparing the two.

DJ [00:24:51] That's not the risk. The risk is we have too few targets and it becomes easier to take down full sectors, right? That's that single point of failure. It's also called [00:25:00] concentration risk. , Josh Corman has worked on that in the past as well. , And so we can't create scenarios, whether it's regulation or insurance, where small to medium sized businesses are priced outta the market.

Dino [00:25:09] Every time I talk to you [00:25:10] get to learn something new about you.

DJ [00:25:12] I, I've brought that one up before too, but it is really interesting that, is it a second strict capability that we really want, or do we want to deter essentially? , You know, [00:25:20] we know how many bombs other countries have, so we know how many targets we need if we want to have a recovery in certain locations.

Dino [00:25:27] Crazy. Absolutely [00:25:30] crazy. , Is there anything that you wanna cover? I have one final topic I wanted to bring up and I wanna make sure that I, offer up anything that you wanna discuss that we, we haven't touched on.

Dino [00:25:39] ~~Yeah, I wanna make sure my computer doesn't die on us. That would be fraught. ~~,

DJ [00:25:39] You and I had [00:25:40] discussed before we started recording this, . , Report that came out from ForeScout. And, , I just thought it was really interesting because it discusses how 44% of industrial organizations claim to have real [00:25:50] time visibility, but nearly 60% can't reliably detect OT and it iot threats.

DJ [00:25:55] But the cool part of this that you and I were talking about before we hit record, is that these [00:26:00] organizations who claim to be early stage maturity have realized that their top concerns are the cyber, . Supply chain cyber threats is how they put it, and cyber criminal activity. [00:26:10] And there are fewer today that are actually concerned about nation state actors and zero day vulnerabilities where, you know, flashback four or five years ago, zero days in nation states, were all anyone ever talked about.[00:26:20]

DJ [00:26:20] And some of the, you know, low level. , You know, negligent insider misconfiguration type scenarios didn't really, even bubble to the top. And so I think that that's an interesting kind [00:26:30] of paradox that more organizations claim to have wrapped their heads around this visibility problem that has become the marketing trope, , for, OT cybersecurity.

DJ [00:26:39] But at the same [00:26:40] time, they've realized that the threats are, Hey, I, I might have a just in time process and a supplier that could tank my, , meantime to recover and, or. [00:26:50] Ransomware and, , easy things like passwords on the internet might actually be more important than a really novel tailored attack coming at me.

DJ [00:26:57] And I think this is also a reflection like we were just talking about, [00:27:00] of threat intelligence not being as impactful for most organizations today as we thought it was going to be.

Dino [00:27:05] Yeah. Yeah. 'cause I, I can see your point on, that. 'cause when you think about very [00:27:10] large organizations who rely on their supply chain, and when you really look at their supply chain, they're really not doing anything in regards to, you know, hardening and improving their cybersecurity [00:27:20] posture at all.

Dino [00:27:20] I mean, some of it just, it's crazy. Like the tire industry, you mentioned Bridgestone, I've been in the chemical plants that provide them the compounds to make those tires, and [00:27:30] they're not doing anything.

DJ [00:27:31] Yeah. Yeah. And you know, there's certain chemical companies that touch 70% of the food industry, of course, as you know.

DJ [00:27:36] And it's not to make fun of the chemical industry, it's back to interdependence [00:27:40] and, and interoperability. You know, what do we care that we deliver every day that we haven't thought through in a crisis? Might be the linchpin, might be the ball bearing is the World War II example. We like to talk [00:27:50] about the choke point issue.

DJ [00:27:51] , This happened to Toyota a couple of years ago, of course, that they had a just in time supplier in Japan, shut down a plant. So, yeah, you can also do everything. Right. And if your supply chain is, is [00:28:00] that, you know, fragile time. Yeah, fragile. It's very fragile. Important. Or just your supplier's risk.

DJ [00:28:05] Posture. Right. I talked to a utility last year that had a hundred [00:28:10] third party risk incidents in one year that they had to, none of them impacted them tremendously, but they had to go. You know, do the investigation, do the due diligence and, investigate, you know, well, [00:28:20] we use the software, where do we use it?

DJ [00:28:21] How much impact does it have? How much access does it have? Who can access it? What are the, user credentials, right? Mm-hmm. Can things bleed? A lot of work.

Dino [00:28:29] A [00:28:30] lot of work, yep. Yeah. So the last topic might be a little near to your heart. So what do you think about the, , Mitsubishi picking up Nazomi?

DJ [00:28:38] Yeah, well I think it's funny, [00:28:40] I, , posted on LinkedIn that I always love an opportunity to be right.

DJ [00:28:42] And I dunno if you remember, but before Nazomi I was in agnostic, , market. A researcher. , So I actually worked for the OEMs doing exactly this, [00:28:50] and I worked with several OEMs that had looked at OMI before it became what it was and before I worked there. , And I did price the market at what OMI was bought for back, and I said by 2030, so [00:29:00] I still think I'm on the money, right?

DJ [00:29:01] That, that investment would be kind of right in the ballpark. . I think the most interesting part of the conversations. 'cause it's not all about what I think, right? There's a lot of people involved in [00:29:10] Niomi. , The most interesting part to me about the conversations is, is niomi, since it was built to be horizontal right?

DJ [00:29:17] It has multiple protocols across multiple OEMs that are [00:29:20] competitors. Can one OEM. Continue that agnostic approach. So back in the day when these solutions began, there was two big [00:29:30] questions. One was, do we build the UI for real people or do we build the platform to go to a sim? And so nobody's eyes are gonna be on, you know, remoting into my sensor and [00:29:40] actually looking at the Niomi dashboard.

DJ [00:29:41] Right? That was the big conversation. Nazomi invested in the dashboard. They had one of the best UIs out there right from the beginning. and we actually saw technically the opposite. [00:29:50] There's more MSSP approaches and SOC operations to OT security than there are organic customers opening up the platform, but still it benefited them to have a good ui.

DJ [00:29:59] The other [00:30:00] big trade off question was, do I build for one sector? And stake my claim in that sector, and then use those testimonials essentially as, Hey, it worked so well here to build out, but then build the parsers and the [00:30:10] protocol adoption later. Or do I get as many protocols as possible and do as widespread of an approach as possible to really showcase that it's a horizontal solution?

DJ [00:30:19] And OMI did that [00:30:20] of course, right? Sure. Got big logos. Those big logos were, were able to pay for a lot of their advancements in their, , actual software. So one incredible comparison, just if you [00:30:30] look at acquisitions, is to look at the number of software updates from Niomi compared to other, , platforms that were actually, , acquired.

DJ [00:30:37] Mm-hmm. And it's kind of crazy how many [00:30:40] evolutions and updates they've had versus others that were acquired. And that's to the nature of, again, the horizontal application, the protocol coverage that they have. , Of course the additional features that they built. And so [00:30:50] the question remains though, can one OEM own.

DJ [00:30:53] A tool that has that horizontal applicability that made it so successful and continues that success. That's what I think is really [00:31:00] interesting about it, and I don't have, of course, an opinion on that. , I think it's great for everyone at Nazomi today, though.

Dino [00:31:04] I have one. I guess if I look at Rockwell, right, they've been doing this.

Dino [00:31:08] For a while, meaning [00:31:10] buying technologies and incorporating it into, into their portfolio, but it's been just for their stuff. Mm-hmm. Right. It's not for Siemens, it's [00:31:20] not for Emerson or Schneider. It's just. For the Rockwell organization and their technologies. , If going back to your point, you know, will they stay in that, [00:31:30] horizontal, you know, in their particular case, just their client base who's a big Mitsubishi clients versus, you know, being agnostic and being able to, , horizontally using your [00:31:40] terms go out across multiple sectors, you know?

Dino [00:31:42] Yep. That,

DJ [00:31:43] Yeah. That's how it's being. Stated today is that horizontal approach will remain. And I've actually seen a lot of the OEMs [00:31:50] try to build some type of competitor baseline, whether it's a configuration baseline to add to their security features. You know, I don't have every protocol [00:32:00] understood from this vendor and exactly how it would work in practice, but I do know that at a baseline it this, you know, it's supposed to do this, this, and this, or it's not supposed to change at this interval.

DJ [00:32:09] Right? Right. And [00:32:10] so we can incorporate a couple of alerts. So. I think it's interesting. if it were me, I wouldn't wanna buy more than one solution. So that becomes the kind of more difficult piece, [00:32:20] which is if I am a Mitsubishi and a Rockwell customer somewhere, well, Rockwell has, I guess, verb, which isn't totally the same, but.

DJ [00:32:28] do I want, [00:32:30] but I've seen electric utilities buy three just to see after a couple of years, which one? But that's because they have larger budgets. So I do think, , you know, deployments that have multiple vendors will [00:32:40] typically have a little bit more budget, right. Than a, smaller shop that has fewer vendors.

DJ [00:32:45] That's typically a correlation that we'll see. So maybe it won't be a problem, but [00:32:50] it's totally remains to be seen.

Dino [00:32:51] I mean, I think 99% of the manufacturers would we go into, have multiple, , automation technology vendors in, in their plants, you know? But most of yours [00:33:00] have pretty good budgets for security, right?

Dino [00:33:02] They don't have nothing to work with. Right. Right. But then a comment, you made a comment earlier about, , I still call it shelfware, meaning that they went out and made this investment [00:33:10] and bought these tools Yeah. But didn't invest in the resources really, to drive it and make it useful and, watched it morph into shelfware.

Dino [00:33:17] Yeah. That's unfortunate because alert [00:33:20] fatigue, as you said earlier, and you know, the amount of events and alerts that they get just become overwhelming and there's nobody actually working on them that's being assigned to clean it up, you know?

DJ [00:33:29] come in and do that [00:33:30] too. We call it tool rationalization.

DJ [00:33:31] What's the ROI? What's the usability? What are the features you have enabled? How far is it deployed? And I typically try to do that before there's an investment in any other security [00:33:40] capability. Whether it's a sim, whether it's anything else that they wanna adopt. I say, Hey, let's pull back and look at what you have today.

DJ [00:33:45] And is it, is it shelfware or not? . Can you confirm or deny that this [00:33:50] is working the way that you intended it to?

Dino [00:33:52] So, well, let me ask you this. So with the acquisition of, , the Zomi and Mitsubishi, do you think that there are competitors that are still out there [00:34:00] and I still think of, you know, clarity Armes and Drago still being, you know, contenders where we've seen other acquisitions with Indige and Cyber X and a few of the others.

Dino [00:34:08] Now with this one, [00:34:10] is it moving them off the board from a competition piece with 'em? No, no,

DJ [00:34:13] no. They're so different actually. And they've morphed in such a way, like when I started at omi, they were pretty [00:34:20] even. , Dragos definitely captured specific sectors more vastly than some competitors. And then with Clarity's acquisition of ate, they really set themselves apart in a sector as well.[00:34:30]

DJ [00:34:30] And it doesn't mean that they're not horizontal, but some countries won't adopt clarity because Israeli based, Nazomi really built the big brand, big logo [00:34:40] and global capacity. But that doesn't mean that, you know, the sector specific or the America specific or the healthcare specific aren't just as successful.

DJ [00:34:49] [00:34:50] Again, these companies numbers are not public. , I don't think it counts anyone out of this market that hasn't already been purchased. Right. I think if this had happened ahead of, you know, some of the other acquisitions we saw, then [00:35:00] those would've fallen, you know, their valuation honestly, I think would've fallen SC defense being one of 'em.

DJ [00:35:04] , This number would've totally skewed right what happened there. But, , not that I know, you know, what it was sold at. I [00:35:10] don't think that was at Republic. But , yeah. And then there's this other conversation of do I buy it or do I build it? And that's what the OEMs have been facing for a long time and I actually think it's more interesting.

DJ [00:35:19] I think all those [00:35:20] competitors are still competitors, but I think it's actually more interesting for the OEM space now they have to watch this acquisition's success or not to understand do I buy it or build it? And that's what like Schneider Electric [00:35:30] is, is looking at right now. Of course, Honeywell bought already.

DJ [00:35:33] , But that doesn't mean they have to stop building, right? It's still very new technology technically, right? And it's moving from asset management, and then [00:35:40] you're adding in vulnerability analysis, you're adding in threat feeds. You're adding in, right? There's layers to the technology. It's not just a, you know, set it and forget it, UI that just, you know, scans everything and does everything [00:35:50] perfectly without the tuning and all of that.

DJ [00:35:51] So. The buyer build, I think is more interesting from an OEM perspective than the competitive landscape. But I think the competitive landscape is just as competitive. , Even [00:36:00] if they start to change, whether they go after, you know, a horizontal application or they get even, they drill down even further into specific verticals.

Dino [00:36:07] I, I think part of it, I, 'cause I've seen this a little bit with Siemens and I [00:36:10] guess a Mitsubishi's heading down the same way as matter of fact, I know they are where they're gonna be able to take technologies like the Zomi and they're gonna start putting it into their control systems. Right? Right. [00:36:20] It's gonna be a module sitting in that PLC and that DCS, you know, whatever it might be to, again, equate it back to, , OnStar, you know, with vehicles, it, it's [00:36:30] gonna be built in.

Dino [00:36:30] You're gonna have it and you just decide whether you're gonna turn it on and use it or not, you know? Yeah.

DJ [00:36:35] And I was still at Zomy when we made the announcement that Mitsubishi had decided to do the embedded [00:36:40] deployments. Right. And we all thought it was really cool. We thought it was cutting edge. Right.

DJ [00:36:43] It was one of those announcements that it wasn't just pr, it was like a milestone and it was really exciting for the whole company. Right. , So yeah, I think buyer build is the more [00:36:50] interesting thing to watch and I think it's been less discussed, , on the successor failure. What does this mean on the valuations?

DJ [00:36:56] Yeah. Well, it was great talking to you dj. [00:37:00] Always. Yeah. I mean, wealth of knowledge in this field is incredible, so I really always enjoy it. Me too. And next time I'm in Missouri, , I promise that we'll do breakfast [00:37:10] again, and yeah, I was so, I was so glad to see you down here in Texas. Yep. Thank you. Thanks for tuning in to the Industrial Cybersecurity Insider. To stay up to date with our latest episodes, be [00:37:20] sure to click the follow or subscribe button now. And if you found this podcast helpful or have a topic you'd like us to discuss, please leave us a review or let us know.

DJ [00:37:29] Thanks [00:37:30] again for listening. See you next [00:37:40] time.