Avoiding Compliance Risks : From Audit to Action

[00:00:00] Kimberly: It's not going to be where the ransomware gets installed. It's going to come from a human error, and somebody checking out at the grocery store and checking their email and clicking on a link and not really knowing the repercussions of that.

[00:00:44] Craig: Hi, and welcome. My name is Craig Duckworth, and today I have the pleasure of Kim Anderson from UHY with me. Kim, welcome to the show. Why don't you introduce yourself and give us a little background?

[00:00:54] Kimberly: Hi, Craig. Thanks for having me. My name is Kimberly Anderson. I live in St. Louis and I am a managing director in UHY's technology risk and compliance practice area. I can tell you that I have started my career in kind of one area, in chemistry and pivoted all the way into IT. It's quite a long story. I'm happy to go into that if you'd like me to.

[00:01:16] Craig: Yeah, sure. Now, I would say for the listeners out there today, a little more about what you do at UHY, how your organization, which is a large consulting accounting firm, how you're engaging with manufacturers and kind of where you're seeing your clients try and lead toward addressing industrial cyber security.

[00:01:39] Kimberly: Yeah, that's great. So technology risk and  compliance is a very large umbrella. We are a global CPA firm primarily known for audit and tax, and we have a lot of other specialty practices, mine being one of them. And what we really are focusing on is being that full service firm, that white glove service, so that we can bring not only IT audits and a test work, but cyber security best practices to the majority of our client base. From a manufacturing and industrial client base, I would say looking at IT cyber practices and understanding kind of the people process and technology, and how they're interacting and maybe where there's some gaps analyzing that IT spend and trying to make some really great recommendations to help bolster security to our clients.

[00:02:29] Craig: Okay, and that makes sense as the OT industrial cyber security, let's call it arena, I don't know what really what the right thing is, but as it's beginning to grow as new technologies are beginning to be more commonplace I say new, they came on the market 8, 10 years ago, you look at the IT space . It's got a 25 year head start, it's larger, it's more mature, it's more accepted, it's practices in place. There are frameworks in place the organizations that are the Cisco, the Palo Alto, the Fortinet, the technology vendors that are in that space have been around for a very long time. You look at some of the tools and technologies that are there, that are purpose built that are designed for the operational side, the manufacturing industrial control side, and it's relatively new getting organizations to, let's call it step outside of their comfort zone. Take a look at holistically, how work they when engaging with you and your team, saying, hey, we need to look at our organization from a holistic standpoint, we need to ensure that we are incorporating our 5, 6, 20 manufacturing sites as we look at asset visibility, as we look at risk and compliance and validation. And how are we doing that? Are you seeing that they're shifting toward that more by chance?

[00:03:56] Kimberly: Yeah, you know, Craig, I was actually as you were talking, it has become evident over the years that we are not saying that. We are really, really excited if we see network segregation, you know what I mean? And that's a big win. So, when we see these networks that are intertwined and we see manufacturing shop floors that are connected to the internet and also connected to the IT environment, it's a big red flag.

[00:04:20] Kimberly: They need help, they need support. And a lot of times they just don't have the IT team with the right skill sets and accountability to make that happen. We really see that's the gap.

[00:04:32] Craig: Accountability is a big piece.

[00:04:34] Kimberly: It is.

[00:04:34] Craig: Would say the other portion is authority. You have a CISO or a CIO or someone that's tasked with securing and protecting the manufacturing space, those industrial networks, and they've got some great laid plans, they understand kind of what they're charged with doing from the C suite and they're starting to make those tracks down, they get to the front door of the plant. They open the door and they say, hey, we're here to help you. The plant manager says, uh, not today, you're not come back next month, next week, whatever that situation is and the authority piece of that it's not quite there yet because they're still reporting structures based off of metrics of uptime versus security and different pieces that really don't coincide with the story you told.

[00:05:25] Kimberly: Right. And there's some territorialness there, right? Because I've been running this shop floor for 20 years, who are you to come in and tell me how to do it, right? So making sure that there's that conversation being happening, that tone at the top and the fact that it needs to trickle down throughout the organization

[00:05:42] Craig: We'll come in this week, I'm traveling and working with a client in the Northwest, we went in and we're doing an IT OT separation where their organization has.

[00:05:53] Kimberly: An it it divorce.

[00:05:54] Craig: Yeah, really, because they have one large network that all of their IT and OT assets are commingled on and part of their structure, their directive from the CISO or the executive staff is you need to separate these so that we have separation, then we need to go in and provide asset visibility on the industrial shop floor. Make sure that they understand what they have. What's the plan to put in a vulnerability management program? How are they looking at vulnerabilities for their industrial assets? And it's not an overnight process, it's not an easy process and organizations are trying to figure it out. They're just a little slow to the ball game, it sounds like.

[00:06:40] Kimberly: Yeah. And we see a lot of our clients want to throw technology at the problem, or a lot of times they'll want to move from an on prem solution to the cloud without doing that third party risk that vendor analysis piece. And so we really try to add some internal controls around that, right? Making sure that you're getting those stock reports from those vendors that you're making sure their background checking their employees, if you're going to put your data in their environment, right?

[00:07:07] Craig: Yeah, for sure. And manufacturing organizations are becoming more accustomed to cloud solutions to going to the cloud. Not all of them are. We have many, many clients that based on regulatory compliance, let's think pharmaceutical, life sciences, utilities, that are really driven by practices that, wow, hotel room fire alarm going off.

[00:07:29] Kimberly: Oh, is that what it is? Oh, wow. Do you need to run?

[00:07:32] Craig: Well, it just stopped. So I'm okay. Perfect. What was I saying? Where were we, Kim?

[00:07:36] Kimberly: Where we were talking about vendor risk.

[00:07:38] Craig: Okay. As organizations are trying to figure out their risk model and looking at technologies, there are multiple technologies out there. A couple weeks ago, Gartner just came out with a new magic quadrant listing the cyber physical system protection platforms as they're labeling it.

[00:07:57] Craig: And they've got the newest and the greatest with, I think they rated 17 different technology vendors and kind of where they placed them in that quadrant. So as organizations are trying to go down this journey, a couple things we recommend are work with partners that understand the technology, the shop floor, the space that you're in, and find someone that can really guide you along that path.

[00:08:22] Craig: And I would say, from your standpoint, the compliance piece, the regulatory piece, as they're looking at this, how does that play into their decision? And how do they make the most of that?

[00:08:34] Kimberly: Yeah. I think it starts with, like you said, the trusted partner, right? You have that trusted partner that you work with and one of the things that we're seeing is that folks can branch out into several different areas of their company and their practice and still utilize that same model for their trusted partner.

[00:08:52] Kimberly: At UHY we have many different practice areas that we can offer and so I think exploiting that to a certain extent and making sure that we're constantly talking to our clients, talking about their growth patterns and things like that. And then honing in on whether it's our valuation team or if it's a specialty cyber offering, or if it's bringing in your team, Craig, which you guys have that niche, that expertise.

[00:09:15] Kimberly: I think that really plays into that. There's a lot of compliance that folks have to go through and it's a necessary evil. So we really try, like I said, that white glove making sure that, especially folks that are going through it for the first time, there's a lot of fear, right?

[00:09:29] Kimberly: Cause there's a lot of costs and, it's sometimes nerve wracking for folks cause it's in addition to their day jobs. So we want to make sure that we're really putting that hat on and giving that customer service and then aligning with other trusted partners.

[00:09:42] Craig: Yeah, that makes total sense. As organizations are understanding what's there, they're looking at their ecosystem and they are beginning to, I guess walk the walk. It's one thing to check a box another It's thing to do what you're being asked to do so that when the CEO sits in front of the board, he with confidence can say we are doing what you've tasked us to do and I feel comfortable that we're making strides.

[00:10:10] Craig: This is a one year, three year, five year plan, whatever that might be, but we are moving forward and we are getting better each period, whether that's a quarter at a time or whatever it is, but he can truly feel good that the organization is doing that.

[00:10:26] Kimberly: Yeah. And Craig, we see both. We see the check the box, we are only doing this when you have an audit checklist and you see that everything was done the week before It's a check the box situation, but we do have a lot of clients that are really trying to proactively put controls in place that are going to not only be applicable to the audit, but they're going to help them from a growth and internal control perspective as they go from a 10, 000, 000 to a 30, 000, 000 to a 50, 000, 000 dollar entity. It really makes sense to design those internal controls for growth. And so that's what we really try to do when we talk about compliance, when we talk about those SOC audits or those ISO audits.

[00:11:07] Kimberly: Those controls are meant to grow, they shouldn't pigeonhole a company into just kind of a one and done situation.

[00:11:14] Craig: They don't need to be in a vacuum. They're living, breathing documents that as the organization expands, they should expand with it. But yeah, we see the same thing. We'll get engagement from a client that says, Hey, um, we have to respond to an audit that we didn't do so good on, and we've got like 60 days, can you help us? I'm like, yeah...

[00:11:31] Kimberly: Yes, we can you need to get started right now. Yeah. My favorite that I've gotten so far was, we just signed a contract that we get a sock on it, can you help us do that? That we currently get one. Can you help us do that

[00:11:46] Craig: Yes, exactly. Let's shift gears a little bit here. I don't know if this is something that you guys help clients with that, we see organizations constantly that can't get insurance or insurance is through the roof, it quadrupled last month, Craig, or it's going up.

[00:12:02] Craig: Or our carrier says, if you don't have multifactor authentication on all of your industrial assets, we can't insure you. And they're like, but we can't put multifactor authentication on our industrial assets, what do we do? Are you seeing insurance play a role in organizations moving or not moving, even if it's from a financial standpoint, what are you guys seeing with that?, anything at all?

[00:12:24] Kimberly: Yeah. We've had a lot of clients come to us and say, we have this cyber insurance policy and we've been reading the news and we see the headlines and companies aren't getting paid out. So we don't even know if we're complying with our current policy, can you do a deep dive on this 800 page document that we have, right? And tell us technically what we need to be doing so we can do a gap assessment to that. And so yeah, I think there's a lot of companies that are scared. There's a lot of companies that we see just not getting it and they're like, we'll just pay the piper, and then that gap assessment piece is really important because if there's one small thing you're not doing and your claim is denied because of that would be very disappointing, right? So the goal is to make sure that insurance is there and that it's working for you, for the organization.

[00:13:10] Craig: Yeah, we see organizations that are, I guess, dealing in fear, uncertainty and doubt that. It doesn't help the industry, it really hurts. And there is a lot of uncertainty and doubt around insurance. Insurance plays a role. It plays a critical piece in your risk strategy.

[00:13:27] Craig: Organizations need to have a piece of risk, that policy that protects them from the unknown. Fire, a flood, a cyber outage. But what does that look like? Does it include business interruption? What's that gap? What's that policy look like? Is there a clause that says you have a $10 million policy, but we're all going to pay $100,000? All those things that gap analysis that you guys do, that's important because the insurers are becoming smarter. They are learning because this is new to them as well, cyber policies are new, how do they make sure that the actuaries on the back side are running the numbers correctly and there's not some cyber event that causes a catastrophic failure within their organization if they've got 10 plants and it closes all 10 plants for a period of three, four or five days, a couple weeks that could be Immediate disaster.

[00:14:21] Kimberly: Yeah, I think there is lot of points of failure within a cyber policy, right? And that's my best way to say it because it's a high risk policy and it takes almost a dedicated person to manage putting that in place and making sure, depending on the side of the organization, of course, making sure that it's actually working for the company as opposed to check the box on that survey. Yes, we have insurance.

[00:14:43] Craig: Are you seeing certain industries, pharma, food and bath, oil and gas, being more proactive than reactive?

[00:14:52] Kimberly: I have not seen necessarily a trend in an industry per se. I think I would more so say the trend is maybe organizational size and maturity. We've seen more proactivity, right? I deal a lot in software as a service service organizations , a lot of healthcare, some oil and gas, and we are really seeing the mandate is coming from the customer side. So our customer's customer.

[00:15:19] Kimberly: And so in order to win a contract, they have to have a certain level of compliance or reach a certain level of cyber maturity and be able to illustrate that with 800, 151. So I think it's not easy to attain and so we don't see that proactiveness in the smaller organizations in the startups. Although I think they know, at some point they have to get there to win those big contracts, right?

[00:15:42] Craig: Yeah, and that brings up another good point. So we often hear secure by design and secure by demand, and it really focuses on what I would call the supply chain. As an organization is procuring contracts, and they are selling goods. What does their SLA and how important is that SLA for what they are delivering for their upstream and downstream contracts, do you guys help clients with that?

[00:16:09] Kimberly: You know, we haven't in the past to be honest with you. That's not something that has crossed my desk. I'd be interested in asking my peers that question, I think it's a great question. I just don't know that I have a lot of value to add to that specific topic.

[00:16:23] Craig: Yeah, no, that's fair. We see it from an OEM standpoint where organizations, large and small, let's take like GM, I don't know, they make cars, everybody knows who GM is, they make all the vehicles. So they will Insist and their procurement department through kind of their legal contracts will require a cyber awareness and a cyber hygiene level from all of their--

[00:16:47] Kimberly: yeah! Like a security assessment that they're doing their are doing on their best.

[00:16:49] Craig: From all of their downstream vendors that say, hey, if you don't meet this certain requirement, almost like CMMC in the Fed space from a prime, they all have to meet a certain level because you look at GM and if you can't get seats, for example, for a car or headlights for a car because they're having a cyber event it could  detrimentally affect your production schedule. So, we're seeing a lot of that as well.

[00:17:14] Kimberly: We are scam to that, right? Several of our clients, we go through that procurement process in order to just be their auditors. And that security assessment is part of it, and I love it. I love filling those out. I mean, I don't actually love it, but I do love it. I and that they're security minded, right?

[00:17:29] Craig: Absolutely!

[00:17:30] Kimberly: It's important and we're telling them as part of the audit, Hey, you got to check your vendors, we can't say, well, don't check us, you know, we have to be part of that and we have to be willing.

[00:17:40] Craig: it's good that you guys are walking that walk as well. And you're saying, hey, we encourage you to do your due diligence on us equally as you do everyone else, because we value your cyber hygiene. We value our cyber hygiene, and we want to make sure that we are practicing what we preach.

[00:17:59] Kimberly: Yeah. I tend to walk the walk a little bit too much. My husband will say, can you take your auditor hat off for just a hot minute so we can have a conversation? I'm like, lock your credit. Everybody's after, you know, calm it down.

[00:18:11] Craig: I can see it now. Can you please fill out what you did today? And I need to make sure that you were productive and that you have a contestant to what I

[00:18:18] Kimberly: don't go that far. I don't go that far.

[00:18:21] Craig: Good. Nice.

[00:18:21] Kimberly: I have been known to audit the household here and there.

[00:18:23] Craig: And there's nothing wrong with that. So, as we kind of look back, and we maybe wind down, we can talk all day on a lot of these things.

[00:18:30] Craig: If there's a couple pieces of advice that you've seen, maybe a trend, something that organizations that are looking to begin the journey or maybe they're in the journey somewhere. They're just not quite there. How would you say this is something that you really should pay attention to. There's something that you should really look at incorporating in your path. What advice would you give them?

[00:18:53] Kimberly: Two things come to mind. The first would be just to dip their toes in a risk assessment. Get a cyber risk assessment, it doesn't have to be a 20, 30, 50,000 dollars. But just going through kind of that NIST framework and looking at where your risk is are, because I think a big part of tackling any issues or problems that you have within your organization is really knowing what your risk threshold is.

[00:19:20] Kimberly: The second thing that comes to mind is the human firewall. It is the end all be all. Many of these companies are not going to have a brute force attack and that's not going to be what takes them down. It's not going to be where the ransomware gets installed. It's going to come from a human error, and somebody checking out at the grocery store and checking their email and clicking on a link and not really knowing the repercussions of that.

[00:19:45] Craig: Yeah, you're spot on both of those. It's something that comes to mind as you brought that up is, we will often go in and do a tabletop exercise to help an organization with alignment and it's crazy, Kim, when you think of organizations that don't have a clear defined role set and they aren't sure who owns the risk within an organization.

[00:20:08] Craig: And until you sit down and do that and recognize, help them understand that there is a gap, that they have a gap within their organizational structure. They just not in a bad way, it's just they don't know they don't understand.

[00:20:22] Kimberly: Yeah, I think a lot of times, too the folks that have the purse strings, the folks that make those decisions, they don't know the questions to ask, or they can hear somebody that works for them say,, yeah, we've got that covered and their comfort level is high in that person, but they might not necessarily understand what the solution is and know that maybe there is some risk there.

[00:20:43] Kimberly: So they're accepting the risk without really knowing they're accepting the risk.

[00:20:47] Craig: And one of the things that we do and again, this is just because we work on the industrial floor We work in that shop floor environment is when we're doing that and we'll have a CISO or a CIO says yeah from an enterprise, we're good. We have firewalls, we've got socks, we've got everything taken care of and we're good.

[00:21:08] Craig: But to take a picture of an industrial panel from their shop floor and put it on the table and say, help me understand how you're protecting these industrial assets, the PLCs, or the HMIs that are running a Windows 7 or Windows XP operating system that is connected to your enterprise. How are you protecting that? And to see their facial expressions, they don't know that those items, those assets are connected and they don't realize that they are not securing those. And the engineering teams, the manufacturing teams, they're not doing anything with it because they've been told forever security is their job. We don't touch it. So that's that, let's call it eye opening experience for a lot of organizations until they go through that and they realize the assets on the industrial side are different and not the same as the IT assets that there's a complete set of assets out there that they're not accustomed to looking at.

[00:22:06] Kimberly: Well and what works on one does not work on the other. And I don't know that's common knowledge.

[00:22:10] Craig: I don't believe it is. In the conversations that we have, I can tell you right now, it is not common knowledge. Not at all. Well, thank you so much for your time today. I really appreciate it. It's always great catching up with you,

[00:22:22] Kimberly: Of course. Happy to do it. Good to see your face.

[00:22:25] Craig: Yep, you as well. Again, thank you for listening, everyone. Kim, if you and your team there have any questions or if you need anything as you're going through this journey with your clients, you know that we play on the opposite side of the fence that you do, it's a complimentary environment, so feel free to let us know. We're here to help you.

[00:22:41] Kimberly: Craig. Thanks.