Cyber Threats, China, and the Global Wake-Up Call

[00:00:00] Craig: At the end of the day, the most successful organizations that are going down this road is 100% collaboration between both of them.

[00:00:11] Craig: Where. It may be uncomfortable for a CSO or a CIO to pick up the phone and call the plant manager or operations and say, Hey, how do I come down there? Can, would you spend an hour and walk me through your environment? Help me understand how what you are doing impacts us and vice versa, so that together we can work on this and solve this problem that we both have. Hi, this is Dino Bus.

[00:01:09] Craig: And I am Craig Duckworth. So what's on your mind today, Dino? I got some thoughts, but

[00:01:15] Dino: Well, let's hear 'em. Let's hear your thoughts.

[00:01:17] Craig: so I've been trying to keep up the best I can and everything else that life is throwing at me with kind of what's happening in the, geopolitical space and how. This week I saw that, that Jen initially, which was the former CSA, came out and, made a post for China, actually just acknowledged part of the role in the US infrastructure, cyber attack.

[00:01:43] Craig: we're seeing a lot of. Geopolitical headlines, tariffs, us, China, other countries added, paused, brought back on everything else. let's kinda walk down this, path for a while and see what your thoughts are on how manufacturing, how. Critical infrastructure, how industrial organizations should be looking at this to better, let's call it insulate, protect, secure their assets from what potentially could be coming.

[00:02:16] Dino: Sure cisa, right? You know, the cybersecurity infrastructure security agency, in our particular world, unless you're in critical infrastructure, CISO's role I think was, kind of minimized. I mean in the public sector, we didn't really see a lot of influence from ciso.

[00:02:33] Dino: Per se. I mean if you were a Boeing, yeah, I can kind of get that if you're in the defense industry. But generally speaking in the food and bev industry, chemical industries, automotive industries, you know, heavy industries, life sciences, we really didn't see a lot of influence. From csa. Providing guidance and direction to those, those organizations, at least not down at the level where the key stakeholders are, that were responsible for, risk, safety and cybersecurity within these organizations. That being said, even organizations such as ours now, I will say, DJ Linsky, is looking at building a partner, , an integrator community.

[00:03:14] Dino: To bring on board, of which, I don't know how many, less than a hundred I think that she's working with to be part of that csa, land because we're the ones that are out there designing and building, maintaining and supporting. these industrial control systems for our clients, so you would think that we would have a significant role in trying to help clients assess risk and the vulnerabilities associated with those machine centers that, that they buy from us, and the ones that we support for them and start changing that narrative, which I think is good. So I think CISA has a role.

[00:03:47] Dino: The question is how do you get the public sector. To start listening to them. back to your original point about, the article that Jen posted in regards to what the Chinese have been doing, the Chinese, communist party, not the Chinese people, and how they have been out there attacking via cyber. and where are they embedded? You know, where are they sitting? Where are they, and lying and waiting potentially to fire off whatever cyber warfare may happen in this geopolitical environment.

[00:04:18] Craig: Well, we've seen over the last couple years organizations that it's no secret the US has made a big push in the last. Five, five years or so to begin Onshoring Manufacturing. There were several very large organizations that, that had, technology hardware that was being, I don't wanna say manipulated, but being affected by the manufacturing in the China region and how, organizations are, we can't use this any longer.

[00:04:50] Craig: And then the federal government would ban certain, Yeah, switching platform's a perfect example. So again, it's not a secret, but you're right. As it's becoming more prevalent, becoming more headline news, think organizations both public and private should start taking a look at. what is their response? How are they as an organization trying to better secure and protect their infrastructure from a potential threat? Because it's easy to hide behind a computer screen and do something nefarious and just step back and say, we didn't do that.

[00:05:30] Dino: Well, and what is the exposure, right? Because you know, I both work with a lot of organizations and you can see the tools that it are using, right? I mean, you think of the, whether it be the EDR technologies that they're using, intrusion prevention systems, the intrusion. Detection systems, the policies that they put in place, the governance, you know, budgeting and resources.

[00:05:48] Dino: And so from an IT perspective, they've been doing their due diligence, the challenge is, is that stuff isn't drifting into the industrial arena around OT and IOT assets, per se. That. As we've said many, many times in these podcasts are outside their purview, And you can call 'em Shadow IT groups on the OT side.

[00:06:07] Dino: I don't know if that's ever gonna change. I, I know there's some thoughts out there that you know that it should take on and own those industrial assets. Great. That means that you have to go out into that OT partner ecosystem and sit down with those organizations to design and build machine centers and the infrastructure that they ride upon to run those applications, to run those machines, to make whatever, goods you're making.

[00:06:31] Dino: And that just hasn't been happening, That's missing. I would expect we should be getting calls from CISOs and CIOs and directors of network technology, InfoSec teams, cyber securities teams from our clients about what are you doing for us under a cybersecurity, ot, cyber security strategy. And it just doesn't happen. We have to carry the message to them.

[00:06:56] Dino: And most of the times we're working with the OT organization, right? So the plant manager, the engineering teams, operations teams, facilities teams. And that seems to be a bridge too far for them to think cybersecurity is their responsibility that they need to be doing something about it that's off over there in the ether, somewhere in the IT world.

[00:07:14] Dino: And that's their challenge and their problem and that, needs to change. So if you're listening to this, to the podcast, you gotta figure out how these two groups come together, Do I see the CIO becoming a new plant manager? No, I don't. But what I can see is those two working together and alignment and collaborative and transparent a singular strategy on improving the cybersecurity and risk assessments within those manufacturing facilities,

[00:07:44] Dino: right? All the partners to the table, you hear me say a lot times, you gotta bring all in the same room.

[00:07:51] Craig: Yeah. it's not easy. Again, and we talk about this often. It's that organizational structure. They have different leadership. They are tasked by different metrics. They are paid by different criteria. And at the end of, yeah. At the end of the day, the most successful organizations that are going down this road is 100% collaboration between both of them.

[00:08:20] Craig: Where. It may be uncomfortable for a CSO or a CIO to pick up the phone and call the plant manager or operations and say, Hey, how do I come down there? Can, would you spend an hour and walk me through your environment? Help me understand how what you are doing impacts us and vice versa, so that together we can work on this and solve this problem that we both have.

[00:08:47] Dino: It sounds like a marriage,

[00:08:49] Dino: right? You recognize each other's strengths and weaknesses, and you work together on that instead of pulling apart and poking at each other, right? And not say that's your responsibility or that's your problem, right? Recognize your strengths and weaknesses and work together for a common goal.

[00:09:04] Craig: Right. You know, it's not, I'll get 50% and you get 50% and we're at a hundred. It's, we're both gonna give 95% every step of the way. And if I can't get there, then we'll find common ground on the other five. But we're both giving everything we can to make it work.

[00:09:24] Dino: Right. then the flip side of that is recognizing that on the OT side, you're gonna be, you're gonna be missing a lot of critical resources, knowledge and experience in regards to pull this off. And thinking that you can do it by yourself alone without bringing your partners to the table is a non-starter, That's where we see a lot of these technologies morph into show. Software they can't seem to move further. I can't tell you how many calls we get involved with when somebody tells me they want a hundred percent visibility inside the manufacturing facility and not really knowing what that means, It's easy to say, I want a hundred percent visibility

[00:09:58] Craig: Yeah.

[00:09:58] Dino: all the way down to the drives. All the way down to those motors and sensors, are you gonna treat those assets the same way you treat every single IT asset that you have that is underneath your cybersecurity, umbrella, including printers and everybody's computer, and all your servers and all your applications.

[00:10:16] Dino: Again, it has done a really good job of, chasing that and going after it, but not so much on the plant floor. Not for all these odd and end components that are still sitting on the network, that have software on them, have firmware on them, or sitting on a network or using networks, have applications.

[00:10:32] Dino: You're not providing the same level of due diligence to determine the risk and have visibility into them as you do on the IT

[00:10:39] Dino: side.

[00:10:40] Craig: Right. No, a hundred percent correct.

[00:10:42] Dino: Right.

[00:10:43] Dino: I don't know if the cloud's the answer. You know, I mean, that's still an arm wrestling match. You'll hear between organizations. You'll hear OT people flat out say, I don't want anything in, in the cloud.

[00:10:52] Dino: And the reason for that is, they don't want their plans to fail to run because they lose their network connection or they use a lose access to cloud, right? They wanna be self-sufficient. That if that plant is cut off from the outside world, from a technology perspective, from a networking perspective, then it can still run.

[00:11:10] Craig: If you look at, so I see both sides of that, you know, and then, and if you say, okay, I've got 20 machine centers in here. Pick a number, whatever it is. And in the event something happens to one of them, one of them goes down, am I am IOEM is in, pick a different country that's a 12 hour plane ride away.

[00:11:32] Craig: How do you get support for that? Piece of equipment without access to a third party, secure remote access, privileged access technology, allowing that individual that you have no idea who's on the other end of that connection into your environment, through your network, down to that asset and control what they have.

[00:11:57] Craig: Access to do what they can. See how long they can be there. Again, it, you're doing it. Do you blindly trust? Do you have another mechanism? but again, you can't live today in what everybody says is a traditional air gap situation because it's not feasible. You can't, it doesn't work.

[00:12:22] Dino: Even if you're pursuing a digital or electronic air gap, versus something that's physically disconnected. We'll talk about physically disconnected in a second, but even if your approach is to put in, air gap technologies. It be data diodes or, other zero trust types of, technologies.

[00:12:40] Dino: You still have to monitor that to make sure that it stays the way that you expect it to stay. Right? 'cause things change, Somebody pushes a patch out, somebody makes a configuration change, somebody adds a new asset, new application, whatever, whatever the case may be. If you're not able to see that, then you don't know what holes that's created.

[00:12:58] Dino: Even though you said we had a great strategy and it'll work perfect. How do you make sure it stays that way versus back to the physical disconnect, knowing that machine is not connected anything? Because I know that it's not, but yet there's a connect, there's a jack on the wall that the, operator or the engineer will plug into that jack on the wall because they need support. And now that access has been granted, what's going on during those comms between that third party, whether it's internal, external, with that machine center, and was it disconnected after the work was done Or. We find cellular modems. So sometimes the OEMs will put inside those machine centers 'cause they want access and you don't know that it's there.

[00:13:38] Dino: It doesn't know that it's there. OT doesn't really care because their mindset is, when I call for help, I need somebody on the phone right away to get this, piece of equipment back up and running so I can keep making goods. the long and short of it is, is that you should have visibility into those, connections at all times.

[00:13:56] Dino: When that

[00:13:56] Dino: machine center comes up online, you wanna see that right away.

[00:14:00] Craig: I look back at, you know, some of the. Human nature is, let's find the easiest path. Let's look for known exploitable. CVEs, let's look for easy roads in. you're not looking at zero day technology, you're not looking at cutting edge stuff. the People's Republic of China are looking for the easy path in.

[00:14:22] Craig: Take a hard look at your organization and how can you. Pick off the low hanging fruit and begin taking that defense in depth strategy and applying it into that OT space and start putting parameters, microsegmentation, virtual patching where you can't replace a piece of hardware, you can't change something else.

[00:14:46] Craig: Or maybe you can do some sort of. OT centric endpoint protection in that environment. How can you take a look at these different methods and start doing some things to help yourself but you're right. Monitoring is important. If you can't do anything, you at least have to know what's there, what's happening, take action for what's there, because that.

[00:15:11] Craig: 15, 20, 40% blind spot, if you're only seeing 60% of your assets can be more detrimental because it's giving you that false sense of security.

[00:15:24] Dino: Well, I've worked with several clients just here in the last couple of months. It's ama You got one, you got technology. That's. 30, 40 years old out there. Right? You got PLCs that are from the eighties and nineties and I was just talking to a client yesterday that's got 4,000 end of life assets.

[00:15:41] Dino: Whether it be peak, the PLCs and or Windows operating system still got Windows, seven still got, XP and their environment. Because capital plan to replace that stuff is, can be ginormous.

[00:15:53] Dino: So do you do nothing?

[00:15:54] Dino: No. Well, but, but, you're right. But that's the mindset that they have.

[00:15:59] Dino: And of course it is gonna, this is where it will turn a blind eye to that stuff,

[00:16:03] Dino: not my problem. They'll just look for a way to put a firewall somewhere in the mix and call it a day. And that's not sufficient. So then you have to start thinking, well, there's a lot of other technology, a lot of other things that you can do, defense in depth strategies, whether it's virtual patching, micro-segmentation, other technologies you can bring in that are specifically built to deal with that stock.

[00:16:23] Dino: And it is never gonna, they're never gonna pursue that because they look at that stuff as being ancient and old need to get rid of it. But at the end of the day, the reality is it's there. It's making goods, it's driving revenue for the organization. how do you close that gap? ' cause OT is not sitting there trying to figure that out, Somebody has to close that gap to say, well, what options do we have? What services are available to us to help monitor this stuff? a lot of clients are starting to move to what I want to call OT managed services. everybody knows that it manages services are, they've been around for a long, long, long time.

[00:16:57] Dino: Let's talk about OT managed services, With OT organizations that have a pretty good grasp of what those machines are, their architecture, the technology that they're using, how they interact with each other, and at the same time bring technologies in to help improve and harden that cybersecurity posture.

[00:17:16] Craig: Well, an ot. Managed service organization is gonna provide more than an IT. One is they're gonna give you insights and interpretation into some of the process integrity alerts that they're seeing. they're gonna give you insights into how better to manager efficiencies based on what they're seeing in the environment.

[00:17:39] Craig: because it's not a one-to-one linear. Unlike on the IT side. If you're in an IT soc scenario, it's you know, isolate and kill, versus you can't just turn off a PLC because you see a code change at three o'clock in the morning. Maybe that's justified. Maybe that's warranted. Maybe the controls engineer on site did that for a reason.

[00:18:03] Dino: Well, that's a human in the loop, That's back to the human in the loop, you know, to make sure that you're not damaging product that, you know, I, that's gonna cost us a million dollars in product based on somebody stopping that machine from what it's doing. And now you brewing my batch, Or I had to sewer the product, or, you know, to pull it out of, out of the warehouse and destroy it.

[00:18:22] Dino: And so in those scenarios there has to be accountability,

[00:18:27] Dino: that's the kind of the piece that's missing a little bit, right? Because we, you know, a CISO or a CIO that recognizes they got Windows seven their environment, would basically tell the business unit owners, you need to get rid of that stuff.

[00:18:37] Craig: And we've seen that.

[00:18:38] Dino: They're not gonna tell 'em how to deal with it. They're gonna say, you need to get rid of it. Well,

[00:18:41] Craig: And we've seen that though though, Dino, we've seen a CSO walk the plant floor with us and others and the controls engineer's like, we've got this Windows XP machine that's running this process area and he's like, take that off. Well, okay, so do you understand? The implications, if I were to unplug this right now, today per your instruction, that line goes down.

[00:19:03] Craig: We stop making whatever it is that we're making in that line, the cost to the business for that decision, and that's, that piece is missing from the equation. Yes, I can unplug it, but here's what happens and here's the cost to the organization, and is the CEO or the CFO or somewhere way above us. Aware that's getting ready to happen.

[00:19:27] Craig: And the answer is no. they don't, they're not looking at it that

[00:19:30] Dino: Right. They're not gonna. Right. and that, that it executive will drift back up and say, I can't influence that. I can't change that. And I'm not gonna help you ride a capital plan to go spend a million dollars or replace that equipment either, Or do a recon control effort.

[00:19:44] Dino: It's, it is just not gonna happen. ? It's, that's back to the OT ecosystem has to get better at this game. And match that CCIO CISO's role, and saying, here's what we're trying to do to get better at this. Please help assist where you can. But at the end of the day, they own that problem because that, that it executive, the, I don't know what the, I think their influence is minimized greatly when it comes to those types of situations.

[00:20:11] Dino: from a hacker perspective, they don't care if they can figure out , the leverage. To get in there or, you know, SMB to, walk laterally through your plant to put in, malware, then you're wide open because you haven't put in, controls

[00:20:28] Craig: Yeah.

[00:20:28] Dino: to prevent that.

[00:20:29] Craig: Well, a compensating control Every single manufacturing client today needs to have a backup and recovery plan, plan for disruption. What does that look like? What is our, continuity, business continuity plan? What is our disaster recovery plan in the event that they have some sort of.

[00:20:53] Craig: Nation state or some sort of ransomware or some sort of event in their environment, how do they address that? You do not wanna start learning that process in the middle of in a, a situation. That is a horrible, horrible idea.

[00:21:09] Dino: Well, if I walked into a plant and was asked to plant, getting ready to put a new packaging line in for you and to broaden the OT cybersecurity strategy questions is what is your incident response plan? And you get that deer in the headlight log, It's like, what are you talking about?

[00:21:23] Dino: It's like, well, what happens if malware in here happens? If I find malware happens, if I bring it in, how are you preventing that? How are you looking for that? Because where I'm plugging into this industrial environment, it might as well be, half the country away from it's tools and their visibility into this plant because they can't see what we're doing in here.

[00:21:40] Dino: They're not providing any direction. You know? What is your defensible architecture strategy? Why don't your integrators and your OEMs know that, there building you millions of dollars of equipment and they don't have input at all of what they should be thinking about or what they should be doing just to cover those two things, And then remote access, throw remote, remote access into the mix.

[00:22:00] Dino: You know, as Luke said, in many podcasts, we find several different remote access technologies in the same plant.

[00:22:07] Craig: I think five or six is the average.

[00:22:09] Dino: Yeah. You know, and one of our vendors came out and said that Gardner's come out and said that, that they find several in one client and we'll find those.

[00:22:18] Dino: Unquestionably in every single plant, right? Because everybody brings in their own flavor of whatever that remote access should look like. And it can say, this is the standard. Well, that's great, but you bought this piece of equipment from Germany and when it showed up, they put in there what they needed to do to get into it from Germany to support that piece of equipment sitting in Alabama.

[00:22:37] Craig: Yeah. it's a whole different situation. it needs to be addressed. It needs to

[00:22:44] Craig: be.

[00:22:44] Dino: should be doing it, Who should be doing it at the end of the day? Who's responsible, And that

[00:22:50] Dino: question,

[00:22:50] Craig: is as, as I would say, for safety.

[00:22:54] Craig: Everybody.

[00:22:54] Dino: it's nobody,

[00:22:56] Craig: Well,

[00:22:57] Dino: It's everybody. Then it's nobody.

[00:22:59] Craig: but if you look at safety, everybody's responsibility and everybody does it.

[00:23:04] Dino: But who ensures that there's safety?

[00:23:08] Dino: No. The local site,

[00:23:09] Dino: when you come on site to work in their plant, they're the ones that oversee the safety to make sure that you are operating safely, you're prepared to be in there to work safely, and they're watching. To make sure that you're doing that There's certain protocols, there's PPE, might be some training, you gotta take some videos, you gotta watch, you know, things that you gotta do in order to come into that facility and work.

[00:23:34] Dino: And that's the local plant's responsibility to do that.

[00:23:38] Dino: Not somebody sitting in some corporate office that may have set governance and policy and said, thou shall do this, but

[00:23:46] Dino: somebody's actually gotta be the cop on the street to make sure that it's

[00:23:49] Craig: Yeah, you're right. I think the moral though, Dino of, of, of this is given the, geopolitical landscape that we're in today with the back and forth on. the tariffs that we're seeing, the, escalation of the political environment between the US and People's Republic of China and the the Communist Party, the announcement.

[00:24:13] Craig: Earlier from Jenny Leon on, China's admitting into part of that to the critical infrastructure organizations have to start doing. So you have to take steps now to begin securing and protecting your infrastructure for the unknown of what I honestly believe is a not an if.

[00:24:36] Dino: Well, you gotta get it into your DNA back to safety, right? If you're building a new plant, there's a lot of safety conversations that are being had when you're building a new facility, right? not only the apparatus that you gotta put in place for, but then training of the people and ensuring that they're executing that I believe that cybersecurity needs to have the same.

[00:24:57] Dino: process,

[00:24:58] Dino: right. Secure by design. there should be an OT cybersecurity strategy that all these partners, when you bring all these dozens of, contractors and OEMs and integrators into this mix, to work in this facility, all have to be on the same sheet of paper

[00:25:13] Dino: when

[00:25:14] Dino: it comes to security,

[00:25:15] Craig: Can't be an afterthought. it can't be. It needs to be done upfront.

[00:25:20] Dino: Right. that's where I fall back to the position of that OT ecosystem has to start approaching this discussion and make sure that that the client side is bringing the right people to the table to either find out what they can do, what they are doing, and or provide them some direction,

[00:25:39] Craig: Yeah.

[00:25:40] Dino: And then somebody make sure that they're doing it again. Back to the safety, to make sure you're in here operating safely, you're building safe equipment. It has to be the same thing. It has to be, the beat cop. Somebody's gotta be the beat cop.

[00:25:52] Craig: Yeah. Any parting words of advice know before we let the listeners go?

[00:25:55] Dino: Do something back to doing something.

[00:25:58] Craig: Yeah,

[00:25:58] Dino: do nothing. Do something.

[00:26:00] Craig: you gotta get better, period over period. Whatever that measuring stick is, You guys have a great week. Appreciate everything. Continue to listen for advice, and thank you very much.