The C-Suite's Role in Industrial Cybersecurity

[00:00:00] Craig: It can't be just a black box anymore. And 'cause organizations, the boards and the directors and the C level, they're on the hook for blindly trusting something that they have no idea about. They can't, it just can't happen.

[00:00:43] Craig: Hello, I'm Craig Duckworth.

[00:00:45] Track 1: And I'm Dina Busalachi.

[00:00:46] Craig: So Dino, I've seen tons of stuff in the press and the news. A lot of headlines coming at us.

[00:00:52] Dino: Well, I think we, maybe we could touch on something we touched on earlier was how does the IT organization, increase their scope? And relationships with organizations that are, responsible for the industrial control systems that are being designed and implemented and supported in manufacturing environments.

[00:01:10] Dino: I was talking to a,client,just the other day, and they have nine plants scattered around the world, but they have 200 plus system integrators.

[00:01:22] Craig: Ouch. It's a lot.

[00:01:23] Dino: 200 external organizations that have access or require access into their manufacturing environments to support 'em. Right.

[00:01:31] Craig: Okay.

[00:01:31] Dino: And the IT guys,the head of the department that was trying to get his arms around this, feels like it's whack-a-mole for them, right? It's like herding cats. And, and it was,and they,the challenge that they're trying to solve was remote access, right? How do I get consistent, reliable, secure methodology in place? To govern, remote access and my control systems and what technologies and tools should I be using.

[00:01:57] Dino: and you and I both know that a lot of the OEMs and system integrators will bring in their own, that they will build into their control system to gain access completely, aside from whatever IT may be thinking or what they're doing.

[00:02:09] Craig: Right.

[00:02:10] Dino: that's one of the challenges. Right. and then the other is how do build this village?

[00:02:16] Craig: Yeah.

[00:02:16] Dino: That is required in order to really tackle OT cybersecurity.

[00:02:21] Craig: Well, I think I like the topic. I like where you're going. I think that, how can systems integrators, system integrators, you talked about, the one client that's got 200 of them across their structure. How can organizations, a CISO, a organization, leverage their system integrator (ecosystem) choose, interview, look at, determine, which of those have the wherewithal, the bandwidth, the skill sets to help. Advise them appropriately on the OT side regarding cyber hygiene and how they can partner together to bring a unified ecosystem and that knowledge share to the CISO that's trying to understand and learn, that's been tasked with understanding and protecting and securing that OT environment.

[00:03:19] Dino: Well, they have to cut through the noise, right? the system does, right? And there's many out there who can talk the talk, but then there's those, how do you get your, site set on those that actually walk the walk? Right? and that's what's, that's the challenge, right? And it gets what you just said about interviewing.

[00:03:34] Dino: you need to sit down and as a, an IT executive who responsible for cybersecurity.

[00:03:41] Craig: Mm-hmm.

[00:03:41] Dino: And determine who are your top OEMs and SIs (System Integrators) that your firm spends quite a bit of money with

[00:03:47] Craig: Yeah.

[00:03:48] Dino: to deliver solutions and technology in these machine centers to operate your plants, to make the goods that, that your client makes, your revenue generating side of the house, right?

[00:03:58] Craig: Right.

[00:03:59] Dino: So, and you have to, where are they, where is the skillset and the practice of those OEMs and SIs as it relates to cybersecurity. and you and I both know that there's, those are very few, right? People talk about the unicorns, but you gotta get past the unicorns, right? You gotta look at it.

[00:04:16] Dino: How do you build the team? Relationships with all these players that are involved in the operational side of your manufacturing facility, which is the key piece, getting closer to the operational side. I think that's where a lot of the IT leadership falls short, is they just don't understand the day-to-day stuff.

[00:04:35] Dino: It goes inside their manufacturing facilities..

[00:04:37] Craig: Well, they don't, but they're very adept and very knowledgeable from an IT perspective. They have quarterly or biannual business meetings with the Microsofts, the Ciscos, the, the Palo Altos, the IT partners that are managing the enterprise, they need to be doing the same things with their OT systems integrators about how can we knowledge share, how are you secure, how are you helping my plant stay productive?

[00:05:08] Craig: What lessons can I learn? How, where are you playing in this ecosystem? and what knowledge can you bring me as a CISO?

[00:05:16] Dino: Right. Well then you gotta, and find those expertise gaps, right? I mean, it's not that OT cybersecurity isn't lacking voices.

[00:05:24] Craig: Right.

[00:05:24] Dino: I would argue that it's lacking qualified ones, right? And so how do you qual how do you qualify?

[00:05:30] Craig: A partner that, that is, has the strategic partnering relationships with these technology companies and actually works in the industrial environment, right?

[00:05:39] Dino: And knows how to run a plant. How to build the machines that are required to make the goods that you know, that your organization is making, right? Whether it's petrochemical or food and bev or life sciences, where are those relationships get past those expertise gaps, right? that's what's missing.

[00:06:00] Craig: Yeah, you got some systems integrators or some OEM manufacturers in that list of a couple hundred, as you mentioned, that are single focused. They do one particular task, they do it very well, but they don't have a holistic view of the entire ecosystem. Those are easily, I guess, removed from that pool of talent because they're, they don't understand the whole focus.

[00:06:29] Craig: They do great with what they're doing, but how do you look at somebody that understands everything?

[00:06:35] Dino: Well, and it's not always about cybersecurity, right? I mean, that's the lead conversations, that's the initial messaging. But there's also a lot of process integrity, operational integrity, results of the information that is acquired by the cybersecurity tools that are being implemented in these plants.

[00:06:53] Dino: I mean, every single manufacturing facility that we go into, we find instances of not only potential disruption, but actual disruption that's not really a cybersecurity event.

[00:07:07] Craig: No, not at all.

[00:07:08] Dino: As much as it is something that's going on is being disruptive to those control systems, right? And

[00:07:13] Craig: Oh, it could be a misconfiguration, it could be someone that simply is doing a task, not recognizing the implications of what they are doing has on the control space.

[00:07:28] Dino: well, it, there could be hundreds of dormant accounts that are sitting out there. maybe you had an event, a startup. Let's say you had a startup, last year, and so there was a lot of activity, a lot of people involved in getting a startup in your plant to get, let's say your packaging systems up and running.

[00:07:45] Dino: Well, did anybody go back through and clean up all those accounts and all those applications that they were using for the startup that aren't required today? from, from operational, active running. are you going through and looking for that stuff and removing it because we find that's not the case.

[00:08:02] Dino: And remote access, what kind of remote access did they put in there and what is, what do those users have access to realistically when they are connected in that environment?

[00:08:11] Craig: right.

[00:08:11] Dino: there's this whole bevy of things that clients are unaware of because the OT team, is the one that, that, instituted this effort and kinda ran it almost autonomously.

[00:08:23] Dino: Asking for peripheral help from it periodically. Hey, I need some IP addresses. I need a port on the switch. I need some,ports open on the firewall. And so that's kind of more like their engagement on the IT side. But all the applications and,the, control system network and the infrastructure, those applications run on are usually, typically independent, and even if it is managing portions of the infrastructure, it still doesn't mean that they're, they know what's going on under the covers as far as from an operational standpoint.

[00:08:57] Craig: Right.

[00:08:58] Dino: and involved with that.

[00:08:59] Craig: Well, and there's two pieces. You've got someone that comes in and does, let's say, a startup, an implementation, a one-time, let's call a project versus strategic support that can look at your organization strategically and long-term outside of just the next 90, 120,180 days that can see 1, 3, 5 years down the road and help you grow and understand how do you get from point A to point Q in your task list, down the road.

[00:09:36] Dino: Yeah. Or how, the good question, for an IT executive is how close are you to the plant performance metrics, right? Their OEE, for example, right? Whatever,metrics a client's using to manage how well they're reducing on plan, unscheduled downtime and producing goods. how is that IT team plugged into that?

[00:09:57] Dino: Right? And when you talk about InfoSec teams, security teams, that's not the stuff they focus on. and it gets back to, okay, well now you need to start interviewing your operational teams and their suppliers, on the things that they're doing to improve upon that. Right.

[00:10:15] Craig: Yeah.

[00:10:17] Dino: When you talk about, improving, your OEE, just a few percentage points, and depending on the size and scope of your organization, that could be literally millions of dollars in loss that you're taking, because of things that are being disruptive in the environment that nobody's really fully aware of or understands how that disruption happens.

[00:10:35] Dino: and not that it's because of cybersecurity attacks. I mean, that's obviously one, but then sometimes it's just human error or just behavior. Or just the way that they do things right. And it may, it might need to change. and if you're not in there really investigating and researching and have that knowledge and the expertise, it gets back to there's many out there that can, talk the talk.

[00:10:57] Dino: But then there's the walk, the walk, meaning I know exactly how this plant runs. I know what those machines do. I know what their uptime should be. I know that what should be on this network versus what should not be on this network, right. and nobody's really weeding through that. Well, and even if it has an initiative to try to separate the IT and OT networks, to, to what extent are they just, are they going all the way down to the PLCs and the drives?

[00:11:24] Dino: Are they just working at the IDMZ level? and then what are those OEMs doing? There's 200 of these OEMs in and outta my environment, on an annual basis. What the heck are they doing right?

[00:11:37] Craig: and you look at, a strategic plan, you look at some sort of roadmap, which again, works very well, but on the manufacturing side, in the control layer. Changes happen daily. There's no standard or consistency there. There may be, but we walk into a plant, we may have the best laid plant in the world and there may be a fire drill that morning that plant manager or that controls engineer is doing to support production operations and your entire month's worth of planning can go in the trash can because if you don't know how to adapt, adjust and modify based off of what's really happening, it, it doesn't make a difference.

[00:12:24] Dino: Right. Well, and so what you should be thinking about is how do I build cross-functional teams where I get, I pair up OT cybersecurity engineers, with cybersecurity professionals or OT engineers, right? The plant people and pair them up with your cybersecurity professionals. You should mandate field experience.

[00:12:42] Dino: You gotta work in the field.

[00:12:43] Craig: You gotta spend some time in those plants. You can't show up at the plant once a year or every other year and be able to gain the expertise and knowledge that you need to have in order to do this correctly. Rotate your staff, through the plant environments, right?

[00:12:57] Dino: Rotate 'em through, right?. There's turn incidents into learning experiences, right? So there, there's a whole lot of things that you can do, in order to improve your cybersecurity posture. The question is, and you can't do it with your internal organization entirely. I know a lot of companies try to do that.

[00:13:15] Dino: You're just not gonna have the depth and breadth of expertise and knowledge be will pull that off.

[00:13:20] Craig: Well look at organizations today in today's operating environment, everyone's doing lean. Everybody's doing just in time. Everybody's tasked to full capacity with whatever they're being tasked with. It doesn't make a difference. they're working. 45, 50, 60 hours and sometimes more than that.

[00:13:40] Craig: Every week. They're not looking for a new job. They're trying to finish and get off their plate. Everything that they have to do every single day. So you can't just pile on top of, you need to say, okay, your dedicated, your job is this, and here is your partner or the team that you're gonna work with that, that cross-functional team that you mentioned, and collectively, here's what you as an organizational piece is gonna be tasked with. It's gotta be something like that.

[00:14:12] Dino: Well, like I said, as an OEM, you would think that we would've more conversations with IT teams that are trying to solve this problem, right? I don't know who they're talking to. if you're not talking to your primary general OEM and SI on a very fairly consistent basis to find out what they're doing every day in your plants,that's a breakdown in communications, right?

[00:14:38] Dino: That's a gap. And we don't see that today. We don't. And there's not very many OEMs and s SI out there that necessarily have the skill either, right? That's why you've gotta go and interview and find out which of your partners are actually moving in, in the same direction you are or the direction you want to go, versus you, you reach out to a system integrator and you wanna know about their internal cybersecurity practice, you want to dig, wanna do a deep dive into it, and you find out that it's either very shallow or it doesn't exist at all.

[00:15:10] Craig: Right, well, there, there needs to and we've said this a hundred times, the there need, the CISOs need an, an, to need to know who to call, who to reach out to, who to work with, how to get that knowledge transfer. I don't think it's that they don't want to do it. they don't know.

[00:15:30] Craig: It's it's it's different. We've heard that and we've said that a hundred times. It's different. It's not your normal stuff.

[00:15:36] Dino: The CISO? Well, ideally the CISO should pick up the phone and call the plant manager and say, who are your primary SIs and OEMs that work in your plant every single day?

[00:15:45] Dino: you could go to procurement and find out who do we spend the largest amount of money with to help us run our plants?

[00:15:53] Craig: I mean, that's a good starting point. It's a great starting point.

[00:15:57] Dino: who we writing checks to and call the individual responsible for running that plant and who they rely on.

[00:16:04] Craig: They gotta start somewhere. And that is a great spot. That's two avenues that give a CISO a place to get that knowledge and that information that says, here's our top spend in the manufacturing. So that's, there's your one good place. Second place is, okay, maybe that's all technology plant manager, who's implementing this stuff, who is connecting this stuff?

[00:16:27] Craig: Who is supporting all these? The spin and maybe that's a different group, completely start there and figure out what does that look like.

[00:16:37] Dino: have a vendor summit, right? We've been, we've participated in those, have a vendor summit and have the vendors come in and present to you what they're doing and what their capabilities are, right?.

[00:16:47] Craig: So let me ask you this. I know you've been to a couple vendor summits for some of our clients. Was IT, CISO involved in that or was it strictly the OT ecosystem?

[00:16:58] Dino: Well, it was being run by OT, but

[00:17:01] Craig: And there is the gap. That's a problem.

[00:17:03] Dino: They were running it. But the IT, there was participation by some of the IT teams, especially around those that are, getting it right. You still got this 60% that are still out there, naval gazing, versus the, you got 30% that are actually starting to do something, at least exploring, piloting, demoing, maybe starting to build a cross-functional team, you would hope.

[00:17:25] Dino: And you got 10% that are actually moving down the road, and making some moves and investing in technology and resources and strategy. building out their governance and their policy and just 10%, but you as a CISO, if you don't know who your top OEMs and SI in there that are, you're spending a tremendous amount of money with to help you keep those plants running.

[00:17:47] Craig: You're gonna have to pick up the phone and call 'em and say, I'd like to have a chat, Without doubt.

[00:17:54] Dino: Because the OT guys aren't going to, influence that per se. I think they'll support it, but they're not gonna drive it. Because they don't think it's their responsibility. What is their responsibility on the OT side?

[00:18:06] Dino: Is it, safety and production, right.

[00:18:09] Dino: We talked about this before, when organizations take digital safety, what the cyber physical systems and the connectivity equally as important and begin viewing it the same as physical safety, machine safety, PEI. I think the message changes. they view it differently and they don't take it with the same amount of severity. And the implications are just as bad. Well, it's gonna harm an organization financially more from a digital standpoint. if they are shut down, if production is halted, as it will from a physical safety, if someone loses an arm, an eye, God forbid, an entire life, where OSHA steps in and shuts it down, does an investigation, the implications are the same or greater, It's a trust but verify, right? Because even the folks. You have working at it, how do you validate the work that they're doing? right. if you don't, if you're not reducing these gaps between the IT and the OT organization, and then understand that there's a huge part of that OT ecosystem out there that you're gonna have to get your arms around, right.

[00:19:23] Craig: Well, and there are processes and controls that you know. Let's call 'em savvy, or let's call them knowledgeable system integrators can help you understand what will affect production and what will not affect production. How do I maximize my spend, my dollars that are allocated to this plant? How? Why do I wanna chase some corner case that means nothing to production, where I've got all these things that are really important that I should focus my money on. System integrators can help you with that flow.

[00:20:02] Dino: I ideally, they, they would, right? I mean, they should be able to tell you what you can and can't, what you can get away with and what you can't get away with. But at the same time, you're also having to educate those OEMs and SI.

[00:20:13] Craig: Yeah.

[00:20:13] Dino: Technologies are not disruptive to their work. Right.

[00:20:18] Dino: Complimentary, right? and trying to get past this. It's like, how many times have you heard, don't touch my machine. If you do, I'm not gonna support you, right? If you get in there and wanna put a piece of equipment in there, or some software in there to help with, cybersecurity discovery related activities, you get pushback from the OEMs, right?

[00:20:36] Dino: Start having conversations with them now and recognizing,and convince that convey to them, this is not disruptive. This is why we're doing this right. And this is how we do it, right? there's obviously several ways to skin that cat, but you gotta have, you gotta start with the conversation with who those people are.

[00:20:54] Craig: Yeah. we see it where.

[00:20:56] Dino: Cross-functional team needs to include them in this discussion.

[00:21:00] Craig: Yeah, it does. It. No, no longer can, the days of OEM owns manages the maintenance for an asset, but the organization is responsible for all the risk because they are being treated as a black box or, oh, don't touch it, or you gotta keep away from it, but we are responsible for the risk. We need to know what's happening there.

[00:21:23] Craig: Who's in and out of that environment? What's it communicating with it? It can't be just a black box anymore. And 'cause organizations, the boards and the directors and the C level, they're on the hook for blindly trusting something that they have no idea about. They can't, it just can't happen.

[00:21:41] Dino: Well, and you just can't rely on, the engineers that are working on site, even at the OEM level, system integrator level, that they even know what their company's capable of, right. But they may have a cybersecurity practice, right? Which are some of the challenges that we see even within our own organization, that there are folks out there that just don't see the bigger, broader picture, right? So you can start with the people that are working on site who are there every day, all day or a lot, and then get into their organization and find out what their capabilities are. What practices do you have, right? So that way you can determine whether, they can help you or not.

[00:22:19] Craig: Or you gotta bring somebody else in, So if we were to, let's call it loosely, advise a CISO with, a handful, three, four questions that they, they're talking to assistant manager, let's say they do their homework, they pick up, they call procurement, they get a list of spend. They call the plant management and say, here's who's doing the work, call them in, sit down, have a, a business round table, if you want to call it. what would they ask? How should they ferret through the weeds? If you want to understand the cyber capabilities, the skill sets and knowledge of that system integrator around their plant to try and get to, who should they partner with for these initiatives? What should they be asking?

[00:23:04] Dino: One is how do I stack up to compare to my competitors? 'cause we're the second largest outside in the food and bev industry, right? So what are my competitors doing? what are my peers or my colleagues, what are they doing in this space? It would be one good start.

[00:23:19] Dino: Two, what was the size and scope of your practice? What are your technology partner relationships, with the Ciscos and the Dells and the Armis and the Nozomi and the TX ones and the, the organizations, the technology companies focused in OT, right? what, what does the cross-functional team look like?

[00:23:37] Dino: Right. what are you doing in my plant specifically? are you responsible for the network? You're responsible for control systems, you're responsible for,process integrity, line efficiencies. you want to kind of get into the weeds of what are they doing in there and what is the size and scope of their practice if they have a cybersecurity relationship.

[00:23:55] Dino: Again, what are my peers and competitors doing out there in this space?

[00:24:00] Craig: Oh, great.

[00:24:02] Dino: Right. What are seeing out there?

[00:24:05] Craig: Yeah, great advice. know, set a cadence.

[00:24:07] Dino: Where do you start? Where do, how do you guys start? you know.

[00:24:10] Craig: Yeah. Yeah, for sure. Just gotta set a cadence, set up a, initially a once a month, 40 minute call, 30 minute call. Have that conversation, work with those teams, and try and figure out where they play. It's, there's all kinds of knowledge, research, availability, resources that are already there doing the work.

[00:24:34] Craig: Just lean on them. Leverage the expertise that's there at your disposal today, every day.

[00:24:40] Dino: And if you're talking to somebody that says, yeah, we do that, make them demonstrate to you where they're doing it, how they're doing it. Are you doing, I hear the talk, the talk, but let's talk about walk the walk, right? What work are you specifically doing? How often are you working in the plan? what is it that you're implementing?

[00:24:57] Dino: What are you installing? What kind of services are you providing? versus somebody that says, well, I put a firewall in. that's what I do. I mean, that's, that, that's our methodology or we put a VPN connected connectivity into the environment. That's what they do. And, we have a partnering relationship with clarity.

[00:25:13] Dino: We sell their stuff, but we don't maintain it or, provide managed services around it. you want, what are their weaknesses and their strengths,and CISOs know what to look for when they talk to it. It's like talking to any other vendor. If they were going after a network refresh for example, they would know what to ask and what to look for and who to talk to.

[00:25:30] Dino: It's the same conversation. It's just a different, group of people.

[00:25:34] Craig: Yeah, there be red flags that, that are similarities that you'll be able to determine and sniff out the walk, the walk versus the truth.

[00:25:42] Dino: Right.

[00:25:42] Craig: Boots on the ground. Rubber meets the road. Walk the walk environment.

[00:25:46] Dino: and then you want your OT people to participate so they can help validate some of this conversation, right? So you want 'em both ends back to that cross-functional team, so don't try to just do it by yourself, independent with an SI. you want the, input from the people that, that, that work that they rely on, that they feel are credible and accountable.

[00:26:07] Craig: Yeah. No, I think that's some great advice. I think this is a very timely, relevant conversation that I would say at minimum 60%, based off of what Gardner's saying, 60% of organizations they need to be hearing this.

[00:26:21] Dino: Yeah.

[00:26:21] Craig: They need to listen to this. They need to understand, they need to like, they need to listen to the other podcasts that the advice that we're providing and really. Start this path, and it shocks me that, that Gardner staff that, that you throwed out earlier where 60% of organizations are just naval gazing and 30% have begun something. What, regardless of what that is, and 10% are really on the path or making progress in a crawl, walk, run fashion. You got 10% that are running 30% that are walking in 60%, which are not even crawling really, they're doing nothing. I'm surprised in the last five years that stat hasn't changed and we haven't seen it. But again, organizations,you gotta start. And this is, you can't, you gotta pull your head out of the sand.

[00:27:11] Dino: Well, and it gets back to the expertise and the gap between IT and OT, and we still see it. And it's prevalent on the OT side, both internally and externally to, to the, organization. And, so you have to really get to the know with them, right?

[00:27:26] Craig: we'll help any organization that's out there if you're not getting the support you need internally from your own systems integrators. If call us, we'll help you.

[00:27:34] Dino: Right.

[00:27:34] Craig: You know, we can bring you that support, that guidance, the knowledge, it's there, it's available.

[00:27:40] Dino: Right. and also, if you do get to the OT side as an IT leader coming in to, to find out what they can know, listen to them. if they're, if you think that you have a tool that you've picked that works in the OT space, you need to validate that with them. Don't just say, Hey, we got an OT tool, so we're good.

[00:28:01] Dino: do you have the best tool? Are you even implementing it correctly or is your scope as broad and as visible as you'd like for it to be? here's some other tools and technologies that we use in this space that you're not using, and here's the reason why we use these tools, because we have clients that, can't provide the data that we need in order to work in a safe, secure manner in their plants. So organizations that, that have the chops, they're bringing in their own tools and those tools and the data that they provide, can be,beneficial to the IT side because you can move that information up to their tools.

[00:28:38] Dino: Might be some integrations there with some of the IT tools. so you gotta dig into it and just don't assume that you've got it covered and you're gonna discount the OT guys because they don't have cybersecurity respons, really? So why would I ask them anything in regards to cybersecurity? if that's your mindset, you're going down the wrong path.

[00:28:57] Craig: Yeah, no, the OT teams, they wanna make things better. They recognize that these tools give them, we mentioned it earlier, that operational resiliency view aspect of helping them manage their OEE while providing this cyber benefit to the IT team, this IT teams and the SecOps teams. So you get both sides of that coin. you gotta start moving in that direction.

[00:29:22] Dino: If

[00:29:22] Craig: great.

[00:29:23] Dino: you and you many, you may not even know it, you may have malware in your environment or malicious activity going on and be completely unaware. we come across that, I know stats out there that 50% of orgs were breached in 2024. Those are the people that tell you.

[00:29:40] Craig: Oh yeah, for sure.

[00:29:41] Dino: Or they that know.

[00:29:42] Craig: And then there's many that don't know. The number is probably more like in the nineties, Yeah.

[00:29:47] Dino: as far as breaches go versus, half 50%.

[00:29:51] Craig: Great conversation, Dino. I'm hoping that organizations will take this advice. Continue to follow us. Look for additional podcasts coming out. Look at your own internal resources. They're there. The data is available. Use it. It's at your fingertips or available at someone's fingertips. Leverage us if you need to. Reach out, gotta start making steps. you can't just check a box, you gotta move forward, get better, period over period.