Plant Floor Cybersecurity Starts at the Top. Not the Server Room, with Robert Maxwell

Robert [00:00:00] because cybersecurity has a technology sound to it, and the mouth from which it is most often heard is a technology person's mouth, it becomes synonymous with a technology problem. Whereas in fact, I'd say 80% of it is not a technology problem, 80% of it is a management problem.

Intro - Outro Welcome to the Industrial Cybersecurity Insider. In each episode, we dive into the world of industrial cybersecurity. Join us as we cover the latest trends, innovations, and practical insights as we talk with leaders and practitioners across the industry. Gear up and let's get into this week's episode.

Dino Hi. I'm Dino Boukalaki with Industrial Cybersecurity Insider, and today I have as guest, and his name is Robert [00:01:00] Maxwell. Welcome, Robert.

Robert Thank you.

Dino Thanks for joining our podcast today. So why don't we begin, uh, your journey into the cybersecurity space? I think you've been at it for quite a while based on what I've seen with your background.

Dino So why don't you kind of give our audience a, just a brief bio on Robert Maxwell.

Robert Thank you. We've been out here for about 30 years now, myself and my team from TGT. We've done considerable work in terms of helping to build applications, helping to improve processes. Our focus is on helping organizations to profit through technology.

Robert And about, I'd say, nine years ago, it really came into focus for us that it's nice to build great things, but you better be protecting the great things that you build. And our clients asked us to start thinking about helping them on the cyber side, and we got very heavily into it, and we realized that more than ever, [00:02:00] clients need help in terms of thinking about and managing cybersecurity.

Robert And we jumped wholeheartedly into it, and we have not regretted the move. we've... Every client that we've met, we've been able to offer some kind of comment Some kind of technology, some kind of process change that has helped to make them just a wee bit more secure, and that's what we're all about.

Dino Yeah. We always say try to get better every day, right? Every day try to get better. Yeah. So what do you think some of the biggest challenges are in the, the cybersecurity world?

Robert Without doubt, the biggest challenge is management's thinking about it. Most senior managers that we've met, whether it's a very large organization or a micro-business, automatically think this is an IT issue, and that's the first myth that we try to bust.

Robert It's not an IT issue. It's a management issue. [00:03:00] There is a business risk in terms of the culture of the organization, in terms of the posture of the organization, in terms of the thinking, the planning, the way resources are allocated, and until management and the leaders recognize and address this, they've got a problem in our view.

Dino Yeah. So, so do you think that they're pushing it off to IT and just letting them try to figure it out? I mean, in our world, we see that as, as a struggle because there's a gap between IT and OT, right? And it's, it's just because the responsibilities at the end of the day are very, very different.

Dino And, um, and there's an OT ecosystem, as I like to call it, that includes OEMs and system integrators and, and all of the, the folks in the OT space, which is plant management and production and operations and engineering and facilities, that, that sometimes march to a different drumbeat, right? In their day-to-day activity, the technologies that they're responsible for, and, um, and you're right, the, the management [00:04:00] looks at it, I think, more, more micro versus macro for their entire organization.

Robert Our observation has been that because cybersecurity has a technology sound to it, and the mouth from which it is most often heard is a technology person's mouth, it becomes synonymous with a technology problem. Whereas in fact, I'd say 80% of it is not a technology problem, 80% of it is a management problem.

Dino Yeah. I, I say people, but yeah. It's not, it's not a technical, it's a people problem. That's correct. Yeah. Yeah. So, um, so what kind of businesses... Uh, so have you been close to working with manufacturing clients? Have you, have you had to work with manufacturing clients?

Robert We have done some manufacturers.

Robert We've done lots of small and medium sized businesses. We've done lots of financial institutions. But wherever we go, the problem's the same. Management is busy. The leaders are busy. They [00:05:00] don't have time to think. So when you say to them, "You gotta sit down and think about this," they're like, "No, I'm already full up.

Robert Just give it to IT, they'll take care of it." And we try to advocate, no, the very first thing you need is a person who has responsibility, overall responsibility for thinking about security. And we don't believe the person has to be overly technical, they just have to take ownership. Ownership is the key word.

Robert They need to take ownership of thinking about it and pulling together the people necessary to make it work.

Dino Yeah. so what are some of the strategies that you use to get them to, to appoint that person, or the tabletop exercises? What kind of conversations do you have to broaden this throughout that organization, broaden the topic of cybersecurity?

Robert we tend to start by saying, we need someone who's got a sense of follow-up and follow-through. [00:06:00] Cybersecurity more than ever requires a lot of follow-up. You need someone who's good at asking politely the same thing 20 times over until it's done. You need a person who wants to take all of the pieces, like a jigsaw puzzle, and put them together.

Robert So we tend to have those kinds of discussions with leadership about, first of all, appointing one of their rank to have that kind of role. Then we proceed to educate them. There's a lot of time spent in explaining what it's all about, where they need to start, and how they need to just create a global organizational type thinking about the challenge.

Robert That's where we like to begin. Not in the nuts, not in the nuts and the bolts, not in the brand of technology you've bought. We're s- we're a Microsoft shop, we're a Cisco shop. That's nonsense. It's much more about the who has the overall picture, and like a jigsaw puzzle, they're gonna build it out piece by [00:07:00] piece till the organization feels like it's thinking about protection.

Dino Yeah. But one of the things that one of my colleagues likes to say, especially when he talks about CISOs when it comes to this in the OT space, is they have the responsibility, but they don't have the authority. And that's... and to your point of,uh, selecting a person, which obviously could be a group, we've, we've seen some of that, right?

Dino Where they're, they're bringing, you know, certain individuals to spearhead this OT cybersecurity. But the challenge is, is that it's too small of a group. Meaning that if you've got 30 or 40 or 100 plants in your fleet, one or two or three people aren't gonna get it done. You, you need dozens and dozens, right?

Dino To be able to, to really fully, develop your strategy and implement it,

Intro - Outro right?

Dino and educate, right? To the people, because you have to get into these other, groups within your, your OT space in [00:08:00] manufacturing, whether it's production, operations, engineering, QA, facilities, your OEMs, your system integrators.

Dino There, there's a lot of players in the space, in my space, when it comes to manufacturing of the devices, the sheer number of assets that you have in a manufacturing facility, some of which are old. You know? I mean, the plant floor, um, uh, assets can, are measured in decades, right? Not three, five, seven years like you might see in the IT space.

Dino I can have control systems out there that are 20 years old, and we find that on a pretty regular basis. I mean, we still find Windows 7 machines, you know, running, running the HMIs out on these plant floors on a, on a piece of equipment that's 30 years old.

Robert One of the things you asked earlier was about how do you approach it, and it's about sharing with management.

Robert It's got to be their responsibility. If they don't take ownership, it just doesn't get done well, it doesn't get completely, done [00:09:00] completely. It just doesn't get done right. So it's about helping management to realize it has to be someone who has reach across the organization. It has to be someone who's understanding the term journey.

Robert It's a journey. You can't do anything in a single moment or a s- with a single swipe of the pen to create cybersecurity. It's a journey. you really have to think of it as an investment. We very much advocate investment thinking in terms of assessing your investment, mapping out your strategy, and filling it in piece by piece over time.

Dino Yeah. So are they, are they always looking for an ROI on that investment?

Robert Yes, they are. And we advocate that the first bit of ROI they have to look for is education. You've got to get some kind of cyber awareness- Product in my mind into the hands of [00:10:00] many people so that you're getting the whole organization to be thinking about cyber.

Robert And that's not an expensive proposition usually compared to the other costs that are incurred.

Dino Yeah. Well, and, and, and, and it's also been kind of minimal, too, right? I mean, most of the s- the cyber... To, to broaden the cybersecurity messaging throughout the organization, the only one I've really ever seen is the phishing emails, right?

Dino And, and, and, uh, you know, the, the, the trying to set up setups to, to, to get people to recognize good emails from bad emails. but I mean, that's been the extent of most organizations as far as carrying that message more broadly, you know, versus it being in a, in a specific silo in your organization that's, that's responsible for, uh, cybersecurity, you know, and what I've witnessed.

Dino Because if we bring up cybersecurity and the work that we're doing in a manufacturing environment, the OT guys will immediately point their fingers and say, "That's IT's problem," And they, they do. It's, it's a, [00:11:00] it's the easy button for them, right? and then when you really start talking about even IT organizations that are trying to bring a cybersecurity strategy and solution in- into the manufacturing space, specifically around the control systems, they do everything they can on the OT side to keep them away from the things that are critical that actually make the goods that they make in that plant.

Dino And,

Robert and here again, there's a lack of just general awareness, which is why it's gotta start with education. And to your point, it's not just about phishing emails that education needs to occur. It's about the whole frame of thinking. People can respect when you educate them. People educate the points you're trying to make to them.

Robert So there's, there's got to be a plan in terms of how you share with people the risks, and how you plan to go about addressing the risks, and it's gonna take time

Dino Yeah. So what, what have you witnessed on, on the flip side for those people that just ignore it, or just they can't move forward, they can't get, uh, out of their own [00:12:00] way.

Robert We see on several occasions where people get hacked, and it's not pretty. We've seen, we've seen firms wiped out because they've been hacked, and they just had... They had no plan. They had no consciousness of what to do. They could not react with speed, and these things do require speed. And as a result, the hacks usually tend to be quite catastrophic.

Robert And at that point we're saying to them, "Look, these are things you should do," but as usual, all of these things take time. We've seen people who... we've been in a conversation with senior management where the CE had, the CEO had to ask, just for a moment, he stepped aside and he's come back and he, he got back on the line and he said, "We've been hacked."

Robert And of course we jump right in and we try and help, but many times it... he was very fortunate, but in many cases, by the time they realize they've been hacked, there's just not enough time to be responsive. So that's why 99% of the effort has got to be [00:13:00] on preventing the organization from being hacked, on making- All people first, and then all systems bit by bit sufficiently resilient that the hack does not occur in the first place

Dino Lee, do you feel that there's any external, actors, and I'm not talking about bad actors, but external, organizations or groups that are hampering this, s- strategy being successful moving forward?

Dino W- I, I guess what I'm trying to say, is there... I'm, I'm gonna go with consulting groups are, are the ones I'm gonna throw out there, is do you think the consulting groups are doing a good job or a bad job trying to help their, these organizations out?

Robert A terrible job.

Dino Yeah, I would agree.

Robert Because most of the time vendors tend to pus- push the message, so they're pushing a product at a particular point in time at a discounted price, and that is not the way that an organization needs to be approaching cyber.

Robert Yes, I respect the fact that every [00:14:00] business wants to make a sale, but the organization cyber goes way beyond a particular vendor, a particular product. There has to be a much more holistic discussion. And as I said, it takes a lot of time. It starts with education. it's, first of all, it starts with appointing someone and giving them the power, and then it starts with education after that.

Robert And it takes time to build a strategy out. And sometimes the place where attention, if you think of a risk-reward approach, the area that needs most attention doesn't perhaps need a product at this minute. That'll come down the line at a, at a different time. But you can't be focused on the vendor, what he's pushing, or the consulting firm and what they're pushing this week.

Robert There's gotta be a holistic approach about it.

Dino Yeah. Yeah, especially, again, I, I'm going back to manufacturing 'cause that's kind of my world, is tho- they're not, they're very decentralized in the technologies that they have, right? You know, most IT groups [00:15:00] have done a really good job of standardizing with the technologies that, that they've chosen, right?

Dino Whether it be their infrastructure, their network, their databases, operating systems, computer hardware platforms. But when you get into the manufacturing space, it can be a wide range of things. Rockwell, Siemens, Honeywell, GE, Emerson. Stuff they bought in Germany, Italy, South America, odd and end pieces and, and, you know, and you can walk into a plant and there could be, you know, 5,000 assets in there and, you know, 50% is Rockwell and the other 50% is broken up on, across a dozen or more different technologies in a plant, right?

Dino And so appointing that person, they really are g- would have their homework cut out for them 'cause, you know, y- to your point, you gotta think globally, but you gotta act locally.

Robert Locally. but until you have that person who has the overall responsibility,who's commissioned to wake up every day and [00:16:00] think about how we're protecting the whole organization, and until they're empowered to then go appoint people on a per plant basis or to address specific types of problems, until you've got that person, the person who actually does the work has no protection, has no proper mandate, has no team to back him or her, and can't do the job well.

Robert So you pointed out, there might be a firm with a h- an organiz- a, a fleet with 100 different plants, and you know that you're gonna appoint one person. That person needs to focus on their job. They can't be focused on worrying about what other parts of the, the organization need attention or, "Am I gonna get fired because I'm gonna show this particular person up?"

Robert Somebody else needs to be doing all of that. They need to be focused.

Dino Yeah. and if you look, you know, you think of a CISO, right? Again, typically responsible for cybersecurity. The a- the average tenure of a CISO is, like, two years, I mean, they're not even, eh, [00:17:00] meaning... And a lot of them, because they'll, the, they don't have the influence and the authority to really drive the change and/or have the money that they,to really go after it, and so they're like, "I'm not gonna be hung out to dry.

Dino I'm out of here," right? And then, then move on. And, and to your, to your point, you know, assigning somebody that, that role, it's almost like, what would you call that person, right? I mean, is, it's, what, i- they, reporting to the CEO? you know, reporting to the board?

Robert Well, I, I'll, I'll share with you the very first thing I would not do is to call them a CISO I would not do that because that, that, that immediately is too limiting.

Dino Yeah. Well, and, and, and as I've said, w- we work with some of the largest manu- manufacturers in the country. We never get phone calls from CISOs, Robert. They, they don't call us to find out how we can help them b- while we're working in their plants doing tens of millions of dollars worth of business with them every [00:18:00] year, designing and building and implementing machine centers and control centers for them.

Dino That includes infrastructure, that includes network, that's automation technology, a bevy of, of technologies that we bring in, that there is no influence from IT at all in that work. Rarely, and so I've always taken the position I don't think that they really care. That I don't think they believe it's their responsibility to figure that out.

Dino Maybe I'm wrong.

Robert I agree with you. No, I agree with you. Based on everything we've seen, not just in manufacturing, but in every other industry, I fully agree with you. They don't see it as being their role.

Dino And if, and if, and if you're, and if you're coming at it from the OT side to, to at least bring it up, sometimes those folks will actually kind of shut the door.

Dino You know? It's not like they don't even wanna engage. It like they think they got it figured out, and my, my thought process is, well, if you got it all figured out, then all the safeguarding that needs to be done, what... And you have a solution and a strategy in [00:19:00] mind, then it should be bleeding through these RFPs that are coming out for us to respond to on the requirements to provide improving your, and hardening your cybersecurity posture.

Dino And we never see any of that stuff.

Robert and now to dovetail that back into a comment we made earlier, when speaking with senior leadership, whatever ch- they choose to call themselves in an organization, unless and until cybersecurity is a priority and they've appointed that person, and that person is given the responsibility to think organization-wide globally about how we're going to build our defenses over time, it cannot be an overnight job.

Robert It cannot be a this year job. It's a multi-year, multi-plant, multi-person effort. So that's... Until that mandate has been created, then most organizations are just treading water, in our opinion.

Dino Well, let me throw a monkey wrench at this [00:20:00] thing. let's talk about AI for a second, right? Which I think is either gonna be the driving force, meaning that you better get...

Dino You, you have to get your cybersecurity situation figured out, the things that we're talking about, before you can be really successful with AI.

Robert Agreed. Do

Dino you think AI is gonna get in front, or is it gonna be the driving force behind this, Because to, to be successful, I think, is to moving forward and leveraging tools like AI, you have to have your cybersecurity stuff pretty well buttoned up

Robert And most people, unfortunately, don't see the twinning of AI and cyber.

Robert Most people think of them very independently, and regrettably, different organizations are being created to deal with it. So the CISO is being told, "You're, uh, you're cyber." AI, unfortunately, is already in place in many areas without the, the management team even knowing that their people are engaged in AI [00:21:00] and using large language models to do many things.

Robert So we've got this dichotomy that has occurred and first of all, there's a need to bring them back together, as you've just commented, but more importantly, there's a need to recognize that even more defensive posture now, even more of a defensive posture is required if you're going to engage in AI.

Dino No, I agree with that. You know, and ag- again, back to my earlier points, we just do not see a lot of, uh, safeguarding requirements coming at us from being a, a supplier on the eco- OT ecosystem to these manufacturers on what should we be using. Should I be putting cybersecurity sensors and collectors in these machine centers?

Dino And what stripe and brand should I be using? Because you're using Cisco Cyber Vision or using Claroty, you know, using the Zomei, whatever you might be using, uh, if you even have it, you know. Because we're, we're developing plans to where, in our proposals to respond to what I call the, the, uh, the [00:22:00] five critical controls for OT, and that is, incident response, remote access, vulnerability management, right?

Dino Defensible architectures. Just those basic things that if the client can't provide that for us during project execution, then we're gonna do it for ourselves while we're working for the next six months, year or two, it, in order to help ourselves if the client's not gonna help us out. If they're not gonna do it, then we need to do it ourselves.

Dino Bring our own platform in. The data belongs to us for the work that we're doing, and when we're done with the project, we're, we're taking our tools and the data and we're leaving, unless you wanna buy it, you know? Or if you have the platform and the tools, well, then, let's leverage yours then, can you demonstrate to me that you don't have malware in this plant?

Dino Do, are you continuously monitoring all these OT assets in here? I know the answer to that, because if you were, you'd... Again, you'd be putting that stuff and laying it at my feet to make sure that I'm watching for that stuff, and here's the tool that you're gonna use to keep an eye out [00:23:00] for these 30 HMIs that you're bringing in, and these three, uh, applicational servers that are running, um, app- OT applications, and historians, and the, the 40 PLCs, and the 20 switches.

Dino all the technology we're bringing into your plant, how do I know, you know, you don't have any known exploitable vulnerabilities on this piece of old equipment that you bought in Germany that's, that I've got to integrate to, you know, to get this packaging line up and running.

Robert To add to what you're just saying, many devices already collect and share data, but most IT departments just aren't even aware of the data that's being shared.

Dino Yeah. But they're not continuously monitoring, though. My, my experience in most manufacturers, I've yet to see one that's got really 100% visibility throughout their entire plant, much less their entire fleet. I mean, with... I'm talking major manufacturers. Like, we still got OT people pushing back about putting anything out there that would be collecting that information,

Robert and now to your point about AI, just dovetailing the two, [00:24:00] the promise of AI is to collect and interpret all of this data, but most people don't have the safeguards necessary to share that data with a large language model. Most people don't have the safeguards necessary to protect other people from then accessing their proprietary data.

Robert And worst of all, most people don't have a clue what people can do with this data to gain access to their organization. It's, it is scary.

Dino Yeah. And, and, and I'm talking, we can talk to the, even the Fortune 10s, you know, uh, that have the deep pockets, have these groups and these programs in place, are still not at that level, in my view.

Robert Because they don't have a single person who's been given overall responsibility for cyber. They've got these, as you've commented, siloed people. They've got these people with very limited mandates, and- un- unfortunately, [00:25:00] it's going to create a very large challenge for us

Dino Yeah. It, it has been. I mean, I've, I've been watching it, uh, for a few decades.

Dino More- last 10 years, really hard, and I, I, I still have yet to see an organization that's really got it figured out, and we work with manufacturers every day, all day, you know?

Robert one of the things I'm hopeful is that as leaders listen to conversations like ours, they at least begin to ask some questions.

Robert that's the biggest hope we can have, that leaders begin to become aware and ask some questions, because then it gives us the opportunity to share with them, "Here's why this matters to your future profitability." It all comes back to profitability. Great that you've got a great product right now, great that you're on a run and the product's selling, but understand that if we're not thinking about these things way ahead of time, there, there's a chasm up ahead.

Dino Yeah. And, and I don't think that the [00:26:00] government is gonna help. I mean, the regulations are kind of, toothless i- in my view. Now, I will say Europe has done a better job with their cyber re- cyber resiliency act because of some of the things that they're mandating, even ... And even though they're, it's over in Europe, we as an OEM, as a manufacturer, are having to meet for equipment that we're sending overseas, to clients that have to meet certain audit requirements and a- asset inventory and vulnerability knowledge, to that stuff that we're sending overseas, so at least they have s- a starting point.

Dino But here, you know, certain regulatory groups, you know, pushing whether it be in the power industry, th- few in far between rail, transportation, you know, they, there are some requirements out there for them, but even then they, they thwart most of them. They don't really follow through well. they don't stay on top of it in, in our, in our, in our

Dino in, from my perspective, but Maybe it'll change. I don't know. I said, "I think maybe AI will be the thing that'll kick 'em in the butt," but

Robert But I think it's too late when AI kicks you in the butt.

Dino [00:27:00] Mm. Oh, yeah.

Robert It's way too late at that point because your data has already gone out the door.

Dino Yeah, and if you're thinking AI's gonna be your competitive edge...

Robert No. No, it's not. we think AI begins to undo much of what they've done, which is why I keep commenting that the conversation starts at the most senior levels of management and helping management to recognize you have to have the conversation. You have to have one of your... We know you're busy, we know everything about how tough life is, but you have to appoint one of your rank.

Robert Give them authority to educate, to work with the rest of the organization, because the number of holes that exist, we don't have enough fingers to fill those holes.

Dino Well, and you have to wonder where those, those people go to, to drink from the fountain of knowledge, because, I mean, there's a lot of events that, both on the manufacturing side and on the, on the IT side, but the person that you're talking about and that role that they need to play, you know, where, [00:28:00] where would the CEO go to even, to begin this journey, right?

Robert I think he goes to one of his own people that he's trusted, one of his own people who has credibility in the organization, one of his people who's got a strong sense of follow-through. There's a lot of follow-through required. This is not a once and done. This is a, "Okay, we did this today, we're gonna do this tomorrow."

Robert And they've got to remember there's lots of nefarious actors out there. For every organization out there, there's dozens if not hundreds of people thinking and plotting about how they're gonna break into the organization. So if you don't have an equal or greater number on the inside trying to protect the organization, it's a function of time before something calamitous happens.

Robert Yeah

Dino Oh. Well, uh, as we wrap up here, is there any, any conversation you wanna have to, with our audience? Something that we may have not have covered that you'd like [00:29:00] to cover?

Robert I'd like to emphasize the need to think of cyber as an investment. Too many leaders are thought, too many leaders are taught to think about cyber as a cost, as an expense, and a trade-off between it and another investment that's on the, on the floor.

Robert We need to help leaders to think about cyber as an investment, an investment which, one, makes progressively, one which is expected to pay dividends over time, one which is worth their while. it has to be one of the top investments that any large firm makes in the future.

Dino Yep. All right. Well, thank

Robert you.

Robert Thank you.

Intro - Outro Thanks for tuning in to the Industrial Cybersecurity Insider. To stay up to date with our latest episodes, be sure to click the follow or subscribe button now. And if you found this podcast helpful or have a topic you'd like us to discuss, please leave us a review or let us know. [00:30:00] Thanks again for listening.

Intro - Outro See you next time