Cybersecurity Unveiled Through IT and OT Alignment

[00:00:00] Jim: Welcome to this podcast episode where Dino and I will be talking about, Dino, what are we talking about today?

[00:00:09] Dino: to, today we're going to talk about operational technology, ICS, cybersecurity talent,

[00:00:14] Jim: That's a good topic.

[00:00:15] Dino: looking for people, people that know how to, to operate within these control system environments and can secure and protect them.

[00:00:23] Jim: Right. I always find one, just explaining that to somebody. much less finding somebody that understands that's always a challenge.

[00:00:31] Dino: Well, ideally you'd like for These individuals that have, manufacturing background, an industrial background, which you usually find in engineering, operation facilities, types of folks. So if you're looking, to me if they went to college to be an engineer during their internship programs, they, probably worked at a plant for a period of time.

[00:00:50] Dino: So they have some exposure to an industrial environment What it looks like, what it means to be there, from a safety perspective, just from an operational perspective, you know, how things are made in centers, all the stripes of the plant floor. So.

[00:01:04] Jim: well, it's a great point because I mean, you know, I mean, it came from the I. T. side, right? So you're my exposure to this and over the past few years of working together here at Delta, I'm learning it from the I. T. side out going, holy cow, this is a whole thing. when we start talking about talent, then where do we get it from?

[00:01:20] Jim: What I found interesting is, and you know, these two people, one's my daughter, one's my now son in law, they're both chemical engineers, And. Somebody wants to know who they are. That's what LinkedIn is for. I'm sure you'll be able to find them, but the chemical engineers and they work on the, floor, And, they're always, calling and talking I'm proud dad, I'm going to brag about him, but you know, they're interested in trying to understand this stuff and they're running processes and they've been into our office a couple of times and we've shown them our lab and shown us some things and they're like, wow, nobody even taught us about this stuff school.

[00:01:51] Jim: And I mean, they're smart individuals, did very well in their class and they have their degree and they're running these processes and they don't know, they're like, holy cow, that's, that's how that stuff works. And so we're not even getting in and out of the engineering programs, much the cybersecurity programs out there.

[00:02:07] Dino: all right. Well, you know, the discipline is a little different, right? Because from the control system perspective, you know, the schools, that have cyber security programs are predominantly teaching that I. T. Side of the equation, The technologies they have, the solutions that they have, the processes on that side of the fence where on the plant floor, those processes are different, You got connected physical systems, Kinetic things that are driven by digital outcomes. So from an engineering perspective, they understand that because they're the ones that are programming those, PLCs or the ones that are developing SCADA systems. they're familiar with that machine's operation,

[00:02:44] Dino: Process. so from an IT perspective is how do you get them to understand that, get to that. Uh, that triad of confidentiality, integrity, availability, which is what the primary drivers are from a cybersecurity perspective for I. T. On the O. T. world, it's availabilities first, then integrity, then confidentiality, right?

[00:03:05] Dino: You just can't switch off a machine. because there's something bad going on, has a process to shut it down. If it's a furnace or reactor, those things have a series of events that you got to get them to a safe state. You just can't flip the switch and turn them off. You could damage the equipment.

[00:03:21] Dino: You can damage product. You can create environmental hazard of some sort where people can get hurt. The engineering teams understand that I T doesn't necessarily understand it because they don't work on the plant floor every day, all day, like these operational technology teams do. So how do you instill that understanding that group of people who are?

[00:03:41] Dino: Trying to help develop a cybersecurity, defensible architecture around that environment, you know, you just can't drop a firewall at the head end of the plant and call it a day. In many of the cases, you can't even run endpoint protection on a lot of those windows operating systems that are out there driving these machines.

[00:03:57] Dino: So in order for them to be successful. Both sides have to work together. It's really important. You want them to be aligned. You want them to be transparent and you want them to be collaborative. And that's always been one of the challenges because I. T. Folks, they're usually not even at the plant at that level, that caliber.

[00:04:14] Dino: When you're

[00:04:14] Dino: looking for a serious, well, certified firewalls, cybersecurity professional, chances are they're not working in that manufacturing site,

[00:04:24] Jim: Right, right. So, IT, OT, disciplines that we're seeing kind of caused the issue. Exists in the education that's out there right now, So we've got our engineering programs. They're still, training and producing and teaching the same way. And then we

[00:04:38] Jim: have their it cyber security programs still training educating in the same way.

[00:04:44] Jim: And the gaps haven't closed then you get to this talent issue and no wonder every time, you know, we're talking to, especially what's coming out of schools, both don't understand. So the gap that exists that causes the problem and has the issue for what we're looking at now, that's an industry issue, The whole IT, OT, competition here, or,

[00:05:03] Jim: convergence, cooperation, collision that we talk about, it exists in the actual training programs that are, there are out there now. And so you have to come from one side or the other and kind of. Venture the other way. So we've talked about this, So we've got to get, like you were just saying, the IT people have to understand. Well, okay, well, there's some similar technologies. There's some similar approaches, but if you use your technologies with your approaches, you're going to cause problems on the engineering side. You have to kind of wake up and go, Hey, you need to understand what's running those machines.

[00:05:33] Jim: There's some, pretty. Big physical health, safety, production issues, outcomes. If you don't understand and you're putting up an insecure system or a vulnerable system, what are some of the things we've talked about, attacking that at least from kind of the ground floor for like coming from a discipline, like, taking an OT person, do you develop the OT talent then, if they're coming from that side, because I think then we can talk about the opposite side of bringing the IT people over.

[00:05:58] Dino: Yeah, I mean, my experience traditionally it's getting O. T. People to learn networking and cyber security because they're already used to working in that industrial environment, It's hostile as it might be. And what I mean by hostile, it's just, it's dirty, it's noisy, it's dangerous.

[00:06:15] Dino: And it's got all these activities going on, it's the concrete floor. it's always been easier to, work with those groups because they know the, things inside the four walls of that plant and teach them some of these skills. I've seen this with networking and I've also seen it with security.

[00:06:30] Dino: It's much easier to work with those folks than it is to take an IT professional and move them the other direction and say today. Or for the next year, you're going to work in the industrial space or

[00:06:40] Dino: new job is not working for the CIO per se, but you're working for plant operations, plant management or engineering or whoever's responsible for those assets at

[00:06:50] Jim: right, right, you come from the OT side, so you're always going to say those guys are easier to train than guys over on the IT side where I come from. But I'm not going to disagree with you there,

[00:07:01] Dino: Well, it's done in the uniform, right? I mean,

[00:07:03] Dino: sometimes you gotta, you gotta wear the safety shoes and the hard hat and the high vis vest and the safety glasses and hearing protection, eye protection when you're out there on the plant floor, right? It's not air conditioned,

[00:07:14] Jim: Yeah. and Dina, I, I think that's a big part of it, got to live the life. You got to understand the four walls. You got to understand that environment you're working in. You got to understand, you know, what's, job one, but when you're working at a plant.

[00:07:25] Jim: What's

[00:07:25] Jim: job two is production, get it out the door.

[00:07:28] Jim: Right.

[00:07:29] Dino: Reduce unplanned, unscheduled downtime.

[00:07:31] Jim: That's foreign to, the IT realm and you coming out of there.

[00:07:34] Jim: Right?

[00:07:34] Dino: gets back to that

[00:07:35] Dino: availability versus confidentiality.

[00:07:37] Jim: Yeah. And so that gets foreign. I tend to agree in this space and where we are now, I think there's a lot of opportunity to go, okay, can we take people out of the, the operational floor?

[00:07:46] Jim: And, and I think part of it is generationally, if you think about it, You know, your engineers your operators now, they've grown up with computers, So they have some basic knowledge. They understand, they go, everybody's got one now. You had 10 years ago, you guys that were engineers, did they?

[00:08:02] Jim: Well, no, maybe it was introduced a little later in life, but where we stand right now. Your operators, or your engineers, or your maintenance managers, those guys, they already have a basic understanding of

[00:08:13] Jim: computers, but what they've got is they get that core of understanding what's going on in the four walls,

[00:08:17] Dino: yeah. You make a great point. It's an excellent point to that extent where you can start

[00:08:22] Dino: really

[00:08:22] Jim: course It

[00:08:23] Jim: is. I do, I always make a great point, Dina.

[00:08:27] Dino: it's time has come, right? Because in order for this to really work well, because again, culturally, you mentioned culture. Sometimes these organizations are very polarizing, right? They don't, mesh well together. And so it will stay away. You know, like I said,they will keep an arm's length distance away.

[00:08:44] Dino: Yeah. Okay. But when you start talking about cyber security, those people on the plant floor immediately going to point their finger at it and go, well, that's their job,

[00:08:51] Dino: Right,

[00:08:51] Dino: That's their responsibility. It's not my responsibility. And then when you look at the machine centers, you know, you start opening up those panels and you show the PLC's and those HMI's that are out there on the drives and the robots and AGV's and pumps and motor control centers and all these again, physical connected systems,

[00:09:07] Dino: IT will turn around and tell you, yeah, well, that's

[00:09:09] Dino: not my responsibility. And so if it's not yours and whose is it,

[00:09:14] Jim: right.

[00:09:14] Jim: Well, let's talk about that then from the it side. So we talked about like the OT group and that, like, I think generationally, culturally, you're getting to a point where they've got the core understanding of how that plant. And if they've got potential the desire to go into the space, I think.

[00:09:28] Jim: it's an easier transition, like you were saying, but from the IT side now, right? So how do you get the IT side over? And I'll open with a couple of comments and I'm going to say most, if not all. The career in IT, the only thing, most IT, and then you get down into cyber security IT, well, they're a little different.

[00:09:48] Jim: They're a different breed, finding the ones that got into cyber security and the IT, they're not the same people that are going to step on that floor. And they're quite frankly, they're probably the people that the guys on the floor make fun of. I mean, you always say they're going to go you with the sandals and the shorts and the hang 10 t shirt.

[00:10:06] Jim: Right. Get off my plant

[00:10:07] Jim: for your name and

[00:10:08] Jim: trust for it.

[00:10:09] Dino: not necessarily sandals and shorts, but not having the proper PPE on and being caught in the wrong spot.

[00:10:15] Dino: and being escorted out.

[00:10:17] Jim: Yeah.

[00:10:17] Jim: Yeah. Cause I mean, it's not often that they're sitting at their desk and their monitor might fall over and kill them. Right. So they're not, they're not looking for these physical things. You're walking, you're run over by a forklift or, the machine door opening or. the chains moving or just all the different things that could go on on the planet, but that's not, doesn't even touch the realm of somebody that's sitting in a cybersecurity. So then we start thinking about, well, it's cybersecurity and they're on the it side and. and you and I know we've interviewed kids and experienced people coming through here trying to find the right mix for us what we do. it's a different, especially with the cybersecurity, right? and don't get me wrong, there are cybersecurity roles out there. That are in, dire need that are very, very technical, They're very technical. They spend a lot of time in there and what we call screen time. They might even have 10 screens or one, you know, whatever that might be. a lot of that generation has gone and trained in cybersecurity. Think that's what all cybersecurity is about. And some that's where they should be, but trying to take those people and move them in the OT, I think is the wrong answer,

[00:11:18] Jim:

[00:11:18] Dino: Yeah, well, and I think what we've witnessed too is when you have that skill and those solutions on that I. T. side, what we've witnessed is them penetrating into the industrial arena, trying to do their due diligence, trying to do the right thing, want to do the right thing, but only to cripple the plant floor.

[00:11:37] Dino: So you have the inverse of I'm trying to do the right thing. It's like no good deed goes unpunished. And so here they are trying to do their due diligence and try to learn about the plant floor with the tools that they have. And these control systems, you know, are very sensitive, to X outside noise,

[00:11:52] Dino: outside pressure, so to speak.

[00:11:54] Dino: And so they will fail, They'll calm fault. They'll go safe. And all of a sudden I'm back to my problem, my number one and two problems. I got a safety issue and I've got downtime.

[00:12:03] Dino: You know, which is costly,

[00:12:05] Dino: and

[00:12:05] Jim: we've

[00:12:05] Jim: seen it.

[00:12:06] Dino: right? we

[00:12:06] Dino: see that everywhere we go all the time, right?

[00:12:09] Jim: Yeah. You and I have fought that battle on a couple of times guys on the floor are like, Hey, I mean, all this is further the divide,

[00:12:16] Jim: Right.

[00:12:16] Jim: It furthers the divide and says, you guys, I don't know what those knuckleheads are doing in there behind their screens, but all I know is our line shut down this week for a couple hours and they probably did

[00:12:27] Dino: They pushed out a patch, you know, or they booted a switch or their port scanning ping

[00:12:31] Dino: sweeping my control systems.

[00:12:33] Jim: so I'm going to, take that a little further now. So I said that, like, that's a big group of cybersecurity, people that think that's cybersecurity. And a lot of people that are in cybersecurity think that's what cybersecurity is sitting behind the screen and looking at that stuff. But if we're trying to get somebody out of there. just like we talked about in the OT guys kind of come come across and trying to get the IT guys to come across. I can't get my arm around this come across So that they can meet in the middle. of the struggles that I see is. there's a lot of, people going into cyber security and think that, they think that's what cyber security is and they think, Hey, I at least didn't get a job, but there's nothing out there.

[00:13:10] Jim: Well, I shouldn't say there's nothing It isn't as evident. Out there that there is this other discipline, And it should be another discipline, quite frankly, how do we find a way to go, Hey, are you interested in cyber security and like to wear steel toe shoes because We got a great job for you, right?

[00:13:29] Dino: Well, to me, comes back to the ecosystem of suppliers in this space, The OEMs, the system integrators. So you can take the big ones like Rockwell and Siemens and Schneider and Emerson and GE, and then you get into those specific OEMs that build those machine centers. they're going to have to start bringing a lot of these tools and technologies and services through that channel because they're the group, they're the trusted advisor that the OTP people buy from, right?

[00:13:56] Dino: when they start speaking that language, and I'm talking about their trusted advisor who that manufacturer buys from, they're going to have to start bringing this conversation to the table, They're going to start putting some of these tools in the equipment that they provide, and they're going to have to start working through a bigger, broader view of what kind of safety and security measures from a cyber security perspective.

[00:14:16] Dino: Do you have in your plan,

[00:14:17] Jim: again, you bring up a, an interesting point, and we hadn't even thought about this. I know we talk about this all the time, so there's engineering schools out there, And Rockwell and, and Siemens and those guys, and Schneiders, hey, all the other guys are providers and they probably put stuff out there for those schools, For

[00:14:30] Dino: Yeah. Sure, they absolutely do.

[00:14:32] Jim: We need to get that same thing over into the Compsci cybersecurity program,

[00:14:37] Jim: so Rockwell, if you're listening, you know, give us, give us a call. We got a couple of programs we can talk to you about. at least right now, today's generation to find out that that is an option, Why isn't that connected at the school level? Because I'm sure they're funding at some level. I mean,

[00:14:54] Jim: we don't have the Rockwell money yet to fund the cybersecurity, but

[00:14:57] Dino: and they provide their technology to the schools

[00:15:00] Dino: Rockwell does, you know, they give them PLCs and SCADA software, for their engineering programs, Purdue and Rolla, I mean, you can think of some of the big engineering schools that, participate in these programs. I haven't seen that cybersecurity piece as a part of that,

[00:15:14] Dino: right?

[00:15:15] Dino: and right now, when you look at those cybersecurity tools, what are those? That are specific for the O. T. space, And it's not that any of these companies own that just yet, right? These are still independent organizations, software companies, you know, dragos, the zone, the clarity, armistice, what have you, with it.

[00:15:31] Dino: Are part of this ecosystem, but right now they're not really attached to any of those automation technology vendors. They are partners. Don't get me wrong. There's been investment. Don't

[00:15:41] Dino: get me wrong. But, you know, getting it into the university level, like that executive from the meeting that I had on Monday was asking that specific question, right?

[00:15:49] Dino: Is this happening?

[00:15:50] Dino: and the short answer is not in a broad brushstroke, it's not,

[00:15:54] Dino: you know, there's some smart folks that figured out we need to do this and they've started, but we got a long way to go.

[00:15:59] Jim: interesting because it's always like, well, what are the schools focused on and how long does it take them to respond to what the demand is out there? I think the demand is just opening up where we're, like you said, these companies are saying, where do I get talent? And it's like, well, the schools are, they really got to build programs unless they see a bunch of open OT cyber security jobs out there, or, what is a chicken before the egg? You know, I think got to kind of attack it from all sides. that'd be interesting. One of the other things that we've been talking about schools up. And even though the OT side probably has some experience training, like we said, you could have a few years and come across, but what about, even Kansai? talked to a couple of groups that, were retraining in the cyber security, I can't remember. We don't need to talk about who it was. And some of them, it was really interesting because They were getting into cyber security and they're doing retraining and they were doing that because they like technology and like the job. But we talked to a couple of them that were like, holy cow, this sounds better because, you know, I worked in a warehouse or, you know, I was doing tool dive before this.

[00:17:01] Jim: I understand that and that would be really cool to put it together. So I think that's an opportunity. And then, then there's the other yet should individual companies be hiring them? I mean, what's the challenge there for a company that's going, okay, uh, we need one OT security guy. what do you think the challenge is there?

[00:17:21] Dino: Well, from a manufacturing perspective, most manufacturers just generally speaking, have multiple plants in their fleet, right? And when you, And it's not just one You need multiple, Because each manufacturing facility is different. You know, no one plant is one particular automation technology product.

[00:17:38] Dino: You know, you're not going to find one plant that's 100 percent Rockwell per se, or 100 percent Siemens. And so there's a blend automation technologies in there. And then as you go across different continents, different countries, you're going to find different groups. Cultures. And what I mean by that is just the way that they operate.

[00:17:56] Dino: So how are you going to, determine, manufacturing facility here and how you secure and protect what's going on in that is not going to be the same, way you're going to deal with the plant, let's say in South America.

[00:18:07] Dino: That has a flat network. it's untrusted compared to one.

[00:18:10] Dino: That's maybe a little bit in North America might be a little be designed different hierarchical design. You know, they've created V lands. They have micro segmentation. So the security practice will vary by zone by region by company, Even in the same company. And I think that's where a lot of folks tend to miss because it tends is more standardized,

[00:18:33] Jim: Centralized versus decentralized. And the plants are very decentralized in the way that they're set up and structured. Well, you know what, that, that point actually kind of lends itself to taking somebody from the OT side, right? an individual company is trying to. shore up their resources to build some skills and capabilities. Then, and you and I have talked about this. We think there needs to be somebody at the plant, just like there's a safety

[00:18:57] Jim: manager.

[00:18:58] Jim: There's a, a cyber ops manager. And is it a full time role or is it somebody's role and responsibility in whatever they might do? we've gone through this, so that would be interesting. And I think of a company's trying. To do that, my, my opinion would be, okay, I got some plants out there.

[00:19:14] Jim: I need to have somebody at that plant. They don't need to be the expert about all the cybersecurity and the threat, but they almost need to be a cyber ops. They need to understand how everything's connected and working behind the scenes at their plan in the network so that they can work with somebody. From the right.

[00:19:33] Dino: Yeah, treat it like safety. Like you said, somebody, there's a few people or a group of people in a manufacturing facility, again, size and scope that has safety responsibility, right? To make sure that the training materials are there.

[00:19:44] Jim: from a company perspective, manufacturer, critical infrastructure, and they're looking for talent. you and I have talked about this, how we think it's, more important to have something at that facility level at each individual facility, Whether it's a role like a cyber ops type of role. you and I have talked to, it's almost like a safety manager,

[00:20:01] Dino: if you think about all manufacturers have a person or a group of people who have the responsibility for safety. to making sure that new people coming on site, whether it's onboarding or, visitors, guests that are coming into work, go through safety training before you get on the plant floor, make sure you have on the proper PPE based on the environment in which you're working in our facility, where to go, if an alarm goes off.

[00:20:23] Dino: mustard points around the plant, hazardous material shipping in and out of the facility. it's a very similar role. These folks have other jobs. They have normal jobs, but they also wear that particular hat around safety. I think that will be the way that this will be done in the manufacturing space around cybersecurity is there will be one or a few people assigned.

[00:20:42] Dino: That cybersecurity role. So if you've got a new machine center coming into your plant, let's say you're putting a new packaging line in, and you're working with the engineering teams and the OEMs, there'll be those questions around what kind of security cybersecurity measures controls are going to be in this new machine center that you're bringing in.

[00:20:58] Dino: Am I going to have collection servers to collect metadata at certain pieces of this plant that I can feed to my OT IDS platform that I have that's either on print here. At the plant or in the cloud, and other practices around that. And when you connect in, it's like, when you connect into this environment, what do you need to see, what's going to talk to this new machine center, and what's it need to talk to,

[00:21:19] Dino: I would say Dino, even more basic than that, The engineers, right? The SIs that are coming in there and plugging their laptops in.

[00:21:26] Jim: right, Who's in charge of saying, Hey, is that thing clean?

[00:21:30] Jim: right.

[00:21:30] Jim: What do

[00:21:30] Jim: you,

[00:21:30] Jim: plug it into my

[00:21:32] Dino: Well, right. And you know this, if we go into 10 plants, eight of them will let us take our laptops and plug it right into their network

[00:21:38] Dino: and nobody scans our machines. Nobody's making sure that it's not carrying any malware on it.

[00:21:42] Dino: They're not making sure that I'm not connecting to something else in their plant, you know, instead of the, where the area of worship where we're supposed to be working, we see that with remote access to,

[00:21:50] Dino: since COVID and even prior to that remote access to these environments is typically free and unfeathered once I gain access into the environment,

[00:21:58] Dino: once you're in, you're in, you know, and if I'm supposed to be working on, packaging line one filler. But yet I can see packaging lines 4, 5, 6, and 7, and I can see utilities, and I can see the mixing and blending vessels, and the AGVs that are on there. If I have access to that, just demonstrates the lack of cyber security within that facility.

[00:22:19] Jim: Yeah. we got to wrap it up here. I'll give my, what I think summary, we wanted to talk about, well, how do you get talent in this space?

[00:22:27] Jim: ultimately part of me would say.

[00:22:29] Jim: Yeah, grow

[00:22:29] Jim: it, I was going to say, build it right.

[00:22:31] Jim: You got to build it and you got to think about where you're coming from. Are you coming from the it side? Are you coming from the OT side? It's not like you're going to find something in the middle and you really have to think about, well, what are you trying to do if you're, a big OEM like a Rockwell, I mean, you guys gotta go build it. you gotta go get down into those, schools and programs and try and build that up. But if you're a client, think from that OT side, Cause you can always go out and get those experts, but nobody's going to know that facility and your product or your production better than you are, and so try and grow them that way and try and meet these things together,

[00:23:04] Jim: without looking for that unicorn that just doesn't exist,

[00:23:07] Dino: I mean, it's almost like going back to networking 30 plus years ago, right? We didn't have the talent to build the enterprise class data center cloud when campus networks 30 years ago. And when companies like Cisco Systems were coming out with their switching routing platforms of that caliber in class, right?

[00:23:28] Dino: They had to grow them. And now, now you look at the tech schools and you look at the universities programs that they have for networking classes, right? And the certifications that you can get for them, and it went looking for that talent, right? So when they were hiring somebody, they were looking for that, that background and experience working with, with Cisco systems.

[00:23:47] Dino: It's the same thing that they do on the plant floor. If you're looking for a Rockwell guy who's really good at programming PLCs, you know, you go to an engineering school where they do that. You'll find that But what you're not finding right now are folks that have an industrial background that are also cybersecurity professionals.

[00:24:05] Jim: right, right. So you have to assemble it together and recognize what kind of world we're living in

[00:24:10] Jim: and and build it from your perspective,

[00:24:11] Jim: whether you're coming from the provider or you're the actual end manufacturer, put it together. Well, this is good. Hopefully, everyone stuck to the end and enjoyed it as much as Dino and I did, because we never know where these things are going to go. so, appreciate everyone listening in

[00:24:27] Jim: and, look forward to, talking and catching up. again, Dino, thanks.

[00:24:32] Dino: Thank you.

[00:24:32] Dino: Bye.

[00:24:33] Jim: Bye now.