Innovation, Regulation and Education in ICS Cybersecurity with Nozomi’s Danielle Jablanski

[00:00:33] Dino: Hi, DJ. Okay. My name is Dino Busolaki. I'm the chief technology officer for Velta technology., and today we're meeting with DJ. I'm gonna let you say your last name. I think my last name is difficult. So yeah. I'll let you introduce

[00:00:48] Danielle: yourself. Sure. My name is Danielle Jablanski. I often go by DJ, and I'm an OT cybersecurity strategist with Nozomi Networks.

[00:00:56] Danielle: Yeah,

[00:00:56] Dino: and actually, that's one of the first questions I wanted to ask is so what is that role at Nozomi as an OT cybersecurity strategist? Because A lot of the, , the partners we work with in this space, I'm usually dealing with the engineers , the selling teams, , some product development, but, , not that I haven't met anybody in your role, from one of these vendors that supply

[00:01:15] Danielle: it's definitely a unique role

[00:01:17] Danielle: I'm more of a horizontal facilitator. So I do anything from industry, go to market strategy, awareness. Translation between technical capacity and , customer facing problems or challenges, high level kind of board level instruction on what is O. T. Why do we care? And then a ton of government relations.

[00:01:33] Danielle: So helping a lot of the regulators out there understand what's different about O. T. Is it that different? Can you still use I. T. Security tools to actually navigate O. T. Security challenges? if so, that's great. If not, why or why not? So all of those kind of broad Puzzle pieces that are out there right now when it comes to I.

[00:01:49] Danielle: T. Versus O. T. I kind of help to put together for different teams in various ways.

[00:01:54] Dino: So when you talk about the I. T. and the O. T. teams, can you kind of give us an idea of what you've witnessed or experienced in those relationships between these 2 groups that have , a role to play in hardening that control system environment and the relationships between these two, be interesting to hear your experiences and what you've witnessed in some of these conversations between those two groups.

[00:02:17] Danielle: Yeah I've seen a lot of context on this question specifically that's out there already. There's a lot of good resources for this. , but one of the challenges that really bothers me is that we still see a lot of silos. And silos, regardless of the department or team, hurt your business overall, and they frustrate your individual employees.

[00:02:33] Danielle: So that's one thing I think we're trying to turn the corner on is kind of busting down the silos between IT and OT, regardless of what they bring to the table, right? , so you can dedicate folks to learn anything. I love to tell people that, if you enable people to learn, everyone in this field is willing to learn on either side of that divide.

[00:02:50] Danielle: But we still see so many teams struggle with cross functional roles, responsibilities and communication. I actually think felt that has a blog on this about the cultural challenges, equated here. , but another issue that I see with those teams is there's this disproportionate focus on internal versus external threats.

[00:03:06] Danielle: I think one way to bring those teams together is to figure out how they can have this duality of focus on internal versus external threats to I T and O T systems. , and then, how to balance budget time and resources is always a leadership problem. And I think as soon as those problems hit your, your delegated teams, , that's a challenge, right?

[00:03:23] Danielle: So the leadership should have those things figured out before they have that interoperability figured out. , and something I like about our partners, , like Delta is that we work together. For what we call professional services. And I think in the industry, people don't know what that means.

[00:03:35] Danielle: They think, oh, you don't have IR. You don't have services, but we work together with a size and others on enablement, right? So we call that professional services. But that's enabling people to do more with less to understand the data they already have access to. And so I think that it's cool to see that there's actually a solution in the product space or multiple solutions to actually help with this divide.

[00:03:57] Danielle: It's not Hey, call us when you figure it out. It's hey, come together and look at this data and enable your teams to actually learn on the job and to, , cross pollinate and then also have professional development to walk away with or, build the business based on these newfound skill sets.

[00:04:12] Danielle: So I think it's a great opportunity. I kind of, disparage folks that. That poopoo the, cultural stuff.

[00:04:18] Dino: No, I think you touched on something there that we've witnessed in our businesses. The impact that external and sometimes that external is really the internal team. So, a lot of times we find I.

[00:04:29] Dino: T. not. On purpose, but kind of meddling in the control system environment and tools like the zombie do a really good job of bringing that to light. Right? And then you have to have that delicate conversation that, , the reason why you experienced downtime this week that cost you a couple 100 grand was because of some event that came down.

[00:04:49] Dino: Somebody scanning your network at the wrong time. Right. so how do you handle those conversations? Because, , when we talk about the east west traffic, right, getting into the lower levels of this control system network to grain to gain greater visibility with a tool like nozomi , I find a lot of organizations tend to want to shy away from that.

[00:05:07] Dino: They'll tell us that that's irrelevant, right? That they're not wanting to get into that space. And so. What has been your experience with one disruption coming from I. T. right and trying to soothe those ruffled feathers that can go on between those two groups and the other going, we need to get further into this environment to gain greater visibility within your I.

[00:05:27] Dino: C. S. Environment and not let I. T. Try to just shy away from it, and I have my own thoughts on why that is, but I'd like to hear your thoughts on maybe why they shy away from that

[00:05:36] Danielle: space. Yeah, of course, everyone loves the word visibility right now, and I totally get it, but there is no visibility without context.

[00:05:43] Danielle: And so to provide context, we look at our telemetry data, and the sad truth is we still see errors constantly in network design, architecture, IT and OT, decision making, lack of documentation, lack of, , process and change control type of issues, right? Program Management 101. , and so that's another way you can kind of bridge a divide and say, Hey, we all speak this language.

[00:06:03] Danielle: Here's the things that we have done without due process. we still see, , misconfigurations and errors that it takes a really long time to hunt down that are internal risks. , and we also still sometimes see entire budgets being dedicated to thwarting a particular threat actor or threat actor capability without actually doing the analysis on site or internally to say, Wait a minute.

[00:06:24] Danielle: What is what I call effects based rather than means based analysis to say what's the worst case scenario regardless of who? It's creating that scenario or how they're creating that scenario. What's the worst thing that can happen to my process environment? What's the worst thing that can go offline and what are all the ways that can happen bounded with rational thought from all of your teams and you're all of your functions.

[00:06:45] Danielle: But, , that's one way to really bring people together. , I think that there's a lot of ways that there's this cognitive dissonance to be able to say, maybe a nation state that actor isn't going to target my pharmaceutical company or my brewery. Right. And that's fine. You can have that state of mind.

[00:06:59] Danielle: , but at the same time, if you're not working back the plans that you think on paper work really well to understand the gap analysis to understand your lack of redundancy, potentially to understand what it looks like to actually go manual, what it looks like when your IR plans fail, then you're really not doing your due diligence, right?

[00:07:18] Danielle: And so there's two things. There's all of these Accidental and incremental changes and errors that are also negligent insider threats, and then there's this sort of well rounded and holistic analysis you need to drive better context for any of the tools you're going to use for quote unquote cyber security, right?

[00:07:34] Danielle: Because there again, there's no set it and forget it. But then at a higher level, because I do talk a lot, , to more of the executive level, there's also this realization, again, that I said this already, that organizations already have all the data that they need, right? We've called this DRIP, , relations forever, right?

[00:07:49] Danielle: Data rich, information poor. And when I was a market analyst, we saw this time and time again. But there's this other realization now that if you don't do all of the gap analysis required for your security program, That you can't do detection, so you have to just rely on I. R. And I think, luckily, and hopefully that's starting to change.

[00:08:07] Danielle: And that makes me really happy.

[00:08:08] Dino: Executives, you brought up a good point. It's kind of an interesting segue going after the broader. I T and O T leadership, right? Getting into the C suite, getting in to other areas that believe should be paying closer attention to this, right? Because of risk being 1 of them, right?

[00:08:25] Dino: So the risk ownership. At the CFO level, CEO level, whoever that might be. So , as you broaden this conversation, how are the executives viewing this per se, right? Outside of just pure ITOT guys and gals, what's going on with that C suite in this

[00:08:41] Danielle: discussion? And I love this question because that conversation has now broken out of the C suite, and this is actually the hallway and the sidebar conversation that's happening at all of the vendor expos, at all of the industry conferences right now is, , are you going to get the budget?

[00:08:55] Danielle: Do you care? Are they paying attention to the right things? Right? This is what's starting to happen. And I think it's an interesting turning point because you have the SEC rule in the U. S. You have NIST 2 regulation coming out in the EU for every member state to create their own set of requirements.

[00:09:09] Danielle: And then you have CERCIA, right, which will mandate information sharing. And these are, legally binding legislation that have all come to bring liability cybersecurity conversation, regardless of what team you're on. So historically, we saw boards that tried to have Risk mitigation by asking and tasking their teams to avoid risk, right?

[00:09:29] Danielle: The very old risk registers focus on likelihood. Avoid that. Okay, we've realized that's not the full picture again. That holistic understanding of our environments is not really going to fit perfectly on those risk registers and likelihood metrics have really. Become very blurry and folks have started to think about the likelihood of being attacked, but the old school likelihood metrics were about the likelihood of a particular vulnerability being exploited successfully in your environment, but either way, it's not a full picture.

[00:09:57] Danielle: So now I think we're seeing leaders avoiding risk by doing the mitigation work and better enabling their teams to monitor status to communicate more than once per quarter. If that so much. To make the case for process and organizational changes, like I mentioned that beforehand, where maybe one officer weren't communicated well or created more, errors or mishaps than they were worth and to test functions that might not otherwise have been so urgent.

[00:10:19] Danielle: So nobody loves more regulation, but that's the state of the world today. , and I do think that it's opening more capacity for organizations to listen. Right internally, and to understand and to have this groundswell of support that isn't the last presentation at their quarterly board

[00:10:35] Dino: meeting. Right?

[00:10:36] Dino: Yeah, I was going to ask risk registers. I was interested in what those are, What those mean to you? , I have my own concept around what I follow as far as I just subscribe to the five ICS critical controls with incident response, vulnerability management, remote access, continuous monitoring, defensible architectures, right?

[00:10:55] Dino: And how do you build those out? But when you talk about risk registers, can you help me understand what you mean by that?

[00:11:01] Danielle: Yeah. So the old risk register was, , vulnerability consequence and likelihood, right? Those were , the different ways to, the equation was built on those three metrics. And then you would kind of do a red, yellow, green, , or most to least likely potential.

[00:11:15] Danielle: So it's all subjective, but it is a scoring methodology that has been used for a number of decades at this point. , it doesn't work well for OT, of course, because some of the vulnerabilities , in OT systems are. Completely irrelevant, depending on how you're using that system, how it's configured, what else relies on it, whether it's critical to your mission, your process, your production, your value, et cetera.

[00:11:35] Danielle: These are the things that we kind of rattle off in OT that become really commonplace. But for IT, then you get into this, , discussion of, well, you can't isolate these systems. You can't segment these things. You have to build different compensating controls around it. So defensible architecture conversation.

[00:11:50] Danielle: But for me, it even goes back a little further, again, to how we think about strategic And so we also thought for a long time that perimeter security was dead. So we have to build robust incident response. And then the pendulum swing a little bit too far, because if you just use insert response as a crutch, you're not doing detection.

[00:12:09] Danielle: So you mentioned continuous monitoring, and now that is the market hype that's going on today for good reason, because if you have. Better detection tools and they enable more context specific understanding of all the data you already have, then you're more likely to do prevention and then you're less likely to need wholesale I.

[00:12:25] Danielle: R. Capacity, right? So it's a swing back and forth and I like to watch it happen and I don't think anyone is wrong, right? Or misinformed. It is just this evolution of trial and error, which is, , the story of cyber security.

[00:12:38] Dino: Yeah, so segwaying to another point, the resources, right? It's interesting hearing from somebody like yourself, and I got a little bit of an idea how long you've been at this and what you've learned.

[00:12:50] Dino: you're looking at a guy with 40 years of experience still learning, right? And focusing on how we can do a better job. Of finding the resources to actually do this. Well, right. So as a vendor and working with your partners, how do you see that landscaping shaping up as far as the number of people coming into this field, specifically around OT cybersecurity, do you see, cause I know the schools aren't necessarily teaching this specific field, right?

[00:13:19] Dino: And so how do you see us getting more folks involved, trained up? And working in this space,

[00:13:26] Danielle: the big softball question. So I've been in the industry just under a decade. , I was an early grad. , and so the first part of your question was, , how do you prioritize things? The second part was about workforce development.

[00:13:35] Danielle: So, first of all, I always go back to strong foundations. And I always tell people that you have no, agnostic, stakeholder in this, right? Every organization, every industry expert, every, , government relations person, every, person has a particular school of thought, right? They have a background in something.

[00:13:53] Danielle: They have a particular. Use case for security that they think is better and that's okay, right? That's human nature. But you have to be your own independent consultant at that point, right? You have to do your own research. You have to do your own awareness building. , whoever that is in your company, right?

[00:14:07] Danielle: That gets tasked with that from an OT, , security perspective, but Back to strong foundations, , building defensible architectures and workforce enablement are required, right? They're not optional at all for these organizations for any, , global corporation at this point. That doesn't mean buying the most complex or comprehensive solution or most expensive solution out there, right?

[00:14:25] Danielle: Again, there's no set it or forget it. , Capabilities out there. So what we're really looking at is, there's more regulation. There's more liability. There's more supply chain disruptions. There's more geopolitical conflict, and there's more well trained that actors. And so the only way to get around that is to build a more robust workforce here in the U.

[00:14:41] Danielle: S. And globally for,, blue and purple teams and even some of the good penetration testers out there, which are less active in the space, but definitely gaining traction. , and we always see two things promoted. One is better education. Graduation. , and one is tabletop exercises. The other one should be upscaling, right?

[00:14:58] Danielle: We shouldn't have to go out and hire unicorns. We should be able to build unicorns. Like I said, anybody in this field is willing and able to learn things. If you can fund them to learn it and give them time. So time and money don't have to be. All spent on building more capacity. It can be on workforce enablement.

[00:15:14] Danielle: I started teaching recently at a community college in Dallas. I teach a 16 week course in their cybersecurity, two year program and it's introduction to industrial control systems. It's theory, it's strategy, programming it's a little bit of everything just to entice them and have them understand the world around them.

[00:15:29] Danielle: And I use really basic analogies. Some of the stuff from, I'm sure you've heard of his book, Grady Hill house has engineering in plain sight. It's not about OT security, but it's about the ways that your background and engineers backgrounds have built. Everything in the world that we rely on, and then you can take that a step further and say, look at how it's all digital now.

[00:15:49] Danielle: And some of the early examples I use in class are a bridge, right? So a bridge used to be operated by manually, and then it was a turn. See you crank a rotor, and then, yeah, and now you see, there's different ones operated for bridges with a man in a booth, and then it's moved to complete automation, and then remote automation, another obvious one that people don't think about is a car wash, right, and you see mishaps when sensors go awry in car washes, and so it's really easy to do maintenance on it.

[00:16:16] Danielle: Provide these building blocks similar to how you would provide building blocks in cyber security and then say, okay, now you're gonna go into forensic analysis and you're gonna go into identity and access management. You can build the building blocks for people in multiple disciplines without having them come to the table with that expertise.

[00:16:32] Danielle: And I think that's really the future, right? Four year degree programs are also essential, I think, but multidisciplinary backgrounds are extraordinary , critical to upscaling. And I think that's the one that's been missing. And then on the tabletop exercise side, everyone says tabletops are a good idea.

[00:16:46] Danielle: There's no one size fits all. And there's really not a lot of scaffolding built around what that tabletop looks like, how to build it, the risk to reward ratio, how, , you've had success. Are you planning to failure? Right? We talked about manual operations. So I think there's actually this whole other.

[00:17:00] Danielle: place to explore in this field, what is a good tabletop exercise look like that bridges the I T O T gap for our context for our operations and our processes? Why and how? And that's some of where I focus in my private research as well.

[00:17:13] Dino: Excellent. Now, I like the part that bringing that into the schools, the fact that you're doing that because education, I think, is a big part of it.

[00:17:19] Dino: I'd really do. So what do you see coming down the pipe? We've witnessed, mergers with some of these OT platforms, , Microsoft, CyberX, Tenable, Indigy, Cisco, Centrio, Rockwell bought Verve here just recently. , you guys, Clarity, Drago's out there still, RMS, how do you see this market unfolding over the next 18 months to three years?

[00:17:43] Danielle: Yes, I mentioned a little bit about that push on terms of regulation. There's a lot of funding that will be there for those kinds of things, though we know, , compliance based check boxes do not do robust security. Well, , like you mentioned, the market is consolidating on industrial cyber. I don't know if you knew this.

[00:17:58] Danielle: My background actually was a market analyst. I was an agnostic analyst that looked at intrusion prevention systems for industrial control systems before I came to Nizomi. So similar to you, I had a little vantage point into all of the products on the market. , I think it's interesting, though, because automation will not hit OT cybersecurity the same way.

[00:18:18] Danielle: It's going to, , revolutionize some of the I. T. , expertise out there. , you can't automate response and remediation in O. T. In the same way, right? It's not going to be, , okay, isolate patch push those kinds of things that just that can't happen., O. T. Will continue to be precise and a nuanced focus area unless we're getting rid of all the protocols that all these systems are built on, which I don't see happening.

[00:18:38] Danielle: Anytime soon. , in terms of what coming down the pike, , I really want to push the NIST 800 82 revision three guide that just came out. It's been a couple of years in the making. , it's a great guide for anyone looking for more tactical guidance on OT. It is vendor agnostic, which is wonderful. But there's lots of traction elsewhere, right?

[00:18:55] Danielle: MITRE and CISA are making a lot of moves in this space. We're seeing federal. Research and development, as well as the Department of Defense, beginning to plan their own initiatives in addition to the work of the national labs and universities. So that, plus the role of independent contractors, like I said earlier, I think we're really starting to see this groundswell of momentum.

[00:19:11] Danielle: And it's not just, hey. These challenges have existed for OT security for the last 20 years. My idea is better than your idea is better than their idea on how to fix it. It's more comprehensive partnerships, , public private initiatives, research and development, funding for,, engineering by design, , the CIE programs, things like that to say, how do we have a sea change for the future?

[00:19:34] Danielle: And then how do we address the multiple insecure systems that we rely on for all of our daily needs in society right now? So last year, I wrote a predictions blog and I haven't written mine yet for the end of this year. But last year, I wrote, if anything has emerged from 2022, it is that trust and verification for OT cybersecurity are not mutually exclusive.

[00:19:54] Danielle: I think that's been well demonstrated. Trust and verification have to go hand in hand, regardless of who buys what solution in the market , customers are still going to say, I don't care that this massive cybersecurity company now has an OT wing. I care that my operators and my engineers will trust that anything IT puts on an HMI or an engineering workstation is going to do only what it says it does and exactly what it says it does.

[00:20:20] Danielle: So we're seeing still this kind of integrity conversation in OT that I think will sustain us going forward. , another couple of things I mentioned in the blog where governance will set new precedent, information sharing will be more meaningful and innovative analysis will set OT security solutions apart.

[00:20:36] Danielle: I think that those things are still true as well for the next year, three years, five years. And back to kind of that detection conversation, the better we get at, , the science that goes into these products, which is machine learning and anomaly detection, right? On top of signatures and TTPs that we really know how to look for.

[00:20:53] Danielle: Well, I think we're just going to see more consolidation of robust opportunities for that trust verification integrity of O. T. Data to complement the work of I. T. That's been going on for many more years. Of course.

[00:21:06] Dino: Excellent this will be the last question. where would you recommend? Organizations, would you send them to go get this knowledge?

[00:21:13] Dino: Right? Which conferences, which events, , it be executive leadership, where would you send them or would you ask them to participate in? Yeah,

[00:21:23] Danielle: there's a lot of free resources out there. I think people overlook a lot of the free resources. There are also a lot of government testimony on ICS security that gets overlooked because it's more than four years old.

[00:21:35] Danielle: But as you and I know, a lot of these conversations are more than four years old. I've said in the past that I stand on the shoulders of giants. That's still true. Some of the folks that built the early ICS courses in SANS, some of the early products that went away, some of those innovative folks in this industry.

[00:21:50] Danielle: I actually referenced there's a congressional testimony that in 2005 had the exact same five risks to ICS systems as exist today. So there's a lot of free and open source stuff. there's a lot of old SISA documents before, , the ICS Joint Working Group existed, before JCDC, before all these initiatives that kind of seemingly grew out of the woodwork, there's actually a lot of good documentation out there.

[00:22:12] Danielle: , there's a couple good lists on LinkedIn, actually, that are circulating with these references. Of course, SANS is great, but other organizations, , like, in South Dakota I the organization that runs Wild West Hacking Fest. They've got Idaho Labs. No, A South Dakota organization, , John Strand runs it.

[00:22:29] Danielle: The Black Hills? Yes, Black Hills Information Security. They have some ICS stuff. The National Labs have a lot of great free stuff. I mentioned SANS already. , their YouTube concepts on ICS are really wonderful. And then S4, of course, is expensive to attend, but then all of the videos come out online. So over the year following, , he'll release some of the videos from the main stage as well as some of the technical tracks and things like that.

[00:22:52] Danielle: Of course, if you're able to go, and make the business case for having your company pay for you to go. We would love to see more people there. , and then there are others, universities offering this. , I think there's an online course in ICS. That's pretty affordable from a community college, Everett college.

[00:23:07] Danielle: I think that's in Washington state, Everett community college. , a couple universities focusing on this. There's a wealth of knowledge out there. Actually, I think once I see people peel back the first layer, they're actually overwhelmed with, , this knowledge and I actually just built, a quick, , Excel spread.

[00:23:22] Danielle: Of the precursor to the SANS ICS 410 course. So anyone going into that course, these are the free and open source things that I would suggest that they look at prior to that. Some of them are going to be obvious, like network security, , if you haven't done, any coursework in that, there's nobody in this field that knows everything.

[00:23:39] Danielle: So everyone's coming with something, and then there's always another kind of, lane to learn more.

[00:23:43] Dino: It will be at the S4X. We were there, right? It was there last year. We had a few people down there for that event and want to ticket of our president 1 for what , the key metric on vulnerabilities that he put together.

[00:23:53] Dino: It was pretty good. So Peterson gave a gave him a free ticket for this coming year. So

[00:23:59] Danielle: that's awesome. Yeah. And then all the speakers get free tickets as well.

[00:24:03] Dino: Is there any final advice that you'd want to convey to our audience?

[00:24:08] Danielle: Sure. I have a really diverse background.

[00:24:11] Danielle: I think it's important to always have a diverse. Viewpoint and to make sure that you're open to diverse inputs, but also, I think, broadly speaking, when it comes to cyber security for OT, I think people continue to want security as a byproduct and they end up accepting it as a bolt on. So it's human nature.

[00:24:27] Danielle: We're obsessed with efficiency and productivity, and we want centralization and analytics and interoperability, and we want it to be seamless. But the truth is security isn't seamless. There's always cracks and gaps and ways to exploit. This digital ecosystem that we increasingly rely on for society and business.

[00:24:40] Danielle: And so there's a lot of good people working really hard to meet compliance, but it doesn't do the trick. There's a lot of really smart people working to create the right standards, but it's not easy to apply across all these different sectors. So it's never going to be perfect. There is no easy button, but if we continue to work together and collaborate and kind of reach across those aisles, whether it's the I T O T divide or the government, your CFO divide, , lean in is really my advice for the future.

[00:25:03] Dino: Well, . Thanks very much. Thanks, Dino.