Episode 81

The System Integrator’s Role in Supporting OT Security

· 32:38 · Host: Craig and Dino

In this episode, Craig Duckworth and Dino Busalachi discuss the critical but often overlooked or misunderstood role of system integrators (SIs) in industrial cybersecurity.

Play this episode

Read the full transcript ↓

Show notes

In this episode, Craig Duckworth and Dino Busalachi discuss the critical but often overlooked or misunderstood role of system integrators (SIs) in industrial cybersecurity.

Key Issues Identified:

  • Organizations typically work with multiple specialized integrators across different facilities and systems
  • Some SIs lack cybersecurity expertise, focusing primarily on equipment functionality
  • Equipment can remain connected to networks for decades, with ownership and oversight changing hands over time
  • System integrators must exercise proper IT coordination to implement remote access solutions effectively

Recommendations:

  • IT and OT teams should collaborate more closely with system integrators on cybersecurity planning
  • Organizations need to evaluate their SIs' cybersecurity capabilities and partnerships
  • Consider standardizing on integrators with demonstrated cybersecurity practices and vendor certifications
  • Apply the same due diligence used for IT vendor selection to OT system integrators

Bottom Line: System integrators are essential partners in executing industrial cybersecurity strategies and protection. Organizations must actively engage them in security conversations and ensure they have the necessary skills and partnerships to implement secure solutions for their plant environments from the start.

Chapters:

  • 00:00:00 - Real-World Ransomware Hits the Plant Floor
  • 00:00:52 - Meet the System Integrators Shaping Your OT Plant Floor Security
  • 00:01:17 - What System Integrators Really Do (and Don’t)
  • 00:04:13 - Remote Access: The Hidden Backdoor Nobody Sees
  • 00:08:34 - Why Ongoing Monitoring Is Non-Negotiable
  • 00:13:30 - How to Pick the Right System Integrator For Your Operations
  • 00:26:17 - Building Strong Partnerships with Your Integrators

Links And Resources:


Thanks so much for joining us this week. Want to subscribe to Industrial Cybersecurity Insider? Have some feedback you’d like to share? Connect with us on Spotify, Apple Podcasts, and YouTube to leave us a review!

Industrial Cybersecurity Insider is produced by Amplafy Media. Podcast production services · Client results

Full transcript

The complete conversation, in order. 5,656 words.

[00:00:00] Dino: we just had an experience here recently, just in the, this week, on a cogen system where we found, ransomware in the control system environment.

[00:00:08] Dino: and the IT group knew about the connectivity, but they did know the extent of the connectivity and the fact that those machines were connected to the internet. If there was bad actors actually accessing and trying to log into those systems without an IT knowledge. '

[00:00:52] Craig: Hi, I'm Craig Duckworth,

[00:00:55] Dino: we wanna talk about the role of system integrators and their responsibilities to networking and cybersecurity and manufacturing and how.

[00:01:07] Craig: I like it and it is very timely. Let's, let's call it that. I think that as organizations are. Trying to figure this out. System integrators are playing a critical role in assisting and aiding organizations from a networking, from an understanding, and also from just the knowledge on the plant floor, where the, let's call it, asset owner may not have everything that they need.

[00:01:39] Dino: I think we need to frame up what is the system integrator in this context and or an OEM for those of you OEMs are other equipment manufacturers, right? So think of, a vehicle, right, manufactured by GM or Ford. they're an OEM, right? They're the manufacturer that builds vehicles, right? and in the manufacturing space, there are people who build machines.

[00:02:02] Dino: Specifically based on requirements that, a client may have. So whether it's the packaging line or, power generation, or mixing and blending vessels or reactors, what have you, those folks who build that equipment and then system integrators are the ones that put controls on those machines.

[00:02:20] Dino: Right? And so in context of it.

[00:02:26] Dino: We need to figure out a way to get these two groups working closer and better together. Right. And we haven't really, and we haven't really seen a lot of that.

[00:02:36] Craig: Yeah, true. but from a systems integration standpoint, and si, sometimes you'll hear 'em called, they are. Critical and integral to an organization's startup when they add replace, bring in new equipment, when they are doing Greenfield, they're doing brownfield. All of the automation I. On the industrial network is typically done by a systems integrator.

[00:03:06] Craig: Large, small, mid-size, doesn't matter. They're every si size, shape, color, or, so that's normally who's on the speed dial for the Rolodex for your plant manager or your controls engineers, who's the local SI that helped me. Install this, that program this, that made this work for me.

[00:03:29] Dino: and in most cases, if not all cases, it usually plays a very. Small of any role at all, and the development of the technology that's used inside those machine centers or skids as they're called. But these, it's these industrial control systems, right? So everything from the network that goes in the inside, that machine center to the software that they're using, the operating systems that they're using, the applications that they're using, it's role is diminished.

[00:03:57] Dino: Do I think that's right? No, I don't. I do think that it needs to play a broader role in it, but what we typically witness is the skill sets and the responsibility and their experience is limited. in this, and we see this like, let's take remote access for example, right? a system integrator who's bringing in a $25 million piece of equipment and, they have a role to not only get that thing up and running, but then they also have the role of maintenance and support, right?

[00:04:27] Dino: So they might be two tier, three tier support for the client, to help them with the maintenance and support of that equipment, and they will cobble together. Whatever technology they can get their hands on in order to gain remote access, and it will a lot of times give them the keys. For that connectivity, but not really recognizing or following through exactly what they're doing once that connectivity has been implemented and what they might be doing after the fact.

[00:04:53] Dino: as far as what they might install that equipment. So whether they're installing, their own cellular modems or their own VPN concentrators or other additional networking equipment that's unbeknownst to the IT team. within that environment, we just had an experience here recently, just in the, this week, on a cogen system where we found, ransomware in the control system environment.

[00:05:14] Dino: And the and the IT group knew about the connectivity, but they did know the extent of the connectivity and the fact that those machines were connected to the internet. If there was bad actors actually accessing and trying to log into those systems without an IT knowledge. 'cause they don't know who's access this thing, right?

[00:05:30] Dino: They're not really following the user role. because they don't know who the other, the partner is that the manufacturer's hired to support this piece of equipment and they can be anywhere in the world.

[00:05:41] Craig: Yeah, no, totally agreed. And they, it kinda, it goes back to again, and I've said this a hundred times, asset ownership. The plant, the controls engineer, the manufacturing side normally owns those assets. The responsibility falls on them to feed care, maintenance those assets. So they're the ones that are choosing the systems integrator or the OEM or the partner to come in and help support, maintain that.

[00:06:17] Craig: And they don't always, they're not as well versed in. Secure access solutions. That's not their job. They're like, so they're will often say, oh, this is the easiest, or this is the quickest, or this is what we have, use it. Or, I have a team viewer account. Just let me log you in. You can do what you want to do or use it on a Zoom or whatever the situation might be.

[00:06:41] Craig: It because it's easy for that individual, because they don't always know the best way.

[00:06:47] Dino: And they lose sight of it, over time, because this equipment's out there for a long time, right? It's not something that's out there for a few years. I mean, when you're talking about a co-generation system, you're talking about something that's gonna be in place for maybe two decades and maybe it's 10 years into a life cycle.

[00:07:00] Dino: And there's, it's changed hands, whether it be the organization that's responsible for maintenance and support or the plant team or even the IT team. And so these things over time, they kind of get lost in their shuffle. Right. And,and we see that, right? and so then you're back to, the responsibility of, from a security standpoint, how do you get your arms around that?

[00:07:21] Dino: How do you find this stuff? Right? And it's not that the plant doesn't know that it's there, but what they don't know is what's going on with that system. That and that connectivity and or those applications that, that are running within their plan, and then they connect it to their plant network people, their plant people come in with their laptops and connect them in,engineering workstations or their hmis or, and they just, they lose sight of them over time.

[00:07:46] Dino: is what we've witnessed with.

[00:07:51] Dino: It gets called because in this particular case we're talking about, a cybersecurity issue. It's like they're starting to ground zero, right? And and we find this at every facility, right? Nobody gets away clean, forgetting the fact that this is ransomware and this is bad behavior going on, bad actors out there.

[00:08:12] Dino: Just the fact that they just, they've lost sight of it, right? And they don't know what's going on with it. First se and then when it comes, they have to start all over and start reinvestigating. It's like, how's this thing put together? there's five or six components inside of this panel for remote connectivity over here to the drives, over here to the PLC, over to the HMI.

[00:08:31] Dino: it varies and they just lose, they lose sight of it. And so why aren't you looking at putting systems in place? continuously monitor stuff. that's number one. number two, as we've talked about many times in our podcast, even if it buys a tool dedicated to the OT cybersecurity space, they're not necessarily getting the visibility and the depth within that environment, right?

[00:08:54] Dino: They only get to a certain point and they kind of stop. We witnessed that, consistently, because getting back to what we've said earlier many times is as a system integrator, if you have an OT cybersecurity plan, we should be having conversations with the CISOs and the CIOs to under make sure that we understand what the direction is, what the strategy is, and what is that we could do better and what we should be doing to help 'em with their cybersecurity.

[00:09:17] Dino: Whether it be with MA, how do you keep with your, your firmware updates, your software updates, How are you hardening that cybersecurity posture around this equipment? For us, because it is connected to our plant network. The plant network is obviously connected to the enterprise network.

[00:09:32] Craig: The enterprise network's connected to the internet, Oh, it's ripple effect. For sure. Well, as, and kind of pulling this all back into the, why is a systems integrator important in this process? I think that as organizations are looking to leverage the. OT technologies, whether they're intrusion detection, intrusion prevention, whatever that might be on the plant floor, the most inherent knowledge of that manufacturing environment is a systems integrator that is working with those.

[00:10:07] Craig: Assets that can understand how to get deeper, richer data from those tools and technologies based on the environment that you have, how to connect sensors or taps or other ways of getting lower in those industrial networks that they very likely. Were designed by and implemented by that systems integrator to help you get better visibility within your own environment.

[00:10:40] Dino: And you could literally have dozens, if not hundreds of sis. Environment. So if you're a very large manufacturer with hundreds of plants, hundred plants, there's gonna be hundreds system integrators involved, right? I mean, it's a wide spread out field. Si that you could, you're working on, especially around the planet.

[00:11:01] Dino: And, and that's very hard to get your arms around. you talk about herding a bunch of cats, right? And it's not easy to try to get them all on the same page and to follow, the same marching orders that, that are coming down. and because very few organizations have standard system integrators in which they work with, there's a few.

[00:11:19] Craig: There are.

[00:11:20] Dino: specialize because that site specialize in certain things, right? They might specialize in automotive or they might specialize in food and bev around food and bev specifically around packaging per se. Maybe not in mixing and blending, so they specialize in different verticals and so you can end up with a lot of them,

[00:11:37] Craig: but I think that even with a lot of them, Dino, I think that in organization, let's pick a medium sized organization that's got. 15 plants. That's that range across the Midwest and the Western United States. They may have a systems integrator that is their predominant provider of general services where they can get them.

[00:11:57] Craig: But in a local, regional, or regional, they may or may not be able to leverage that same systems integrator in every facility because they may not have a presence there. They may have a local. Specialist in certain places, so they're, you're right. But I think that some try to have one generalist kind of, that does some of their things.

[00:12:22] Craig: Maybe not all of them.

[00:12:23] Dino: Yeah, I mean, I mean if you were in the construction industry, you're right, you have a general right, and the general's the one that's responsible for the overall construction of let's say a $300 million plant that you're gonna build. But they manage all the different traits. They're responsible for all the different activity and they control that.

[00:12:42] Dino: But from an SI perspective, I haven't really witnessed where there's a general SI across the entire organization. that's responsible for all your control systems,

[00:12:54] Craig: no. And I don't think that there would be,

[00:12:56] Dino: there's a lot of pockets, because sometimes the local plants like using their local. Jimmy lives down the street.

[00:13:03] Dino: We've known Jimmy for 20 years. Our kids play ball together. and so I hired Jimmy to help me with, my packaging systems at this particular plant. and each manufacturer has their buddy system,

[00:13:15] Dino: right? And their buddy system. they're not cybersecurity guys, they're not networking guys.

[00:13:20] Dino: They're just really good at managing and maintaining and building this equipment, right? Just like your favorite automotive mechanic that you like going to,

[00:13:28] Dino: right.

[00:13:28] Craig: Yeah, no, you're right. So how, so what are some key benefits, I guess, of working with the local SI specifically as it relates to the cyber technologies? where we as one, as a, as design group are a systems integrator? we have a cyber practice, so for clients that have systems integrators.

[00:13:51] Craig: What would be an advantage of leveraging them to help deploy, help, bring insights, help understand these technologies?

[00:14:02] Dino: Well, I think this is where you go back to an it, best practice, right? Where they standardize, right? You find a general that you're working with. Let's say you're doing a, an enterprise wide network rollout, right? You're gonna, you're gonna pick a company, you're gonna pick a technology.

[00:14:18] Dino: It's the same, right? You're gonna pick a supplier who's gonna go and help you do this work, right? Unless you just have a big organization to be able to do it yourself, but most don't anymore. when it comes to cybersecurity, I think you have to use the same mindset and best practice that you would see IET do.

[00:14:35] Dino: And it's like I need to have a general, to be able to go and implement a singular. OT, cybersecurity, strategy, and the same thing around your control system network, right? Not your enterprise network or the controlled by it, right? Still have. and helping with that. But when you drift down into that control system arena and you got, all these various, FIS engaged, it's like, well, how do you roll them up underneath one general who's got the plan to be able to go and execute this and understands how to, understands that industrial environment, but also understands networking and understands cybersecurity.

[00:15:13] Craig: The cost benefit can be substantially better to outsource it versus trying to bring all that separate talent

[00:15:20] Craig: by general, Yes, correct.

[00:15:22] Dino: Yeah. That's why we find a wide range of switching equipment, for example, right? You go into a plan and you don't find one standard switching platform. You'll have somebody say, well, our standard is, Rockwell Strat, for example. I'll go in there and say, yeah, 60% of your stuff is Rockwell Stratix, and then you've got seven other, or eight other different ones in between Red Lion and scale and intros and D links and Phoenix contacts.

[00:15:47] Dino: And so you'll still find a wide range of other switching technologies within that one single plant. same thing with remote access. We find a lot of different paths and technologies used for remote access. how do you standardize that? Right? And the plans can't do that at the individual level.

[00:16:03] Dino: Right? Think globally. Act locally. Like we always say in this case here, you want to think globally of an overall strategy and plan, but then how do you push that down in all these local organizations?

[00:16:15] Craig: right. No, for sure. So let's look at, I would say traditionally the systems integrators are. Focused on verticals, whether that's food and bev, whether that's critical infrastructure, they're great at power distribution, power generation, nerc SIP compliance. If they're good at, a particular thing, how should they try and leverage that? Is it, does that help or hurt them you think? I. From an organizational structure, from an end asset owner trying to get a system integrator to support them well, who should they look for?

[00:16:59] Craig: what makes the most sense?

[00:17:02] Dino: You need to look for integrator one who has a demonstratable practice.

[00:17:09] Craig: Okay.

[00:17:12] Dino: Strategic technology vendors. Right. Versus somebody who doesn't have any relationship. Let's, with Cisco, for example, would you rely, if you're a or Cisco shop, you know is really a Cisco box underneath the My point though is that. Would you just rely on some local SI who doesn't have any certifications or any really networking skills, they just know how to put in a dump switch and plug things into it?

[00:17:35] Dino: Or do you want to put somebody in there that knows how to architect and design networks? Right, and when I say architect and design and network, I don't mean back to the Purdue model of just working in level four and three in the plan. I'm talking about levels four, three and a half at the IDMZ level three, level two, level one that can work down through that whole stack.

[00:17:56] Dino: Right, and not only that, have the partnership relationships with those vendors, whether it be, again, a Cisco for example, or a Siemens, because they also provide switching technology if you're a Siemens shop, but, or ge, or Emerson or Honeywell or Schneider, Somebody that has that level of a relationship versus somebody doesn't have any of that partnership.

[00:18:16] Dino: They just run down to some distributor or channel and buy parts and pieces, and it's like, oh, those switches are being spent this month, so let's buy those because that they're only gonna be 50 bucks a pop versus me spending 500 or $1,200 for a layer three smart managed switch. Buy that $50 layer, two unmanaged switch.

[00:18:36] Dino: Joey can't.

[00:18:42] Craig: Yeah. Well, and a lot of the systems integrators, if you find the right one, they will work with you from the beginning. To ensure that cybersecurity is incorporated, designed in from the beginning, so you don't have to come back and retrofit. After the fact we've talked about in the past seat belts and the way their implication on cars.

[00:19:02] Craig: It's let's put 'em in when you build the car versus trying to have to figure out how to put 'em in after the fact.

[00:19:08] Dino: Even if somebody can actually do the work. So even if you look at the, the consulting companies.

[00:19:17] Craig: Sure. Any of them. Yeah.

[00:19:18] Dino: And it, and the businesses, they use those folks to help develop and build a strategy,

[00:19:23] Craig: Yeah. Absolutely.

[00:19:24] Dino: gotta go execute that strategy. Right? And so how do you get all of those different groups that we keep talking about in these manufacturing environments on the same page? Now that you're starting to develop this plan and this strategy, how do you rope them in?

[00:19:38] Dino: Because what's gonna happen is some of those are gonna fall off. We can't do that. We won't do that. that's not us, right? So then you might have to start maybe getting rid of some of your system integrators. Aren't moving and maturing in the path that you're headed. Right. Versus sticking with the small shop in your little town in the south for of Iowa that you'd like using for the last, decade or so that knows very little about technology at that level.

[00:20:02] Dino: it's if you started pursuing ai, you think you're gonna do that at the local level.

[00:20:07] Craig: No, but I think that system integrator should be. Evolving, as you mentioned, so that they can help bridge that gap. They have enough IT skill sets on their team to bring that convergence conversation and be the subject matter experts about everything in industrial. On the plant floor and how it applies and the data that goes into a historian on the IT side, or how the MES incorporates into it and really help the enterprise IT teams understand and evaluate the way that their OT is interlaced with their it.

[00:20:49] Dino: Of course there's. Right. How many times have we witnessed it? Some folks will shy away because one firm's gonna come in who's got a pretty good idea based on what you're doing because we've done it. It cost a million dollars, whatever the size and scope of that project is, and a client choking on that number and they got somebody over there in the corner says, well, we'll do it for 150.

[00:21:09] Dino: Right. Well.

[00:21:12] Craig: to do it again.

[00:21:13] Dino: Right. That, well, yeah, you can do it right or do it again. Right? and, but that's another key piece, right, is the price sensitivity, because these system integrators in there competing for the business and it is not driving that particular. narrative around the costing, right?

[00:21:31] Dino: It's the capital plan that the plant, the company's put together that says, Hey, look, we should be able to build this, brownfield expansion that we want to do at this plant, and we're gonna put this out for bid and we're gonna award it to, let's say the lowest, but. Right, and they're gonna nickel and dime their way through that.

[00:21:49] Dino: And you're gonna get the cheap, easy, simple stuff with no security in it at all, right? Because they're sitting there looking at it just like we always witnessed today, who's responsible for cybersecurity? When you have that conversation at the plant level, they're gonna tell you that it's it. And then we invariably show them the pictures of the machine centers we're talking about that this was the target, and it will say, yeah, that's not our responsibility. And then you see the gap and then the OT guys are going, we don't know how to handle this stuff. So then you have to find, back to your point, we have to find partners that knew how, they know how to do this, that have demonstrated that they can do this. And they have the partner relationships with the technology companies to demonstrate that they can do this.

[00:22:33] Craig: Well, a race to the bottom is never a race that, that I wanna be in ever. I've worked in organizations and industries where every penny counted and if you've got a. 15 cents on the margin, and somebody comes in and does it for 14, and somebody else comes in and does it for 13, somebody else does it for 12 a.

[00:22:54] Craig: Again, all you're doing is trying to find out who gets to go outta business the quickest, and it's just a horrible model as a vendor.

[00:23:02] Dino: Right. who was it last week that you were commenting on a $500 million, market devaluation that they went through. Right. $500 million.

[00:23:10] Craig: It was unify. Unify. Lost 500 million in market cap in 60 hours. That's crazy.

[00:23:18] Dino: And probably because they were trying to, they were tripping over, dollars to pick up, nickels, dimes.

[00:23:23] Craig: Yep. True. Yeah.

[00:23:24] Dino: know that's, and that's a classic example. We see that a lot, right? When you have whoever's driving that capital plan and is trying to squeeze that stuff out, all of a sudden you end up with an issue.

[00:23:36] Dino: Situation like that,

[00:23:37] Dino: project earlier, the problem that we found based on the work that we were doing pays for itself 10 times over.

[00:23:44] Craig: Well, I was at a conference yesterday and one of the speakers was talking about how they were. Trying to choose a new tech stack. They wanted a new tech stack to perform some feature functionality. I'm not sure even what it was. And they had a vendor that they were working with that came in and said, you know what, we're gonna give you year one for free.

[00:24:11] Craig: So your cost is zero. Six years later, that client unwound all that mess, got out of that, brought in the tech that actually worked, paid for it, and their comment was, free isn't always better because we. Year one, we didn't pay, but we did have to pay for the next five. And now we are five years behind where we should have been when we started this process because someone in finance said it's free.

[00:24:46] Craig: That's what you're gonna go with. And they hated that for six years. They hated it. So you get what you pay for.

[00:24:56] Dino: That's true. Well, and those software vendors who are giving this stuff away, it's like the one I was just speaking about, they were given a tool at the beginning of the year, but nobody's teaching 'em how to use it. Nobody's advancing the ball forward. Right. They just dumped it into the client's lap.

[00:25:12] Dino: The client eventually walks away from it. The equipment was still sitting there, the license had expired. It hadn't been updated since it was installed. Right. and we see that all the time. It's very common, right? Because somebody went out and got a tool where they got it for free or paid very little for it next to nothing, but there was no investment follow up.

[00:25:33] Dino: Right? And then the stuff that dies, right? The shelfware as we like calling it, is what it morphs into. And it's like you just turned your back on a technology that could have told you months ago what we found doing what you asked us to come out there and do this week.

[00:25:49] Craig: yeah,

[00:25:50] Dino: Right? And that's the challenge, right?

[00:25:53] Dino: Because they try to do it themselves. The software vendor will do that. They'll drop that stuff off and hand it to you, but they're not going to advance the ball for you. You have to figure out and do that on your own.

[00:26:03] Craig: you are a hundred percent correct in all that. you have to make smart decisions. You have to make educated choices and Yeah. Without doubt.

[00:26:15] Dino: Right. and I would, and I, and we said this in our last. A couple of podcasts, CISOs and CIOs, you have to find who are your primary go-to sis that are working in your manufacturing environment. you need to meet with them. You need to bring them in, find out what they're doing for you, what their role is.

[00:26:33] Dino: Look at the spend. in a lot of cases, you're gonna find that when you talk about these system integrators, you're spending a lot of money with these folks 10 times, a hundred times more than you're spending on your IT stuff, right? When you think about the scope and responsibility, if you've got 10 or 15 or those system integrators that are either doing capital projects or doing some maintenance and support, who are responsible for your revenue generating facilities, right.

[00:27:02] Dino: and you need get, you get to get your arms around them and figure out what their capabilities are, how they're advancing and moving the ball forward. How are they maturing, in this space, whether it be cybersecurity, ai, networking, machine learning. What are you guys doing? Right, those cso, those IT leadership teams, if you're really going after this ITOT convergence, you have to find out who your top partners are in that OT space.

[00:27:31] Craig: Yeah, that was gonna be my next question. You just kind of answered it. Before I asked it, but is how, for those that are listening, how can they begin evaluating, understanding and trying to go down that path of who are my systems integrators? Who should I be leveraging as a system integrator?

[00:27:50] Craig: If. Who I have doesn't meet the criteria. And are there certain criteria they should be looking for as they choose that? And you kind of walk through a lot of that, but go, if you wanna kind of recap real quick. if they need to try and choose a systems integrator or leverage something, how do they get started?

[00:28:10] Craig: What's a good way to do it?

[00:28:12] Dino: They already do it on their IT side, right before they choose a vendor, right before they pick an IT var or an it technology. They're doing their homework. IT

[00:28:22] Craig: Yes, they are.

[00:28:23] Dino: executives leadership and their teams, they're doing that, right? they're looking at the partnerships, the certifications that they have, the businesses in which they operate in, and so they're doing their due diligence on the IT side.

[00:28:34] Dino: They've already got the roadmap now do now is you just gotta apply it to a different sector around a different group of people who are actually working in their manufacturing facility to try to understand who's the best in breed that you have out there, right.

[00:28:46] Craig: I would say as we kinda wrap this up, if there's one piece of advice that our listeners could use to, to start evaluating, how do they make sure that they have the right systems integrator, the right technology partner, similar to you said on the IT side. How should they begin looking at this from an OT side?

[00:29:06] Dino: Yeah, it has playbook, right? And how they evaluate their partners and the technologies that they work with, right? and what I would say around the partnering aspect of, especially with technology, it should make it all incumbent. Upon yourselves of choosing the cybersecurity platform for the OT environment, right?

[00:29:25] Dino: You need to get the OT people and these system integrators involved in this discussion. So they already have a methodology, I believe, I know they do it most IT organizations do on how they select partners. Whether it's not only the technology, but it's also the business relationship, the partnering relationship, all the research and background check type of work that it does with before they start engaging particular partners in their technology.

[00:29:50] Dino: You have to do the same thing on the system integrator side. Your OT people have probably done some of that, but they haven't done it at the level when you're talking about the sophistication and complexities around, Cybersecurity within the manufacturing environment because it's not their forte or their strength, but there are some integrators out there that are, that have crossed that divide, right?

[00:30:08] Dino: They have these partner relationships. They have the references. They have, probably a longstanding relationship with their company already. I. Right. And so you just have to, you would have to engage them just like you with any other partner that you're starting to work with, and,and try to get a better feel for who they are, what they are, what they do for us.

[00:30:26] Dino: And at the same time, you need to start driving your cybersecurity strategy to see who's gonna stick and who's not. But some of 'em aren't gonna make it, right. Some of these guys, are gonna have the chops for what you're looking for, and they're out there. Um,and you just have to, you have to look for 'em.

[00:30:41] Dino: And I said, they've already in your house. You don't even know it. They're just working with the local teams like they always have been and when they start, 'cause we've witnessed this, right? when our client facing engineering teams are working with their client, with the client and they start asking these types of questions, they're like, yeah, we don't know anything about it.

[00:30:58] Dino: It's not our responsibility. And then it just kind of dies there, right? They really have it come in and start driving that. And that really helps a lot. but what I would say to it is, you can't do this on your own. You're gonna have to work with those sis to execute your plan. You can't do this by yourself, and you're not gonna be able to do it with your plant teams either because they just don't have the resources and they don't even have, the capabilities or, they don't have time.

[00:31:22] Dino: and most of those folks in the plant's got seven jobs and trying to add this onto their plate, a nonstarter.

[00:31:27] Craig: Yeah, no, I would say a hundred percent correct. Skill sets aren't always there, and it's overworked. it's gotta start and you gotta start researching.

[00:31:37] Dino: Yeah, I mean you can drop it in and they'll be fine. Put it over there in the corner and I.

[00:31:43] Craig: Yeah. Yeah. Nobody wins in that. So great conversation today, Dino. Thank you so much. Hopefully all you listeners got something out of this. Begin asking the questions of your local plant team. Start figuring out who those systems integrators are, which ones have the skillset you need. Make sure you follow and listen for additional dates

About Industrial Cyber Security Insider

Industrial Cybersecurity Insider brings clarity to one of the most urgent gaps in manufacturing and critical infrastructure: the divide between IT and OT. Hosts Craig and Dino talk with plant leaders, engineers, and security practitioners about protecting industrial operations in the real world — practical conversations for the people responsible for keeping production running and secure.

See all 147 episodes of Industrial Cyber Security Insider →

Book a 30-minute strategy call