Gartner, DOGE, and the Future of OT Cybersecurity Policy

[00:00:00] Dino: Think globally, but you got to act locally, what you apply to one plant and how you get to it is not necessarily going to be the same at another plant, right? On how you get to that information, right? I mean, the technology would be the same and you can execute the same way. Meaning that how you get to that data, but some plants are standardized than others, and some of them have a lot of varying different types of automation technologies in there that they use.

[00:00:26] Dino: And I know we've talked about that in previous that we've done. But it's unfamiliar and unknown, Hi, I'm Dino Busalachi. I

[00:01:03] Craig: And i'm craig duckworth and today I think we're going to talk about Headlines, they're everywhere. It's what's happening in the news in the media in real day life

[00:01:15] Dino: sound like Ron Argendy.

[00:01:17] Craig: well someone's got to be right first thing. I want to talk about dino is Gartner one of the leading I guess Evaluation organizations, research companies have just come out with a new magic quadrant for OT cyber physical systems, and I really want to kind of talk a little bit about that kind of what they did, how they evaluated it, and some of the players that we're seeing for those that out there that are listening that are trying to go down this journey, it's a great place to look to do some research, figure out who the players are kind of where they stack up against each other and kind of what's going on.

[00:01:54] Dino: Yeah. Well, we have a little bit of an inside track on that, right? Because sometimes when you look at 17 vendors that they evaluated, And they set the criteria, we do the same thing. But in the real world, a lot of, if you look at those, leaders in that particular OT cybersecurity space to bring software solutions to the table, we work with them every day and we sometimes do bake offs, because clients want to see the tools in their environment to determine which one best meets their needs.

[00:02:20] Dino: So, for those of you that are, unfamiliar with what OT cybersecurity technologies is, represent. take a look at the Magic Quadrant report from Gartner to look to see who the leaders are and who the challengers are and visionaries and who's the niche players and some of these vendors you guys can be very familiar with on the I.

[00:02:38] Dino: T. side with Cisco Systems and Palo Alto and four scout, maybe tenable, but then there's others out there that. tend to fall more into the OT arena. And what I mean by that is, a lot of IT groups will pick a tool they already have. Let's say you're a Cisco shop. may as an IT organization think I want to leverage the Cisco OT IDS platforms within my environment.

[00:03:01] Dino: There's nothing wrong with that. Some of the others aren't as good as the others, right? So, you know, it's kind of the round peg square hole. and what I will tell you is that If you, present the OT cybersecurity technology in front of the organization that's going to be, that's going to receive the bulk of the work from what these tools provide, it's going to be, your OT team has to be involved, and they will help steer that decision making process.

[00:03:27] Dino: And if you leave them out. And they are they don't participate at the same level you will find we have found is organizations pick these technologies and it slowly morphs into shelf where we can get into why some other point of why we see that. But if you're not bringing people in, and if you still don't know who the people are within your organization.

[00:03:50] Dino: Please go do some research and find out who they are. But it's going to be those folks that are responsible for your manufacturing environment.

[00:03:56] Craig: Yeah the ot teams, you know to kind of help bring some clarity into that are the operational technology plant floor controls engineers that are responsible for Manufacturing and producing the goods and products that you as an organization sell every single day So you may call them maintenance guys.

[00:04:16] Craig: You may call them technology support controls engineers controls managers Yeah, so, but, again, these two,

[00:04:23] Dino: their ecosystem too. Don't forget the suppliers, right? Because they

[00:04:26] Craig: you got Rockwell, you got Ignition, you got Siemens, you got Honeywell, you got all of the automation vendors, yeah, for sure,

[00:04:34] Dino: size. And, so from an IT perspective, you got to look at that ecosystem the same way you look at your IT ecosystem of partners, who you buy technology from Microsoft, Cisco, Oracle, SAP, take your pick. And you have relationships with those companies who have relationships with vendors who supply you that stuff.

[00:04:51] Dino: Maybe they provide you services, resources, et cetera. Same thing. The same holds on the O. T. side, right? They got a whole bevy of suppliers that bring them these technologies. They bring in these machine centers. They bring the infrastructure that goes with them. And now. These organizations are starting to develop and design cyber security related technologies into the machines that they're providing.

[00:05:15] Dino: So think safety, safety's job. Number 1. So, you know, over the last 15 plus years, they've been doing a better job of designing safe systems.

[00:05:26] Craig: yes,

[00:05:26] Dino: we've got that under control, now we're moving towards how do we make them cyber ready. I think the term that I learned at S4, which we can talk about here a little bit, was, what did they call that?

[00:05:36] Craig: It was a, always called it cyber ready machines, but it basically there's guides and implementation use case studies out there that basically are looking for engineering to implement cyber security, reducing risk in the machines that they're designing and building. okay,

[00:05:52] Craig: nice,

[00:05:53] Dino: but.

[00:05:53] Craig: yeah,but back to the Gardner, you know, Again, it's the cyber physical systems protection platforms and some of the true plays that are there that are built for ot that are ot centric that have better More deep rich protocol understanding and then you look in as you get away from that high right Quadrant, which is the magic quadrant the where the leaders emerge and you know They've got a complete platform and they've got better vision And you know you get to some of the other what we would call ot hybrids or the it technology that are trying to backdoor into that that really are a me too to kind of Because of their I.

[00:06:39] Craig: T. prevalence and you know, just making sure that you look at this with the right lens of if you are trying to protect and secure your O. T. assets, not all I. T. technologies have that ability to understand and interpret those protocols down below that controls layer.

[00:07:03] Dino: and it can also be disruptive, right? Some of those tools that they use and how they implement them. and I would say, as an it leader, you might check with your peers and your colleagues, find out what they're doing in the manufacturing space. that you obviously don't want to work with your competitors, but your peers and colleagues that you guys don't view each other as competitors.

[00:07:22] Dino: I know what they're doing. I think you'll be surprised. how many have already started this journey? As I always say, it's a marathon. It's not a sprint because it takes Quite a bit to learn what do I actually have in my environment, you know, of all the jobs we've done, and we've done hundreds of them.

[00:07:39] Dino: Nobody has a good grasp on exactly what they have in their plans. They just don't,

[00:07:44] Craig: Yeah.

[00:07:44] Dino: you know, because they're highly dynamic, facilities, especially if you've been through mergers and acquisitions, if you've been over through high turnover, little to no documentation, and not having tools in place to, create a baseline of the assets that you have.

[00:08:00] Dino: And from there, you can determine your vulnerabilities and risk associated with that, everything from end of life, end of support, to real life exploits that are out there in the wild that you might really be concerned with trying to close that, that gap improve your cybersecurity posture. So, talk to your peers and colleagues, find out what they're doing, And what tool they picked and why, why did they pick that tool?

[00:08:19] Craig: Yeah. You know, as I glance at that, report, that quadrant, all those in that top right corner, as our partners so again, back to that ecosystem, choose a partner that's comfortable with your environment, your control space, that. Understands the technologies to support and can help you down that journey, regardless of what tools and technologies you want.

[00:08:44] Craig: And we can do that with any of those. that's an important distinguishing factor as you, as you try and go down this marathon.

[00:08:54] Dino: I remember What that acronym was, right? It's C. I. E. It's cyber informed engineering.

[00:08:59] Craig: Okay. That reminds, it's a lot like, secure by design. It's along that same thread. Yeah.

[00:09:05] Dino: It is. Right. So

[00:09:07] Craig: Okay.

[00:09:08] Dino: sorry for driving off to that side, but I wanted to make sure I knew I had to shake my brain a little bit to get that to back up, but.

[00:09:15] Craig: Understood.

[00:09:16] Dino: All right, and I learned that from the S4 conference, right? So, just came back from S4. another great conference, down in Florida.

[00:09:24] Dino: And, what I will tell you is that this is a conference that's been going on for almost two decades now, and we've attended the last handful. but I'm starting to see. more participation of roles that are being defined. 1 companies are starting to create O.

[00:09:39] Dino: T. cybersecurity positions within the organization, and it's a combination of both engineering and plant teams and the I. T. teams. And from our experience, those organizations that have a really tight. Relationship between it and OT. They're aligned. They're very collaborative. They're transparent.

[00:09:57] Dino: They recognize each other's strengths and weaknesses and they leverage each other and their partners, are starting build a coalition around. How do we provide a cybersecurity strategy for our business? And so the S4 does a really good job of, one, bringing all of the technology partners in, the leaders, the visionaries, um, activities that are going on in this space, use case studies, they're witnessing around the world, they have a lot of different events in there, but a lot of the vendors that has published in their Magic Quadrant report attend and participate at the S4 conference.

[00:10:35] Craig: Well, a Selfless plug for dale and the team that sponsor promote and run the s4 conference dale peterson They that conference is designed for the ot Ecosystem as it's evolving as it's becoming more prevalent and the tools and technologies that are there for that organizational structure.

[00:10:59] Craig: It's designed to promote was started out of the operational side and has continued to grow and evolve. It's a. Gathering place for that ecosystem to be at the cutting edge of what's there because it is such an important shift as organizations are trying to figure out how do I apply the same frameworks to secure and protect my O.

[00:11:26] Craig: T. Infrastructure as I do my I. T. Infrastructure and there are differences in the way that it's applied, but the frameworks can be similar in the overarching piece of that

[00:11:38] Dino: Bye. it's also how It's funded, Because on the OT side, a lot of it's CapEx. and OT is obviously for primarily OpEx. And it's not that OT doesn't have OpEx, they do. But in order to replace end of life and end of support. Machines on your plant floor, it usually requires a capital project to do that, ?

[00:11:58] Dino: It's not like you're going to get an opex project that's going to come in and say, I'm going to do recontrol and upgrade PLC's, replace PLC's, upgrade my SCADA system, replace my SCADA system. update my network, replace my network, those types of activities traditionally and typically in the manufacturing world on the plant floor, usually fall under the umbrella of a capital project.

[00:12:19] Craig: because of the life cycle it takes to complete it to do it the cost associated.

[00:12:23] Dino: The way they depreciate it off with books, you know, the way the accounting rules handle it. And that's why a lot of that stuff falls into that particular piece. So, as an organization, you're going to have to figure that out, that blend between CapEx and Because when you do have capital projects, and it's something that, you know, from an IT leadership, you might want to try to get arms around is what capital are we going to spend, in the next 3 to 5 years?

[00:12:46] Dino: And what's it going to be focused on? that's the time that you really want to start talking about, funding your OT cybersecurity technologies in a lot of ways, right? And because it's not. For most organizations, this is all net new stuff, and because there's a lot of unknowns within these manufacturing facilities, if you have a lot of plants, if you have, you know, a dozen or more plants, it's going to take a bit to go through each one of them, right?

[00:13:09] Dino: Think globally, but you got to act locally, what you apply to one plant and how you get to it is not necessarily going to be the same at another plant, right? On how you get to that information, right? I mean, the technology would be the same and you can execute the same way. Meaning that how you get to that data, but some plants are standardized than others, and some of them have a lot of varying different types of automation technologies in there that they use.

[00:13:36] Dino: And I know we've talked about that in previous that we've done. But it's unfamiliar and unknown, And so you have to have an organization that really knows how to go in there to do this work and not be disruptive, right? You can't shut that down while it's working or you got to work around their maintenance windows and schedules that they put out there that you have to come in behind and work while that plant is down or portions of that plant are down to do some of this work.

[00:14:00] Dino: Just keep that in mind when you start pursuing OT cybersecurity strategies, you and don't just pick a tool for threat hunting. If that's what your intent is from an IT perspective, if that's what you're looking for, you're kind of missing the boat a little bit, right? You really need to look at a technology that meets. The majority of it to meet the OT needs, right? Because you want them to see value and benefit of it. If you have a cybersecurity OT IDS platform today, and if I'm working in your manufacturing plant, installing a packaging line and doing some lifecycle replacement, I should be seeing information from your OT IDS platform to give me a better idea from an engineering perspective of what I'm up against inside this plan.

[00:14:44] Dino: What are the weaknesses that are in here? What are the vulnerabilities that you have? What's the remote access look like? what kind of things should I be looking for and maybe implementing for you and designing into these machine centers as I, complete the project that we were brought in to do in regards to doing that, refresh project

[00:15:00] Craig: Well, as organizations are going down that, budget cycle, that approval process and your I. T. leadership is trying to incorporate the holistic enterprise wide security strategy to build into that, CapEx portion for the OT security as well, and there may be a portion of it. If you look at the way that IT outsources and this SOC and their leveraged partnerships With other third party providers, there may be a piece of that as you're trying to leverage.

[00:15:35] Craig: How do I support the operational side from a managed services of who's going to interpret and understand all of this new work that's coming in. Maybe there's a capex and an opex component within that as they're trying to understand what that looks like,

[00:15:54] Dino: and set the ground rules too. Right. And understand that because a lot of the guys are not big fans of cloud solutions. And they don't want them. They want things to be on prem, because in their mind, if it's instrumental to running the plant, and you lose your WAN or you lose the cloud piece or whatever, they don't want that to impact them.

[00:16:14] Dino: And the other thing is they don't want a lot of their information to be somewhere that. It's not within their control. I would say from an I. T. Leadership perspective, you need to start helping them understand that one. All of these platforms that are out there again back to the Gartner Magic Quadrant report.

[00:16:29] Dino: All of them provide cloud based solutions. many of them provide on Prem. But they all provide a cloud based solution. So, now's the time to talk to your OT leadership on the values and benefits of cloud and why it's relevant and it's important, and help them with that.

[00:16:46] Dino: Otherwise, they're going to fall back to on prem solutions are going to tell the OEMs and system integrators that that are coming in and driving some of these OT cybersecurity initiatives, within the plant, And they'll do it with or without you. . Because they're going to their, their ecosystem is bringing this to the table

[00:17:03] Dino: and starting to ask those questions.

[00:17:05] Dino: And a lot of times we catch it flat footed, because they either have a tool that doesn't necessarily fit round peg square hole, or there haven't been sharing, or they haven't even been looking at

[00:17:16] Craig: well, and as we look at the. The shifting landscape, the changes that are, that we as a country have seen in the last, I don't know, 60 days, let's call it, with DOJ and the implementation of new policies, procedures, guidance from the federal government. there's a chance that the accounting rules and regulations could potentially change and shift to be more favorable and the tax regulations could shift and change to be more favorable for some of these projects as we as a country are looking to secure and protect our.

[00:17:53] Craig: critical infrastructure, our manufacturing, and how we can do that. So now may be the time to see what you can do as an organization to get some of these projects in there and really begin bolstering your cyber presence.

[00:18:07] Dino: as we're seeing in our business, the things that are coming back on shore.

[00:18:12] Craig: Yes, sure.

[00:18:13] Dino: so obviously those are going to be capital, expenditures, and you're going to start seeing some retooling and you're going to, and when you start seeing that type of activity within the manufacturing arena, that's the time to start thinking about your cybersecurity strategy.

[00:18:28] Dino: if the money is being set up in a set aside for OT cybersecurity, And that's the time to do it, right. So whether there's tax incentives that are driving it, on shoring is driving it, Retooling of your plants that you got going on and need to start that's the time to start trying to figure out how do I set money aside in order to improve my cyber security posture within my manufacturing environment and you got to bring all the sides together.

[00:18:52] Dino: You got to get, as I used to say, you got to get all the wires in the same room. Right. and I don't mean that in a bad way, but I'm basically saying those that are responsible, the key stakeholders, the decision making teams need to be involved and engaged in this,

[00:19:08] Craig: Well, as manufacturing shifts as more come back to the US that the onshoring as you mentioned while ago, Look at AI and how it's playing a prevalent role. the data centers. I saw a statistic last week or earlier this week, where 65 percent I believe was the number of the AI data centers around the globe are focused in the U.

[00:19:32] Craig: S. Look at the production of those data centers and power. That's taking to do that. what's happening from a an infrastructure and on shoring. It's really becoming prevalent of we are trying to make sure that we're going down this road correctly.

[00:19:50] Dino: and we're seeing that in our business, right? Because we do a lot of data center work, right? When it comes to the power systems for you folks out there, semiconductor business, but also in the data center business, meaning, you got building automation, building management systems, power management systems, and we're wrapping cybersecurity because those data center companies are going in with cybersecurity in mind,

[00:20:12] Craig: Absolutely.

[00:20:13] Dino: They're not, it's not an afterthought for them. It's part of the project going forward with those guys.

[00:20:18] Craig: it can't be if you manage a data center That's three or four hundred thousand square feet or whatever That is if you lose your cooling or you lose the chilling in that data center It's you don't have a data center any longer.

[00:20:30] Dino: fluctuations, you know, you

[00:20:31] Craig: for sure.

[00:20:33] Dino: So, just keep that in mind as you guys go through this journey, you know, again, for you folks out there, I've become familiar with these cybersecurity, companies. would bring them in and talk to them. I would also bring your people to the table, and work with them again.

[00:20:48] Dino: Don't do this by yourself. Don't do this in silos.

[00:20:50] Dino: You know, it's a recipe for disaster, but I will tell you, as OT's growing and maturing in this space, they will go down their own path like they typically do, because I always fall back to, at the end of the day, who actually owns the asset out there on that plant floor?

[00:21:04] Dino: Who owns that PLC, who owns those drives, the HMIs, the engineering workstation, servos, the motors, the pumps, all of it, the process, who owns that? And right now I don't see I. T. organizations becoming the new plant operations team,

[00:21:21] Craig: No agree.

[00:21:22] Dino: a team. so they will go down their own path if you let them and their ecosystem will bring these tools to the table if there's not a working relationship across the aisle between I.

[00:21:34] Dino: T. and O. T. So if you're looking for an integrated approach, if you're looking for, an enterprise wide structure and strategy, Okay. You got to get together. Otherwise, you're in silos, and if you're in silos, then nobody's really winning. but will tell you that OT will go down their own path, and we've seen it, and we work in that space, and they will head down that path to bring these technologies and services and solutions to the table if there's no guidance or, conversations going on with your IT teams.

[00:22:04] Craig: totally agree Organizations have to choose a partner choose someone that both sides are comfortable with that can have the discussion have the conversation and begin Working together.

[00:22:15] Dino: the other thing I will tell you is that for those organizations that work with big bars that provide consulting and technology and they have manufacturing clients, they're contacting us and working with us as a partner to do delivery and execution on the plant floor. Because it's not something that they typically do.

[00:22:35] Dino: It's not something they're familiar with. So they're getting back to that O. T. Ecosystem. The O. T. Ecosystem on the solution provider side is hooking up with your I. T. Solution partner that you're working with today. So just know that's going on the backdrop of this

[00:22:52] Craig: Again, it allows for best in class solutions, providers, services, to be able to present a unified front to the client. total makes sense. Great conversation, Dino. We could have this conversation for the next four days and never stop. But, I don't think our time is going to allow.

[00:23:09] Dino: yeah. Well, safe travels. I know you're gonna be on the road,

[00:23:11] Craig: you too. Appreciate it.

[00:23:13] Craig: Great conversation as always.