How CISOs Are Bridging the Gap between OT and IT Cybersecurity

[00:00:00] JC: we see it across from a cybersecurity standpoint, in OT and outside of OT. Certainly the escalation of that and of those environments and the, rapid attacks that allow, let's say, less skilled adversaries to do highly skilled things, actually lowers the barrier to entry for people to come into environments

[00:00:19] Intro - Outro: Welcome to the Industrial Cybersecurity Insider. In each episode, we dive into the world of industrial cybersecurity. Join us as we cover the latest trends, innovations, and practical insights as we talk with leaders and practitioners across the industry. Gear up, and let's get into this week's episode.

[00:00:49] Dino: Hi, this is Dino Busalacchi, and today I have the chief strategy officer from Kasm with us today, Justin Carlson. Welcome to the show.

[00:00:58] JC: Thanks, Dino. Always a pleasure to be with you.

[00:01:01] Dino: Yeah. So, we've been talking a lot about Kasm internally, and we've seen it in the marketplace, and we've worked with you guys.

[00:01:08] Dino: so for our listening audience, the idea here would be is tell us your elevator story on Kasm

[00:01:15] JC: Oh, elevator story. Oh,Kasm was born out of necessity. It was essentially created by two engineers who simply needed more secure computing environments to work in. with the advent of Docker in sort of the late teens, they saw an opportunity to do that, build these nice ephemeral environments, the kind of environment you can, destroy.

[00:01:36] JC: They worked in offensive and defensive cybersecurity, so the need to, let's say, have something that, could be destroyed at a moment's notice if there was compromise, was, ideal for them, and they did not have that solution in the market. So this wasn't-- Kasm wasn't built as a commercial enterprise.

[00:01:52] JC: It was built out of necessity by engineers. and at that point, after they built it, they then had an opportunity to work on a project, a government project called Project Maven, which was a collaboration between, various governments along with top-tier universities. And they needed, a, that same ephemeral environment to collaborate in, that had high DLP, data loss protection, controls in place, such that, these enclaves, could be collaborated within.

[00:02:21] JC: And, at the end of the day, no information could leak. And that, is where Kasm was born out of and, and what we've continued to expand on to this day is adding a very versatile feature set that allows those environments, to be ideal environments for, for OT or, companies that are also working in various other types of VDI-type environments or secure remote access or OSINT-style research.

[00:02:51] JC: Like it's a very versatile platform with a lot of feature sets that enable companies to configure it in a way that meets their needs.

[00:02:58] Dino: Yeah. Which is one of the things that draw me to it, having a mutual colleague I've been working with for the last several years, kind of brought this to my attention and thought it would be a good fit into the industrial space, especially since it was already working in the, the government arena, being used for very critical systems, of all sorts.

[00:03:16] Dino: And I thought, well, if we can do it in that space, it could definitely work in the manufacturing environment. we started looking at it mainly from a managed services play, because we provide managed services, something that we see that's a, a growing industry from an OT perspective. In the IT world, it's been around for decades, as we all know.

[00:03:35] Dino: but the same challenges that, that IT recognized all those years ago, we're starting to see in the manufacturing environment. and it- it's, it's the complexity of, of the technology that's being deployed in these environments. obviously the cybersecurity, is a, is a major component. AI is another big component.

[00:03:53] Dino: And, and so our, our clients are starting to recognize, "I just don't have the skills. I can't find them. I can't keep them." and this, this isn't stopping, right? The OEMs and system integrators that are helping us build these plants and support these plants and do this automation integration work, et cetera, bringing these machine centers in, it's becoming harder and harder, right?

[00:04:14] Dino: and one, to secure it, and, and two, to be able to leverage tools like technology. So, we, we see Kasm as that, that front door for all the various applications that,we support, for the clients who have a wide range of automation technology,in their plants. the Rockwells, the Siemens, the Honeywells, the GEs, Emersons, and then you get around the networking stuff and the cybersecurity stuff, and a whole host of other, technologies that are in there.

[00:04:40] Dino: It's like, how do we... how can we best secure and protect that front door? But then also at the same time, the remote access into these environments is probably one of the biggest- Riskiest things that's out there that allows access into these environments. At least that's been our experience.

[00:04:58] JC: Yeah. I mean, you hit on a bunch of things there, Dino, that I think are, are really important. And I've, I've worked in the oil and gas industry for 20 years, and so the concept of sort of that silver tsunami or the loss of experienced workforce is ever present there as well, because you've got, It's very tough to go to a career fair at any one of the top, universities and say, "Hey, come over and work with us in oil and gas."

[00:05:24] JC: I will tell you the, those booths are not visited as frequently as many of the other,biomedical or,cybersecurity or some of the other more,fancy tech more modern,industries. And, that's, where I think the energy space, along with the manufacturing space, and I've worked on a production line, a plant line myself, pulling,widgets out of an injection molding machine, cutting off the tag ends and doing all that stuff.

[00:05:49] JC: Like, this, it's, it's a challenging environment to attract people. And so, the reality is that it's even more important for companies in that space to modernize, to find ways to leverage remote workforces, find the most experienced people that can work on, on that equipment, and manage those services securely, but also, more importantly, to ensure revenue and uptime.

[00:06:14] JC: It's one of the things that I think ties really well to Kasm and, and how the, the Barry-Wehmiller Group is using it, is that Kasm itself, and it is n- intentional the name Kasm. it is a bridge. like we are crossing chasms between technologies, and one of the things that we wanted to enable that's really important for us and that I think the Barry-Wehmiller Group is finding, is that you talk about that single front door into any sort of application you might need to operate in an environment.

[00:06:43] JC: we're... You can bring your own workspaces into Kasm. We will put within a container any sort of application, or desktop or browser that you need, and therefore that single front door into any of those technologies- is, okay. We don't require that you rip and replace anything. Bring your own storage, however you want to store it.

[00:07:06] JC: Bring your own cloud if you want to do a cloud because you, you might want to do it on-prem, you might want to do it air-gapped, you might want to do it in the cloud. W- It doesn't matter to us. Our, our, product works in any way that works for the customers. we have different ways to authenticate.

[00:07:22] JC: And so we wanted to give the Barry-Wehmiller Group in particular, NDG 360, the flexibility. it's important to us that they have the flexibility to meet the customers where they're at, in their journey, to modernize and to find a, a solution to today's problems that meets their needs.

[00:07:38] Dino: Yeah. And the, the remote access is key.

[00:07:41] Dino: in our business, we obviously have a cybersecurity practice, and one of the, the key things that we do to get started with a lot of clients is we do these visibility studies, we call them. I think some... a lot of folks might call them an assessment, but the goal is to really go out there and find all the assets in your environment, right?

[00:07:58] Dino: One of the things that we typically find is we usually find several different remote access technology/platforms being used in a single plant, right? OEMs put things in, the system integrators put things in, OTs put things in. because of the life cycle of these environments and the mergers and acquisitions, a lot of different groups have been in and out of those plants over the decades, right?

[00:08:22] Dino: and so the question is how do you consolidate that, right? Because that, that is, in my view, one of the single b- biggest risk points is this remote access into your environment. Even the IT organizations recognize that their problem and challenge is trying to find it, right? And knowing where to look or why it's re- why it's required and, and how it's being used and its impact to production and operations per se.

[00:08:47] Dino: and so that's been my view of when I saw-- started working with the Kasm team is, well, now I can start converging this down. I can still leverage what's already there, but still have them go through this front door that's very secure to gain access to that environment until the client and/or that OEM system integrator wants to move it onto the Kasm platform.

[00:09:08] Dino: and eliminate that VPN concentrator that they have out there or, some other VDI technology they might be using, TeamViewer, Zoom calls. We see all kinds of stuff. So Cradlepoint cellular modem, a whole wide range of, of things that we uncover in these environments that, they just don't know that they have

[00:09:27] JC: Yeah.

[00:09:27] JC: And I imagine you run across, 'cause we talk about it, you run across, the old legacy tech, that has difficulty being integrated into a modernization strategy. 'Cause you just can't, you can't just rip it out. You can't take a production line down. You, might not even have, it, it's a whole project in itself to try to replace that thing.

[00:09:46] JC: And,that's where being able to cyber wrap that in a virtual environment, in a container, effectively cyber wraps that thing and protects it against, so that you don't have to exclude it from your modernization strategy. So a- again, another thing that, y- I think from...

[00:10:02] JC: It becomes a stopping point out, for many of our clients is, "Oh, I can't do something now, because I have this, these Windows environments or these, Windows XP environments that aren't accommodated by most, technologies." Well, we've got a single front door, as you noted, that, that helps, people into those, to view those environments, but they're cyber wrapped in a way that they're protected.

[00:10:25] Dino: a- and, that's the conundrum for IT, right? Is because they recognize there's not much I can do about an environment that's old, that's legacy, right? I, I don't... My influence to be able to, to, one, I can't necessarily turn around and write a capital project to replace it, right?

[00:10:42] Dino: Rip and replace, as you stated, 'cause that can cost millions of dollars. problem number one. Problem number two is, I, my tools that I have in my IT world won't even work with that stuff, right? Another problem that they have. And, and then problem three is, is I don't know if it's really my problem, right?

[00:10:57] Dino: I don't own the asset. I don't own the responsibility. So it's like we always say to ourselves is we told, "Concern yourself with the things that you can influence and change, and don't worry about things that you can't." And I think for them that's a big one that they just can't in a lot of cases.

[00:11:10] Dino: So, but we as,practitioners, companies that, that's our livelihood is working in manufacturing- We just have to get better at this. N- not only designing and building that, that future state, but then of being able to operate and maintain within the environment that we're working in, right?

[00:11:28] Dino: Putting in a new packaging line, doing some life cycle replacement, maybe some integration to some new control systems that the client's, pursuing. Whatever the case may be,we're, we're in there. We're kind of... I don't want to say we're stuck, but, we, we have to lead from an OT perspective.

[00:11:43] JC: Well, how do you... So when you walk into clients and they get in that mindset of, "We just can't, we just can't, we just can't," how do you... I mean, I'm a big, proponent of can and and, and I don't like the word but. it's not in... I try to remove it from my vo- my vocabulary as much as possible. And, so how do you get people to can?

[00:12:05] JC: Like, what's... I often see financial,disincentives as a major factor in that. And you talked about the non rip and replace component of it, right? Which is a, helps reduce that financial burden. What are other ways, that managers that, people operating the OT environments can justify the budgets that often a lot of this modernization stuff costs and that trade-off of, of, moving to a more managed service type environment.

[00:12:32] JC: how do you get, how do you help people? How do, how do you see people deal with that?

[00:12:35] Dino: y- you're spot on on cost. Cost is usually the biggest, stumbling block right out of the gate, and who's gonna pay for it,

[00:12:42] JC: right?

[00:12:43] Dino: And, and, and it's how you frame- The conversation, right? Because if you start talking about cybersecurity, the OT guys are just gonna immediately say, "Hey, that's IT's problem."

[00:12:52] Dino: And in many cases, IT is gonna say, "Yeah, that's our responsibility," right? Then the question is how do you fund that, right? And that's where the money always comes up, up short, right? And because if IT is gonna fund it, then they wanna be able to control it and manage it, and the challenge that they have is they can't get far enough, deep enough into the environment to really have any meaningful impact.

[00:13:09] Dino: That's problem number one. problem number two, and the way I see in solving some of this is you have to add this into your capital project, right? So when you hire organizations like ours, typically, it's on a CapEx, right? expansions, brownfield, greenfields, new SKUs, new machine centers, lifecycle replacement, whatever the case may be.

[00:13:27] Dino: Those are typically CapEx expenditures. My experience in doing this f- for four decades is if you're gonna build a new network to, to a, a standard that you as an organization developed and you're putting a new packaging line, which I can speak to because I've, I've done this many a times, is the engineering and the technology and all the work for start and commissioning for that packaging line pays for that network, for example.

[00:13:55] Dino: It pays for the switch. It pays for the conduit run of fiber out to where that switch is sitting out on that packaging line, all of the lateral runs to all the control systems that are out there, the PLCs, HMIs, and drives, sensors, r- motor control center, whatever. and in all the engineering, programming, startup documentation, it's all built into that capital project, right?

[00:14:17] Dino: And so I think organizations need to start looking at it from that perspective. I mean, you have to have an overall think global mentality, but you gotta act locally. And that act locally means I gotta... I-- there's an overall plan. Now how do I start, implementing that overall plan on these CapEx projects that are coming in, Because they're just from an operational, operational budget, they're never gonna have the money for it, 'cause they're not really sure what it's gonna take to do it broadly, more broadly within the plan. It's much easier to, to eat the elephant in bite-sized chunks in a manufacturing facility as you tackle your, those projects that come in, but you have to have that overall plan, right?

[00:14:56] Dino: So I mean, that's, that's my view on how to get after this from a co- to deal with the costing aspect of it. it's never really a technology issue as much as it is a people and process issue,to har- to improve and harden cybersecurity posture. And, and so how do you get the two groups together?

[00:15:14] Dino: I was at a conference, two weeks or so ago in Nashville, ICS conference, and somebody was asking about IT/OT convergence, right? We've been hearing about that a lot, right? and it sounds great, but the challenge is, is that when you say IT/OT, you're automatically putting those two groups in their own camps.

[00:15:30] JC: Yeah, us versus them, right?

[00:15:31] Dino: Exactly. And so, the, the idea there would be we need to eliminate that, right? And just call it technology per se. But you have to get the OT ecosystem... There I go again putting them in a, in a camp. But you gotta get that group of people on board to what your overall big picture plan is, Otherwise, they just operate independently and do what they need to do 'cause they're competing on the project that they're, they're bidding on at the plant, new packaging line, and it'd be three or four, integrators in there that might be doing that. And so you're competing, And if you're fighting over cost, well, everybody, is going to cut where they can, which makes sense, and a lot of times it's things like your network, which is why we find a lot of, unmanaged layer 2 switches, buried out there in these control system environments because it was cheap.

[00:16:20] Dino: And the same thing with remote access, To go buy, Sekomia, EWAN, Toshiba box, Cradlepoint cellular modem, maybe leverage the Zoom, RDP types of te-tech that you might have to gain access to the environment, right? 'Cause they, they do it on the cheap, not recognizing the vulnerabilities and risks that they expose themselves to by doing that kind of stuff.

[00:16:39] Dino: So, it, it again, it has to be a, a, a vision at the top says, "Here's where we wanna go." We have to, we have to invite the OT ecosystem that we rely on to design and build and maintain and support these manufacturing facilities for us to the table to tell them what we're trying to do and how might they be able to help us.

[00:16:59] Dino: And that's a, that's a missing component, especially when you have CISOs that have a very short tenure in many cases. I mean, the tenure of a CISO today is in 26 months, right? it's very hard to get a lot accomplished if you've got 30 or 40 plants in your fleet to determine how you're gonna actually solve that problem.

[00:17:15] Dino: you might... So it's, it's... They have- there has to be a different approach to it, right? One being start thinking about your CapEx, adding this in. and two, s- bringing that O- OT ecosystem into your tent and start sitting down with them and having a conversation how they might be able to help you.

[00:17:34] Dino: That, and that can help solve the resource challenges that you have.

[00:17:38] JC: Well, yeah. I was actually just gonna transition to that, Dino, because now you're talking about, the OpEx side of things a bit, where, not only are we having difficulty finding the people, and I experienced this again as I, as I related in the energy industry.

[00:17:51] JC: But even in,and just in general of, hey, when you hire these really smart folks out of college or out of other organizations, you kind of want them to do, be doing,the highest value work to the organization. And so how do you get your people focused on the most important things, and then having other people who are experienced to handle other things?

[00:18:11] JC: And so the OpEx side of things comes into play, where it's like, hey, do I wanna hire four people in-house to do a thing? Or can I justify, let's say, not hiring those four people, but instead hiring a managed service that can handle that same job? It's a bit of a trade-off on the expenses. Hey, I don't need to hire here, or at least this is how it needs to be portrayed in front of the management teams and executive teams is, "Hey, I don't need to hire four people here.

[00:18:39] JC: What I'd rather do is hire, a managed service that can do the work of those four people, and cover, the... With more experience, more expertise,more backup, i.e., 'cause it's, they're gonna have all that experience and the knowledge of all the systems better than teaching four brand-new people how to do it."

[00:18:59] Dino: And I think that's one of the, the, the true values that IT can bring to the table, because they- they've done that. they've been doing it for decades, right? I mean, to the point where I- I'll see IT executives turn around and look at a proposal where it is managed services, and they'll be like, "Yeah, well, that makes sense to me.

[00:19:15] Dino: I get it." Because they already understand it. It's always the OT people that, that are kind of pushing back thinking that they can do it, right? And that's just not the case anymore.

[00:19:23] JC: Well, a bunch of engineers, we can all solve. I'm an engineer. I know it. I got the same disease. Give me a problem and I can solve it.

[00:19:30] Dino: That's right. That's right. but the problems have gotten... There's many of them,

[00:19:34] JC: right?

[00:19:35] Dino: And it's big. it's not just a small subset, right? It- it- it's... It can be overwhelming,when you think about,like you said, you mentioned the silver tsunami. For every two people that leave, all that tribal knowledge is walking out the door.

[00:19:47] Dino: Only one person's coming back in the door, right? And,and trying to do more with less, and we've seen it, right? We've seen the technology that, that these organizations have bought, and it turned into shelf wear Right? They just don't have the peeps to deal with that. how am I gonna remediate and mitigate, if I'm not even reviewing the data or IT's looking at the baseline of the cybersecurity intrusion detection system, and they're not sharing it with any of the OT teams at all,

[00:20:11] Dino: and setting priorities or direction or, to try to move forward. How are we gonna get better? every day you should be trying to get better.

[00:20:18] JC: Well, and speaking of which, I mean, that's... You hit right on one of the unique value propositions of having that single front door that integrates all those technologies, is gaining wider adoptions across the organization because- and wider, usage of it because now you've got one front door, you then have and can sub-segment access to the users, and only the users who need to use a thing.

[00:20:43] JC: But instead of going, and in Kasab's case, it's, it, you don't need... it all works through a browser. So effectively, it's easy to BYOB or BYOD your own device into that. Sorry, I was at a, I was at a tailgate, so BYOB at the tailgate, but BYOD into your environment. and, and ultimately control or have give access to and roll out these systems, update them every night.

[00:21:08] JC: You can run automated scripts. Like, we need to streamline operations in order to modernize. That's a big component of it. It's not... This shouldn't be a bunch of manual busy work. It should be things that can be automated and streamlined so that they are continually done, continually checked against, and continually managed against by a service, like you guys who can, can help walk in and, and make sure things are running smoothly.

[00:21:36] Dino: Yeah. yeah, and again, why aren't they tapping into that resource, right? And the question is, who should be doing it, right? 'Cause on the OT side, there's multiple integrators in a single plant, right? I'm, I'm working with a dairy company that's got seven plants, and they've got, over 20 different SIs, right?

[00:21:54] Dino: 20 of them, which amounts to over 250 different people with remote access into their environment, whether they're on-prem or remoting in, showing up with their, with their own BYOD, as you say, and- or remoting in from wherever they are in the world. and there's no oversight on any of it, right? and we've seen these breaches, again, going back to, the primary, access into these environments is through remote access.

[00:22:20] Dino: And it's piggybacking in or finding stuff that's been left out there and not turned off, hasn't, accounts not disabled, default passwords and credentials, all of that stuff that, we uncover through a lot of the, dis- discovery work that we do with some of the cybersecurity tools, just like IT would, For IT, again, this is something that they do every day, all day. and, and still are fighting the good battle, from a cybersecurity su- cybersecurity perspective. But on the plant floor in the OT space, it's not so much, right? So you have to pivot into those organizations that have the capability.

[00:22:53] Dino: We're not all the same, right? There's thousands and thousands of system integrators and machine builders out there providing a whole wide swath of automation control system stuff across a wide range of verticals, right? So whether critical infrastructure, food and bev, chemical, automotive, life sciences, advanced tech, you can just go down the list, there's integrators that are niche players, and then there are integrators that work across, a wide range of, of control systems, maybe a big Rockwell shop like we are, or Siemens or Emerson, take Ignition.

[00:23:26] Dino: but that all being said Th- that, that's a resource that's just not being leveraged, per se. More broadly, very tactical. "Hey, I need, I need a new packaging line. I need to integrate some stuff, between my, mixing and blending vessels and utilities over here", or whatever the case may be.

[00:23:46] Dino: Or I got a new machine coming in and can s- my filler's gonna go from, 1,000 cans a minute to 2,000 cans a minute, that type of stuff, that we do all day every day, right? And then do the maintain and supporting of that. But then the question is somebody came up to us and said, "Well, can you help us secure and protect that?"

[00:24:02] Dino: Well, we could say yes. And a lot of our colleagues and competitors out there would be like, no, that's not us." So anyway.

[00:24:09] JC: Well, speaking, speaking of, protection, let's maybe transition a bit and, there's a lot going on, and I'm sure there's a lot of scary stuff, or I know there's a lot of scary stuff that I've seen across the headlines coming recently.

[00:24:23] JC: And I think, you've probably ... You're on the, you're in the trenches experiencing that stuff where people are dealing with incidents, and we saw the recent,refrigeration issue and a lot of lost product there that cost a ton of money. We've certainly seen the water, breaches recently, which is critical infrastructure.

[00:24:40] JC: I remember back, as a energy analyst when Colonial Pipeline was, hacked and, they, shut down as a precaution the entire pipeline which supplies 45% of the eastern seaboard's,f- And ultimately, prices went up $3, which, didn't,which impacted everyone along that eastern seaboard.

[00:25:00] JC: So I mean, the incidents are, especially with the advent of AI, it's easier and easier for everyone to, or for, adversaries to do,and get access to and attack environments. And so what do you ... I guess the, the time is now. That's just why, it, it, I don't think you go or to a conference or listen to a podcast without people talking about the severity of the issue.

[00:25:25] JC: You can no longer hide anymore, and you talk about that assessment and finding assets, and, like, those assets can't hide. yeah, I mean, what, which, what's been your experience? What are you seeing from the trenches of people, having these fears about the next incident could be... The next headline could be me.

[00:25:42] Dino: Yeah. I, I, I mean, I go back 20 years ago when SQL Slammer came out, and the place I was working at lost three of their manufacturing facilities in the span of less than an hour. and the way we were able to stop it was by disconnecting the routers from the network to keep it from getting to the rest of the facilities.

[00:25:59] Dino: And, I can remember the, the vice president of operations b- basically saying, that's the single biggest thing that kept him up at night, was having another one of those. That was 20 years ago, right? and now here we are, with AI coming at us like a freight train, here, right?

[00:26:16] Dino: The train's left the station. and now you can, you can speed up, the things that were always murky and not well understood and weren't supposed to be connected, air-gapped, as everybody would like to say, around a control system environment's just not true. And the vulnerabilities and, vulnerabilities and risk associated with that stuff is extensive, right?

[00:26:36] Dino: They haven't patched it in years or not, i- if at all. and, and there's no security perimeter. There's, there's, there's no knowledge of what you have at the edge of your environment. you don't even have a good asset inventory. And so they got, All of these things that I'm citing, and now you've got AI that's gonna speed this up to be very disruptive to your environment in, no time We can hear you, pause.

[00:27:02] JC: Yeah, I mean, we're certainly,we see it across from a cybersecurity standpoint, in OT and outside of OT. Certainly the escalation of that and of those environments and the, rapid attacks that allow, let's say, less skilled adversaries to do highly skilled things, actually is a low, lowers the barrier to entry for people to come into environments that, you know, where before ransomware was a primary target 'cause it's quick access to cash.

[00:27:29] JC: you hold an environment hostage until you get that cash, and it's a quick payday. Well, the, the lower cost, the lower barrier to entry for adversaries to do things now means that they don't necessarily have to-- They can have a bunch of different, its quote-unquote, "mining operations" havering, happening at one time, where there may be mining data to resell that data.

[00:27:50] JC: So instead of holding someone hostage, they're using that as their, sort of a different tack, a different tact on money generation, where it's not necessarily about, a quick hit from a, ransomware attack, but instead a mining operation of data and IP and,that, that stuff.

[00:28:06] JC: Again, coming from me as an analyst, where data was gold to us, having that information, get exposed out in the environment could be highly detrimental to the future revenue, projections of companies. So it is becoming critical and something... it's again, going back to the beginning of this conversation.

[00:28:24] JC: It's, I'm, again, I'm a yes guy and an and guy, and I really like taking action. And so, we encourage people to take action as quickly as possible. and that's why, getting in touch with the, the Barry-Wehmiller Group, having services and softwares that can be utilized across, that don't put barriers up, but instead open doors.

[00:28:46] JC: that's an important aspect, I think, that companies should consider as they, look for solutions to problems is, I don't-- you don't wanna bring more problems into your environment, more barriers. you wanna open doors, and that's what folks should start to look for in solutions that they employ in their environments.

[00:29:04] Dino: yeah, I mean, the senior leadership in these organizations, I, I don't think that they, they... I don't think they have a really good grasp of what's inside these manufacturing environments per se, right? They're, they're relying, solely on the, on the local teams to be able to produce those goods, for, and generate the revenue, and lower their costs and reduce unplanned and scheduled downtime.

[00:29:24] Dino: obviously work in a safe environment, which they do a pretty good job of. But there's so many external, forces out there today that are beyond their control at the local level. And,that can be very disruptive. it was, we spoke with AI, remote access, the whole cyber situation.

[00:29:39] Dino: And, how, how you get that senior leadership to be more focused on this has always been, an interesting narrative that y- you don't know what they're thinking, right? Where do they go for,for the knowledge? Where do they drink from that fountain, to fi- figure out how to do this?

[00:29:54] Dino: And, and I know they sit on each other's boards and, they're all dealing with this at, at different levels and stages. But, as far as coming back and assembling, a, a commission of some sort, which includes the ecosystem, right? Not just internally, but the, the external ecosystem, and bring these folks together to figure out how they can drive forward to do that.

[00:30:13] Dino: It's, it, it's a bit of a quandary in my view, right? Again, I don't know why CISOs don't pick up the phone and say, "Hey, I need to sit down and talk to you guys about this expansion project you're doing, because I got a cybersecurity challenge in front of me. Here's what I'm thinking. What can you help me with?"

[00:30:28] JC: Well, luckily,you Dino in particular, and the Barry-Wehmiller Group is in the food and beverage business, so they don't have to pick up the phone. You guys can just go grab a beer and, and have a, have a good talk about it and see where you guys can help.

[00:30:41] Dino: And we've been in there for years, decades.

[00:30:43] Dino: designed your plant, devi- designed your packaging systems, the network that stuff runs on, the applications, the infrastructure. we've done it all for you in a lot of cases. Even if we didn't do that particular line in that plant, we did this one but not that one, we understand that environment.

[00:31:00] Dino: We know what, what's being used in order to, package goods. and, and, and so we can definitely help More broadly, right? It's not something that they're running towards at this stage. But I think AI's gonna change that game.

[00:31:14] JC: Yeah. I agree. Well, Dino, maybe we should wrap this up. I mean, well, I guess, you and I have rambled on a bit about a bunch of things.

[00:31:21] JC: I mean, what... I, I guess, do you have a top three points of wisdom, for people that are, concerned about their environments, considering, a change? Like, where,where would you go? Where- what would you point them to, to take action on,moving forward with a strategy?

[00:31:39] Dino: I mean, from a cybersecurity perspective, I mean, obviously the, the first thing we always go after is your asset inventory, right? Getting a really good, visual of your assets in your environment. And not just from a snapshot in time, but continuously monitoring them, because those environments are very dynamic.

[00:31:55] Dino: They're not as static as most people think. thinking about re- re- your capital plan, how to pay for it, right? if you're gonna spend several million dollars on a new packaging line, spending another 100 grand to get the right components, engineering, and technology out on that packaging line to improve your cybersecurity posture is a rounding error, for- per se.

[00:32:13] Dino: come up with a strategy for that. create an overall one globally, or, or, nationally, whatever you're trying to accomplish, but then you gotta act locally, right? and do that. and then when, when you're short, when you're talent-stricken, and can't find resources and get them trained and keep them, think of the managed services programs that are out there today.

[00:32:34] Dino: 'Cause it's... From an OT perspective, it's growing. Right? I mean, Rockwell's been doing this for a long time from a managed services perspective. They've done a pretty good job of it. but they can't do it all, right? I mean, it's, it's just too much. And so, their partner community and, and, and their competitor partner communities, the Siemens, GEs, et cetera,the, those system integrators are gonna have to start getting into the managed services game.

[00:32:58] Dino: I mean, a lot of them already provide support. The question is how can you do it in a managed services perspective versus, call me when your filler's not working, and I come help you with that. But what happens if it was a cyber breach that was causing that problem per se, and you're not tracking that?

[00:33:14] Dino: I mean, if we go into 10 plants, we're gonna find malware in two of them, right? That they didn't even know that they, it existed. And so, you really have to start figuring out, what do you got in your manufacturing facilities. You're gonna have to get to the edge. and a lot of clients don't chase that.

[00:33:28] Dino: They just rely on the local teams to try to understand that and deal with it. And, there's just, they j- they just don't have the chops for it.

[00:33:35] JC: Agreed. I mean, I, I'd also encourage people to look for, a culture, in an organization that works well with yours. Like you, culture and the collaborative environment of your service providers matters, and so finding a group that is easy to work with, that cares about what you care about, has got your best interest in mind is really important.

[00:33:57] JC: I would, also encourage people in the OT space in particular to not be afraid to lean into new tech, because, the environments are changing that rapidly. And just my experience in the energy sector was,and in OT in general, it's kind of like, let's wait, let's wait, and then let's act.

[00:34:14] JC: by the time you've done that, they... Especially with the advent of AI, everything's moved beyond you, well beyond you, and you are already, at, in a very vulnerable state. and all your revenue is at risk. And so, finding ways to act and even making small changes in the environment to prove it out are a great way to get started.

[00:34:34] JC: We often run, POCs with folks in small capacities just to get the proof points to show them this works in a small frame, and in a large frame we can, help, and alongside you guys can help scope all that out for anybody. And so just find small ways to act, and, and get started. Because the worst thing you can do, especially in the environment of today, is wait.

[00:34:58] JC: and the best thing you can do is just to start, to begin with,

[00:35:01] Dino: Yeah. There's a lar- there's a large amount of, manufacturers out there haven't even started yet. I mean, over 60% of them have not done anything per se to, to move forward on, the things that we've been talking about, right?

[00:35:12] Dino: They just kind of bump along and hope for the best. Roll the dice, right? Hope is not a strategy.

[00:35:17] JC: Well, thanks for the time today. I appreciate it. Always great talking to you.

[00:35:20] Dino: Yeah, same here.

[00:35:21] Intro - Outro: Thanks for tuning in to the Industrial Cybersecurity Insider. To stay up to date with our latest episodes, be sure to click the follow or subscribe button now.

[00:35:30] Intro - Outro: And if you found this podcast helpful or have a topic you'd like us to discuss, please leave us a review or let us know. Thanks again for listening. See you next time