FBI Alerts, OT Vulnerabilities, and What Comes Next

[00:00:00] (TEASER) ​

[00:00:00] CSI - Craig & Dino Ep.90 - Craig: Here's what it's gonna cost us. If that happens and goes down, or we lose that production line or facility or whatever you're looking at and. It's gotta go to dollars and cents. That's how businesses make decisions, is what's their financial risk to the organization and how do you mitigate it?

[00:00:21] CSI - Craig & Dino Ep.90 - Craig: People don't understand what they can't see and when they can't see all of those assets and all that inventory and all of that stuff, they don't understand it.

[00:01:01] CSI - Craig & Dino Ep.90 - Craig: Hi, I'm Craig Duckworth.

[00:01:03] CSI - Craig & Dino Ep.90 - Dino: Side bus.

[00:01:05] CSI - Craig & Dino Ep.90 - Craig: You got the sidekick part, right? So

[00:01:08] CSI - Craig & Dino Ep.90 - Dino: Happy Friday, correct?

[00:01:10] CSI - Craig & Dino Ep.90 - Craig: Happy Friday, Dino. What a beautiful fall day it is here in St. Louis. Love it.

[00:01:16] CSI - Craig & Dino Ep.90 - Dino: Yep.

[00:01:16] CSI - Craig & Dino Ep.90 - Craig: So as we. Look around and we got the art festival downstairs getting ready to kick off this weekend in Clayton, and all of the stuff regarding manufacturing of I, I look around at all this. I'm like, okay, so what, what are you thinking topic today? I'm thinking possibly, you know, as, as we're transitioning seasons, as we're transitioning around, how about we talk about the role of the CIO or CSO as it relates to manufacturing, which we've done a couple times and my favorite topic is you have responsibility. You don't have authority and how we can help bridge that? Is there a better method? Possibly?

[00:02:08] CSI - Craig & Dino Ep.90 - Dino: Maybe we ought put, uh, describe what you mean by that. Right. what, what is it that we, actually witness working in manufacturing environments? assisting with ot, cybersecurity strategies for clients, deploying technologies, providing services and support around these OT cybersecurity technologies, you know, as it relates to their industrial control system environment.

[00:02:32] CSI - Craig & Dino Ep.90 - Dino: Why is it that they have the responsibility, right? I don't think too many people argue who is your cybersecurity owner in the organization? So what do you mean that you don't have the authority?

[00:02:44] CSI - Craig & Dino Ep.90 - Craig: and what I would say is, and I I see this and witnesses all the time when I'm in a plant, is the CSO or whoever has the. Responsibility of ensuring cyber resilience for the organization as a whole that reports to the board or the CEO or whoever they're tasked by. They run into a roadblock and are often, what I like to say is kneecap when they get to the front door.

[00:03:16] CSI - Craig & Dino Ep.90 - Craig: Of the manufacturing site and you have operations or plant manager who's being tasked and reports to someone differently, and his metrics are production uptime, number of widgets. They make KPIs, safety and their different task, and he says, thank you for the offer to help. Cyber resilient, my facility, and take my plant offline for a couple hours to do your task.

[00:03:49] CSI - Craig & Dino Ep.90 - Craig: But no thank you. I've got widgets to make and I don't report to you. So there's the disconnect.

[00:03:58] CSI - Craig & Dino Ep.90 - Dino: It's more than a couple hours, right? I mean, think

[00:04:00] CSI - Craig & Dino Ep.90 - Dino: about it.

[00:04:01] CSI - Craig & Dino Ep.90 - Craig: Well, I was being kind.

[00:04:03] CSI - Craig & Dino Ep.90 - Dino: Well, and you have to step back and you have to look at, well, how does this technology get into my plan? And what I'm, and the technology I'm referring to is your industrial control system technologies. So your PLCs, the control system, network, the infrastructure to support those applications.

[00:04:20] CSI - Craig & Dino Ep.90 - Dino: You know, the networks that are there for the communications between, , control devices, again, PLCs as we talk about HMIS drives, uh, motor control centers, robots, you know, vs your pick flow meters. A whole litany of assets that are connected to the network. That's a control system layer. It's really out of the purview of the IT organization, And you really have to understand that. And I, I think a lot of organizations miss that piece. to the extent where it doing their due diligence, doing what they can, doing what they know. But then they're knee capped when it comes to that control system space because their, their role is very limited if it exists at all.

[00:05:07] CSI - Craig & Dino Ep.90 - Dino: In the decisions on what's being chosen in that space, deploying it, who's supporting it, how is it architected? You know, what is it supposed to be doing? Right. And, and there's, that's where we find this gap, right? Everybody talks about ITOT convergence. It's, it's a great soundbite. Of it is, is there's a disconnect on how these two groups operate between IT and OT and the roles and responsibilities, right.

[00:05:35] CSI - Craig & Dino Ep.90 - Dino: As we've said multiple times in some of these podcasts is, you know, if you're a ciso, you really are gonna have to start building relationships and bridges over to a lot of these system integrators and OEMs and your plant teams in order to really implement your cybersecurity strategy. Right? And, and one, one size doesn't fit all necessarily.

[00:05:56] CSI - Craig & Dino Ep.90 - Dino: You know, 'cause your plants are not the same. They don't have the same technologies out there. They don't have this equipment is of different era, right? You have control systems around measured in decades, right? Not just a few years. And the people that really know how that stuff works, how to maintain it, you know, what makes it tick.

[00:06:17] CSI - Craig & Dino Ep.90 - Dino: Somehow have to get onto your, um, advisory board, if that's what you want to call it for your OT cybersecurity, to assist you with your strategy to deploy and implement and maintain and support, um, an OT cybersecurity, uh, type, architecture within the environment. Right?

[00:06:35] CSI - Craig & Dino Ep.90 - Craig: Well, yeah, it's the same frameworks, conceptually, different technologies, different approach, different methods of doing it. But you're right. when the. Operational environment. The OT team decide what switching platform layer two dumb switches, Netgear from Best Buy, whatever they want to use because of cost goes in there.

[00:07:03] CSI - Craig & Dino Ep.90 - Craig: And they also make the decisions, they own the assets from the robots that you mentioned. They're responsible for maintaining them. If something goes down, they're responsible for updating them. They're responsible for working with the OEM for remote access. In, in situations, if there's an issue, that ecosystem that we've mentioned so many times is different.

[00:07:27] CSI - Craig & Dino Ep.90 - Craig: It's hard for someone on the outside a responsibility. Owner of security to dictate to an asset owner on the inside what to do and how to do it when they don't have skin in the game.

[00:07:43] CSI - Craig & Dino Ep.90 - Dino: Or there's bad experiences from prior activities that maybe it was trying to deploy, maybe some, let's say a firewall. And, and it's been maybe disruptive to the point where it's caused that un unscheduled downtime. Um, and so the OT teams get a little skittish around it just willy-nilly coming in and start, um, messing within the environment and vice versa.

[00:08:07] CSI - Craig & Dino Ep.90 - Dino: A lot of it organizations have been burned enough to say, you know what? I really don't want to get involved in that particular. Space. Right. But you have to, if you're going to improve your cybersecurity posture around those control systems, right? And, and the technologies that are being used for this, you have to make sure that you're, you're looking at the type of technologies that are built for the plant floor, just like the control systems, you know, and the technologies that are used, those PLCs.

[00:08:36] CSI - Craig & Dino Ep.90 - Dino: You know, when you look at the architecture of those things, how they're designed to live and breathe in an industrial environment. Well, these OT cybersecurity tools are of the same stripe, meaning that, the applications, the protocols, what they, machine learn on are of that same stripe. So you have to know that whatever tool you might be using in it, right, the round peg, square hole, it may not fit.

[00:09:00] CSI - Craig & Dino Ep.90 - Dino: And even, and so then maybe you said, well, now we're smart enough to know that we gotta pick an OT cybersecurity platform. Great. But then what does it take to really implement, administer, and manage and design that into my environment? Right? And if you've never done that before, trying to do it by yourself is a little bit of a recipe for disaster, right?

[00:09:21] CSI - Craig & Dino Ep.90 - Dino: Or it's gonna take you much, much, much longer. Especially if you're a, you know, you've got several plans, dozen plans, 50 plans in your, in your fleet. That task becomes. A huge hurdle, right? And so you're gonna have to rely on that OT ecosystem to assist you, and you have to leverage them. And if you're not doing that, you're putting yourself at a disadvantage.

[00:09:41] CSI - Craig & Dino Ep.90 - Craig: Well, you know. Look at the resources. The resources alone will normally dictate your ability to to scale across your organization and when you have one or two OT cyber engineers for 10. Or 25 or 50 facilities, do the math. There are 2080 hours in a year, and if it's gonna take you x amount of time per day to kind of help manage and advance and you know, operationalize that technology, you have a finite number that when you hit 2080, you're done.

[00:10:23] CSI - Craig & Dino Ep.90 - Craig: That's it. That's where you are capped at, you know, so whether that's a, a virtual. OT CSO that can help bridge that gap and work with the, the IT leadership that has the responsibility, whether that is outsourcing to an organization like ours, whether that is something to bring that resource to bear, however you think that it makes the most sense for you to get it.

[00:10:51] CSI - Craig & Dino Ep.90 - Craig: It's gotta be done. It can't, you know, it's, it's not feasible. It just doesn't work.

[00:10:55] CSI - Craig & Dino Ep.90 - Dino: You can't do this remotely either, right? Not, not initially. You can't do it remotely. You have to be on site. Right? We have a lot of clients where we see, um, it again, moving, trying to move the ball forward. Great. They're doing that, but they don't wanna go to the field, right? And so it's like, well, how do you plan on implementing your technology that, that your.

[00:11:17] CSI - Craig & Dino Ep.90 - Dino: Acquiring into a manufacturing facility. If you don't go to the field to go look at how that plant is put together. Right. And you just can't look at it from your, your networking perspective, you know, and the networking perspective being the, the network that it is responsible for on-prem at the site because there's other networks in there that it is not responsible for, and there's assets out there that it is not responsible for, and there's production activity that it is not responsible for the safety protocols that go along with it.

[00:11:48] CSI - Craig & Dino Ep.90 - Dino: So that being said, in order to really do this correctly and safely. And, and without being disruptive is to be on site.

[00:11:59] CSI - Craig & Dino Ep.90 - Craig: But I think that the, the gap is, it is so accustomed and so. Lackadaisical in their effort because everything they do can be deployed remotely. From a, we can push endpoint to every asset we own remotely. We can push the. Remote access through BeyondTrust or whoever it is to everything that we do remotely.

[00:12:27] CSI - Craig & Dino Ep.90 - Craig: We can deploy VMs remotely. But when it comes to manufacturing, there are so many differences, so many unique things that you cannot do remotely. The every single plant is different. The setup within a plant is different between cells from thick manufacturing of a. Automobile. You got paint, you got panels, you got glass, you got, they're, they all operate differently.

[00:12:53] CSI - Craig & Dino Ep.90 - Craig: Even though they may be similar in nature, you can't paint with one big brush and it work across , the uniform, but they want to save their money and they wanna take a, we want this technology deployed remotely into our environment. Okay. How's that work? Well just put it in there o Okay.

[00:13:19] CSI - Craig & Dino Ep.90 - Dino: Difference is, is that what you just described, or for the systems and network that it is responsible for. Right, that they, they have responsibility for if it doesn't work, if there's needs, if there's support that needs to happen, it has to provide that it is not gonna provide support for an issue going on between an H-M-I-A-P-L-C and drives that aren't working correctly.

[00:13:45] CSI - Craig & Dino Ep.90 - Dino: Right. They don't own any of those assets or any of those applications or the network that those things reside on. Right. That's completely outta their purview. And so when they do things remotely, it's usually around the things that they have responsibility for. Back to what you said, they have the responsibility, but I don't have the authority right back to the team.

[00:14:04] CSI - Craig & Dino Ep.90 - Dino: The authority means that in order for you to continue to, to provide greater depth of visibility within your industrial control system environment means that you have to have an inherent knowledge of that stock and how do you gain that? Right? And you can't do that from states away or continence away, have to be on prem.

[00:14:24] CSI - Craig & Dino Ep.90 - Dino: In order to really figure out how that that plant is put together in order to determine where do I drop my collectors, how do I configure them, how do I set up the network in order to get that span traffic up to that platform to start this machine learning and to start implementing these AI uh, activities around.

[00:14:43] CSI - Craig & Dino Ep.90 - Dino: Not only just the cybersecurity piece, but also the process integrity piece that comes with it, right? There's a huge benefit to the operations teams that when they get their a chance to see the data that's being presented and provided by these tools, they, they're the ones that want us, that have the epiphany.

[00:14:59] CSI - Craig & Dino Ep.90 - Dino: They're the ones that say, oh, I had no idea that this tool could do that. I didn't know that it could give me, um, information about PLC changes would be made in the environment or the communication flows between these devices, or I got rogue assets in my environment. Right. they're not thinking that way because you have to marry those two together.

[00:15:18] CSI - Craig & Dino Ep.90 - Dino: And right now, that's just not happening. Not at the level that we would expect to see it.

[00:15:23] CSI - Craig & Dino Ep.90 - Craig: Well, you know. How does a CSO that has that responsibility, how do they help bridge that gap? How do they get the two organizations aligned? Do they, is it walk to the plant floor, make new friends, try and understand, is it to bring somebody in from the outside that can consult and provide that inherent knowledge and that boots on the ground?

[00:15:49] CSI - Craig & Dino Ep.90 - Craig: For them, that liaison that reports back up to them to help do it externally. , How does an organization move forward? What, pieces of this are of, well, they're all available, but how do they, how do they take the next steps, I guess?

[00:16:05] CSI - Craig & Dino Ep.90 - Dino: Well, you gotta get all the liars in the same. For starters, right? cause even the vendor whose technology have chosen is not necessarily the best one suited to get, make this delivery happen. A lot of organizations, as we witnessed, will, um, leverage a resource from the vendor whose technology they're buying, right?

[00:16:26] CSI - Craig & Dino Ep.90 - Dino: You know, some se that knows the platform pretty well. Doesn't really know how to implement it, you know, into the level of getting it into the plant and setting up and configuring it within, within the confines of that plant. Again, you have to know the plants put together. And so in a way it's a disadvantage.

[00:16:42] CSI - Craig & Dino Ep.90 - Dino: You're paying a lot of money for, you know, uh, some system, uh, engineer who, whose tool you bought. Again, they're trying to do things from a remote, remote perspective and they, they don't know a lot about the plant. They don't know enough about the plant on how they can take their technology and really push it down into that environment

[00:17:02] CSI - Craig & Dino Ep.90 - Dino: deeper.

[00:17:03] CSI - Craig & Dino Ep.90 - Craig: Well, it takes a practitioner that works with the tools, that works with various aspects of those industrial networks, understands how they're architected, how they're laid out, what it takes to get those lower level assets and those cells up into that collector. It takes a lot of knowledge.

[00:17:23] CSI - Craig & Dino Ep.90 - Dino: And negotiations too with, uh, the OEM. Who, who is responsible for that piece of equipment may own it. You might be just leasing it from them, right? It's sitting on your network. but they, they have kind of barred the door to keep you from, you know, collecting that metadata that's in there. Or at least that nobody has sat down and had the conversation with them and, the right people in order to calm them down.

[00:17:48] CSI - Craig & Dino Ep.90 - Dino: When I'm saying them, I'm talking about your OEMs specifically. To say, here, this is what we're doing. This is why we're doing it, this is how we're gonna do this, and, and let, and let me explain it to you. Let me show it to you. And then it's a whole different conversation that doesn't happen with that particular group and any manufacturer, all you manufacturers that are listening this, you have OEM equipment on your plant floor that is maintained and managed and supported by that vendor.

[00:18:12] CSI - Craig & Dino Ep.90 - Dino: And they will tell you that if you make changes to that environment, you're gonna avoid their warranty. Now you gotta be able to demonstrate and show it to them. I'm not changing the configuration within that environment. I'm just adding something in there that's siphoning off the metadata out of that environment so I can get asset inventory.

[00:18:31] CSI - Craig & Dino Ep.90 - Dino: Then once I have asset inventory, I can determine what the risk and vulnerabilities are associated with that equipment that I can start making steps towards protecting it, whether it be remediation, mitigation, microsegmentation, you know, other, other technologies that I can implement. Implement a hard net cybersecurity posture around those control system assets.

[00:18:49] CSI - Craig & Dino Ep.90 - Dino: And you have to do that in a, in a manner where everybody is going along the same path,

[00:18:56] CSI - Craig & Dino Ep.90 - Craig: But I still go back to, you know, I got a CISO and you got somebody, VP of IT pick. Pick somebody that's kind of underneath them that says, Hey John, our plants are fine. I was at them last week and we're good. How do they validate? how can they trust but verify? You know, which we like to say all the time.

[00:19:18] CSI - Craig & Dino Ep.90 - Craig: You can't just rely on somebody else. To a degree you can, but you, you gotta, again, trust but verify. You have to know if you are responsible, back to that responsibility versus authority. If I'm signing on the dotted line to the board of directors that everything is the. Secure and we've adhered to the cyber hygiene that we as an organization culturally and fiscally believe is the right thing to do to the shareholders.

[00:19:49] CSI - Craig & Dino Ep.90 - Craig: And my name goes on it. How do I trust, but validate that information.

[00:19:56] CSI - Craig & Dino Ep.90 - Dino: Well, I think some clients are running into this a little bit with cybersecurity insurance, right? Um, because the insurance, um, carriers. Are putting an emphasis on asset inventory.

[00:20:07] CSI - Craig & Dino Ep.90 - Dino: Right. And if they know you're a manufacturer and, and you give them some data, they're gonna want to trust and ver but verify that, right?

[00:20:14] CSI - Craig & Dino Ep.90 - Dino: And if they find out they're only giving 'em half the story, well then they're gonna take a different course of action of how they're gonna provide you cybersecurity insurance, especially two fronts. One, you don't have a good asset inventory. The other side of that coin is what is your, your method and strategy to reduce the risk associated with those, right.

[00:20:32] CSI - Craig & Dino Ep.90 - Dino: How are you going about that? And, and I will tell you right now, working in, you know, plants all over the world and been doing this for, for multiple years, that's not happening. Even clients that have bought these tools and have had 'em for years still are maybe looking at less than half of the assets in their manufacturing facility because they just don't know how to get after it.

[00:20:54] CSI - Craig & Dino Ep.90 - Craig: Well, I think that they, I don't know if they don't know. I think that they're trying to. Do it cheaper, or they're trying to do it how they're accustomed to from an IT side remotely, and it doesn't work. First off, they don't recognize, maybe they do recognize, maybe they don't care that there are multiple layers of networks assets, everything underneath that top layer, PLC that they don't even know exist.

[00:21:28] CSI - Craig & Dino Ep.90 - Craig: That are adding to that which have vulnerabilities equally as much as the top layer. It's that east West. Control layer traffic that we often talk about, and those assets that are down there, that are outside of the purview of, of the IT teams that are saying we are good because they don't know, they're not seeing the forest, the millions of trees because they're standing in front of one giant tree and they can't look around it.

[00:21:59] CSI - Craig & Dino Ep.90 - Dino: And if you're talking to the plant teams, they may tell you that equipment is their gap, right? Well, how are you gonna validate that? It may already be in your baseline, but you don't even know. That, that that machine that they're saying is air gap is, um, actually really connected and it always is connected.

[00:22:17] CSI - Craig & Dino Ep.90 - Dino: And even if you have machines that are truly air gap, somebody's still walking in there at some point for maintenance and support and plugging it into the, into the plant network to get remote access to it. Or somebody's showing up with their laptop to plug directly into that machine center. And then you don't know what's on the laptop.

[00:22:33] CSI - Craig & Dino Ep.90 - Dino: Do they have wifi on it? Do they have cellular modem on it? You know, what, what applications and are they running that's on their machine, you know, how do you know they don't have malware on their laptop when they walk into your plant and they plug it into that space? You know, because it's completely underneath, um, the umbrella of OTs responsibility and it just doesn't know who's coming into the plant every day, all day.

[00:22:57] CSI - Craig & Dino Ep.90 - Dino: What cap projects are they working on? What activities are they working on? You know, they just don't know. And, and it, and it creates, like I said, a blind spot for the IT organization because there's a, there's a whole bunch of stuff going on in these manufacturing facilities that are just outta your purview.

[00:23:14] CSI - Craig & Dino Ep.90 - Craig: Well, it's the, the conversation needs to go from a CISO and they need to equate it to risk. What's the dollar value of the risk and how do you equate that and balance that security versus. Productivity. If it costs me a hundred thousand dollars to make my product every hour going down the production line, and my risk is $5 million because my outage is 50 hours or whatever that looks like if something happens, what's the cost to remediate that upfront and what's the meantime to recovery on the backside?

[00:23:58] CSI - Craig & Dino Ep.90 - Craig: So somebody, financial analyst. Someone can say, here's what it's gonna cost us to fix that. Here's what it's gonna cost us. If that happens and goes down, or we lose that production line or facility or whatever you're looking at and. It's gotta go to dollars and cents. That's how businesses make decisions, is what's their financial risk to the organization and how do you mitigate it?

[00:24:28] CSI - Craig & Dino Ep.90 - Craig: People don't understand what they can't see and when they can't see all of those assets and all that inventory and all of that stuff, they don't understand it.

[00:24:41] CSI - Craig & Dino Ep.90 - Dino: , That's the problem, right? I mean, it is a master plan. You know, most organizations have a master plan, and the master plan is going after obsolescence, right? It requires capital in order to determine. what are my most critical machines in my plant that without them, um, I'm not running very well, or I'm not running at all.

[00:25:00] CSI - Craig & Dino Ep.90 - Dino: Right? And then how do I put a capital plan together to determine what is end of life and what's in the support? Right, so I can put my capital plan together and prioritize which, which areas in the plant are am I going to tackle. Now, I would argue most manufacturers, that's the plant's responsibility, right?

[00:25:20] CSI - Craig & Dino Ep.90 - Dino: The plant's job is to determine what are my old assets that I have. And which ones are end of life, end of support, and which ones do I wanna prioritize in a capital plan that I want to go after moving forward, you know, whether the next three years or five years out on how I'm going to spend our money in order to, , remove this, obsolescence equipment, right?

[00:25:42] CSI - Craig & Dino Ep.90 - Dino: And, and anything new coming into your plant, it becomes in, is, is more highly connected, right? Anything new coming in is gonna have a lot more connectivity, a lot more data that people are gonna be chasing with those new machines. So, um, and that's the plant's responsibility. And so as, as an IT executive, how do you get plugged into that?

[00:26:02] CSI - Craig & Dino Ep.90 - Dino: Right. How do you determine what that master plan is? And, and you could be a great source of truth for a lot of that if you implement these tools in the correct manner, that you can provide that to these, um, manufacturing leadership teams to determine how they should be structured, their capital plan to go after the obsolescence that they have in their facilities.

[00:26:22] CSI - Craig & Dino Ep.90 - Craig: Well. Know as, organizations begin to transition that power from responsibility to to authority or put someone in that role to equip them with the power to make the change, to affect production risk parameters, you know. They've gotta take steps to look at the entire, let's call it supply chain inside that organization.

[00:26:54] CSI - Craig & Dino Ep.90 - Craig: You know, because again, we're seeing that you can't have one half of the equation and expect to make change. It doesn't work. You know, there are outside sources available, there are, you know, models that it is use forever from a, leveraging, All kind of different resources. You, you gotta, you gotta do something.

[00:27:17] CSI - Craig & Dino Ep.90 - Craig: It can't do the same thing over and over to expect a different result. That's insanity.

[00:27:22] CSI - Craig & Dino Ep.90 - Dino: Well, I think a lot of it depends on the type of organization, and this is a, we could have a podcast on this, the difference between private equity. They don't see manufacturing environments versus family run or publicly run companies, you know, that are, that are separate from a private equity group whose job is just to extract as much as they can out of it, spend as little as possible and extract as much as they can.

[00:27:46] CSI - Craig & Dino Ep.90 - Dino: If it's that type of an organization, which we've witnessed, they're not gonna do a very good job of this. They're, they're just not, they're just going to run it into the ground. Right. Until they, until they, it, there's no more use for that facility, whatever. Versus an organization who's moving in a different direction has a different plan.

[00:28:03] CSI - Craig & Dino Ep.90 - Dino: How to be, you know, a world class manufacturer versus a private equity firm that just has a different model. Right. And then we've seen that too. We've seen that dynamics between those types of organizations.

[00:28:15] CSI - Craig & Dino Ep.90 - Craig: yeah, you're right. So, as, I guess a, a final parting comment from my side, at least as you know, from an organization that's looking to create this ciso, give them the responsibility of overseeing security for the. Organization. How do they set 'em up for success With the authority as well, you know, is that.

[00:28:46] CSI - Craig & Dino Ep.90 - Craig: CISO is now the plant manager. Is it? Here's your get Outta jail free card because I'm not gonna penalize you for production downtime if I'm asking you to shut down the plant while we do these security upgrades. So you know, what is that mix? How do you task them so that the operations will go in and do what they're being asked to from a.

[00:29:12] CSI - Craig & Dino Ep.90 - Craig: Security standpoint without being penalized from a production standpoint because they're operating under a different metric.

[00:29:22] CSI - Craig & Dino Ep.90 - Dino: No, and I think it, and also under a different business model, right back to private equity versus. You know, a

[00:29:29] CSI - Craig & Dino Ep.90 - Craig: Yep.

[00:29:30] CSI - Craig & Dino Ep.90 - Dino: publicly traded company, you get a private company whose family may have started this business 50 years ago,

[00:29:37] CSI - Craig & Dino Ep.90 - Craig: Yeah.

[00:29:37] CSI - Craig & Dino Ep.90 - Dino: 70 years ago, and it, and it's grown, you know, um, you know, their, their mindset's a little different than what we've seen with private equity versus, you know, publicly traded companies.

[00:29:47] CSI - Craig & Dino Ep.90 - Dino: So.

[00:29:48] CSI - Craig & Dino Ep.90 - Craig: Great conversation and we could go on forever and ever with it, but Well,

[00:29:56] CSI - Craig & Dino Ep.90 - Dino: That

[00:29:57] CSI - Craig & Dino Ep.90 - Craig: yeah. Well, you know, everything's gotta change like the seasons, right? So,

[00:30:03] CSI - Craig & Dino Ep.90 - Craig: appreciate it.

[00:30:05] CSI - Craig & Dino Ep.90 - Dino: time.