Five Federal Agencies. One Zero-Trust OT Briefing. Most Haven't Read it.

Dino [00:00:00] the Cyber Resiliency Act over in Europe actually is doing a better job of enforcing regulations for,organizations that are based out of Europe but have operations in the States are starting to, push those requirements, those regulations into their clients here 'cause we're seeing failed audits.

Dino Not because they're failing an audit because of some regulation coming from the States based on what we're talking about that was just published. It's because of what the CRA is telling those European, companies what they need to be doing, Intro/Outro: Welcome to the Industrial Cybersecurity Insider. In each episode, we dive into the world of industrial cybersecurity. Join us as we cover the latest trends, innovations, and practical insights as we talk with leaders and practitioners across the industry. Gear up and let's get into this week's episode.[00:01:00]

Craig Hi, I'm Craig Duckworth

Dino I'm Dino Buxalci

Craig Dino, what's on your mind today?

Dino Well, we could talk about zero trust, right? Yeah. and what that means, and you talk about IT versus OT, We also hear IT/OT convergence a lot, but, and I still see a lot of IT versus OT.

Dino and a lot of it stems back to what you've heard me say many times on these podcasts, that the IT organizations aren't tapping into the integrators and OEMs and trying to get, a complete picture or a full understanding of the technology, and control system solutions that are within their manufacturing facilities, right?

Dino and really understand it, right? To the extent where,a single template may not always work for you, because your plans aren't the same. And, and you're not really in, interviewing those that are closest to your manufacturing processes and operations.

Craig [00:02:00] Okay. and I agree 100% with that.

Craig And I think that the timing is very spot on. I know that,there was a publication just issued on April 29th, which was a joint publication between S- CISA, Department of War, Department of Energy, FBI, and Department of State, that outlines adapting zero trust principles to operational technology, and their recommendation slash about an eighth of an inch shy of mandating zero trust in OT to help begin securing and applying those principles that you talked about to that OT environment.

Craig And this article talks about the differences in why it's not the same as an IT approach. So I think that the timing is perfect.

Dino Yeah. and how many OT organizations do you think are actually reviewing that material?

Craig My guess, not many of even know [00:03:00] it exists, but if you wanna reach out to me, I will send you the document.

Craig So there we go. So now everyone has access to it. How's that?

Dino Well, it, and one of the questions is it, getting back to the IT/OT, relationship getting tighter and aligned and collaborative, how many IT organizations do you actually think read or get their hands on a proposal that's coming from, a control systems integration group like ours, and what it is that we're pitching to the manufacturing environment?

Craig very few, if you wanna know my opinion. I, which I-

Dino I would bet none ...

Craig I, well, few is like two, so none is... I'm higher than you, but we're- Neither of us is a big number.

Dino Well, because it would roll back, right? Because if IT was reading those, they would have questions. And those things would roll back to the organization that's proposing this new expansion or line or life cycle replacement of control systems within your environment, that would have some of these, requests [00:04:00] around zero trust, around cybersecurity, things that IT should be pushing But it's not making its way to those folks that are actually pitching and proposing, control system solutions to their manufacturers.

Dino I see 'em. I even see 'em in our own proposals. it's a question when you look at the fact that you're gonna build a network, and you're gonna, you're gonna put control systems on it, And for those of you that wanna know what control systems are, I would learn what PLCs are, I would learn what HMIs are, I w- I would learn what, engineering workstations are, what drives are, and robots, motors and pumps, all these IoT or OT assets, Understand what's coming into your environment that's being touched, and none of these principles are being appliedto us to meet those requirements, right? So, and we see it if, with, the Cyber Resiliency Act over in Europe actually is doing a better job of enforcing regulations [00:05:00] for,organizations that are based out of Europe but have operations in the States are starting to, push those requirements, those regulations into their clients here 'cause we're seeing failed audits.

Dino Not because they're failing an audit because of some regulation coming from the States based on what we're talking about that was just published. It's because of what the CRA is telling those European, companies what they need to be doing, and they're just pushing that overseas. And at the same time, if you're an OEM shipping equipment into Europe, n- now you're being tasked with meeting those CRA requirements for machine centers that you're sending overseas.

Craig Well, it goes back to the CRA in Europe has teeth. Look at GDPR from a privacy in Europe. It has teeth. It has significant financial monetary impact for violations. Look at some of the stuff that the f- the US does. There's no [00:06:00] teeth behind it. there's no, I guess, reason that businesses should comply because the cost of non-compliance is irrelevant.

Craig it's minimal in compared to compliance. Maybe if there were, if you don't comply, if the fine was 20x or one times annual revenue or something that really hurt organizations, then they would say, "Hmm, I know it's gonna cost me $2 million to do this, but if I don't do it, it's gonna cost me $50 million," versus looking at it the other way and saying, this is gonna cost me $2 million to do, but- I don't think I'll get caught, and if I do, it's a $50,000 fine.

Craig Who cares? You gotta look at it that way.

Dino also in this country, depending on the administration, sometimes regulations ramp up. Other administrations come in, regulations ramp down, And I would say in the current administration in the United States, regulations are ramping down, right?

Dino so again, back to your point, there's no teeth in it.

Craig But if we go back and we look and we touch [00:07:00] a little bit on that proposal and is IT reviewing or looking at proposals for control system upgrades, modifications, whatever,you mentioned the network. In that, there's gonna be IT technologies.

Craig There's gonna be servers. There's gonna be switches. There's gonna be technology that IT very well may be interested in looking at or understanding And they're not

Dino No, yeah. I mean, operating systems, the firmware versions. when you think of the OS, you think of what IT goes through, to, to set up an OS, to harden that cybersecurity posture.

Dino None of that is being applied to these control systems that are bringing in Windows machines that are landing in your environment. and then sometimes what happens is we find that,for those organizations that are using VM infrastructure to run their HMIs, and their historians, and their OT application servers, and their engineering workstations, some of those EDR packages, antivirus, for [00:08:00] example, endpoint protection, is being applied after the fact.

Dino And then we find that it's being disruptive because it was never really designed and set up correctly to operate in that environment, meaning that IT and OT aren't working together to determine where that disruption may come when a scanning tool fires off, because CrowdStrike is starting to scan these machines, and it's being disruptive to the communications.

Dino It's, because it's taking resources to communicate to, connected physical systems in a timely manner. And if those connected physical systems do not receive timely communications, what do they do? They fault. they'll fail safe, right? And all of a sudden now my $100,000 an hour packaging line generating revenue is idle.

Dino It's sitting there taking a break. It's having a coffee. And OT doesn't even know why, because they don't know what that antivirus package is doing on those machines. who's firing it off and when. Are they really trying to work around schedules to make sure that those aren't impactful? Are they working with the [00:09:00] engineering teams who designed and built those things to determine, what are the resources required to do that?

Dino When's the best time to run that stuff? None of that stuff is happening, right? You're back to IT versus OT, not IT/OT convergence.

Craig Right. it's, it puts it back in the silo. It's, the ... So a couple things that were interesting after reading this article, back to kind of the topic here, is in this document, it

Craig Let me see if I can find it real quick. It really talks about some of the differences, and one thing I wanna kind of point out is on- the, the IT versus OT segmentation as you're going through this zero trust in your environment, you're laying in segmentation, it specifically calls out from an OT practice, the primary goal is protect physical processes, provide safety and [00:10:00] reliability, and prevent disruption, versus an IT focus, which is contain breaches, enforce compliance, and manage access.

Craig So now you have the, let's call them regula- regulatory bodies that are kind of trying to drive this are saying, "Look, safety and availability are a priority in the OT environment, and the approach should be with those in mind, not so much on an IT perspective where you're trying to manage data and enforce compliance."

Craig They're recognizing and hel- trying to shift that focus down.

Dino Yeah. Well, and the OT world i- is dealt with that in a couple of different ways, right? One is they set up it and they architect their control systems in such a manner- But that stuff never makes its way down to get the visibility to do that because [00:11:00] they're protecting themselves for everything you just said, safety, operational integrity, and protect the process.

Dino So what do they do? they put components in place to block that access, right? and we see it all the time, right? Because out of all the, these, cybersecurity tools that are being sold, these IT organizations are buying and they're seeing a third or less of their OT assets, still have huge blind spots throughout the manufacturing environment because they got jump boxes in there, they got PLCs with multiple Ethernet cards in them.

Dino they have local networks that they've put in that, that are NATted, et cetera, that are not visible to IT's purview, to be able to do any, this hunting that, or enforcement. And,and what the OT guys would say, especially the OT ecosystem that supply a lot of these machine centers and this technology and design and build these control systems, would basically say, "Yeah, don't do that stuff because you're gonna be disruptive."

Dino They break things. They, whether they push out patches, whether [00:12:00] they do their scanning, they make configuration changes to the environment that are impactful because they do it, on the fly in a lot of cases. it's not a,a well-thought-out process in order to do that because the IT people are too far removed from how that plant operates on a day-to-day basis to be effective, to be able to implement those solutions or those strategies or,enforcement of whatever regulations they might be after, from a data perspective.

Dino But it's still a disconnect. I see it in the proposals that are being written by these control systems integrations groups. I see it in the way these control systems are architected and set up. and there's just not any continuity between these two groups You know, they're not practitioners.

Dino At the end of the day, the IT folks are not practitioners when it comes to OT. How do you change that? how is the best way to change that narrative and flip it?

Craig Well, y- again, you have to begin collaboration. You have to start with the end goal in mind. You have to say, [00:13:00] "Okay, here's what we wanna achieve.

Craig How collectively can we work together to get that?" And both sides of that coin get what they need or as close to it as possible from the beginning, and there's some give and take in that process. I was looking at an architectural design of a network a couple weeks ago where the client was looking for visibility, and they were trying to figure out how to see their east-west traffic.

Craig And based on what they were using, the architecture that they have, they had t- top level PLCs with two NICs, like you mentioned. Below that was a set of DLR rings that were invisible to the top layer, and there were to the tune of 25 DLR rings underneath that, that they had no idea which represented [00:14:00] thousands of assets, and they wanted to know why they couldn't get to those.

Craig Because they were architected that way and designed that way when they were installed.

Dino Right. So how do you cross that divide, right? That you either have to have OT people who have the inherent skills and experience to drive improving that cybersecurity posture to get that east-west traffic in a meaningful way without being disruptive, right?

Dino And that means you, again, you have to be connected to that plant intimately, right? Not from 1,000 miles away. I mean intimately, right? And you need to be part of the, the upfront design and engineering of those control systems so that you understand what a DLR ring is. I mean, if I talk to most IT organizations, they have no idea what a DLR ring is and what it's used for, how it's set up, and what's in place to make that happen, even how it operates, right?

Dino Its topology. Yeah, it's [00:15:00] a ring. That's your topology, right? What protocols does it use? And what kind of switching technology are they using? How does that traffic flow through those devices that are out there with your drives and your PLCs? They don't know because they are not part of the design phase.

Dino So are you gonna put your IT people into that mix, or does the OT org ecosystem have to grow up and mature and be able to provide the cybersecurity solutions, strategies, and capabilities within the design of the control systems that, that they're putting together and run- and starting up and commissioning in these plants?

Craig Well, if you know that in the design phase your intention for this new facility is to incorporate technologies that are gonna have visibility into your assets and provide cybersecurity capabilities, then in the beginning phase, you should have at minimum a placeholder that says, "Talk about cybersecurity before we pencil to paper and design this whole thing and [00:16:00] pull all the cable and get it all done."

Craig So, that would've been an easy process and would've saved thousands, if not hundreds of thousands of dollars of trying to fix it after it was already done.

Dino Well, and I've been through a few of these exercises, right, where if you go to the OEM and try to get in front of what they're gonna pitch and propose,they will either turn around and say, "We're not doing it."

Dino they'll flat out tell you, "No, we're not doing that," or, "That's gonna add a million dollars to your project." And it's gonna take another six months or a year, right? On a capital spend where I'm saying on, August 1st of 2027, I plan to be up and running, not 2028 or 2029. working with a party that's not connected to my CapEx project to get it start up and running by August 1st of 2027.

Dino there's a d- and I've seen that. I've seen those go back and forth, and usually what happens is the [00:17:00] CISOs and CIOs and the IT, they don't wanna fight those battles. they just don't. And so they ignore it, leave it alone, which is typically what they see, 'cause if they were really trying to push their way in, they'd be calling organizations such as ours to say, "Here's what you have to design and build as part of this new packaging line that you're gonna put in these, this plant."

Dino And that's just not happening. It's just not. and I would argue it because, you're looking at one of the largest, food and bev system integrators in North America, and we have zero calls from CISOs and CIOs. Zero.

Craig Well, hopefully, if we kind of circle back around a little bit to this, the zero trust and, trying to layer in that into the OT space, hopefully this will facilitate some of those conversations.

Craig Hopefully they will take this and begin making those phone calls and going back to their [00:18:00] Rolodex and asking their OT counterparts, "Hey, I know we got like eight manufacturing sites. Who does our work down there? 'Cause we don't have any people. Who's doing our control work? Who's helping us when our stuff breaks?"

Craig And then maybe pick up the phone and call and ask, as they're trying to figure out micro-segmentation, trying to figure out how to implement this down in that control layer, 'cause it's not gonna be as easy as it is on the IT side.

Dino Well, zero trust OT,an OEM would say, "Well, don't connect it to anything."

Dino That's their, that's zero trust for them. And then you turn around and say, "Well, how are you gonna support me?" But you have to have remote access. I'm not gonna stay down for a couple of days waiting for somebody to fly out to this plant in the South 40 of Nebraska, to get me back up and running.

Dino No, you provide remote access for them to do that, and if you don't do it, they're gonna put it in themselves, them in the plant to get it done. Long story short, [00:19:00] everything's connected. They'll lie to you and say, "Yeah, it's not connected." Because they'll say that, "Because I got a PLC interacting as my, segmentation device."

Dino And at the end of the day, IT doesn't own that asset. Yeah, they can say, "Our company owns that asset." No, you- your OT people own that asset at the end of the day. They are the asset owner, and they are gonna determine- How to best manage and control and administer and support that, right? and they're the ones that don't have the cybersecurity skills.

Dino They're the ones that don't have the budget, they don't have the resources, they don't have the expertise, they don't have the relationships with the vendors, that supply this technology. They don't have any of that stuff, And you're not ... So how are you gonna build that? you're gonna have to tap into the OT ecosystem to find those practitioners that have the practice, that have the resources, who have the partnering relationships, who understand zero trust, who understand how to improve your cybersecurity processors, process, understand [00:20:00] security frameworks, right?

Craig OT's been left to their own devices for far too long and been forced to figure it out, make it work, come up with a solution. And we see it all the time from IT saying, "You can't have access to the internet in the plant." The plant says, "I need it for this. You c- here's the 45 hoops you gotta jump through to get it."

Craig Plant manager picks up the phone, calls the ISP, they pull in a separate line, they run it, and it's in there. And then IT comes to turn it off, and the plant manager's like, "Go ahead, turn it off. The whole plant goes down. Call the CEO, see what he thinks." And it's there for years.

Dino Or they'll put in a Cradlepoint cellular modem, Yep. And so is that z- zero trust, right? So it, it all sounds really good in theory, but in practice, how are you gonna get there, right? At some point you gotta get all the wires in the same room and really try to work through this, right? and we're [00:21:00] just not witnessing that. Personally, I don't think a lot of IT leaders really wanna own it at the end of the day.

Dino I just don't think they do. When you have a CISO whose tenure runs between 18 and 26 or 28 months, they're short-timers. You got 40 plants in your fleet. That person is never gonna figure this out. I don't care how smart they are or how connected they are, they're never gonna figure this out, in that realm.

Craig Well, and this, the advice of this briefing from CISA and the FBI and everybody else is ... And they talk about methods to do that, and one specific thing that they talk about is this is not a rip and replace scenario. we don't believe that's the right approach. We should layer on the zero trust, provide micro-segmentation, and use what you have today.

Craig I gotta think, Dino, there are some significant challenges with that approach. Not that it's bad, but [00:22:00] it's gonna be ... It's not just gonna be a check a box. So what's ... Give me some advice. how would you approach if you have a plant that's, let's pick a nice young one, 20 years old, and you're trying to put in some zero trust and some micro-segmentation, and the goal is you can't rip and replace everything you have, which you wouldn't do anyway.

Craig How would you approach it?

Dino Well, I, we had-- I was talking to one client last week,and trying to determine, they failed an audit. it, it really came be-because of the European CRA stuff, 'cause they're a European company, have operations in the States. They failed the audit. My first question w- to them is, "Well, how much visibility do you really need in your plant?"

Dino They go, "100%." And I'm like, all the way down in the, the level one, any device connected to the network, right? And then my next question is, "Well, tell me about the OEMs that you have." That you're gonna have to... And you've got dozens of them that we're gonna have to sit down, and you're gonna have to review your contracts to [00:23:00] determine, how do you keep from becoming null and void in trying to im- you know, implement changes in that environment that they will turn around and say, "Well, you're gonna void the contract for our support.

Dino You're on your own." So you have to wade your way through that. This particular client, their stuff has been out there so long that their warranties had expired. Now they have free reign to do what they want. But again, you're talking about stuff that's 20-plus years old, right? and still generating revenue, building the widgets that they build, that they sell.

Dino and so, you have to get through that, right? And then you have-- And then you go in and get your asset inventory. You really want to understand how your network's put together because in a plant, there's no singular network owner You have one from an IT perspective that owns the business systems in the plant, and probably if there's an IDMZ, they own the top half of that IDMZ.

Dino Then you get into there, and if you have a plant that's, let's say, a million square [00:24:00] feet and got hundreds of process area cell zones and lines in it, well, now you're talking about dozens and dozens of different networking solutions that are in that plant, right? Like the DLR ring we brought up, right?

Dino I mean, how many networks do we go into where that level two network, the control network, is just a flat layer two unmanaged environment, right? Right. A lot, right? And, and the question is, are you in the winner or the loser bucket, right? From a government perspective. So all that stuff that, the feds are pushing out on what you should be doing, are you a winner or are you a loser?

Dino Because they pick winners and losers. We saw that during COVID. which businesses can stay open, which businesses have got to close. who's the government gonna cater to on who they think should really be paying attention and doing this? Critical infrastructure? Yeah. But how good are they at it?

Craig Yeah. Well, critical infrastructure is already mandated for zero trust, and now they're [00:25:00] recommending in OT across other inf- other areas.

Dino Yeah, but how many municipalities do we come across, critical infrastructure, water, wastewater, and power, that are still not even close?

Craig I got the number.

Dino Yeah. Right.

Dino That's ... Exactly. So you can say whatever you want, but if you're not gonna put teeth to it, it doesn't matter. At the same time, this is a very small community when you think about OT cybersecurity. And, and so how do you, how are you gonna change that dynamic? You're really gonna have to rely on these partners, and there's not

Dino i- if there's 1,000 integrators in North America, I bet there's probably five or 10 that actually have practices to im- with cybersecurity partnerships, with resources on staff, a practice in place, and a strategy on how to implement zero trust and OT cybersecurity technologies and solutions within a manufacturing environment.

Dino Not very many.

Craig No, very few. very

Dino few. [00:26:00] Very few, right? And so a- as a CISO or a CIO, it's your job to find out who they are 'Cause if you're trying to really solve this problem, you're gonna have to work with them. You're gonna have to contact them and find out who's capable and who's not, and find out what they're doing in your environment on a daily basis, because they are, they're out there doing startup and commissioning, they're out there doing maintenance and support.

Dino they're out there with technologies, whether they're actually on site physically or they're remoting in. You need to get your arms around that. And if you're not willing to do that, then, you just stick to your business systems and call it a day.

Craig Yeah. and those CISOs, those organizations When I read through this Adapting Zero Trust document, it's extensive.

Craig There's a lot of stuff there. it's g- there's like s- five, four little bullet points. Z- why it matters. Back to this top, why it matters. Zero trust is now the operational baseline [00:27:00] for critical infrastructure where property adapted for industrial systems. It explicitly rejects rip and replace we just talked about.

Craig Designed for environments where cyber incidents can cause physical damage, safety incidents, or severe disruptions. Well, again, back to the OT space. And validates OT realities, including legacy systems, safety first principles, and passive monitoring. Again, IT organizations that are going to try and adapt this are gonna have some struggles, and the OT teams that are already tasked with 600 other jobs that are all not getting paid for 590 of those are not gonna wanna figure it out.

Craig They're gonna need help. They're gonna need guidance, and we and other organizations can be that support system to do that. It's... There's no reason to do this by themselves. [00:28:00]

Dino Yeah. Yeah, and it's not so much, trying to talk about, well, what our organization does. it's how do you build, a strategy that it's gonna encompass all of this, right?

Dino and it's very difficult 'cause it's been going on for a while. I mean, this is not a new thing, and OT's been at it for quite a while doing what they do. And they've been successful at it, per se. I w- But, I would also say that a lot of manufacturers have a lot of unplanned and scheduled downtime due to disruptions within the environment that they can't quite put their fingers on, right?

Dino and losing millions and millions of dollars a year into a black hole in the middle of their plant because they, they shoot from the hip when they make control system changes. Or IT has got enough hooks into the environment that they're disruptive doing the things that they're doing, right? Round peg, square hole, because they don't realize that scanning the network at the wrong time of day can be very disruptive to the plant or,implementing a, an IT cybersecurity tool that's pounding the crap out of my control system environment and being [00:29:00] disruptive, right?

Dino or at the same time, just ignoring, things that are shutting my plant down, right? Why is my filler not running correctly, Did somebody put a rogue asset in here? Did somebody make a PLC change? do I have malicious IPs in the environment? I mean, as an OT company getting ready to walk into a plant, I'd like to know if you have malware in here.

Dino Can you demonstrate to me that you don't have malware in your plant? What tool are you using? What data do you have to show me this environment is pristine and clean? and nobody, right? And I'm gonna touch your network. I'm bringing technology in. I got 20 guys showing up over the next six months with their own laptops.

Dino They're gonna plug right into your network to do programming of control systems, and you don't know what's on their machines. Nobody's looked at them, and they're connecting right into your space, and they're setting up remote access, and they have remote access on their laptops that they're bringing in, these engineering programming workstations, and you're not chasing any of that stuff, right?

Dino the question is, are you? How are you gonna get to zero trust when you look at what I just described? And this [00:30:00] happens every day, all day, in all these places. Now, you can fall back to critical infrastructure and say, "Well, our practice and policies are different." But if I ask those same questions, what answers would I get, right?

Dino Again, prove to me that you don't have malware in your environment. You can probably do th- in IT, you can do that, right? You can do that. You got the tools to do that. You have the inventory to do that. That's something that a CISO could pull up really quick in a report and show, "Hey, today we're good," right?

Dino They can't do that on the plant floor, And so how are you gonna, how are you gonna get over that hump? When you've got, when you've got 50 integrators and OEMs involved in your 50 plants.

Craig Yeah,it's a tall hurdle. I- we could have this conversation for the next five days and not touch on the top of it.

Craig So, but I think that for those that are listening, if you haven't seen the report, get your hands on it. Email me. I'll get you the report. You can get it on our [00:31:00] website. we'll make the report available. it's a public report. Look at it. Begin figuring out what is your strategy? Where are you in the process?

Craig What do you need to do? What guidance do you need? What support do you need? How far along are you? Start making a plan to begin addressing zero trust in your OT environment. you gotta start somewhere.

Dino I, I get it. So one of the largest North American automation technology vendors, and you know who they are, we've been talking about the events.

Dino where do you go to find ... if you're going to a pure OT event of some sort, some conference, one, there's hardly any IT people at these events, right? And cybersecurity in a lot of cases isn't even discussed, or if it is, it's such a high-level conversation that, that they can't make it realistic, on how they do it.

Dino Because the manufacturer who may have some people there, don't have that responsibility and really don't understand the [00:32:00] technologies. I mean, you throw out terms like Armis or Claroty or Nozomi or Cisco Cybervision, y- Dragos. You throw those names out there, they in a lot of cases don't even know who they are, right?

Dino And so this very large automation technology vendor who tries to go to events where the IT guys are, your CISOs and your CIOs and your InfoSec people and your networking people, the leaders of these organizations, they're not even attending those anymore because they don't have any conversations with those people in regards to, oh, well, we are a

Dino I think we're a big, customer of yours. As a matter of fact, we spend $25 million a year buying your stuff, maintaining and supporting it, and using integrators who are s- who cert- certified to use your technology. They're not even doing that anymore, right? So as a CISO, where are you gonna go to learn about OT cybersecurity?

Dino All right? this ecosystem we're talking about, if you're gonna go think you're gonna find that at Black Hat [00:33:00] or RSA or Cisco Live, you won't. th- these organizations are still in the IT realm and thinking that their IT practices are gonna work in your OT environment, And so then you have to start going to OT-specific cybersecurity events, if you will, and those are s- attended very minimally. where RSA or Black Hat might have tens of thousands, you go to an OT cybersecurity event, I just went to one down in, Atlanta last month, there was 200 people there my point is that, you're fishing in the wrong ponds, right?

Dino On either side of the fence to try to solve this problem, And the government, they're not practitioners either. they might be with their,Department of War systems that they use, from a military perspective, from a d- Department of War, Defense, whatever you wanna call it perspective.

Dino Their stuff. the power that feeds those places, they have [00:34:00] influence in there. But you can move out in- into, the middle of the country, these municipalities and these chemical plants and these, food and beverage plants and these pharmaceutical plants, you're not gonna find that.

Dino You're not. I just... it is. It is what it is, right? And, what's the right answer? if I'm a CISO, the first thing I'm gonna do is call my plant people and t- say, "I wanna know who the integrators are and the OEMs that we buy equipment from that are in my manufacturing environment. I need their names.

Dino I need to know who they are. I need to have a chat with them."

Craig Great. Great advice, and I would say spot on.

Dino That'd be the first thing I'd do. get them all in the room, and interview them to find out what their capabilities are, what kind of partnerships do they have, what kind of practice do they have, and, and start from there.

Craig Yeah. Great advice. don't do it by yourselves.

Dino You can't, 'cause you... If you could, you would. And if you [00:35:00] were doing it, we'd know about it because we're the ones that are standing down there in the environment fighting the fires every day trying to keep your plants up and running.

Craig All right, I think we've exhausted it.

Craig You guys have a great day. Until next time. Intro/Outro: Thanks for tuning in to the Industrial Cybersecurity Insider. To stay up to date with our latest episodes, be sure to click the follow or subscribe button now. And if you found this podcast helpful or have a topic you'd like us to discuss, please leave us a review or let us know. Intro/Outro: Thanks again for listening. See you next time.