Former NSA now Founder & CTO Breaks Cybersecurity Down: Satellites to Manufacturing

Dick [00:00:00] we're in the first little inch of the inch worm on understanding the impact of cybersecurity. we don't even have the sheet pulled up to understand what's under there yet. Intro/Outro: Welcome to the Industrial Cybersecurity Insider. In each episode, we dive into the world of industrial cybersecurity. Join us as we cover the latest trends, innovations, and practical insights as we talk with leaders and practitioners across the industry. Gear up and let's get into this week's episode.

Dino Hi, this is Dino Bussi, and today we have with us Dick Wilkinson, who's the CTO and co-founder of Proof Labs. Welcome Dick.

Dick Hi, Dino. Nice to meet you.

Dino So where are you located?

Dick I am in Colorado Springs, Colorado.

Dino you skier.

Dick No, I like the snow, but flat ground. Yeah.

Dino Yeah. We can catch up on that conversation later.

Dino Sure. I [00:01:00] just came out of the mountains myself a couple weeks ago, so.

Dick Gotcha. I love the mountains, but I, try to keep it at a slow speed.

Dino Well, welcome to the show. So why, why don't you tell us a little bit about your journey, whether you wanna start from the beginning and work your way to today or.

Dino Vice versa.

Dick Sure. yeah, we'll start with the history lesson and, and we'll come up to current times. So, um, the, the story begins as you can kind of see over my shoulder here. I was in the Army for 20 years and so we get to skip a lot of the story because there's 20 years that are all just kind one thing.

Dick I worked for the National Security Agency for most of my time in the Army. I did signals intelligence. I was enlisted for about five years and then became a warrant officer, which is the technical officers in the army. really enjoyed that and that experience set me up for a future in cybersecurity.

Dick I, Finished off my career. I had a bunch of great assignments and I had a lot of space exposure and ex assignments directly in satellite operations. So as we talk about the company and some of the things I worked [00:02:00] on now, that's where that started was in my Army assignments. my last five years in the Army were at Kirtland Air Force Base in Albuquerque, New Mexico.

Dick That's where I retired, I was a lab director. for a Secretary of defense activity there where we, we assessed technologies, in like a rapid sort of, capability. And so we had radio frequency, lab resources, and we also had a cyber lab. And once I got there, that's when my kind of branch over from.

Dick Very unique security things on the RF side to the more what we think of as it penetration testing. That's where that happened. that set me up for an opportunity after I retired to work for the state of New Mexico. I was the Chief Information Security officer of the Supreme Court, upon retirement.

Dick And then I got promoted to be the CTO, which is the statewide, judicial branch. So we had a lot of employees, big enterprise, all the, you know, judicial records. the permanent record type, resources that we had to protect. So it was really cool, opportunity to come outta the military and get to do that.

Dick worked there for about three [00:03:00] years. Did that during the pandemic. I forgot to put in my, bio that I was also at the, uh, water authority for Albuquerque and Bernillo County. So I was the CISO there for about six months. During that timeframe, I, started my company Proof Labs and we incorporated in 2021.

Dick While I was still working for the state, I believe, did a few consulting jobs here and there as we were getting the company stood up. but now we're full. I'm full-time cyber, you know, signals intelligence is in, in my background. and I've been, you know, a, a CISO kind of, Instructor and, and helper with writing courses and, you know, with, different certification programs and things like that.

Dick So really like being part of the community. And when I saw this, media outlet that you all operate, I said, wow, I think this would be a great resource to participate. So thanks for having me.

Dino Oh, thanks for, thanks for joining us today. So tell us a little bit about Proof Labs. So what's that all about?

Dick Proof Labs is a cybersecurity company that's focused on space technology. And as I mentioned before, the reason that we did that is, because I'm the [00:04:00] CTO, I said, let's, do what I'm most comfortable with and let's work in a space where there is high value assets that require a lot of.

Dick Security. we had started out on the iot side of the house and, and for your audience, you know, there's a lot of exposure to the explosion of IO OT right now. looking to try and make security solutions for more of the home user or, not quite commercial or industrial grade products. And we quickly realized that there's.

Dick Not a big motivation for security solutions in that space. I felt like it was a broad market, but there's not a lot of adoption for security there. And so we didn't really get much traction, did that for about a year. And then we said, all right, my partner, I have a, my co-founder and CEO, Rick Aguilar, we said we both have DOD background experience.

Dick He's been a contractor doing it, work for them for a long time. We said, let's go back to, the horse. We know how to ride and let's, let's go to the DOD and see what we can do. And satellites was just the right fit for us. So we make security software, that's onboard intrusion [00:05:00] detection for satellites.

Dick So that's a, a new field. And we're one of the first entrants into that market.

Dino so outside of government, how many commercial organizations are actually using satellites today for communications, especially around manufacturing, which is kind of our focus on the OT side, but

Dick mm-hmm.

Dino I'm guess oil and gas would probably be a big one, but,

Dick yeah, so oil and gas is a great example because they have a lot of,

Dick Backhaul requirement where there's remote, locations where there are people or there's just equipment and there's not usually people. So they're definitely using satellite. And then of course they've got, people that just need to use satellite phones and, and internet connectivity when they're out in remote locations.

Dick But there's, uh. Satellite is built in, in so many different parts of critical infrastructure that people don't realize. There may be your primary link that's gonna be terrestrial and maybe a cellular network or microwave, connection, but you've almost, in most places, if it's a critical component, you're gonna have some satellite connectivity there as well for, a bare minimum and emergency [00:06:00] way to contact that system.

Dick So honestly, the penetration of satellite use throughout. Any vertical, it, it's there. You just have to follow the network path and you'll, you'll find some satellite links in there.

Dino So do you see, um, see control traffic in the traditional OT type assets going across the satellite network? When I think about, you know, kinetic, machines.

Dino Versus just data comms, you know, for communications. But I'm talking about machine control, you know, or I guess like on an oil rig, you know, are they com using satellites to communicate with control systems on oil rigs?

Dick Yes, absolutely. Yeah. There's remote, control panels. There'll be some big central station that has, you know, eyes and visibility into the primary operations of, equipment that's actually deployed out there.

Dick And they'll be able to send commands and, you know, turn dials virtually. because everything's done on some kind of a virtual kind of dashboard now instead of mechanical dials.

Dino so it's intrusion detection system. So are [00:07:00] you, uh, doing the, the asset inventory, malware hunting, providing insights into, communication, past asset, protocols, applications.

Dino So yeah. OT IDS is what I'll call it. Okay. Declared the arm isn't in his OMI types of technologies that

Dick the way to describe it is, a lot of people don't think of satellites as a piece of OT equipment. And so while we're, while discussing it in this lane, I like to describe to people, especially in the space industry, if they're trying to determine where have they departed the IT network.

Dick And they may are now. Probably in an OT data stream. A good line of departure there in satellite networks is, have you left? TCP IP as your packet structure, and now you're in some other proprietary packet scheme that happens in satellite equipment. When you're at the satellite modem from the ground where the pedestals at, up to the spacecraft, you are most likely encapsulating TCP as an underlying data [00:08:00] stream, and now you've got a different overlying data stream on top of that.

Dick And that is an OT connection, right? That is not a standard signaling system that is not using regular. Act, you know, handshake, it's doing something else that's persistent and, authentication is happening in a different way. So that's a good example of how OT is part of a satellite network. As far as intrusion detection, we are on orbit.

Dick our software runs directly on the satellite. So we are watching, several different, attack surface, control areas within the spacecraft. And we're using automated, Sensors, which are machine learning algorithms that can watch the traffic from the systems inside the spacecraft.

Dick your vehicle, just like your car on the ground, it has an internal bus network and there's CAN Bus, which you know, a lot of the folks on this, you know, audience are gonna understand. Yeah. Can BUS is used in spacecraft. There are satellites that use the same vehicle bus structure with the same signaling.

Dick And so we are watching and [00:09:00] observing that type of bus signaling and we're able to detect anomalies in behavior, or in operational status of different parts of the spacecraft. So intrusion detection is, in this case, is a heuristic analysis of how is the spacecraft behaving based on previous understanding of nominal operations.

Dick And then being able to identify when even the slightest variation indicates that there's something wrong. one challenge here for space is that you can't automatically assume it's cyber intrusion. You have environmental concerns in space where you have space weather, and you have, performance and mechanical issues that can happen with your asset.

Dick And so part of our job will be to help those engineers who already respond when they get. Fluctuations in telemetry to understand, is that a mechanical fault or is that an intrusion that is masquerading as a mechanical fault? Is that the kill chain, right? That cyber intrusion is meant to perform. So that's, where we're at within, you know, monitoring things that can happen inside the spacecraft.

Dino Yeah, that, that's interesting. 'cause you know, that the sophistication at that [00:10:00] level, we, I would call that especially at the can bus level, the, east west traffic versus North South. And, um, which is one of the biggest challenges we see in manufacturing today is that that's not an area that they're really, it's not that they're not focused on it.

Dino haven't implemented the sensors or the technology at that level mm-hmm. To able to collect that metadata within that machine center to get it to like a, an IDS, system. So. Because, uh, my belief system is that ideally you want to build that in when you build the machine. Mm-hmm. And do it retroactively.

Dino It's just a little bit more disruptive and it's more costly and you have to have folks that are inherently knowledgeable of that control system architecture. Mm-hmm. The infrastructure, be able to put that in, versus doing it upfront, which is kind of cool that you're able to do that with these satellite systems that you have it built in.

Dino I call it the OnStar, right?

Dick Yeah. Yeah.

Dino You know, it just comes with the vehicle. Right, right. Like to see it come with the machines when you buy it, that that technology is there for you to use if you so choose to. Mm-hmm. You know?

Dick Yep. And we can do post, [00:11:00] deployment. So if you're already on orbit, we can deploy on spacecraft that are already in operations.

Dick we have a plan for probably two deployments this calendar year. We just wrapped up the, development phase and the proof of concept, which is the Air Force Research Lab funded effort that we've been performing on for about a year. so I like to give the, you know, give the props to the government, program here that.

Dick Sponsored us so that we were able to get this thing from, you know, back of the napkin napkin concept to something that's ready to go to space.

Dino so you guys are the, technology company, right? You develop the technology and the software?

Dick Yes.

Dino Are you also doing all the deployments and support, or you do have a channel or a partner community that you work with, with that?

Dino Or how does that all work?

Dick right now we'll be pretty hands-on with a lot of it. there would be some really mature, spacecraft manufacturers that could probably adopt the software into their internal processes and deliver the same type of, maintenance service or other faults monitoring services that they provide to their clients.

Dick So those are some of the folks that [00:12:00] could be the owner operator level support. but right now, especially with government clients. They're gonna want us to be hands-on, do the deployment integration, and then even probably help inspect alarms or, or issues in the future, you know, work with their engineering team to investigate those alarms.

Dino and so the gist of it though is the Proof lives technology is primarily for the operation and functionality of that, spacecraft, right? It's not for control of machines On the ground, right?

Dick Correct. Yes. It is protection of the asset that's on orbit. and, you know, we've got some coverage for inbound commands and for, protecting the memory in different parts of the spacecraft.

Dick But the data stream that's internal, that's going up and down on, you know, sort of the bent pipe that is obfuscated away from what we're protecting. Yeah. Okay. If the satellite's available and the data stream's moving, we're not inspecting that traffic right now.

Dino this is all new technology for the, the spacecraft, right?

Dino I mean, it's not like you've got competitors in this space that are doing this today, [00:13:00] right? I mean, correct. I haven't heard of any stories of where some of the OT IDFs platforms that we work with are actually running on, spacecraft. Right.

Dick No, it's definitely, it's, a migration of concepts from what works on the ground to how can you apply that concept in space.

Dick But you can't deploy a hardware, you know, firewall that weighs a lot of, you know, rack mounted space weight. You can't send that to space. there are probably, I'd say there's us plus maybe two other companies that are. Deploying similar technology or entering the market. there have been some satellite manufacturers that have looked into, building it themselves and they're finding that it may be something that the internal r and d that's required to maintain it and keep it running may be, you know, buy over build the buy option may be suitable for quite a bit of the manufacturers out there.

Dino Hmm. Interesting. So, um, given your experience what cybersecurity risks do you see across the industry today, especially from a spacecraft [00:14:00] perspective, but generally in the industrial world? What kind of challenges are you seeing, you know, from a cybersecurity environment?

Dick yeah. This, uh, one of the questions, you know, that I had reviewed before was, and I tried to put some thought into this and, and I think that there is a Opportunity to move from the old concept of the castle wall, you know, the external perimeter, and let's guard the perimeter and still have kind of a soft inside. I'm not saying that anybody in a CISO position is okay with that, but I think it's accepted, it's accepted risk in a lot of situations.

Dick There is misconceptions around zero trust and whether or not you can even use zero trust in certain OT environments. And so I think that right now some of the misconception that's still being accepted as, I don't know, common operation and common procedure is to really rely on that, external perimeter hard line for your cybersecurity and then have a little [00:15:00] more, gray area on your internal controls.

Dick And I think that's something that. Is past due for people to graduate from and fight the good fight internally. If you're a CISO or a security leader, C-I-O-C-T-O, I think it's time to get on board and start pushing the issue. If there's some issues you need to champion this year, maybe that's something you wanna talk to your leadership or your board about and say, we are relying on a, a concept that's pretty old and we really need to move forward.

Dino you're spot on. I like that. I like where, where you're going with that because I, have the same mindset that in our business from a manufacturing perspective is the CIOs, the CISOs, the CTOs, those that have traditionally that cybersecurity responsibility are not engaging the OEMs and the system integrators who are doing a tremendous amount of work in their manufacturing facilities on a pretty consistent, regular, daily basis, right?

Dino Mm-hmm. and because we're on that side of the fence, right? I, I put us in that OT ecosystem, not in the IT ecosystem. And you know, sometimes, you know, we're doing millions of dollars worth [00:16:00] of, you know, upgrades, brownfield, Greenfield expansion, lifecycle replacement, you know, new products that the, the client may be wanting to, to run on their systems and adjustments need to be made.

Dino And we just don't have that continuity between that IT leadership. And the folks that are on the boots on the ground, as I call 'em, that are working in plants every day, you know Sure. Try trying to drive an OT cybersecurity method so that I I like where you were going that, that needs to change.

Dino Right. And it does it somehow, we gotta get those folks engaged in. Who these organizations are. What are your capabilities? Who are your partners? What kind of practice do you have? What kind of partnerships do you have? What kind of services do you provide? You know, because I have a cybersecurity strategy I'm trying to implement, and I got this big gaping hole in my plans to the squishy middle, as you called it.

Dick Yeah.

Dino You know? Yeah. I, I call it the last mile, you know, in the plan. It's really, the last mile is kind of a blind spot for the it mm-hmm. Because one, they're not the asset [00:17:00] owner at, at the end of the day.

Dick Yeah.

Dino There's a lot of other d decision makers determining what that technology is and how it's set up and configured within those environments.

Dino It really doesn't have a, I hand into it. Mm-hmm.

Dick as I think I mentioned earlier, I was the CISO for a water authority and, that was probably my experience or my most, exposure to engineers that have that requirement for availability or safety. Their vote weighs more than the cyber vote or the it vote.

Dick Really the operational vote was, always gonna win the day. And that required, you know, unfortunately political, you know, thinking at times or a lot of relationship building to understand, hey, I under, I know that this movement has to happen. That's what it's gonna mean to me and my responsibilities.

Dick that's what you're talking about there as far as having that exposure to the boots on the ground. Why did you change that and who understood what was gonna happen when it got changed? How was the change management process, including somebody like the separate [00:18:00] leadership?

Dino Well, it's 'cause safety's always job one and priority number two is reducing, unplanned, unscheduled downtime.

Dino Yeah. And that's just not an area that it spends a lot of time in having to deal with. Mm-hmm. Either one of those and 'cause I've had CIOs just flat out tell me, I don't wanna be the SC a cop. Right. That's, yeah. You know, to them it's not like picking up a porcupine. No matter what you do, you're gonna get stuck.

Dino So they just learn to leave the damn thing alone, you know? Mm-hmm. I'm not saying that's right, but that's just been my experience, you know, and this whole ITOT convergence discussion, is, has been a challenge. Right. Sometimes we call it ITOT collision. Mm-hmm. The way those two groups have operated over, over the years, and, and they don't always sit down because one's revenue generating part of the business and the other one.

Dino Is kind of an overhead administrator, service provider. Yeah. Yeah. Right, right. shifting gears a little bit, let's talk about ai. Sure. So I just, got my hands on the, you know, the World Economic Forum that just was this past week. there was a report pushed out from, I think it was [00:19:00] Accenture that wrote it, that, talked about AI is, is really moved up the scale in regards to challenges with cybersecurity, both good and bad.

Dino Mm-hmm. So what are your thoughts on that?

Dick AI as a category, it's a tool. And so I'm not surprised that it can be used equally well in the, you know, black hat environment or the white hat environment. the motivation of the user of the tool is what determines the outcome, right? so the tools themselves rapidly progressing into situations where I think the biggest impact is that it lowers the barrier of entry.

Dick For a lot of people that maybe wouldn't have been able to technically grasp how to do a penetration test or even understand the results of a penetration test, maybe they understand how to run a tool, but then when they get the results back, they just don't know what it means. And so I think that has lowered that barrier of entry to a whole new category of people Now.

Dick Good or bad. Right? You, you know, you [00:20:00] say, well, having to learn how to build the set out of the erector set in the Lincoln logs, like that is part of it, right? And that is what you become. How you become a a well-versed expert is because you understand how the building blocks go together. But then at the same time, there's been lots of opportunities that we can look at.

Dick In the past where technology was adopted, you got those early movers that have to be the. The widget builders, but then it becomes an application layer type experience. And AI went from needing to understand how to be a widget builder in almost any AI application to, it's a fully user X, you know, UX experience.

Dick There's, there's no technology knowledge required. That happens so fast. And so I don't think, I mean, we're in the, first little inch of the inch worm on understanding the impact of cybersecurity. we don't even have the sheet pulled up to understand what's under there yet.

Dick That's, that's kind of my take on it.

Dino Yeah. 'cause I would, I will tell you that in the work that we've been doing for the last several years and working in the, in the manufacturing space, I've yet to find a [00:21:00] client that's got a hundred percent visibility into their entire industrial complex, per se.

Dino Yeah, right. It's hard. But if you're a CISO or CIO on the IT side, you've done everything you can within your power to have that asset inventory and understand the risk and vulnerabilities associated with those assets that are within. It leadership's control. But back to our earlier discussion on IT and ot, we just, we just don't see that, you know, and it, it's creating, you know, to your point about, I, I call it alert fatigue, right?

Dino When we put in these O-T-I-D-S tools, the amount of information that comes flying up and out of there, stuff that they've never seen, right? They think they have 3000 assets. You got 10,000 assets in this plant. Mm-hmm. Um, multiply that across, you know, 50 plants that you have, and all of a sudden it becomes just an overwhelming, you know, slog of data that they.

Dino How do I organize this? How do I prioritize this? What does this mean? without internal resources that have done this work. So then you gotta rely on maybe third parties, these consulting groups, you know, the services organizations and you gotta find them, and there's not very [00:22:00] many of 'em out there, per se.

Dino And the IT side there, you, you can, you can find it and from an IT perspective, but on the OT side, not so much.

Dick I think there's, um. And, well, it's been around for a few years already. I can say that confidently, but as I was talking about earlier, the, Apprehension around deploying stricter segmentation or zero trust, or, you know, increasing the level of scrutiny within your internal network.

Dick That's one area where AI, even a few years ago, in the very big offerings, you know, your, your Cisco and, and those levels. You know, Juniper and those kind of guys, they had that capability where it would sense the network for a couple days or a week, and then it would give you a, a menu of options as the person that was gonna configure the box to say, Hey, okay, these connections make sense.

Dick These connections don't make sense. Don't authorize those. And it was a way to fast track your deployment of a much heavier segmentation within your network where something that might take three or four people, you know, a couple of months to conceptually map out. Then start to execute. you know, you got there in about a week or [00:23:00] two and then a week or two of tweaking and only one person doing it for a few minutes a day.

Dick So that's just one example that's already five years old. so I can only imagine I haven't peeked into that, you know, in the last couple of years how robust some of those capabilities are Now.

Dino Yeah. Well, and the infrastructure is still light. I mean, the, the lifecycle of of OT assets is measured in decades, you know, it's not in a few years.

Dick Yeah.

Dino we still find large flat networks that are out there in these plants. So you got, I, I call it the dogs and cats or living together, you know, so. Far as the communications, they're not doing the microsegmentation. And even if they are, they're doing it at such a high level. They're not down in that control layer to determine why is utilities talking to my filler, you know, per se.

Dino Mm-hmm. On the packaging line, that that conversation doesn't need to happen. And if you're talking to the plant, they don't know why that's there. So then you gotta wind your way through OEMs and sis to determine, yeah. Why, why is

Dick there a dependency? Yeah. If I, if I disconnect it, what happens? Right? And I'm an army guy, right?

Dick So I'm, I'm [00:24:00] authorized to pull the plugin and stand there and watch and see what happens, right? That was my doubt. I was the guy that said, yeah, we can do that. So

Dino the plant people don't like doing that because

Dick no, we weren't making money with our stuff. We were doing other things. You know, there was no revenue associated with pulling the plug.

Dick It

Dino could have been a safety issue. They think something. Bad could really happen. Does damage equipment or somebody get hurt?

Dick Mm-hmm.

Dino Or just, you know, the loss of revenue that you might sustain, which I've seen that happen. I've seen somebody pull the wrong cable and shut a plant down for a day and they lost a million too.

Dino because the furnaces came down, you know, and you can't stop a furnace when it starts shutting down. You gotta bring it all the way down to a safe state before you can bring it back. That takes a day. Gosh. So now I've lost a day of production because somebody pulled the wrong cable and the network froze, and the control system said, I'm out because I can't communicate.

Dino So they fault, safe, you know? Yeah. And they start making it, they, they orderly shutdown.

Dick Right. It's that easy.

Dino Yeah. I, I always say that when it comes to an event, the first responder is your operator. It's not some IT [00:25:00] group, it's the operator, you know? Sure. She's got, you know, so

Dino well, is is there anything that you want to touch on that we haven't touched on?

Dick Mm-hmm.

Dino in our discussion here?

Dick Yeah.

Dino Any

Dick topics? Well, As we've been talking about, and I know earlier I said, we're talking about segmentation. There was, an item that I had mentioned when we were setting up the show about, there's a new device that I want to tell people about and it is something that I had never heard of.

Dick and I got an opportunity to do a bench assessment, a cybersecurity assessment on this device, do a vulnerability exposure. And that was about three years ago. I did a project with some college interns and, it was, you know, it was a great opportunity and it was a proof of concept for my company. I. As I worked on this device, I understood how it worked and I was, it was one of those situations where I could immediately see the application in so many different, locations, industries.

Dick I called the water authority that I had worked at and said like, you guys have to see this right now. I was reaching out to my old military office and telling them that I wanted them to see it, and so. [00:26:00] After about a year of working with the company and, and I decided I didn't wanna do any evaluations for 'em in the future, I wanted to tell people about the, the device.

Dick And so this, this device is called Firebreak. It's from a company called Goldilock. they have started most of their work over in Europe. They're a UK based company and they've got a big footprint in Europe, but they're in the US now as well. And for this group, the application for any OT or, or industrial, situation is that this device is a layer one air gap device.

Dick You can put it in at your, at a rack or at a, in a data closet, and where your inbound internet connection is coming in, it's got multiple ethernet ports lined up. It just looks like a regular piece of rack equipment, but the top one in the bottom one, you know, inbound and outbound. The technology inside of it that allows you to pull the plug remotely is that there's a motor behind those two wires and there's a servo that rotates a metal connection.

Dick And so when that metal connection rotates in one direction, it opens and the wires are no [00:27:00] longer connected. And then when it rotates back, it closes. And now your network's back online.

Dino Mm-hmm.

Dick And so you can remote control that device through a bunch of different ways. there is a data port on the back so you can have it on a separate network.

Dick If it's controlling one down network and you wanna remotely just have, you know, a way to interface with it, with a dashboard, you can do that

Dino management

Dick management interface. It's got a little management interface. Or it's got, SMS capability, which is what I was most interested in. So you could deploy it somewhere, put a SMS, you know, cell phone card in there, and.

Dick Text message the box. You text message a specific string of characters, and that's the command to open or close, whatever numbered port you want on there. Or you can send it a, like an emergency command, close all open all, and you get that feedback right away to somebody's console, even if it, you get a text message back to you and back to the control console and it's within a second.

Dick Well, you send that text message as, as the latency is of the network is the longer delay, the actual open or close. You can do that once a second. You can [00:28:00] pre-program it as well. So if you don't want to have a sim card in it, you just want it to be able to know, you know, if it's on and live and it has a clock associated with it, you can say, be open from this time and close it this time.

Dick And so that capability of, you know, let's say you got a station. I live near the mountains. You've got a radio station up at the top of the mountain and it's, it's your, trunk mobile radio that talks to all your crews that have all their trucks. And you, that thing starts to have problems. It takes you maybe a whole day to drive up to the mountain, check on it, see what's going on, replace something, come back down.

Dick What if you could just turn it off, isolate it, right? There's all sorts of, as we were talking about earlier, the outstations that you have for any kind of industry. If you've got a remote location and it's got internet connectivity, and then it's got that satellite dish right there, you can open or close that connection as needed.

Dick Maybe you want to control your bandwidth so that you're not using up money, and it's not even a security need. It's just a way to make sure that it's only talking when it's supposed to. there's 20, 30 different applications.

Dino So [00:29:00] it's a human, human in the loop, right?

Dick Yes,

Dino per se.

Dick Yes, there are ways to do it without a human employee

Dino so you can program it. So like you said, I want to open between 12 and two on Saturdays and so you can schedule,

Dick you can also API trigger it. And so we had some use cases where, let's say you have a security system. The security system is pretty advanced, so it can draw a box around an intruder and if somebody's at your gate trying to get in or there's somebody inside the facility and the security camera system sees that draws a green box and says there's a person that can hit an API disconnect your network.

Dick So there's a lot of different ways to trigger it, and there's a lot of different ways to manage how data's going in and out of it. You can make it sort of a, a man trap port for data. So data goes in, if you've got a DMZ, you can send data into one area, disconnect the network, and then allow the internal network to come get its download.

Dick That way you don't have a full connection open if you're doing something like firmware updates.

Dino Yeah. So is it like a container?

Dick It is physical [00:30:00] layer one only. there's no IP address associated with those ports It's just the cable connection in and out right there.

Dino Right.

Dick Yeah.

Dick You're

Dino controlling that serbo.

Dick Yep.

Dino Yeah.

Dick That's cool. So it's, it's just a really cool device that I think if, if anybody listening is, has the light bulb has gone off for them, and they have air gap concerns, Something to look into. something that I think, you know, I say I'm an evangelist. I want critical infrastructure to be protected, and I see this as a way to really be able to throw the switch, so,

Dino perfect.

Dino Very cool. Yeah. Back in when I started way back in the day, and I'm talking eighties, we used to have the old AB switch, remember? Mm-hmm. Mm-hmm. Yeah. To deter, to, to open or close comms based on, you know, whether I wanna move from one system to the next, or I want it to be offline until I want it to be online for somebody to gain remote access, per se.

Dick Yeah. Yep. Yep. So there's just the modern version of that. And then they do it on, um,

Dino almost like A PLC. I mean, that's how PLCs operate,

Dick right? Yep. And, it's got whatever ethernet and fiber, so there's, [00:31:00] there's different options. Yeah. So just something that I like to share the word anytime I get a chance to talk to different, different industries and different folks.

Dick yeah. So I, you, I appreciate the opportunity to mention that.

Dino I think a quick que, have you ever heard of Chasm Technologies, chasm? You ever get a chance to look it up? It's in the, it came outta the DOD space. Been in there for over a decade. It has to do with, not, it's not anything to do with what PROOF labs, but it's more of a workstation streaming.

Dick Hmm.

Dino Right. Yeah.

Dick I can't say that I have, yeah.

Dino It's something worth taking a look at. We're looking at it for, for managed services platform. I didn't know because you came out of the military, if you, if you'd come across chasm as KASM is, is what it is.

Dick Yeah. No, I have not.

Dino Okay. Well, I think some of your brethren from from your military days, Are very, very familiar with, with chasm. So it came from that space. It's just now kind of inching its way out into the commercial world. Gotcha, gotcha. Lived now, so. Well, it's been great. It's nice meeting you.

Dick Thanks, Dino. I, yeah, appreciate the opportunity and as I had said, you know, I think it'll [00:32:00] be an easy day for both of us, so it is been a great conversation.

Dino Yep. You're not going to S four, are you, at the end of the February OT cybersecurity, conference down Florida?

Dick No, no. I stick to space, you know, if I have to travel, I try and keep it directly, you know, space, customer focused. It's, we're in go to market mode, so I'm gonna have a lot a lot of movement around needing to go to conferences.

Dick To people about satellites.

Dino Yeah. You haven't been to space, have you?

Dick I wish, no. funny story there. I, when I was deployed to Afghanistan, I got in touch with, there's an army major that worked at the, at nasa. And, I said, Hey, I, I figured I'd, I'd use the, I'm in a war zone, so you have to talk to me.

Dick 'cause otherwise I knew he'd just be like, you're not, you're not qualified for this at all. And just like, hang up on me. But I, I managed to get a phone call with him and tell him what I, I wanted to be an astronaut, right? And he said. Yeah, no, you're not. You're the wrong type of everything as far as what the army is concerned to be an astronaut.

Dick So like, I don't know, get outta the army and then maybe you could be an astronaut. [00:33:00] So when I put in the call, I did

Dino well. Good. All right, Dick. Thank you.

Dick Yeah. Thanks Nina. Take care. Intro/Outro: Thanks for tuning in to the Industrial Cybersecurity Insider. To stay up to date with our latest episodes, be sure to click the follow or subscribe button now. Intro/Outro: And if you found this podcast helpful or have a topic you'd like us to discuss, please leave us a review. Or let us know. Thanks again for listening. See you next time.