From NSA Threat Intelligence to Factory-Floor Cybersecurity

Tim [00:00:00] tools don't solve security problems.

Tim Security is, is really a discipline. It's a process, and it's a discipline, and your point to tying it to lives, a lot of folks tie it to compliance. Tying it to lives makes a lot of sense,

Intro - Outro Welcome to the Industrial Cybersecurity Insider. In each episode, we dive into the world of industrial cybersecurity. Join us as we cover the latest trends, innovations, and practical insights as we talk with leaders and practitioners across the industry. Gear up and let's get into this week's episode.

Craig Hi, welcome. Today with me, I have Tim Hoffman. Tim, why don't you go ahead and give the audience a little bit of background about yourself, kind of where you're from, what you've done, and, and why you're here today?

Tim [00:01:00] Well, Craig, I'd like to first say thank you for having me on. I'd like to thank the audience for listening.

Tim kinda, I s- I think I, I could say this best by saying I'm a little long in the tooth. I started in the Navy in 1969 with, an entry into communications. I did networks. Back in those days, there were networks. I did sophisticated signals processing, o- offline cryptography work. I got a commission, and then I w- progressed through, signals intelligence, communications intelligence, electronic intelligence, ECM, ECCM, all that stuff.

Tim Then I served as the, NSA director of threat for two years, and, that was the foundation that actually taught me security is operational and consequential, and it directly shapes mission outcomes. After the Navy, which was, my, my first retirement I was on the team that, was, designated by the Secretary of Defense to architect the, what's called the DITSCAP.

Tim It [00:02:00] was a security assessment framework that later migrated into DIACAP and later into the risk management framework for the DoD. after that, I directed 80 security programs at ITT. I've managed a large transitional group for the Space Launch Systems range, both ranges at Vandenberg and Patrick Air Force Base.

Tim I served as a chief security officer at Moore Health for nearly six years. I led security engineering at UCSF for five years. I've, worked as a consultant for, GRC for American Express and the, Arizona Supreme Court. In each environment, whether it was military, industrial, healthcare, financial, or judicial, i- there was a reinforcement that cybersecurity is not

Tim We call it cybersecurity now. We've always called it security. It isn't IT hygiene. It's mission integrity, and people's lives are on the line when you have something called operational technology or, [00:03:00] OT, something that people need every day, and it can't be shut off

Craig Yeah, no, I- that's an, an extensive background, and you're 100% correct when you think of OT, you think of operational technology and the mission critical aspect of that, where human lives most often can be affected, whether that is chemical reaction, that is, a saw, a, that is whatever the situation is.

Craig In most OT environments, it does have a physical aspect to it. So you're 100% correct, and that's, you know, it, it brings a different level of concern and responsibility than that of, "Well, my email's out for the next two hours. I'm just gonna go to the park and walk around."

Tim [00:04:00] Interesting. Very, very interesting.

Tim One thing I did leave out, and I, I should mention, I spent, three years on the midnight shift putting beer in bottles at Anheuser-Busch. It's not on my resume, but it was an area-

Craig Fantastic

Tim It was an area where we actually had to, look at PLCs and operational technology that shouldn't shut down because you would be losing a lot of money if the beer lines ever stopped.

Craig And there are a lot of very thirsty people in this country- ... and world, and that would have been a disaster. So I am glad that you oversaw that, and we made it through it just fine. Nice. So let's, let's do this. Let's talk a little bit about, p- and, and part of it is as you kind of walk through your background and your history, your precursor to what is today the, the CMMC, or let's call it supply chain management, let's call it whatever, third-party risk, [00:05:00] how- however you want to address it, and the importance of that within the OT and in general the cyber risk assessment.

Craig how do you see that playing today, and the real value of organizations that are trying to understand the weakest link in the chain that they have today?

Tim Wow. That's a, that is an amazing ... Well, no, that's an amazing question because my decades working on what I was told and know to be mission-critical systems made, industrial security, made OT security completely unavoidable.

Tim when I saw defense contractors treating CMMC as a compliance checklist rather than, some type of operational transformation, which is what the, the whole point of this is, it's a cultural change, [00:06:00] but it's, it's more than IT. It's designed to help the culture understand the importance of mission-critical.

Tim And, manufacturers, any, any operational world

Tim Cybersecurity is operations. It's part and parcel of operations, and it can't be isolated from an OT environment just because somebody says, "Well, that's an OT environment, don't touch it." I saw a gap, and that gap really drives me to focus on critical infrastructure, so much so that I volunteered, I- the crazy person that I am, in Arizona for the InfraGard.

Tim It's a, it's a, joint venture between the FBI and, and private sector companies to improve cybersecurity, and I'm the designated communication sector chief for the Arizona InfraGard now.

Craig Oh, fan- fantastic. that's a great role.

Tim it's important because the [00:07:00] difference, between ... there's a gap, and the difference is either not having cybersecurity or being able to do the job and seeing it not, not seeing cybersecurity as a barrier, but seeing it as an enabler to help the business get to where it needs to be.

Tim Does that make sense?

Craig Oh, absolutely makes sense, yeah. And it's, it's a critical role. often organizations will have a designated person responsible, whether that's the CISO, that's a CIO, that's a VP of IT, it's, it's whoever it is. title or not, it's often one person has the responsibility of security for that enterprise.

Craig what I would say is we so often in OT see, let's call it misalignment with that individual because [00:08:00] while they will often have responsibility, they most often do not have authority to affect any change within the OT environment because their background is IT related.

Tim Yes. Yes. You, you have- you've nailed an issue.

Tim one of the ways I think, though, is that any C-level executive has to match the board, the executives, the investors, if you will, in some cases, has to match the, I'm searching for a word. the person who comes in in that role can't be the king or queen of no and say, "No, you can't have this.

Tim No, you can't have that," or, "No, we can't do this. No, we can't do that." The goal of that role is to figure out how to keep the business running, just like all the other executives in the business, and that role has to take on a, [00:09:00] a shawl or a, or a, a, a protection for the business to keep the bus- that's the mentality, keep the business running because it's so mission-critical, and, gain influence and gain influence with all the executive stakeholders so that they understand.

Tim Not ... You don't sit down and teach IT to an OT crowd. that's not gonna work. It's not gonna play very well. at the same time, you have to adapt a way of revealing the risk in financial terms. There has to be a translation process, and I think when you make the jump from, a security engineer or a cy- cyber analyst or something into that role, you have to be able to show clearly how a, a risk could affect the business negatively, and then what's the probability of that, meaning not just talking in raw probabilities, but how much certainty do you have that we can keep the business running after we get hit?[00:10:00]

Tim Does that make s- Does that make sense? It's, it's kinda like in the ship analogy, if, if you took a torpedo, would the whole ship go down?

Craig and I would say depends on where the torpedo hit the ship. but yeah, no, it definitely makes sense to me. I think that organizations that make the effort to try and work together where a CISO or an IT person spends a day in the shoes of the OT teams or comes down to the plant, walks the facility, has enough wherewithal to know that they don't understand all of the aspects and nuances that the OT team does, and asks questions, and generally makes the effort to learn how it affects their side of the fence and their responsibilities will somehow gain that trust and [00:11:00] respect of the OT teams to be given some of that authority to make changes and represent change possibly.

Tim I think you just, you just captured it. Leaders have to care about three things. Can we operate? Can we keep operating? Are we protected? And what does it cost? And as a leader, you have to take the time to actually understand Outwardly what the business is doing, but you also have to take the time inwardly to understand what the business is doing.

Tim So you have to understand the business you're in, and most businesses are not in the cybersecurity business. They're in the business of making beer or making cars or, or in one case where I was, an assistant public works guy in, in the Navy, we had a water treatment plant that had to work 24 hours a day or it got really really bad.

Craig Absolutely. And we're seeing a lot of, you know, issues today in the last

[00:12:00] recent with water facilities being targeted, whether that's from nation states over in the Middle East, if that is, whatever it happens to be, we're seeing a lot of publicity, a lot of press, a lot of focus put on municipalities to try and store up and beef up and really protect and take a hard look at how are they securing their OT around that, because that is something that is absolutely a, a real life today situation.

Tim it's in the news, it's in the news every minute, and,the, the question hits, you know, what's the best way to communicate the risk? And it has to come down to, cost. It has to come down to can we operate? Can we be protected? Can we still operate after we take that torpedo, and how effective can we do the business of doing the business?

Tim Now, in the case of a city, the city [00:13:00] has to keep running, but, water treatment plants are not always owned by the cities. they're owned by private firms. So the private firm is gonna have investors, the board, and they're gonna be asking, "Well, what happens if..." And you should, if you're a CISO, you should be bringing those, those items to the table in a tabletop exercise maybe.

Craig Yeah, no, and I, I think that any public utility, whether it's water, that is power distribution, power generation, it's not a... I think that it's a little different than what's the cost, but I think that cost should be equated to potential lives. Because in the event that fresh water is, let's call it tainted, or if it's becomes- polluted or damaged or, you know, the controls are putting too much chemical into that water where it becomes unsafe to drink or whatever the situation is,

[00:14:00] then that organization needs to look at what's the cost of human life in that situation?

Craig Same with power. If there's no power, gas in the middle of the winter in Upper Peninsula of Michigan, people are gonna freeze. If there's no air conditioning in Southern Texas in July, people are gonna... They're- you're gonna have heat-related deaths. So it really should be looked at not from a financial aspect, but from a cost of life, which is often the case in OT environments, whether that's in a manufacturing plant, that is in any type of OT scenario potentially.

Tim that's well said. Thank you. a lot of folks believe at the, at the, at the level below the CISO that tools are gonna solve security problems, so many folks bring that mentality with them when they transfer into the [00:15:00] CISO role. And quite honestly, tools don't solve security problems.

Tim Security is, is really a discipline. It's a process, and it's a discipline, and your point to tying it to lives, a lot of folks tie it to compliance. Tying it to lives makes a lot of sense, especially here in Arizona, where the temperature yesterday was 114 degrees, the day before 114 degrees. People will die.

Tim it's just that simple. in the northern, Michigan Peninsula, people will die in the middle of winter if there's no electricity, so I absolutely agree on tying it to lives. I think the board might ask, in order for them to be able to carry the conversation, they will ask, "Well, how much is this gonna cost to, to protect those lives?"

Tim And I think that's where you have to be not a math genius, you just have to be able to be sure that you're detecting and responding to the real threats, and you're [00:16:00] conveying it in real terms that the board can consume

Craig Yeah, I think that, if you look at it and, and what's the cost, you know, maybe the cost is in human life.

Craig And the answer is you can't afford not to do this. You know, it's... And it really, when you think about it, you know, I've got, friends that are like, "Are we going on vacation?" I'm like, "I can't afford to go on vacation." They're like, "You can't afford not to go on vacation." If you look at the aspects of how it translates to decompress from, from the stresses, look at it from rejuvenating so that you come back stronger and better and you're more creative, and things like that.

Craig So there's a, a different way to view it. And, it's a just a different mentality.

Tim It's a very different mentality. I, I, I think a lot of organizations, not necessarily in the OT world, but a lot of organizations, don't [00:17:00] understand their value that they represent to an adversary. I think in the OT world, people understand they have to be always on.

Tim and their prioritization in the OT world is more, effective than the IT world. I think that's a comparison that, we could make.

Craig Yeah, I would, I would say true statement. It's like- The technologies in the OT space don't allow for as much of the automation, meaning endpoint detection, meaning, MDR, meaning a lot of those ca- capabilities that you can run those agents on IT-related devices.

Craig You can't necessarily run those on some of the PLCs, the HMIs, the OT piece. So it's, it's not an apples to apples comparison.

Tim Yes. I, I would, I would agree with you. I, again, I go back to that whole idea of [00:18:00] security being a, a process, a discipline. it's not just patching something. And I think that the checklist, the people who believe in the checklist are IT people, and they won't convert, easily over to OT until they, they touch it, they feel it, they see it.

Craig Yeah, but it, tech... When you look at security in general, I think that we as a society have moved past or should have moved past a check the box mentality because it's not getting us anywhere. And now that the adversaries are doing two things. One, they're using AI to their advantage to enhance and escalate the attack vectors more quickly, and they are recognizing that the OT environments are the cash registers of the organization.

Craig So they are [00:19:00] now targeting, whether that's through a business email compromise and they're laterally moving to get to the OT space. However they get there, it's they are focusing or trying to get as quickly as they can into the OT environment. And you can't say, "I've got a firewall," because that doesn't work.

Craig Every organization that's had an issue will say, "You know what? We had a firewall. We didn't do anything with it. It was set to any, any, but we had a firewall." Or, "We had to open it up for X, Y, Z, and someone forgot to close it," or whatever the situation is

Tim your, your point about AI, leads me to a question for you.

Tim H- how do you feel AI is going to change the way you are communicating with the executives and the boards that you come in contact with? how do you feel AI... To me, a, a lot of [00:20:00] security people that I've heard are saying the sky is falling. I'm not ready to say the sky is falling. I think that's the wrong message to send to the board.

Tim what's your message to the board?

Craig well, the message is definitely not the sky is falling. I think the message is, AI has a place. AI is being used as much or more for good as it is for bad. My th- my, my message is if your organization is using AI, there should still be human checks and balances.

Craig Someone's gotta use a gut check. Is this answer look plausible? Is that an, an anomaly? Is there something that says, I don't know, that just might not pass the sniff test"? Are you... Do you have those in place? And you cannot rely exclusively on [00:21:00] AI-generated answers or processes to, to run your business. You still need that human in the middle, that loop process and the continuous improvement that may not come with just AI.

Craig So if those things are in place It's okay, but you can't just rely on AI, would be my message

Tim I think I'm going to say I'm violently in agreement because I think we still need the, the person, and I can give you... Because I've been using AI for a few years now, I can give you some examples where AI has come back and said, "I know that you have a mandatory requirement for me to triple check everything, but I assumed.

Tim I'm sorry. I won't do that anymore." And I have to tell you, that's scary. it- to me, it's not 100% ready for prime time, and yet people are bringing it in, and that brings [00:22:00] us back to the CMMC discussion because in the world of CMMC, if you don't know your environment, you can't get your environment to be assessed properly.

Tim Just like in the OT world, you have to know every switch, every, every IoT device, every IIoT device. You have to know everything that's out there. And bringing AI in on a browser and using it actually brings in something into your environment that the people who are in charge may or may not have authorized.

Tim So that's a, that's a big red flag to me, is like slow down. Let's just hold on. Let's identify it. Let's analyze it. Let's see what harm it could possibly do. But absolutely keep the human in the loop, put the guardrails up, make sure that... I actually, told the group, I did a presentation on AI and cybersecurity, and I said, "We don't need [00:23:00] guardrails.

Tim We need a prison for- ... for AI." Yeah.

Craig Well, if you look at the last couple times that the AI model hacked out of the box it was in and it... because it was looking for... I'm like, hang on

Craig a second. You've seen that with OpenAI, you've seen that with Anthropic. You've seen these models are becoming, I, I would say, almost uncontrollable in a sense

Tim that's a very big concern because that, that breaks the three things, those three questions I keep going back to. Can the business operate?

Tim Well, if AI attacks it, maybe not. Are we protected? If you're in the role and you want to tell the board, "We're protected," you have to have some level of certainty when you make that statement or don't make it at all. And then the third one is what's the cost? Well, what's the cost if, if a human life gets affected?[00:24:00]

Craig Yeah. You know, it's, it's- It's good and bad. There's, it's, AI is, is a double-edged sword. It's helping both sides advance quicker. You know, it's helping automate some of the responses, it's helping to create better playbooks in the event there is an issue, but it's also advancing the threat actors much faster.

Craig They are exploiting the vulnerabilities much quicker. What was normally a week, a day, a month, is now minutes. They are exploiting some stuff almost instantaneously.

Tim you're spot on, and that's the concern. Again, security being a discipline and a process, we need to get those processes down and we need to know how to act and react with AI.

Tim That's a very, very good point, Craig.

Craig Yeah. So let's, so if you were to go back and you were to look

[00:25:00] at, let's say keep it simple, two things that organizations that are, are trying to better get a handle on third-party risk, on how to begin improving some of their processes today. what would you say one or two key components, key takeaways, key action items that, not trying to eat the elephant in one bite, one little piece of it or one little chunk of it, or, or where would they start?

Tim I think you, you've nailed it on the head. where should we begin? where is the right place to start? And define the processes that you have today in not, I don't wanna say excruciating detail, but define them to the [00:26:00] level that someone, I think we can agree, McDonald's. When you go to McDonald's, you have standards.

Tim You have, the, the food comes out the same, comes out the same temperature, everything's the same. Define your processes and then enforce that discipline over time so that security becomes a process as opposed to a new shiny tool or more budget or, "I need 20 more people," or, "I need this, I need that."

Tim Define the work in the business so that it becomes the process, and then stick to it with discipline. Those are the two things that I think, process and discipline, and, it sounds super basic, but it is a cultural revolution. It's so hard to have people, because they think as soon as you say the word cybersecurity, we've made the whole world too hard.

Tim It- people roll their eyes into the back of their head and say, "I'm, I'm done. I'm out. I'm gonna tap [00:27:00] out."

Craig it's gotta be made simple. you look at... and I, I agree with the methodology that, that you're saying, is it's gotta be where people, it's comfortable for people. You know, I look at the training for, kids.

Craig look at what they do for children that are in elementary school through middle school, from a fire drill to a tornado drill, depending on their location. You know, they practice it monthly. They go through that routine. If it's not culturally drilled into the organization to all of the different levels, they're not gonna do it.

Craig You know, if I were to walk into an organization at... And I don't wanna start at the top, I wanna start mid-level down, where they're in the trenches, and I would say, "Let's take a pause for five minutes and-" [00:28:00] Let's pretend that you just had a cyber breach. What's the first thing you would do? Most of them would be like, "I don't know."

Craig Because, but they're the ones that would be dealing with it. It wouldn't be the executive team because they're not getting the information until the phone call comes to them. But if the first person doesn't know who to call or what to do or how to react, it could be hours before that message is communicated to the right team.

Craig But if they practice it for 30 minutes once a month, and you were to walk in and ask the same question, it would be a different response.

Tim Agreed. I agree with you. I just read an article where they said that, you should have enough people on your incident response team so that in the case of a breach, someone could leak it to the press.

Tim However, you should contain that incident response team to the people

[00:29:00] who actually need to know, because we tend to overshare. and you just nailed it so perfectly. It's the school drills. It's the kids who, stop, drop, and roll. The, the, that whole o- idea of you're in an OT environment, you need to keep the process consistent.

Tim And, you need to be able to assemble an incident response team where maybe everybody knows what to do in an incident, but you keep the team small enough to actually respond to the, the threat that's happened, the breach that's happened, the problem, if you will.

Craig Yeah. It's got to be as basic as safety on the plant floor.

Craig You got to think cybersecurity, digital safety. You've got to think this is no different than everyone knows where the, the big red E-stop button is. Everyone knows the drill if the ammonia starts leaking out of the refrigerant, and then where, where to go, what to do. It's got to be that simple, and people need to understand it.

Craig It can't be this mystic [00:30:00] mystery- portion that no one knows what to do.

Tim so I don't get to put on a wizard hat and-

Craig You

Tim do ... and have a long beard and wave a wand and say this- You

Craig do if

Tim you

Craig want.

Tim No. No, I don't. I want it to be simple. I want to simplify it for people because it, it's, we use so many big, complicated words, and all we're trying to do is protect the information, protect the business.

Tim That's it. We're trying to keep the systems running so that the systems can produce the effect that they're supposed to be having, which is giving electricity or passing water or whatever it's doing, keeping a hospital operational. Those kinds of things are critical to our environment, to our entire society.

Craig Yeah. You know, you got, there's three s- three legs on the stool. People, process, technology. The people and the process are the critical portions, and the technology is designed to augment and support the other two. But without the first two, the technology is, [00:31:00] means nothing. What a great conversation. Tim, this has been phenomenal.

Craig I appreciate your insights, your guidance, and hopefully the audience has, has gained something. Any, any final parting things that you think makes sense?

Tim I simply want to communicate my thanks to you and to the audience for taking the time out of your day and out of their day to listen, because I think everyone, on the planet is tuned into the word cyber.

Tim we just need to tune into the word process. We need to tune into the word discipline. We need to focus on OT as the lifeblood of what this country needs. And yes, some of those systems are pretty old, so we need to think about, you know, what can we do to protect them, to protect the information, and to protect the company.

Craig Yep. No, great parting thoughts. It's, that's, it couldn't have been said better because as you know, and most of the audience knows, a [00:32:00] lot of the controls that they're dealing with could be 15, 20, 30 years old, and you can't just go in and turn it off and patch it and expect it to work again.

Tim Craig, thank you so much.

Craig Yep. Thank you very much. Great conversation. We appreciate it.

Intro - Outro Thanks for tuning in to the Industrial Cybersecurity Insider. To stay up to date with our latest episodes, be sure to click the follow or subscribe button now. And if you found this podcast helpful or have a topic you'd like us to discuss, please leave us a review or let us know.

Intro - Outro Thanks again for listening. See you next time.