Asset Inventory and Management the IT versus the OT Way

[00:00:33] Dino: Hi, I'm Dino Boussalaki. I'm the chief tool pusher. I mean, chief technology officer at Delta Technology. And today I'm working with one of my colleagues and his name

[00:00:43] Dino: is.

[00:00:44] Jim: allegedly Jim Cook, , when I consider myself as, the COO here at Delta Technology, the former IT guy. So welcome everyone to today's podcast, where we'll be talking about, what are we talking about today,

[00:00:57] Jim: Dino? Yeah,

[00:00:58] Dino: We're going to talk about OT and IT asset inventory and what the differences are between these 2 environments. We're going to share some pictures with you to demonstrate the environment that we are talking about. So, for those of you that are pursuing security frameworks, NIST being 1 of them, everybody knows that the number 1 security tenant is.

[00:01:18] Dino: Asset inventory. So the question is, is how do you obtain asset inventory of your industrial control systems or OT assets, as some people like to classify them, comparing that to IT?

[00:01:32] Jim: and I'll get to take, the I. T. perspective being a former I. T. guy for those of you that don't know. that's where I came from, know, and I go way back. And when I joined the organization years, but I was that I. T. guy, right? I was that I. T. guy where. frankly, there's a lot of surprises. So, uh, I'll take that perspective along the way as, discussed bit of the differences between, getting to IT inventory management, no T

[00:02:00] Dino: wouldn't sell yourself short. I mean, you've been in the field, I mean, for those of you that know us, , we consider ourselves as practitioners, meaning that, we work in these environments, So we wear the uniform, as I call it. The uniform consists of safety PPE, you know, your personal protection equipment, hard hats, safety glasses, safety shoes, high vis, maybe fire retardant if you're working in a refinery defense.

[00:02:21] Dino: So that being said, going to give you a little bit of a taste

[00:02:24] Dino: of the type of environment that we're

[00:02:26] Dino: looking

[00:02:26] Jim: Dina, you were just mentioning the whole PPE thing. And the thing that I want to bring up is, let's just say I didn't never had steel toe shoes before I started working with you here. and that's, our biggest issue in it was, getting the it guys to wear closed toe shoes, much less steel toe shoes, wearing,

[00:02:43] Jim: pants and not shorts. that was our uniform,

[00:02:46] Dino: well, recent as last week, on a job it people involved, both from the vendor and from the client perspective, and we're getting ready to go out and do the tour on the plan for when I say tour, it's just not to go out there and Visually look at their environment.

[00:03:00] Dino: It is to go in there and tear into this environment, It's out there for hours, opening panels, doing shutdowns, lockout, tag out procedures, de energizing equipment so we can get into it and the IT people show up and they don't have safety shoes and they can't get out of the floor.

[00:03:14] Dino: They can walk right up to that concrete from the carpet and they look and go, I can't go out

[00:03:19] Dino: there. that in itself should demonstrate to some degree of the challenges that we see when it comes to inventory and these environments. So if you don't show up prepared to get out there, they're not going to let you out there because.

[00:03:31] Dino: Safety is job

[00:03:32] Dino: one,

[00:03:32] Jim: Right, yeah, I know, Dina's, equipment with, our company, hard hat now, and, some of my friends that, let's just say work in industrial environments for the first year kind of made fun of my hard hat because it wasn't dirty enough, It could spot me a mile away, but, before you get into pictures, man, know you want to show these pictures.

[00:03:50] Jim: and those for me were an eye opener, just pictures alone. And then it's a real life. I opener doing it yourself, which again, like we said, we've been doing this for years now. I just want to, from an it perspective, One of the things that I found was pretty big surprise, It, up to now has pretty good inventory management. That's, Kind of SOP, Standing operating procedure as I got into this and it was early on getting into this, and you were talking, inventory management. I'm like, well, they're engineers, man. They probably got an inventory, I mean, these engineers are detailed. Why wouldn't they have an inventory? we're a bunch of guys. We got our inventory. Wasn't the engineers have their inventory. Well, they don't, and to me, that was a big surprise. Right? we'll just link into what your engineers have the floor that they don't know.

[00:04:36] Jim: They go, well, that'd be great. Can we get inventory management from an IT perspective, man, right? that's 1, admitting that you have a problem, And the problem is it doesn't exist in the engineering space. So

[00:04:48] Jim: now how do you get to

[00:04:50] Dino: and there's a chain of custody issue, OEMs, for example, who have responsibility for maintaining and supporting that equipment. and they will do everything they can most times, a lot of times to keep the client who actually owns the asset, whose property this machine center is sitting in, and they can't.

[00:05:07] Dino: Touch it from a controls perspective, They can't modify it. They can't determine that they need to update it. They can't determine that they want to put cyber security technology in order to better understand their cyber security hygiene, so the negotiations at that level on the chain of custody.

[00:05:23] Dino: This equipment is coming into question. As we start digging into this, because what a lot of manufacturers are realizing, and once you start putting this visibility and asset inventory into place, well, now keeps everybody honest, And so if you've got an environment that's been sketchy or what the plant managers say to us last week, it's flaky, right?

[00:05:44] Dino: The environment's

[00:05:44] Jim: a technical engineering

[00:05:46] Jim: term. I think

[00:05:46] Dino: you know, in a second. What do you mean by that? He goes, I

[00:05:49] Dino: got people from all over the world that he means from all over the world that have access to his plant floor control systems to help him keep that thing tuned and tweaked and running. you're talking about a very complicated piece of equipment, that's making high end complex machines, so using machine centers to make machines.

[00:06:07] Dino: that being said, it's they're OM with these odd and in ways to get into these environments and nobody's the wiser of what they're doing. it would never, it has a pretty good handle on the assets that they're responsible

[00:06:21] Jim: Yeah. Yeah. You let me just interrupt you from that perspective where you're saying, okay, these machines are in their protective. I'm from the or the outside. They're connected to your network. It'd be almost like from an it perspective, someone coming in and putting virtuals up on your servers, They're putting up virtuals and they tell you, you can't get in here. You can't see inside here, and we'll tell you what you need to know, and you've

[00:06:45] Jim: got no idea what's running in your network. Right, and that's what inventory management is ultimately driving to from the I.

[00:06:50] Jim: T. side is, well, you've got to have that basis so you can manage the risk and get your vulnerabilities out of it. But it's almost like that. So, but that's the world they've lived in. So that's why engineers are you see that big box with probably a bunch of stuff in it. Yeah, we don't know what's in it.

[00:07:04] Jim: Yeah. But we know it's connected to the network, we're just focused on what it produces and not everything inside of it. that's a tough concept for, the it, my it mine, and I'm assuming others that have been in this space to grasp and once you grasp that, then, the door start opening up to really understand, what those challenges are. you ready to share your pictures yet?

[00:07:25] Jim:

[00:07:25] Dino: So, this is one panel, This isn't a bunch of panels. This is one.

[00:07:31] Jim: so all of

[00:07:31] Dino: this equipment, You got drives. You got other control systems drives. You got switches. You got remote access technology. It's connected to the plant network. It has its own network and. When you sit down and you look at this thing, this again, we're still in the same box, We haven't moved out of the one panel and you can find 50 of these in a manufacturer, you know, take a 500, 000 square foot manufacturing facility. You can literally find 40 or 50 of these panels and machines out there your environment, so asset inventory to us is twofold. One is to physically take a look at what's out there, And start mapping it out. What's your control system architecture, what kind of networking equipment are you using? some of these plants we go into, we'll find a dozen different Ethernet industrial switches of different stripes, different manufacturers embedded in these machine centers, connecting this stuff up.

[00:08:25] Dino: And there can be a cellular modem in there. There can be Wi Fi in there. We find USB flash drives that are in there that they might be using for backups or for updating. They're just leave in there. Like I said, it's connected to the plant network. So, for those that think that this environment is isolated is a mistake.

[00:08:42] Jim: while you have this up, I'm going to put this channel. So you guys are from the IT side. I think he's ever listening or watching this. hope. That someone is, and I hope you recognize I got my haircut today, and it's turning out okay. But from the I. T. perspective, of the things that is very common to get your inventory management is scanning and or combination of scanning and agents on the end points.

[00:09:06] Jim: Well, if you're from the I. T. perspective, you're gonna want in the world are these things that I'm looking at. But you look closely enough, and some of those pictures there are network connectivity. the thing that you've got here, yeah, you've got all these devices and networks running up and down these panels some of these devices.

[00:09:25] Jim: the thing that you have here is you don't have normal devices. That the IT world is you've got different types of OT devices we've mentioned them throughout, but, well, there you go. HMI is right. Oh, it's a computer. Well, it's an HMI and that HMI is actually talking to that stuff in the other picture that have PLCs and drives and remote IO.

[00:09:50] Jim: And weird switches that I had never seen before, aren't standard and layer two stuff. And so the thing to remember is now we've got all these different devices out there that connected to your network well, there's no real standard. If you're going to do agents on these things, for a PLC, well, there's no agent that you put on there that tells you about things.

[00:10:12] Jim: There's, the HMIs, you don't want to. Put an agent on a lot of those HMIs. The vendors won't let you because it might slow the machine down. If it slows the machine down, it'll slow the communication through there. So you can't do that. And scanning, you don't want to scan these devices because the one that might not recognize what these devices are too.

[00:10:32] Jim: And most importantly, as it might affect the operation of the machine running. So OT needs to figure this stuff out. And this is why they don't have an inventory, because usually those doors are closed when you walk in a manufacturing plant. a lot of times, the SI just closes the door and says, well, they only open it for themselves and fix it.

[00:10:50] Jim: And the engineers are worried about what's coming in from one side of the machine and what it's cranking out on the other, so that's where that inventory, the methods and, different worlds start colliding. Well, we still want inventory management. let's talk a little bit.

[00:11:04] Jim: well, how do you get inventory management? If I can't scan, you know, you don't want me scanning this stuff and it could be, either disruptive and I can't load agents on this stuff. Well, how am I supposed to do inventory on these things? you started touching on it, what we do, which is, we do this.

[00:11:19] Jim: It's so, so important is that visual inspection of this, but matching it up to something. And why don't you expand on that on how to get the inventory

[00:11:28] Jim: management of this stuff?

[00:11:30] Dino: ideally, when we go in, it's not only just a visual inspection and assessment, but we're also putting in passive intrusion detection systems built for this space, O. T. I. D. S. tools, And there's a, a bunch of them out there, some better than others. And we work with all of them, and we know which ones the top tier OTIDS platforms to be able to extract as much information out of this environment as we can while we're on site.

[00:11:56] Dino: And the goal is, what am I seeing visually and inspecting? And what is my tool picking up? So I can find my gap, the gap being. What's missing? Why am I not seeing these IP addresses? Why am I not seeing these PLC's? Why am I not seeing these HMI's? Why am I not seeing these drives, et cetera, So then we can determine, okay, next steps, this is a marathon. It's not a sprint. And now we got to look at because there's something within the infrastructure that I can bring a sensor into the space. There's other tools that I can run on the HMI that are executables. They're not scanning tools, but these are tools that provide rich information in regards to information around that HMI.

[00:12:34] Dino: the software that's running on it, who its neighbors are, what patch level it's at, So that's really key so we can determine the risk mitigation and vulnerability status of that box. So, those are the, methodologies to go through and find these things. You gotta know what you're looking at, Sometimes you gotta trace these cables down.

[00:12:50] Jim: we have to, want to touch on something and, again, coming from that it perspective, the things that. kind of hit me that helped turn the lights on early on in my conversion process. I've said it before. consider myself a bit of converted OT guy, but like almost an ex smoker here where, I'm going to be vigilant about this, but one of the things that really turned it on and kind of surprised me to come in from the IT perspective is how many networks you think we're looking at right there, Inside one panel, it was the realization that there can be multiple networks in the same panel. so, whether you call them nested networks, the 1st, I called them hidden networks, and it could be referred to as either or. there's only usually only usually only one point that's connected up into your network, but there could be a couple of different networks for maybe for IO control and another network for your interlocks and another network, for data communication.

[00:13:46] Jim: then above that. So you got 3 or 4 layers of networks before it's even visible. To actual network or the customer network that is connected to. So that's a realization. And that's to me as an it guy, that was a realization. Well, how in the world do you get down there?

[00:14:03] Jim: Right. I mean, I'm used to having a network and my network guy can get me anywhere in my network as well. As long as I have authority. Well, that's not the case when you get here, those panels might have three or four of their own networks, and if you've got five machines, we'll multiply that by, another three or four.

[00:14:18] Jim: Maybe you've got five, 10 machines. You get, another 15, 20 separate little networks running around below your network attached to your network that you have no visibility for, and you can't get through, you can't get through your own networks. You're never guys stopping at the door. and to me, it was, a huge realization, another reason why is why engineers don't have that, but you touched on now you got to get visibility down there.

[00:14:43] Jim: so that's a big thing, and then you've got to use the passive method at 1st, because you don't want to disrupt, those are very sensitive. Sensitivity of the network communications are very, very important down in

[00:14:54] Jim: these machines.

[00:14:55] Dino: They are. The cycle times can be very tight tolerances in order for machines to, communicate in a timely manner to make sure that, if you're moving, 2000 cans a minute through your filler, you don't have a whole lot of time for. Networks stop, or if you have an AGV, an automated guided vehicle, it's moving on the floor, moving 5, 000 pounds of material, if it loses communications, it's going to stop, That's the safety measure. Just can't keep wandering around because it can't talk to anything. It's going to stop if it loses comps, we find it scanning these networks all the time. with these intrusion detection tools that we put out there. and many of them still think it's okay.

[00:15:30] Dino: I. T. still thinks that's just normal way of doing it. We've always done it without even realizing how disruptive that they're being to their manufacturing, partners and the plant. from an I. T. Perspective, you send so much time and energy, forward facing to the Internet, trying to protect it.

[00:15:44] Dino: And we'll go out there and find all these back doors into this stuff coming right into your plant and getting right on your customer network from the other side. so how do you solve this problem? because I would argue that a lot of I. T. Organizations don't want to go do this work.

[00:15:57] Dino: I see it too much.

[00:15:58] Dino: see the contractors and the consultants and the partners that they work with, the staff that they have. Just to my point, they walk right up to that plant floor and they stop because they don't want to go out there and do this too. You got to have to work around downtime to do a lot of this work.

[00:16:11] Dino: You can't get into a 480 volt panel while it's powered up. Sometimes, one, you can't even open the doors in most cases even get in

[00:16:18] Dino: there, right?

[00:16:18] Jim: Yeah, you

[00:16:19] Jim: don't want to.

[00:16:20] Dino: All right,

[00:16:22] Jim: I don't want to be wearing

[00:16:22] Jim: the mask and do they call it?

[00:16:24] Jim: protection or arc

[00:16:25] Jim: training, right. Right, right. I'm like, turn that thing off, man. I'm not before I get close to it.

[00:16:31] Dino: so they're going to throw this lever down right here, this red lever, they're going to power it down, they're going to lock it, so nobody can

[00:16:37] Dino: come by and push

[00:16:37] Dino: it

[00:16:38] Jim: hang on. Yeah, that moment. This is something if you're an IT guy, you're finding this of interest, You want to talk to your OT guys. learn about lockout

[00:16:47] Jim: tag out, This is

[00:16:48] Dino: Yes,

[00:16:48] Jim: I

[00:16:49] Jim: got

[00:16:49] Jim: engineers in the, yeah, the, energizing lockout tag, but lockout tag is very, very important.

[00:16:54] Jim: they probably do a whole session on that. There's probably, if you go out in the engineering fields, they'll tell you if you know somebody that's working as a controls engineer, anything on a plant floor. like I said, I got family that's doing this and I lockout tag, it If you don't understand that, they don't want you on the floor. I want to touch on something, Dino, there's a lot in here, and there's a big, a lot to unwrap. And showed all these different, devices out there, And this is why it's like, well, if I can't even recognize that stuff, and we should say, it's difficult for, Oh, key people that have seen the stuff before recognize some of these things, because the switch might not look like a switch and they might have a machine over here and the same vendor provide them another machine, but they're using a different switching device and a new model of a PLC.

[00:17:39] Jim: so even inside same machines those devices. But on top of that, you touched on the passive and I want to explore that a little bit because IDS does DPI, Which is deep packet inspection. this is where I want to get we talk about the O2 protocols and a big difference here.

[00:17:54] Jim: so I tease out there and I've got their inventory management and they're scanning and I get 1 level of information. and then there's also the agents that they put on that. They get that real detail piece of information. but in OT, we're saying, don't do that, man, don't do that.

[00:18:11] Jim: You've got to be careful. You got to have a plan. So how am I ever going to get the information I need? the IPs, the Macs, the models, the software inventory, the versions, plus know that yeah, firmware plus know that it's a PLC or it's remote IO, or it's a card on one of these devices. do I get this out? And this gets to the OT protocols, if we're dealing with DPI and DPI, just essentially for those that are this off the side, some probably already know DPI is taking that, communication that's going back and forth, and breaking apart, the actual messages that are being sent.

[00:18:46] Jim: Across, as I got into it, I see protocols have some of that, you know, Oh, well, that's communications. Probably it's a windows box or this one's an apple OS, but it doesn't tell you the version you get in some of these protocols. It tells you. Who you are, So if I'm calling Dino and I'm a Windows machine and I'm using Windows protocol, hey, Dino, it's me and I'm a Windows machine, that's in the messaging. But on the OT side, Every time I talk to Dino, I'm telling him my phone number. I'm telling him how old I am every communication, I'm telling them, my address, I'm divulging this in the communication. So this is where it becomes.

[00:19:26] Jim: Something that the IT group needs to understand if they're trying to help the OT group out that information is in the passive. It's not all in the passive, but there's a big chunk of it. That's going to tell you. Hey, I'm a PLC. This is my vendor, which you get from max out

[00:19:42] Jim: there, but it's going to tell you your firmware version.

[00:19:44] Jim: It's going to tell you aerial numbers. You're going to get some pretty darn powerful information from these devices. But again, you can't use the it stuff. You can't use the it methods. It has to be purpose built for the world to be able to dissect those ot protocols and retrieve as much information and knowledge about that.

[00:20:05] Jim: That starts feeding, asset inventory that we're all

[00:20:08] Jim: looking for. Right.

[00:20:09] Dino: Yeah, you also have to consider just because if you've got 25, 30, 50 plants in your fleet and you go to one plant, this one, for example, it makes what it makes and you've got another plant that's very similar and makes very similar products. Don't assume that they're identical.

[00:20:25] Dino: They're not.

[00:20:25] Dino: They're of different eras. the vintages of the equipment that they have is going to be different to control system. You might be Rockwell in 1, side of the plant and seem as another plan back off another side of the plan. And you get to another plan and they're using, you saw 1, it should be.

[00:20:39] Dino: She and, Siemens, right? It's always a splattering of stuff. It's not a consistent

[00:20:44] Dino: standard

[00:20:45] Jim: and those machines will look exactly like each other, Until you open up the panels and see what's in it. Well, we bought that 1 and then now we got a lot of business going on on it. So we bought the same machine from them, 2 years later, because we wanted to increase production.

[00:21:00] Jim: And then you open up the panels and like you said, it's like, well,

[00:21:03] Jim: it's not the same open up

[00:21:06] Jim: the

[00:21:06] Dino: They bend metal, They

[00:21:07] Dino: both bend metal, but what's inside of them are using different technologies that bend the

[00:21:11] Dino: metal,

[00:21:12] Jim: right, find that all the time, They'll say, well, we've got 5 machines. here they are. The ABC, there are 5 machines. just need to look in 1 of them, Because they're all the same thing. They're doing the same thing and we're like, no, we need to open them up.

[00:21:25] Jim: And they could be configured differently on the innards. we've seen just what the HMI is. They're different software versions just on the same machine. And probably the operators.

[00:21:40] Jim: they love that on the plant floor, but when you start opening it up, those innards are different, the assets are different, therefore the asset management becomes that much more important and valuable and as valuable as it is for OT guys. Man, they're surprised when they realize

[00:21:55] Jim: this can be done,

[00:21:56] Dino: they need help. they don't have bandwidth or the resources, the budget, the executive teams, they're leaning on it to solve and fix and, lead this. it's just unfortunate that. They can't, they just can't, Because you have to make a conscientious decision as CIO that I want my people working on that plant floor.

[00:22:16] Dino: I got 40 plants in my fleet. You guys are going to be out there for the next year, Because it's how long it's going to take you to get through these plants and work around their shut down. down windows to begin to get into this environment, to put these tools in and start doing this work, And then working with those OT guys, how are you doing your PLC backups? How are you doing that today? Where you put that data at, I mean, when you walk around and open up cabinets and you see thumb drives, flash drives stuck in the PLC, hanging on a hook inside the cabinet, sitting on top of the cabinet, sitting on top of the

[00:22:44] Dino: rack.

[00:22:44] Jim: On someone's

[00:22:45] Jim: drawers. Well, I mean, desk drawers, not their

[00:22:48] Dino: You know, so it's just the vulnerabilities that are just, out there tenfold compared to the problems to ice. You mentioned in your data, so you walked into your data center and you found a cradle point modem sit right in the middle of your data center, hooked up to your key

[00:23:00] Dino: critical

[00:23:01] Dino: assets.

[00:23:02] Jim: never

[00:23:02] Dino: data center, right?

[00:23:04] Jim: Tino.

[00:23:05] Dino: Right. Yeah. Well, think about the control that you have to get in and out of the data center, And how they do that, even to get into certain cabinets, It's very structured, very secure, very, controlled environment. You could have 100 people walk through your plant floor in a

[00:23:19] Dino: month.

[00:23:20] Dino: And as the plant manager told us last week, he's got people from all over the world every day, all day, basically breaking into his plant and messing with his, control systems or the machines that he's using to make the

[00:23:31] Dino: products he's

[00:23:31] Dino: making.

[00:23:32] Jim: yeah. And this is so important to, from the visibility call this morning. We're working with a client, another client, and on data side, With the tool side, we're saying, hey, let's track down this device. What's it doing? It's not behaving normally. That's in your environment. And this is with, think let's just call him a production engineer, right?

[00:23:53] Jim: And, we do a little research with him on, he's like, well, it's not on my list. I don't know what it's doing. And, we were able to pull, the model number off of that. And lo and behold, it's a, router wifi with VPN connectivity, probably about twice as big as an iPhone, Could be tucked anywhere. OEM probably left it somewhere. OEM probably has access through that. He has no idea. He's like, don't even know where to begin.

[00:24:19] Dino: the guy may have been on the job for six months or six weeks, So he hasn't even got a chance to get his hands around what's going on in that

[00:24:25] Dino: facility and no documentation,

[00:24:27] Jim: Yeah. Yeah, so this device that's on the network plugged into the network that we identified. And now we're going to be going through this investigation and going, okay, what do we know? Where is it at? How can we locate it? Maybe what switches it track the wire down?

[00:24:43] Jim: Where's this little thing plugged in? we're working with, the local. O. T. their I. T. was on the phone as we're pulling the resources and figuring out what data we have. But that goes to the importance of, trying to tie that visual inspection back up to the data and the combination of these tools to get the proper inventory management.

[00:25:02] Jim: This was a net outlier. We're like, well, it's showing up over here, but we didn't see it here. So this thing's probably tucked away somewhere. Okay. But that's something that we help the teams. I mean, in order to get to that, we had to work with them, We're like, Hey, we know you've got, this, process area and so, and it's doing this and this process area and so we'll now.

[00:25:23] Jim: over the past month, this thing popped up and it doesn't look normal. but that's something that we can't do on our own. and that's what we bring to the table, In these situations, cause we're bringing all this stuff together. We've, seen, hundreds and hundreds of panels just in a few years doing this, but it's the importance of that, going out and said, Hey, IT network.

[00:25:43] Jim: Security guys, let's talk, hey, controls, engineers, guys, let's talk, hey, let's actually get your maintenance managers and let us get in there. Hey, let's put our tools together. Let's, let's bring all this way. takes a lot of effort, but I mean, it can be done. that's how we're, seeing success to get to the OT.

[00:26:01] Jim: Inventory, When you say that,

[00:26:03] Dino: Yeah, it's, relevant, I mean, you should think about, you're IT executive, you should be asking your, networking team if they know what a PLC is. Or an HMI, and how many types do we have, what are we using them for? if they don't know that information, then they're going to have to go seek it.

[00:26:19] Dino: And they're going to have to go talk to their colleagues over there on that concrete floor. They work with that stuff every day teach them.

[00:26:26] Dino: because you're not going to teach the OT guy to be a cyber security professional, right? He's not going to be the firewall guy.

[00:26:32] Dino: He's not going to be the networking guru, but what he knows is what that machine does and what the components are that are in it to make whatever that product is that that machine does, need to understand the process, Because process integrity is also a key component. it's not always just cybersecurity related.

[00:26:49] Dino: the asset inventories are relevant. So you can assist with process integrity, Because outside of safety being job 1, the other thing that those people in the plan are trying to do is reduce unplanned, unscheduled downtime, because if they

[00:27:01] Dino: have that, your company's losing

[00:27:03] Jim: right. And that doesn't even fall into the cyber security scope, but these tools can assist in that. So you can win on both sides. we do this, process all the time. Whether we're going through our asset inventory, visibility study, or whether we're actually doing a deployment management of these systems.

[00:27:21] Jim: that's kind of step one to get eyes on this thing. And it's not eyes on glass, it's eyes on floor. you did mention though, when you were saying, Hey, come out to the concrete. I was going to say just. Do you need to ask that question. If you can't come up with, do you have the PLCs?

[00:27:35] Jim: Do you know how many are out there hmis, and we've used that term a few times as a human machine interface, which is generally a Windows type machine or a, tablet of some sort. that's out there. It's very common windows and it. Usually old and it's always not patched and there's, likely no antivirus.

[00:27:53] Jim: So those of you on the it that are freaking out going, I didn't know I have these, you got them on your network. They're just below, you can't see them, but gotta say, okay, before I send them out on the floor, look through the window you store in your open toe shoes and you don't have the steel shoes to walk on and you don't want to walk out unless you understand things like lockout tag out from safety perspective, but start to conver

[00:28:14] Dino: well, we had a partner last week, she wanted to get out on the plant floor. She comes from the side within the 1st, 2 days of working with us. She'd already went out and bought a pair of safety

[00:28:24] Dino: shoes. Right? She

[00:28:25] Dino: got on the internet

[00:28:26] Jim: No,

[00:28:28] Dino: and she didn't

[00:28:29] Dino: like them

[00:28:30] Dino: and she hated them.

[00:28:31] Jim: weren't pretty enough for it. Yeah. they were ugly.

[00:28:33] Jim: They were bad.

[00:28:34] Dino: go get her own and she did.

[00:28:36] Jim: thing.

[00:28:36] Jim: Yeah.

[00:28:40] Dino: I need safety shoes. And course, and felt the compter, the hard hat. So we're sending our hard hat and

[00:28:46] Dino: safety glasses.

[00:28:47] Jim: we're swell guys

[00:28:48] Jim: like that,

[00:28:48] Dino: Yeah, we?

[00:28:49] Dino: are. So because her plan with her clients is that's her mode.

[00:28:53] Dino: Now. She wants to get out there on that plant floor to see what they got.

[00:28:57] Jim: Yeah. No, no, that's merging two worlds, Well, there's similar technologies. There's definitely different techniques, you gotta be conscious of I've said it before. I always say, Hey, look.

[00:29:09] Jim: from the it world, you're used to dealing with digital systems that control digital outcomes. And here we're dealing with digital systems that control physical outcomes. So the rules are different.

[00:29:19] Dino: and work with those people don't rely on consultants who don't work on the plant floor. Right.

[00:29:26] Dino: You

[00:29:26] Dino: know.

[00:29:26] Jim: to be one

[00:29:27] Jim: man. I used to

[00:29:28] Dino: Right.

[00:29:28] Jim: guy

[00:29:28] Jim: that

[00:29:29] Dino: that's, that's, the gist

[00:29:31] Dino: of it, right? You

[00:29:32] Jim: dirty.

[00:29:34] Dino: know, if you're talking to somebody selling this technology and deploying it and getting it up and running and making it do what it's supposed to do are two different things,

[00:29:43] Dino: so the only way to be successful with it is IT and OT most definitely has to work together. with unquestionably they do. and, it can't be a one-sided gig, but don't be disappointed if OT gets going on it because they will.

[00:29:58] Dino: We

[00:29:58] Jim: That was a long

[00:29:59] Jim: day

[00:29:59] Dino: OT there, OT guys.

[00:30:00] Dino: They're like, I got it. I'm on my own. I'll,

[00:30:02] Dino: I'll run. I got my money, I got I know who to work with. And they'll go run their own show. And some IT organizations are perfectly fine with

[00:30:08] Jim: Right. '

[00:30:08] Dino: cause they don't, they don't, it's like. That's good. You're

[00:30:11] Jim: nothing wrong with that. The only thing that's wrong with that is if nothing gets done, right? If nobody's doing anything and that, that's, probably our cue to kind of wrap this thing up. And say, well, Hey, listen to this, hopefully there's some people stuck around and getting some value out of this.

[00:30:26] Jim: my perspective is a wrap up on this is, understand that it's different. That's really about it. I think if somebody has listened to it, they know it's different and they're hoping to find, some nuggets here. To do, but if they were to say, well, what now?

[00:30:39] Jim: I just listened to these knuckleheads and, where do I go? I'm going to say, go forward. you got to start it. If you're not starting to get better, go to, OTS at management, we'd always love if you want to call us and ask us what we think and how to do it, we're more than happy with it, but do something.

[00:30:55] Jim: whether it's calling your engineering department, whether it's calling your trusted advisor and your vendors, whether they're on the it side, whether it's calling that your trusted SI guys. And quite frankly, you call them, they might call us in the background, but. You know, start with who, you know, and who you trust, but get something moving because this is going to be a long journey and it's just, Dino.

[00:31:18] Jim: Touched on some things just to get down to the space, just to get in there and to do the things that you need to do to get a real O. T. asset visibility that it may take time. And go, okay, well, we got a project slated for next month. What are you going to do? Guys in plan, go, well, you got to wait till shutdown.

[00:31:35] Jim: That's 6 months from now. so those are things my wrap up. I'll give you a minute. Do you know, my wrap up for this is get it moving and if you are starting to get it moving, get better at it. Because believe me, phase 1 is phase 1 and there's phase 4 and we haven't seen the end of it.

[00:31:51] Jim: here's what I would say. If you've already, got an OT IDS platform and it, if you've procured it and installed it, are you working with your OT teams? Are you giving them reporting? Are you giving them information you're uncovering and finding that environment? 'cause sometimes we find it has gone down this path to check a box and said, Hey, we've done something, we're moving forward,

[00:32:09] Dino: but then we'll turn around to the engineering team.

[00:32:11] Dino: It's like, so. Are you getting any data from them? And the answer is no, they don't share anything. It's like cloak and dagger. It's like, well, why is that? The tool is not for you. It is not your tool. It's for the O. T. people.

[00:32:22] Jim: Can't we all just get along,

[00:32:24] Jim: Dino?

[00:32:25] Dino: yeah, just share is what I would say. and the other thing I would say is, you need to begin the process, If a plant tells you, oh, you can't come in for 6 months, you know, we're not having shut down until July 4th. Yeah, don't believe them. They got maintenance windows, right?

[00:32:40] Dino: things

[00:32:41] Dino: things

[00:32:41] Dino: shut down, slow down. There's, line changes. There's, that. That's, you got to think local, right? But you got to be in there to recognize.

[00:32:48] Dino: It's like, hey, this shift, those 5 machines out there are going to be offline because they got to do some, some maintenance on. They got to repair belts or chains or put a motor

[00:32:56] Dino: in 1 of them. That's when you zing in and go do your thing, right? So don't necessarily listen to them when they're telling you.

[00:33:03] Dino: Yeah,

[00:33:03] Dino: come back in 6 months or around the holidays. there's opportunity in there to go do this work. Trust me. There

[00:33:09] Dino: is, but you got to be close to them in order to find those windows.

[00:33:14] Jim: Yeah. if not moving and not doing anything, got to remember the risk are out there. All these cyber risk are out there. 24 by 7. they're going to keep trying. So if you're not moving forward with anything, you're not getting better and they're going to keep trying,

[00:33:28] Dino: You're going to be a victim.

[00:33:29] Dino: All right, well, for hanging us. Appreciate it. Have

[00:33:33] Dino: a good 1.

[00:33:34] Jim: All right. Thanks everybody. Till next time.