Industrial Cybersecurity: The Gap Between Investment and Cyber Event Prevention

CSI - 95

Craig [00:00:00] Hi, I am Craig Duckworth.

Dino [00:00:01] And I'm Dino Bus.

Craig [00:00:03] How are you doing today, Dino?

Dino [00:00:04] I'm good. Fall's finally getting here, I think.

Craig [00:00:07] Yes, it is. I went out and took a little walk while [00:00:10] ago. It's beautiful outside. 70 degrees. Phenomenal. Yep. So, so I, I got a topic today I think I wanna talk about. Why [00:00:20] organizations that are investing are trying to do the right things that have made an investment still.

Craig [00:00:29] Uh. [00:00:30] I guess experience a breach or still have issues and maybe some of the things that could be leading to why that is because as [00:00:40] a board member, I say, Hey, Dino, here's a million dollars to fix the OT cyber problem that we have. Go run off and do with as you [00:00:50] please, and you spend the money and in six months we have an issue.

Craig [00:00:54] Whatever that is, whether it's material, non-material, whatever it is, something doesn't, something still [00:01:00] happens. Yeah. Where are organizations falling short and I made a kind of a, like a, a topics list, if you wanna call it that. I, I'd like to kind of walk through and see where you [00:01:10] think makes the most sense.

Dino [00:01:12] Dick talk about investments, right? It's like, it's like somebody who, who goes out and buys a, you know, high tech vehicle, let, [00:01:20] let's just say a Tesla, right? They spend 70, 80 grand on this car. They're probably using probably 30% of the capabilities of the technology in that vehicle, [00:01:30] you know?

Dino [00:01:31] Not taking advantage of all the things that these, these cars can do. It's for crazy, right? Mm-hmm. If you, if you, if you look at a new car, and, and I see the same thing in the investments that they make [00:01:40] in technology, especially around cybersecurity, when it comes to an area where they're unfamiliar with it, right?

Dino [00:01:46] I mean, if you've been a driver for 30 years of your life [00:01:50] and even driving cars for 30 years, you got a pretty good idea how to drive a car. You know, what the rules of the road are, how to make a stop, how to go turn, you know, et cetera, et cetera, et cetera. [00:02:00] Imagine doing the same thing with technology that you've bought and you're using just a small percentage of, of the capabilities of that [00:02:10] technology.

Craig [00:02:11] ~~I do that every We see it day. Yeah. We see, I do every day. My cell phone ~~

Dino [00:02:11] investment. Yep. Right. And, uh, I, I've checked the box. I, I, I bought a new car and it's giving you point to A to B, but are you really taking advantage of all of the technologies that are [00:02:20] available from that vehicle? Right. And do you understand it?

Dino [00:02:22] And I, and the answer to that is, is no, you don't because you're, you're not learning anymore per se. Especially if you, [00:02:30] if you bought the car and you gave it to one of your kids, right? They might get more out of it than you, but you as, as the owner of the car. Really aren't sure per se. And, and yeah, we've [00:02:40] seen that with these technologies in these, uh, manufacturing environments that have made these investments.

Dino [00:02:44] Big companies, large companies, global companies, and seeing a third or half of their [00:02:50] assets, right, not really stretching the legs of this technology to be able to improve their cybersecurity posture. Right? Even, even to the extent of helping them improve their operational efficiencies within their [00:03:00] manufacturing facilities, you know.

Craig [00:03:01] I look at it and I, I have that, let's call it issue. Every day I bought a cell phone. I do, I [00:03:10] make phone calls and occasionally I'll text. And other than that, I really don't do anything. And it's got like, I. Terabyte of storage and [00:03:20] it's got a process. It, it can do as much as my laptop almost, if I chose to do it, I can put any app in the world on it.

Craig [00:03:27] I can do anything with that thing, but I It can track your [00:03:30] vitals in your body. Yeah. You know, and I make a phone call with it and I text with it, and that's about the extent. I don't play games on it. I don't do anything else with it. I don't [00:03:40] need everything. It does, and I for sure don't understand all of the feature function capabilities of that device, and I use it every day for what I'm [00:03:50] comfortable with.

Craig [00:03:51] Maybe organizations are getting comfortable and not trying to better understand the, the limitations of the technology.

Dino [00:03:58] I just think it's like ai, [00:04:00] I, the world is changing so rapidly, people just can't keep up with it. They're exhausted, you know, like we do what we would say. For clients that have invested in these technologies, they, they get alert [00:04:10] fatigue, right?

Dino [00:04:10] When you're seeing tens of thousands of alerts a day across your manufacturing fleet and not really sure what's good, what's bad, who's [00:04:20] responsible for resolving and researching and investigating it, you know, and not assigning, not training, not teaching the, the, the people that. Are close to those assets, you [00:04:30] know, it's just, it's like you're wasted your money, right?

Dino [00:04:32] Yep. And, and you, because you're not hiring or finding the right appropriate people. And, and to be honest, there's not a lot of organizations out there [00:04:40] that, that are sophisticated enough to be able to, to, to leverage this technology, to the benefit to your organization. We, we see it with the system integrators and OEMs, the ones that I call the [00:04:50] disinterested parties, right?

Dino [00:04:51] Yep. And I would actually say CISOs and CIOs are disinterested parties when it actually comes to their plant floor. Per Right. Right. Yep. But even the people that design and build, maintain, and [00:05:00] support the control systems within their plant that make the goods, which provides revenue for those folks to get a paycheck, are disinterested in how to provide a greater degree of security within that [00:05:10] environment.

Dino [00:05:10] And it's, and they're not building relationships with those organizations that are designing and building and maintaining those control systems within their environment,

Craig [00:05:17] you know? Right. So let's, [00:05:20] let's go to the. I spend the money, I buy it. How now I, I believe I'm trying to tune it. Let's call it operationalize it.

Craig [00:05:29] Continuous [00:05:30] maintenance management of the tool where, 'cause not everybody does that. And these are not just turn it on and forget it or set it and forget it. Technologies, [00:05:40] continuous maintenance up feeding and care of these tools is, is necessary to better understand them.

Dino [00:05:47] Well, it, it is a lift, right? I mean, it's, it's [00:05:50] like if you wanna lose weight, think of all the things that you have to do in order to, to be able to do that and, and whatever path you choose to do that.

Dino [00:05:58] Yeah. You know, whether it's [00:06:00] dieting, whether it's medication, whether it's exercising, you know, changing, uh, your, your, your routines. You, you have to really make some sacrifices and you have to be [00:06:10] disciplined. Yeah. And the same with this stuff. You know, you have to make sacrifices. Sacrifices, meaning, um, I don't have the internal staff to do [00:06:20] this.

Dino [00:06:20] I know that I'm not gonna be able to get them there anytime soon. How do I find somebody to help me? Right? Number one. Number two is, is, um, which tool do I [00:06:30] pick, right? How do I go about doing that? Who do I talk to? You know, and to, that actually has real world experience. It's, that's a true practitioner.

Dino [00:06:38] You know, people who work in [00:06:40] manufacturing facilities day in and day out every day, all day, that's what they do, right? Yeah. You know, if you're gonna talk to an IT var who's just doing something, who's just transacting, just doing a commercial transaction to [00:06:50] sell you the software. How they're just to sell you the software.

Dino [00:06:53] They're not gonna teach you how to use it. They're not gonna teach you how to, to implement it. They're not gonna train your, your staff. Right? [00:07:00] Yep. They're not gonna show you how to make it actionable. Right. Operationalize it as you stated to tune it. You know, there, there's, there's those gaps where you have to [00:07:10] start, um, looking at it from a broader perspective instead of whatever narrow path you usually go down when you're, when you're picking technologies.

Dino [00:07:19] You know, and you have to be able [00:07:20] to convey that up to your leadership, to the people who sign the checks, whether it be the board, the, the, the, uh, CEO, you know, the president, you know, being able to explain to them where you [00:07:30] are, where you have blind spots. Right. Instead of just masking it to take, rip the bandaid off and say, here's what the problem is.

Dino [00:07:38] And I don't know how to deal with this. Not [00:07:40] effectively. 'cause I don't have the relationships, I don't have the partnerships. I'm unfamiliar with the assets that are in these plants. I don't know what the people in the plants do every day. Right. I don't know the [00:07:50] technologies that they have down there. I don't know how their networks are set up.

Craig [00:07:54] Well, the, the tools do. They do a lot of stuff. They do [00:08:00] cybersecurity, vulnerability management. They do end of life, end of life asset identification. They're great at asset visibility. They do [00:08:10] patch management, kind of if you look at it, of how you need to, you know, based on firmware versions. They do a lot of monitoring, you know, intrusion [00:08:20] detection, monitoring anomalies in the environment.

Craig [00:08:22] They, so the, the tools are there for. A lot of, a lot of things.

Dino [00:08:27] They give you a path forward. The tools give [00:08:30] you a path forward. You just have to follow the path and you know how you have to learn how to, how to read the, uh, the, the uh, uh, footprints or the trails that it's [00:08:40] leaving you, right? I mean, you have to learn how to read those, right?

Dino [00:08:42] Just as if you were hunting, you know, where do you go looking for the best place to find the game that you're chasing, right?

Craig [00:08:49] What's [00:08:50] important to you as an organization where, what are you trying to solve for? What is your business use case? What are you trying to get out of these technologies and let that kind of help [00:09:00] drive part of that narrative?

Craig [00:09:01] I think,

Dino [00:09:02] ~~well, I What the, what? ~~I don't think they're trying to get anything out. It, I think what they're trying to do is I, I satisfy a need that says, I checked the box [00:09:10] and I, and I have a technology number one, but the real driving thing is being profitable. Right. How do I make goods today is, you know, the most [00:09:20] effective, cost, effective, efficient, safe way as possible, right?

Dino [00:09:24] Yep. That, that's their, that's their driving goal as a manufacturer is to be able to make your goods, you [00:09:30] know, without unplanned, unscheduled downtime in a safe manner. Right? Keep, yeah. You know, and worry about my supply chain, right? Selling my goods [00:09:40] when it comes to cybersecurity around those control systems.

Dino [00:09:44] To them, they may treat it as a necessary evil, you know, but at the same time, they're, [00:09:50] they're not really, they're not studying what evil is, per se. They might be looking at it from the standpoint of what they've witnessed, you know, what in, in the media as they [00:10:00] read it, or what they've heard in other board meetings that they've sat in on.

Dino [00:10:04] Um, but they're really not assessing the risk and the manner of, of, you know, doing tabletop [00:10:10] exercises, having an incident response plan. I mean, I've yet to run into a manufacturer that has an incident response plan on their plant floor, and I've been in hundreds of plans. If you get an attack, [00:10:20] what is your plan?

Dino [00:10:21] I know who the, the first responder is, and it's not some IT security guy. It is gonna be your operators that are out there on that plant floor or your first responders.

Craig [00:10:29] Oh, [00:10:30] without doubt. They're the ones standing in front of the machines that understand what to do, where the E-stop buttons are, how to disconnect if they're required to do that.

Craig [00:10:37] There's, those are the, you're a [00:10:40] thousand percent correct on that. Yep. So let's talk a little bit about the network architecture. It's different on the OT side than the IT side. And I [00:10:50] say that with a, a caveat. The OT teams are very, very good at using PLCs and other [00:11:00] devices. That's network segmentation devices to hide, protect themselves, shield themselves from.

Craig [00:11:08] Adversaries or even [00:11:10] internal IT threats?

Dino [00:11:11] Yeah, I would say most of the networks in the control system in Reno are pretty primitive, to be honest with you. Okay. Based on the technology that they use. Flat networks, [00:11:20] layer two, unmanaged switches. I mean, you would never find that at the enterprise. Right.

Dino [00:11:24] Switches in technology been out there in decades, not a few years. You know, it doesn't keep force [00:11:30] switches and firewalls and you know, routing platforms around for 10, 15, 20 years. They keep 'em around for several. Right on the planet floor. We don't, we don't see that. And at the [00:11:40] same time, you have a networking team or you have a partner that's helping you with your network on the planet floor.

Dino [00:11:46] You don't have any of that. You know, you got a combination of a large [00:11:50] bunch of different groups that have been cobbled together, machine centers on your plant floor, um, and connecting devices, especially if you have grown through mergers and acquisitions. You know, [00:12:00] documentation gets lost. People are unsure what's where, what's connected to what.

Dino [00:12:05] Um, the, um, there's a wide range of technologies that are out there. It's not standardized. You [00:12:10] might find 5, 7, 8, 10 different, uh, networking technologies on your plant floor built into those machine centers out there. There's been no standardization on it. I mean, there are clients that say, yeah, we standardize [00:12:20] on.

Dino [00:12:20] Cisco or Stratix. Yeah, some, but you, you're never a hundred percent there, number one. And those are few, you know, those are, you know, those are your black polar [00:12:30] bears, you know, that, that actually have a plan and are, are managing their, their environment to that level. But I would say 98% of them out there, it's still, still the wild, wild west on their [00:12:40] network.

Craig [00:12:40] I, I would say you're probably pretty accurate from, from what I see as well. I see. I'm seeing the exact same thing.

Dino [00:12:47] And they don't manage it to the level [00:12:50] like it does with their networks, right? Making what? Controlling traffic, traffic flows, intrusion prevention, you know, over subscription of, of, of, of the data moving through their, you [00:13:00] know, setting priority, uh, quality of service, you know.

Dino [00:13:03] Firewalling, you know, the route switch to VLAN strategies, the IP addressing schemes, all of the things that, it does a really good [00:13:10] job in managing an enterprise network. You very rarely see on the plant floor. You know, you might, we're starting to see VLANs out there. Um, but even then you'll see, you'll see clients [00:13:20] using, um, private IP addresses, you know, within their network that are public facing.

Dino [00:13:25] I mean, it's just, it's, it's crazy. Some of the stuff that we find in these [00:13:30] environments.

Craig [00:13:30] And that, that brings up change management. You know, it again, has a, a very robust, well-defined change [00:13:40] management process. Ot. Normally not everybody's the same, but normally there is no patches that apply to the operating [00:13:50] systems.

Craig [00:13:50] There is no, no plan,

Dino [00:13:52] that's for sure.

Craig [00:13:53] Well, yeah, there's no updating hardware. You know, it's, it's. It's more [00:14:00] replaced obsolescence, you know, they'll run something until it dies, a break fix model, and then they will figure it out. Same with patching. They, because there's so many [00:14:10] unknowns of what could go wrong if you update or you patch that are interconnected that you might not even know about.

Dino [00:14:17] And there's thousands and thousands [00:14:20] of vulnerabilities in a, in a medium sized manufacturing client with, um. Firmware and operating systems and applications have been patched in several [00:14:30] years, or a decade or longer, maybe more, maybe two decades, never been patched. And so that that vulnerability list, the cvs as they're called, just keeps growing and growing and growing and growing.[00:14:40]

Dino [00:14:40] And then you get into life, into support, you know, and you're still, you know, hundreds of levels below on, on your firmware revisioning that you haven't touched in all those [00:14:50] years. And you got into life into support assets, which is the other thing is we find a lot of that there hasn't been capital investments made in the majority of the manufacturing [00:15:00] environments, especially those that are owned and operated by private equity.

Craig [00:15:03] Well, yeah, I think that as. Has a general rule, private equity likes to buy stuff and take the assets and like strip [00:15:10] 'em dry, run, and then

Dino [00:15:11] run until it breaks, you know? Yeah.

Craig [00:15:13] Leave it there.

Dino [00:15:14] Yeah.

Craig [00:15:14] So how, how would you say [00:15:20] the human factor, let's take the technology aside. Let's look at the silver tsunami as we hear it often.

Craig [00:15:28] Let's look at the [00:15:30] overworked, you know, already have 15 jobs. Don't want another one. Please find somebody else. Mentality. You look at all of the [00:15:40] human pieces of this puzzle, how, how does that, how big of a role is that playing into this? Huge,

Dino [00:15:48] it's, it's massive, right? [00:15:50] Which is where, you know, some people might think automation and, and AI is gonna, you know, help solve some of that.

Dino [00:15:55] Yeah. But, um, at the end of the day, somebody still has to be able to program support and [00:16:00] engineer and, and, uh. Manage those, those systems. Right. And you're getting to the point, what was the stat last year for, uh, for every [00:16:10] two people that leave, only one's coming back in the, into the environment and not everybody wants to work in manufacturing.

Craig [00:16:15] Right?

Dino [00:16:15] Right. And so what are you getting, you know? And so from a cybersecurity [00:16:20] perspective, when you're talking about technology, you're not getting the best of the best, right? You're getting to your point, you're getting a jack of all trades and master of none of them. You know, it's [00:16:30] got a responsibility from everything for making sure that there's toner in the printer, fixing a broken monitor to Oh, you're the networking guy and you're the SI cybersecurity [00:16:40] professional.

Dino [00:16:40] You got no training, right? You have no real, real background in the field, right? You don't work with the top tier technologies that are out there. Um, [00:16:50] and at, at the plant level. When you say cybersecurity to them, they point their finger north to corporate and say, that's. The enterprise and IT cybersecurity [00:17:00] InfoSec job.

Dino [00:17:01] And then you, you turn around and you look at the machine over here and you open up the panel that's got all this technology in it. It's like, this is the target who's responsible for [00:17:10] this? And you get that deer in the headlight look.

Craig [00:17:12] Everybody says, not me. And it's musical chairs, and there's three chairs and there's eight people.

Craig [00:17:18] So somebody's gonna stand [00:17:20] up and get stuck.

Dino [00:17:20] Right? And when and when you hear it, leadership saying that, you know, everybody's responsible, that just means nobody's responsible.

Craig [00:17:27] Right? No, I, I get it. [00:17:30] But at, at the end of the day, I would say that's probably the easiest one to address. 'cause there are organiz organizations like Design Group that have the [00:17:40] skill sets, the expertise, the,

Dino [00:17:42] a lot of our peers don't

Craig [00:17:44] a lot of, to help support these organizations, to provide guidance, to provide [00:17:50] that what, whatever you wanna call it, staff, all you wanna call it.

Craig [00:17:55] In managed services, whatever the model is, we can help organizations. So [00:18:00] that really shouldn't be an issue.

Dino [00:18:02] Yeah. But even, even if you look at the very large technology companies that are out there, and you can take, you know, whether they're the worldwide or the CDWs. The [00:18:10] Guidepoint or even the, the big four or six accounting firms that are out there that you know, that have, um, they have the knowledge, but what they don't [00:18:20] have is the, the ability to operate and execute in the plant.

Dino [00:18:24] Space. They don't. Right. And they're all, and and all of them, you know, the ones that I just mentioned are, [00:18:30] they're, these are trying to develop services. Mm-hmm. Right. Which is very hard to do. Right. And so how are, how are they handling it? You know, most of them are just [00:18:40] recommending, this is what you should do, here's what you need to do, here's what you need to buy.

Dino [00:18:45] Good luck with that.

Craig [00:18:46] Well, you know, as organizations are trying to figure [00:18:50] that out, they need to, as they're interviewing and talking to their local sis, they need to make sure they're screening for cybersecurity, best practice for [00:19:00] expertise, for practitioner skill sets that meet what they're trying to find, not just a systems integrator that can program A PLC [00:19:10] with ladder logic or whatever.

Craig [00:19:11] You know, these are different skill sets and, and. But again, they're there. They're available. Yeah. The resources there,

Dino [00:19:17] it's not, it's a skillset, but [00:19:20] it's also organizationally how you, how you're gonna define that and set that up, right? As you hear me say all the time, you gotta get all the liars in the same room, right?

Dino [00:19:27] Mm-hmm. That means you gotta bring all the right folks to the [00:19:30] table who have a stake in this game to determine how you're gonna move forward. And that's, that's where it becomes. Very difficult where that's not [00:19:40] happening. Plant managers working with the CIO and the ciso, working with the OEMs and the system integrators and the technology partners, getting all of those folks in the [00:19:50] same spot, getting past the market texture to try to dig into what are the requirements that you're really trying to uncover.

Dino [00:19:56] Mm-hmm. Which is basically, I wanna secure and protect my plant floor so I can continue to make. [00:20:00] Goods what? Without being, um, uh, disrupted, right? Without a material breach and without somebody shutting me down and or breaking my stuff or [00:20:10] hurting my people, you know, how do you get that, that coalition together to, to work through this and, and that's that Again, that's, like [00:20:20] I said earlier, it's like trying to find a black polar bear.

Dino [00:20:22] All right? Yeah.

Craig [00:20:23] I'm sure there's some out there, there is probably hiding in the, in the black woods, in the Sahara Desert.

Dino [00:20:29] [00:20:30] Well,

Craig [00:20:30] so, so

Dino [00:20:31] it's rare and we, and we're in this game every day. Yeah. And I've never seen a coalition like that together that's got a collaboration that's far and [00:20:40] wide, even if they have a certain group of people that have that responsibility, you don't see the local level being brought into the fold.

Craig [00:20:46] Right. Nope, you're right.

Dino [00:20:47] And being a part of it.

Craig [00:20:49] Yeah. Part. [00:20:50] So you touched on visibility earlier. I mentioned segmentation I mentioned. OT teams and the [00:21:00] controls layers using PLCs as network segmentation devices. I look at visibility and I, I'm often, let's call it, [00:21:10] scared for lack of a better term, for that false sense of security, meaning organization comes in, they believe they're seeing a hundred percent of their assets, [00:21:20] they believe they're covered.

Craig [00:21:22] They believe that they're in good shape and. The reality may be they're seeing [00:21:30] 50% or 30% or 60%, so the blind spots that are there can be more harmful than [00:21:40] knowing the vulnerabilities of what you do have. At least if you know what you have, you can do something to address it. If you have no idea. That's, to me, that's a huge [00:21:50] miss.

Dino [00:21:50] Yeah. Or they don't, they don't validate, you know, and you can't validate without having key, key personnel that work in those manufacturing facilities to to [00:22:00] show you where all of those assets are, that drive those machine centers to make the goods within your plan. Right. What it likes to do is they wanna try to do it, [00:22:10] you know, from a, a virtual logical perspective, meaning I just wanna put something in, try to get it into the right spot and collect and scan whatever I can see from [00:22:20] that location.

Dino [00:22:21] That's where you find that they're missing all these, these process area cells, zones and lines and assets that are out there, the blind spots as you call it, but they don't [00:22:30] know what those blind spots are because they're not familiar enough with the plant and they're not talking to the people at the plant.

Dino [00:22:35] They know where all that stuff is at. When we go through this every single time and we do the [00:22:40] visibility studies and we're out there with the engineering team or the electricians or the operations group who know when that machine's not running right, where it is that they need to go look where they're gonna at [00:22:50] least start.

Dino [00:22:50] Right, and they're gonna go to that panel and they're gonna open that panel up where the PLCs and the drives and the hmis are the network switches and India flow meters, [00:23:00] anything else they might have in that environment that's connected to the network. And they're gonna start there. Do I have power?

Dino [00:23:06] Right? Has anybody made any changes to the PLCs? Is there [00:23:10] anything new that's been stuck in this environment that I can physically see? Right? And the IT organizations are never gonna see that. They're never gonna know what's going on down there. And so they cannot help [00:23:20] from that perspective, right? What, what they can do is recognize that if you believe that you're the smartest person in the room, you're in the wrong room.

Dino [00:23:29] [00:23:30] Yeah. And, and recognizing that so you can go get in another room where there's people in there that know that stuff better than you do, who can help you out.

Craig [00:23:38] Well, there, there's [00:23:40] that and, and that, you know, that's one piece of it. Then you look at, and you, you mentioned this in the very first three [00:23:50] minutes today, instant response, how you don't see incident response.

Craig [00:23:56] On the OT side, and what I would say is [00:24:00] when I do see some instant response on the OT side, they normally don't have a holistic enterprise approach to [00:24:10] instant response. Meaning if I were to ask the SOC who's gonna manage. Who do you call on the plant floor if there's a problem? [00:24:20] They can't tell me.

Craig [00:24:21] Somebody. If I talk to the OT team and I say, Hey, let's say that your HMI comes up [00:24:30] encrypted. Who do you call? Uh, somebody in it. I don't really know. So there is no collaboration. There's no. There's not both. They're not all working [00:24:40] together.

Dino [00:24:40] Well, it is gonna be risk adverse, meaning that if they don't manage that asset

Craig [00:24:44] mm-hmm.

Dino [00:24:45] They don't control it. They don't, they didn't pick it, they didn't program it, [00:24:50] configure it, or set it up. They're not gonna touch it.

Craig [00:24:54] Yeah.

Dino [00:24:54] Right. They're just not, because they, they, they, it's not their [00:25:00] responsibility. One, they don't own the asset in the truest sense. They don't own the asset. Two, that they played little to no role.

Dino [00:25:06] Why it's there. In many cases, the [00:25:10] machine's probably been there longer than the, the 25-year-old IT person standing there looking at it. Yep. You know, trying to, trying to troubleshoot it, you know? Mm-hmm. Um, it's so [00:25:20] long story short, is that. It is, did it? They're gonna shy away from that stuff because they, they don't know what it is.

Dino [00:25:28] They don't know what it does, [00:25:30] and it wasn't their choice. And why should I support a Windows seven machine or a PLC? What Siemens, what? You [00:25:40] know? Yeah. I'm Ron. What? You know, Modbus t what? You know, I mean, they're, they're just, they're gonna fall off. Right. And so now you have to find [00:25:50] people within your organization that know what that stuff is, that know what it does know, know how to work with it, know how to touch it.

Dino [00:25:58] Right? [00:26:00] Yeah,

Craig [00:26:00] no, you're right. I, I would say of all of the things that create. Some of the gaps that we're [00:26:10] seeing. Probably the biggest, and, and we talk about this a lot, is the it OT collaboration. We don't see, [00:26:20] you know, if I could draw up a, a plan and I would say, okay, I'm gonna take the IT person's response for cybersecurity and for the next.

Craig [00:26:29] [00:26:30] 45 to 60 days, he's gonna work as a plant engineer and work alongside that controls engineer to understand the [00:26:40] technology that he's trying to effectively support. And then I think I would pluck that OT person. I would give him some it. [00:26:50] Visibility into what it looks like as well, the way that it's different and see if I could cross train so they understand what each other does to maybe try and help [00:27:00] each other some better.

Dino [00:27:02] Eh, it, I don't think that works. Okay. The reason why I say that is the person that you choose to do that isn't gonna stick around for [00:27:10] that. You know, depending, you, you'd have to look at that, that individual and figure out what their career path and goals are. And, and, and for somebody who, who's [00:27:20] comes from the IT world, went to school to be an IT professional, has always worked in an office data center.

Dino [00:27:25] Enterprise environment is not, is not likely to wanna work in a plant [00:27:30] environment. Uh, Nick can almost a bet on that, right? Yeah. And as we've always seen, it's always easier to take, take industrial people and provide them the skills [00:27:40] necessary to, um, to learn how to work with this technology and let them grow into this because they've made a career choice, but at least initially to work in this type of environment.

Dino [00:27:49] Okay. [00:27:50] Um, the, the better. Another option is go find organizations that do this today. Recognize that there are industrial engineering and, [00:28:00] and organizations out there that have people that work in the manufacturing environment every day, all day, right? Yeah. Your IT person, if you're [00:28:10] just giving, dropping them in there to give them a taste of it, you know, just to see this is what it's like, what it means.

Dino [00:28:17] It is just a, as a, a check the [00:28:20] box, kind of a, a career learning experience, and then boom bop they're moving off into something else. Yeah. That's what you're gonna find. Right? But that it has to be a career path [00:28:30] to want to be able to work in a manufacturing environment. It, it's rare to find people that, that go from it to move into an industrial arena and wanna stay in that space.

Dino [00:28:39] [00:28:40] Maybe if they did it as an internship, worked in industrial space, and then got into it and went on, you might see them want to come back. But, um, but a pure IT [00:28:50] programmer, you know, networking professional, somebody who wants to be really, really at the top tier of their profession isn't want to gonna go out there and look at a network that's 20 years old [00:29:00] and say, oh, I really wanna work with that stuff.

Craig [00:29:02] Yeah, it's not glitzy and glamorous. I get it. So, but I, but I, again, we see so [00:29:10] many IT professionals that are now tasked that have responsibility, as I like to say, for OT cybersecurity as part of [00:29:20] their enterprise wide endeavor, but they don't have the authority to affect change, have never. Put on any steel toed boots and [00:29:30] gone down to the plant.

Craig [00:29:31] How, how can, how can they begin to address it if they don't know what they're trying to fix?

Dino [00:29:37] Well, like that, that's what I said earlier. If you, if you believe you're the [00:29:40] smartest person in the room, you're in the wrong room. Right. And so, you know, to, you're, you're not gonna, you're not gonna get them. To, to [00:29:50] take that on holistically per se.

Dino [00:29:52] I, I, I've just never seen it really stick in that manner. And, and I, and I'll give you an example, and, and this is true, that [00:30:00] person or that group that's being asked to drive that particular strategy and objective within the organization, who would be one of the first people [00:30:10] that you'd wanna get ahold of and talk to?

Dino [00:30:11] The people who design and build, maintain and support the control systems in your plan. Yep. We're one of the largest, if not the largest system integrator in the food [00:30:20] bev industry. How many times do it professionals call the designer group?

Craig [00:30:24] Not that often,

Dino [00:30:26] if at all. Right? Well,

Craig [00:30:28] I always try to be [00:30:30] kind.

Dino [00:30:30] Right? And so there's the myth. Yeah. Right there is, if we're working in, if you've got a hundred plants and working, we're working in 20 of them. You know, [00:30:40] generating, you know, for ourselves several millions or 10 million plus dollars a year in business, you would think that IT person tasked in charge with that OT cybersecurity [00:30:50] strategy would pick up the phone, call the plant manager and engineering team and say, who are the top system integrators we're working with?

Dino [00:30:56] I need to meet with them until that narrative, until that [00:31:00] starts happening, then I'll know it's changing.

Craig [00:31:03] Yeah. And that is otherwise,

Dino [00:31:04] otherwise they're just pissing on the wind.

Craig [00:31:06] Yeah. And that, that definitely hasn't happened yet.

Dino [00:31:09] No. [00:31:10] And, and, and, and, and the way that we run our business is we, we work with the local plant teams.

Dino [00:31:16] Oh, we're doing cleanup in aisle nine, right? [00:31:20] Yeah.

Craig [00:31:21] Yeah. Good point. I this. We could have a day's worth of conversation on this. And I, and unfortunately, I, [00:31:30] hopefully for the listeners out there, somebody takes this back to their organization and says, Hey, you know, I heard these two guys today and here's some questions I need to ask us about.

Craig [00:31:39] [00:31:40] How are we doing this? Or what are we doing there so that if it spurs thought conversation and helps somebody. [00:31:50] That's the goal. If you don't know where to start, call us. We'll give you some advice. We'll guide you. We'll help you, we'll partner with you. You, there's no reason to do it alone. Yeah, [00:32:00] it's can't do it.

Dino [00:32:01] Well, there's a big difference between corporate law and criminal law, right? Yeah. And if you wanna be a corporate lawyer, you know, working on [00:32:10] big commercial transaction and business deals, chasing criminals is and being is, is not gonna be your thing. Right, and you gotta think it in that [00:32:20] context, right?

Dino [00:32:20] And so and so what you need to do is find the right profession that's geared for this industrial world that wants to work in this [00:32:30] space.

Craig [00:32:30] Yep. Great conversation, Dino. Hopefully this helps somebody. Guys keep listening, following reach out for advice. We're here to help you.