Is Your IIoT Strategy Creating More Security Risks?

[00:00:00] Dino: you have a technician or an engineer who shows up on site and connects into that level of the network, and what they're doing in that, realm is invisible, right? 'Cause nobody's really watching what they're doing, right? Whether it's a remote access piece in, or whether it's a technician getting in, or whether the third party's put in their own, cellular device that they've embedded into that machine center so they can remote access into it.

[00:00:23] Dino: So the point being is all devices that are connected to a network, even if the perception is that it's isolated, they're not. They're just not.

[00:00:34] Intro/Outro: Welcome to the Industrial Cybersecurity Insider. In each episode, we dive into the world of industrial cybersecurity. Join us as we cover the latest trends, innovations, and practical insights as we talk with leaders and practitioners across the industry. Gear up, and let's get into this week's episode.

[00:01:04] Craig: Hi, I'm Craig Duckworth

[00:01:07] Dino: And I'm Dino Busalacchi

[00:01:09] Dino: let's talk about the term IoT and how it relates to OT, right? So the Internet of Things, or the Industrial Internet of Things, or operational technology on the OT side, how are those assets classified, right?

[00:01:27] Dino: And I would say that,a lot of organizations have started de- deploying and implementing these OT intrusion detection systems within their manufacturing facilities to obviously get asset inventory, and as you collect that a- asset inventory via machine learning and AI, it's giving you risk, and vulnerabilities, and exploits, potential exploits associated with those assets.

[00:01:49] Dino: But a lot of organizations that have implemented these OTIDS, technologies are not pursuing the broader spectrum of devices within their manufacturing environment

[00:02:02] Craig: when you say that, help me understand what you mean. I think internet of, IoT devices, I think connected devices that have firmware and not an operating system, which is the def- by definition should be those.

[00:02:17] Craig: Are you talking about the cameras and the printers and the scanners? Are you talking something different? help us understand kind of where you're going.

[00:02:26] Dino: Yeah, and so, y- o- one of the,the ways we describe things, right? In the enterprise world, data driving data results, right?

[00:02:34] Dino: In the industrial world, in the OT world, it's data driving connected physical systems that do kinetic things. And organizations, be IT primarily that are looking at how do I get a, asset inventory of everything that's connected to the network, right? And they chase, on the IoT side, so you think cameras, you think thermostats, you think,printers, right?

[00:02:55] Dino: And those are all, th- those all become, collectible assets within the environment 'cause they're on their network, so you can get some information regarding, again, asset inventory, vulnerabilities associated with it, and things that are interacting with those devices. But on the industrial side, there's a lot of assets that are connected to the network that, that are being either overlooked or ignored or do not

[00:03:16] Dino: Th- the perception is that why is it relevant for me to have asset inventory and have visibility to things like drives and motor control centers, right, and AGVs and robots and pumps and things along those, th- along that nature classification of assets, right? And so, I guess what I would say is if you're pursuing printers and you're pursuing cameras and you're pursuing phones because they're connected to your network and you think that those, c- provide risk and vulnerabilities to your environment, why aren't you pursuing those assets, right?

[00:03:52] Dino: And there's a disconnect, and it's on the control side, right? So you're talking down at the control layer of PLCs that are talking to these devices that are driving physical outcomes. And you and I both know in order to get that level of visibility, you have to have technologies deployed at that level to be able to collect that information, right?

[00:04:16] Dino: And some organizations aren't driving that deep. And I would also argue a lot of it is because most of these, initiatives are pr- primarily driven by IT. OT has some role, but they're not necessarily engaged and involved with the whole scope of what IT may be trying to do with that cybersecurity intrusion detection platform.

[00:04:40] Craig: So you think that they just- I, I don't want to say it's not important, 'cause I'm sure in their mind it's important. Maybe they don't recognize the importance of it. You think that they just don't know how to get to it? What c- what do you think kind of driving it?

[00:04:55] Dino: I think that many believe that they, those machines are isolated, insulated, right?

[00:05:00] Dino: Not connected, which is not true, right? just the bottom line is that, is those machines are connected. Even for those organizations that can take a standalone machine center, you still have remote access. you may actually do some physical intervention to connect that machine to the network because you need support from somebody outside.

[00:05:21] Dino: Or you have a technician or an engineer who shows up on site and connects into that level of the network, and what they're doing in that, realm is invisible, right? 'Cause nobody's really watching what they're doing, right? Whether it's a remote access piece in, or whether it's a technician getting in, or whether the third party's put in their own, cellular device that they've embedded into that machine center so they can remote access into it.

[00:05:44] Dino: So the point being is all devices that are connected to a network, even if the perception is that it's isolated, they're not. They're just not. At some point they are connected, whether it's for support reasons, primarily, or because the,it's connected via a PLC that's connected to the network.

[00:06:08] Dino: But as you and I both know, the PLC acting as a gateway Isn't allowing intrusion detection systems to walk across the back plane of the PLC to get to those other devices that are still connected, right? So whether it be drives, other PLCs, HMIs, motor control centers, AGVs, et cetera, you need to be able to capture those assets the same reason why you're chasing everything else that you're trying to get onto your IDS platform, right?

[00:06:38] Craig: Yeah. that makes sense.

[00:06:39] Dino: Right. and so the owners of those, the knowledge of those falls in different buckets, right? It falls into the OEM, it falls into the system integrator, it falls into different groups within the manufacturing environment specific to the plant that's responsible for those assets, right?

[00:06:55] Dino: So IT tries to cast the widest net they can with the tools that they have, but you're missing many of them, right? and IT is not necessarily skilled in how do I intervene to be able to get to those particular assets down at the control layer, right? Which is where the, where you have to start working with engineering teams and the OEMs, folks that are knowledgeable of how that network is designed, how that infrastructure is set up, what the purpose is of those machines, and do you have asset inventory of it?

[00:07:27] Dino: So you may have a client that says, "Well, I have Rockwell Asset Center, Rockwell Shop, I got Rockwell Drive, so I have an inventory of my drives." Great. You have an inventory of the drives. Now tell me the vulnerabilities and risk associated with those, and that's where you get the deer in the headlight look.

[00:07:40] Dino: They don't know They don't know what vulnerabilities are associated with those assets, right? All they know is I got something that, that's telling me what in my programs and in my project files that I have these things, and I may have an asset inventory of them, right? And most manufacturers, y- you never run into a plant that's 100% one automation technology vendor.

[00:08:02] Dino: So even if you had a Rockwell shop and you're running Asset Center, you're gonna have some number of assets that are not Rockwell, that aren't gonna be even inventoried at the level, just to have an inventory of it so that you know that you have it. Much less what are the CVEs, common vulnerabilities and ex- and, exposures related to that asset, right?

[00:08:21] Craig: Well, and there could be some significant risk of not understanding or ignoring those drives and those IoT or industrial IoT assets as you describe them by not looking at the vulnerabilities, especially if they are a known exploitable vulnerability. And the risk to the organization, at minimum it's a blind spot.

[00:08:47] Craig: at worst, it could be a huge exposure and could cost millions of dollars of downtime, could cause harm to individuals. It c- there could be a lot of bad things happen through a physical system.

[00:08:59] Dino: Well, and the u- the umbrella view of it is,from the standpoint you can't always look at this like a s- from a cybersecurity perspective, right?

[00:09:06] Dino: We talk about process int- process integrity a lot, right? and so these tools are not only providing you,rich content and information regarding cybersecurity, looking for, malware signatures, right? Looking for,vulnerabilities associated with it. But it's also the things that can be impacting to your production.

[00:09:24] Craig: Go back to OEE and helping become more efficient.

[00:09:29] Dino: Whatever metric you're using to track that operational efficiency, whether it's OEE or many m- several of the other metric the clients may use on managing how well do I, avoid unscheduled, unplanned downtime, right? And so if you have drives that are being i- impacted by traffic or by a change, are you tracking through that to determine, "Hey, why is my filler slowing down?"

[00:09:54] Dino: And something may be impacting the drives. And so what could that be? It could be somebody in there, making changes. It could be,a traffic, unnecessary traffic that's flooding the network that you're unaware of. Again, think of somebody remoting in, think of somebody walking in with their laptop.

[00:10:12] Dino: think of an IT, cybersecurity technology that might ha- have... Is scanning the network, and probing. we've seen clients that have implemented tools, EDR tools i- in their HMI environment and when that antivirus piece kicks off and scans ensue, it's not only impacting the HMI, but it's also impacting the things around that HMI that it's interacting with, right?

[00:10:33] Dino: And if you don't have visibility into that, again, it's not necessarily a cybersecurity threat as much as it is an operational impact that's impeding those machines performing optimally because there's unnecessary activity going on and it's being disruptive.

[00:10:50] Craig: Well, and you look at it from... So there, there's two ways to look at that.

[00:10:54] Craig: One, the unscheduled, unplanned downtime has two significant effects. One, the production of the plant team and to be able to operate efficiently, manage those equipment, and have smooth operations. The, the second piece is the financial impact. And if you look at, an organization and what their cost of downtime is, and if you knew what was causing that downtime, and you could take preventative measures to prevent it in the future or have a conversation with, IT or someone that is unaware of their acti- actions and what's happening in the operational side, if you could- improve that efficiency by one or two percent, that could have a substantial cost to the bottom line savings that a lot of organizations may not recognize

[00:11:49] Dino: Well, it kind of goes in along the lines, y- and what I've seen clients, especially mature organizations that have spent the time to put sensors in those environments for thermal, for harmonics, for vibration.

[00:12:04] Dino: looking for anomalies that they can determine, "Hey, look, we're starting to see the heat signature go up," or, "We're starting to see the harmonics change," or, "We're starting to see more vibration." And what that would indicate is that you have a ... you're getting data, which a lot of clients are chasing the data on the plant floor, right?

[00:12:23] Dino: To determine, "Hey, I might have another 100 hours or 500 hours of that machine running this way before I gotta take it down for maintenance." And it's much more cost effective to do a planned shutdown to be able to go and do that maintenance and replacement when those, data points, take off around, again, around

[00:12:43] Dino: I'm just using thermal and harmonics and vibration, for example. again, from a maintenance perspective, a lot of companies have invested in this technology in order to try to reduce their downtime instead of waiting for something just to break and burn up, and then you have a very costly initiative where you've lost product and now you're gonna be down for days or weeks versus planning for it because you know that equipment needs to go through some type of maintenance cycle in order to repair it and make it operable.

[00:13:14] Dino: B- And so you put those types of sensors down there to collect that. This is the same conversation Right? It's the same. we're n- we're not chasing thermal and harmonics and vibration. What we're chasing is anomalies in behaviors and activities that are disruptive to those same assets, right? So your mindset has to be along those same lines.

[00:13:36] Dino: If you're mature enough to put in instrumentation to be able to collect data to determine, how can I most optimally run those machines? you think about your new cars today, they tell you your tire pressure, and they can give you an alert to say where your tires are. Same thing with your oil, right?

[00:13:53] Dino: And many other data points so that you can avoid a costly mistake, right, and get your car to the shop or get air in your tires. It's the same conversation on what organizations have been pursuing that for a number of years. Now we're talking about, how do we from a digital perspective look for those thermal harmonics and vibrations that are disruptive to the machine being able to operate, outside of the physical mechanical issues that might be going on.

[00:14:23] Dino: That make sense.

[00:14:24] Craig: Well, it, it makes total sense. And then you got the other end of that for those organizations that are leveraging, let's call them lease options for equipment for machine centers where the OEM is responsible for managing, securing, and protecting, and doing the preventative maintenance that you mentioned on those equip- on that equipment.

[00:14:45] Craig: Then you've got, remote access into that from the OEM. What does that look like? How do they get into that? How often do they get into it? Well,

[00:14:53] Dino: and why are they accessing that, right? They might be access... The OEM may be accessing, looking for the thermal and the vibration harmonics or the number of hours the machine's been running, and knowing that, look, it's been running for 1,000 hours.

[00:15:06] Dino: we've got a window here that we need to come in and do some, maintenance on, right?

[00:15:11] Craig: Yeah. it's no different than the, than the, The example you gave on the car. the dealership under a leased vehicle is gonna say, "Okay, you need to come in, you need to do this at this number," whether it's ready for or not, they're, 'cause they're responsible for that Y-

[00:15:24] Dino: your car's reporting on it , right?

[00:15:27] Dino: I mean, there, there's an e- there's a, data going to GM, and GM's sending you a, an email telling you, "Hey, here's what's ... Here it is," right? It's the same conversation except we're flipping it to the digital aspect of it, right? And again, digitally what we're talking about is what's, what is floating around in there consistently, and when does anomalies happen when somebody's remoting in and making a change, or there's data that somehow has made its way in there, or somebody opened up a new unsecured port, or somebody installed a new application, or somebody implemented a new protocol in that environment.

[00:16:08] Dino: So, it's being able to track those same attributes from that digital perspective that you chase those attributes in regards to physical, mechanical issues that you're trying to resolve, right? To get ahead of preventive, right? They call it preventive maintenance, and you need analytics to determine that, right?

[00:16:28] Dino: It's the same conversation.

[00:16:30] Craig: Well, that's the second, that's the second side of that coin. most of these tools, technologies, the IT side is looking at what is the cyber aspect. How can we better secure and protect the organization from a cyber event, from breaches? And then the opposite side of the coin is, you mentioned it earlier, the process integrity portion where organizations can become more efficient.

[00:16:56] Craig: They can run leaner. They can predict unscheduled downtime, try and do preventative items, task to operate more efficiently. And most organizations miss that second piece of that because they're so focused on the cyber aspect. But again, from an organization like ours that really drives down deep into that control layer and understands how the operations work, it's easier to point that out.

[00:17:30] Dino: Well, and what we hear a lot is organiza- And you've heard this. You just heard this last week. You have companies that have gone out and bought these OT cybersecurity intrusion detection tools, right? And yet when you talk to the OT people who may be aware of it, but what value are they receiving from it or benefit?

[00:17:50] Dino: Because nobody is showing them the power of these tools, the capability of these tools, right? And so they think of it as a cybersecurity tool or something that IT is managing and running, and nobody's really, walking them through what that tool is capable of providing them, right? Which is something that we do pretty well because our goal and role is to get the OT teams that are responsible for these assets, that care how those things operate, how they run their production, how they do their maintenance, how they do their day-to-day activities, they're the ones that need to see the value of what these tools can provide for them, right?

[00:18:25] Dino: and that's the, that's a disconnect. When you talk about IT/OT convergence, that OT convergence means your OT needs to really understand what the capabilities of these technologies are, and right now they don't. It's not... IT can't convey it to them, and at the same time, they're not working with organizations that can help them figure that out, right?

[00:18:46] Dino: And that's why we see the shelfware,W- what happens to these tools turning into shelfware or the alert fatigue where people have hit the wall, right? "I've been running this tool for a year, I got a lot of information, I don't know what to do next with it."

[00:18:59] Craig: Yeah. No, v- very true. we-

[00:19:02] Dino: They get hung up.

[00:19:03] Craig: Yep, we see it all the time. they... organizations should really look at, for those that are going down this journey, how do I choose a practitioner partner, if you wanna call it that, for example? Someone that understands my network, understands my automation, understands my environment, and is proficient and a subject matter expert in tools and technologies that are bringing this cyber process integrity aspect and visibility and vulnerability management into my environment so I can make business decisions based on that risk, and walk down that journey together.

[00:19:41] Craig: It is hard to do it by yourself. Don't... There's no reason to, with all of the individuals like, like you and I and our teams that are... can do this every single day. we're here to help people.

[00:19:54] Dino: There's two paths, right? if you're an IT organization and you have a role and responsibility, you need to start, building relationships with the organizations who supply your, manufacturers with equipment, people who build plants, people who design, control systems.

[00:20:14] Dino: So from an IT perspective, you're gonna have to make some new friends, right? You're gonna have to start bringing them in. if that's not the IT's role and goal is to get to that level, then it has to come from the OT side, and the OT side has to get better at this, and they're gonna have to mature and leverage these tools and start forging their own, relationships with engineering groups, OEMs, or architectural engineering and construction.

[00:20:39] Dino: You think, "Well, why is that relevant and important?" Well, if you're building a new plant, up front during that AEC process, they're gonna want to implement... You- you're gonna wanna throw in, how do I build cyber security-ready process integrity technologies into my manufacturing facility?

[00:20:57] Craig: Yeah. It's critical.

[00:20:58] Craig: It's critical. Dino, we could have a... This conversation could go on for days, I believe

[00:21:06] Dino: And we give plenty of examples. we could s- we got, we've got hundreds of examples, So, so keep learning, keep listening. try to find events, that, that focus in this particular space.

[00:21:16] Dino: and we're starting to see some of that, right? I mean, we're starting to see some of these conferences where you're starting to see a broader blend of IT and OT people, that are participating in, what I wanna call this OT cybersecurity journey.

[00:21:28] Craig: Yeah. No, and we're here to help.

[00:21:30] Craig: For any- anybody out there listening, reach out. we can help guide you. We can partner with you. Whatever you need. If you're just looking for advice, we're doing that as well. So we're here. So thanks, Dino. Great conversation. Appreciate it, as always.

[00:21:46] Dino: Safe travels.

[00:21:48] Intro/Outro: Thanks for tuning in to the Industrial Cybersecurity Insider.

[00:21:52] Intro/Outro: To stay up to date with our latest episodes, be sure to click the follow or subscribe button now. And if you found this podcast helpful or have a topic you'd like us to discuss, please leave us a review or let us know. Thanks again for listening. See you next time