IT SOC vs OT SOC How & Why They’re Different

Craig [00:00:00] at the end of the day, the organization, the entire enterprise, the organization is responsible for figuring this out. And when you ask. Six people that should care in an organization of various levels, and six of them say, I don't know, it's not my problem.

Craig , But at the end of the day, no one is doing anything because all six of 'em are pointing their finger at somebody else, and there's a gaping hole in the security posture. Intro/Outro: Welcome to the Industrial Cybersecurity Insider. In each episode, we dive into the world of industrial cybersecurity. Join us as we cover the latest trends, innovations, and practical insights as we talk with leaders and practitioners across the industry. Gear up and let's get into this week's episode.

Craig Hi, I'm Craig Duckworth

Dino in a sidekick [00:01:00] Dino pki.

Craig Okay, sidekick. What's today? What are you thinking about today?

Dino Let's talk about ot socks security operation centers.

Craig Okay.

Dino That seems like a good topic. Don't you think

Craig that'd be a great topic? Because I would say there's probably not a lot of them.

Craig There are significant differences in the way that an. It SOC would handle feeds into that and responses to those things versus how an OT centric SOC should do that. So yeah, I think that that sounds like a great topic.

Dino So we could talk about some use case studies, right. I got one.

Craig Okay,

Dino perfect. A very large, beverage company, global.

Dino It's had a soc. Right. and they've installed one of these O-T-I-D-S platforms and only to learn many, many years later that, they were seeing a third of their assets.

Craig Ouch hurts.

Dino What do you think that is?

Craig I'm gonna guess because. The alerts were going to the soc, probably [00:02:00] offshore or not in the us They don't understand the assets on the plant floor at the physical locations, have never been there, can't validate it back to what we say all the time.

Craig Localization, think global, act locally, and they don't know what they don't know. How close did I get?

Dino Pretty good. bottom line is, is they don't know what's in the plans and so they, they assume they got a tool out there that's picking stuff up and, they're getting everything they need.

Dino And not recognizing that 50% or two thirds of the assets aren't even part of your baseline. Right. And, and even, and it's back to the old story. We, we say a lot is the assets don't belong to the soc.

Craig Cool.

Dino They don't belong to it. You know, these are assets that are managed and supported and implemented and maintained by completely different group of people.

Dino You know, in the IT world, you manage your enterprise, you manage [00:03:00] the, the server farms and the network and the applications and the desk. Tops and the printers and cloud you manage that. Mm-hmm. In the OT world, you manage next to nothing.

Craig Right.

Dino You know, very little. The closest you might get is some, some of the network in the plant, but it's definitely not the PLCs, it's not the SCADA systems or the d.

Dino CSS or the motor control centers, or the AGVs or the hmis or engineering workstations, it's none of that

Dino So from a sock perspective, if you can't get your arms around it, how are you gonna manage that? Right.

Craig you look at just the logistics, you know, the data feeds a. Come in from an IT perspective, if you have to do something, there's normally an endpoint protection or there's normally A MDR.

Craig There's normally a something that you could do to isolate and remove that asset, you know, that you can do automatically.

Dino Well, think of it like this. [00:04:00] If I'm making product X. And I'm gonna run that for a week, and then the next week I'm gonna run Product Y and I'm gonna do a line change over, I'm gonna probably take some of that equipment offline because I don't need it to run this product.

Dino IT organization isn't close enough to understand operationally what's going on in that plant. And so let's say they we're monitoring those assets. What do you think the plant wants a phone call and say, Hey, you know, portions of your packaging line are no longer. Operating in invisible and the plant's like, well, yeah, we know because we're running product Y today.

Dino And

Craig we turned 'em off.

Dino We turned 'em off. You know, we move them out of the way while we run this other product, right? And so it's just wasted energy, wasted motion, and to the point where they just ignore those calls that come in from it. Right. Like A PLC change. I talk about that all the time. Making A PLC change to an IT organization means nothing to them.

Dino Right? If they were watching that PLC change being made, would they call the plant to say, Hey, somebody made a change to the PLC and the plant's gonna be like, well, yeah, we made, now we're doing a line change over, we're switching [00:05:00] products today. so how do you get close enough to be able to understand that, right?

Dino To build the continuity between what operationally, what's going on in the plan, and match that up with the systems that are monitoring. Your industrial assets, you know?

Craig Yeah.

Dino And it's back to what you said earlier, you can think globally, but you gotta act locally.

Craig Well again, another fundamental differences is you know that first in line to address anything.

Craig When a call comes from the SOC is gonna be, need to be that engineer or that controls technician that's managing that piece of equipment on the plant floor to say, Hey. What are you doing? What did you do? I call it the interpretation. Layer. Someone's gotta interpret what that, you know, that threat came in.

Craig Is it a process integrity threat? Is it a known signature threat? What is it? And how do you interpret that before an action can take place? Right. And that is a lot of times missed.

Dino Well, and the other thing is, if you do have an event, who's your first [00:06:00] responder? Right? I know we've stated that before in previous podcasts, but it's gonna be the operator.

Dino Yeah. It's not gonna be some networking person or some IT person going out there trying to figure it out. It's gonna be the operation. Teams to, respond and get that equipment safe, get product safe, make sure people are safe, you know? Yeah. Before they start turning things off and, and tackling the problem.

Dino So, yeah. Again, and, and so what we're seeing are. companies that are going after OT centric socks, right? One of our big partners is one of those Rockwell. They, they have that, you know, when you think of the Arctic Wolfs and some of the others, some of these firms have hired because it's expensive to stand up a sock, you know, there's no mm-hmm.

Dino No argument there. You know, if you want a 24 by 7, 365 follow the, on kind of a model. Well, that's expensive to set up. Very, and, and we've worked with some of the IT SOCs and, they're in the same problem and a, a client is, even if they have their own soc they got the same challenges.

Dino If you chose a third party it [00:07:00] SOC that's doing your IT in your enterprise, right? And you're given, but they might be doing something with the plant, but again, we have found it's. Either disruptive, they're not handling it appropriately. They're, they're missing big chunks of the assets that are out there, and nobody knows how to get to 'em.

Dino And so you have to take a approach 'em from a different mindset.

Craig you know, there's, there's a lot of, pieces of that, you know, cost is, one, how do you handle the alerts is second one. How do you make sure that the alerts that you're bringing in are the relevant alerts on the operational side of the house versus a known security threat, a known signature.

Craig Right. You know, how do you handle that versus. Something different? Is that as important? Is it, is it something being masked as that? there's a lot of, I guess I would call them unknowns and very blurred lines. that really are in the, in the mix.

Dino Well, you have to demonstrate value. And then, you know, you know, the flip side of that narrative is accountability.

Dino You know, and, [00:08:00] and what I mean by value, meaning that you have to show value to the people in the manufacturing environment that what you're doing is helping them. Right. And if you can't demonstrate that, then, there's no working relationship. And, and that's typically what we find. I mean, that's generally most organizations out there, that's the disconnect between IT and ot.

Dino have we seen it work well, I. Eh, not yet. Not really yet. Not, not to the, the point where they're very collaborative line. Some, some organizations talk a good game. Mm-hmm. But in practice it's not how it operates, you know? 'cause I go back to what I've said previous is then if that was true, then the IT leadership, we'd be building bridges and relationships with the OEM and system integrations community.

Dino That's totally agree. Most of the time working in these plants. And if you're not doing that, then you're still not doing it right.

Craig Well without doubt. you and I both know that pick a, a very large manufacturer, don't, it doesn't matter who it's, and you were to go to the CIO or you were to go to the ciso, [00:09:00] someone that manages their risk and governance for that organization and the security posture for that organization, and you would say, Hey, if there's an issue on your plant floor, who would you call?

Craig They're gonna call. Somebody at the plant, the plant manager who's running around with his hair on fire trying to put out whatever problem it is that just happened, or you know, would he have access to Rockwell, Siemens, whoever his automation vendor is in your, to your point, you're trying to make they wouldn't have that in the Rolodex and they need.

Craig Need to have that there.

Dino I witnessed that during some big ransomware or malwares that were pushed out, like when WannaCry came out. We witnessed that when I was working at, Rockwell at the time. And, you would think that the, the Rockwell teams would've been on the Rolodex would've been one, you know, the second for sure.

Dino Second group that A CIO would've called, you know, if they were having problems with their manufacturing environments. But it didn't happen that way. It really, really didn't, you know, it kind of falls back to the plant and their organization [00:10:00] trying to deal with this the best way they know how, per se.

Craig So if we go back and we take a look at an OT soc, can you think of maybe three or four, what assets do you think would be critical that they would, would be part of the monitoring? Are there certain pieces of the environment that are more critical to monitor and to view and to be able to respond to?

Craig Or would you look at them all, let's call them equally? make a difference? Even

Dino you talking about it, monitoring it

Craig Well. Right now. that's the only solution we have. There really isn't, you know, outside of what Rockwell has an, a true OT centric sock. So if we are trying to make the best of what's available today until there is an option or an alternative available, what would you try and focus on if you were trying to, figure it out today in a manufacturing site?

Dino Well, you know, working backwards through it. I mean, and, and, you know. Focus on a security framework. I would go [00:11:00] after asset inventory. Right?

Craig Right.

Dino I'd wanna try to, make sure that I have as many assets as I have in my plant into my, intrusion detection system baseline. Mm-hmm. Right. I at least wanna document, right.

Dino So that way I have the risk vulnerabilities associated with them instead of just ignoring them, which is what we find everywhere. Even companies that have been installing these tools for several years and still seeing a third or less than half. Their assets. What was the point in buying the tool? You know, and I've heard, I've heard some people say, well, we don't care what goes on on the east, west side.

Dino It's like, well, why is that not important? They don't have an answer for that. Right. The short answer is, 'cause you don't know anything about it You don't know how to even deal with it, so you just ignore it. that's the real answer. It's not because you don't think it's important, it's 'cause you don't understand it.

Dino Right. Well

Craig at least say, you know. We're taking a phased approach. We're gonna start with our north south traffic. We're gonna understand that we're gonna slowly start making our way down to greater visibility that east west traffic. Then we're gonna figure that out, and then we're gonna start introducing intrusion [00:12:00] prevention and, really try to start securing our environment.

Craig But you're right, it is just a. none of that's important. We're just gonna do this

Dino because if that was true for clients that have gone down this path and have been using these, OOT cybersecurity platforms for a number of years, all their capital projects that are coming in, whether they're doing lifecycle replacement, brownfield, Greenfield expansions, the OEMs and system integrators they would be working with, they would be deploying collectors sensors.

Dino Inside those machine centers is they're,

Dino putting this stuff out of the field, you know, be proactive, you know, if you really were, if you were really trying to figure it out, you'd be ahead of the game by doing that. Right. Against back to, I want, yeah, the backup cameras and the airbags and the sensors and every, all the safety equipment on the vehicle when I buy, when it's being built.

Dino not bolted on after the fact.

Craig Well, it changes the narrative. it, again, it moves the environment and the mentality and the thinking from a break fix, reactive mentality to a proactive being in front of it, [00:13:00] able to accurately forecast accurately budget, actively predict. Those assets and how you can better manage them?

Dino Yeah. Well it just, to me, it demonstrates that there's still a wedge between the IT and the OT organization. You know, to, in the context of expanding my plant, or I'm replacing old equipment with new equipment, and OTs doing it in a vacuum all by themselves. Making all the selections on the equipment with the OEM and system integrator and it's role is diminished or is non-existent.

Dino Until that dynamic changes, you're gonna get more of the same.

Craig Yep. You're right. And, it's a slow shift. This is a giant battleship out on the ocean. It's not a speed boating, it's not gonna change overnight. And we've seen that, we've been beating this same drum since 2019 and it's still.

Craig You know, not, not there yet.

Dino I I still talk to, you know, mid-tier manufacturers that still have layer two flat [00:14:00] unmanaged networks. Yeah. They've never seen or heard any of these tools that we're talking about that have been around for a decade. You know, don't even know what they're capable of, what they are, what they're doing.

Dino you know, I think that they're, they're position is, I defer cybersecurity when I hear it belongs to it. It's not my problem if I'm an OT person, which is the wrong mindset to have. Yeah. But we still witness that today. Mm-hmm. And at the same time, the OT ecosystem is not really pushing. the needle into coming forward with security solutions and the equipment that they're making, just like they did with safety.

Dino You know, you had to make safe equipment. Well, how do you start adding safety and and security into that same equipment?

Craig Well, yeah, there's that. And then you look at, from an organizational standpoint, how do you address and handle in the event you have something happen in the OT space? Who is your, let's call it phone tree.

Craig What's the site gonna do? Who are you gonna reach out to? What are the steps? You can't just start unplugging [00:15:00] stuff. A lot of organizations want to make sure that they can still make product in a. Pseudo un pseudo air gapped environment. They wanna be able to, continue to operate, but it's mentality is cut the cord and be done.

Craig let's save ourselves and it doesn't. Work in an OT space though.

Dino Yeah. Well, you know, when you talk about the soc, I mean, their job is really to hunt, right? I mean, if they've got their hooks into all of the systems that generally the enterprise has, they're looking for the rogue assets. They're looking for the malicious ips, they're hunting malware, su suspicious activities, you know, systems that aren't part of the standard that have made their way to their environment.

Dino They're hunting this. All the time and looking for it and dealing with it when it comes up. They're not doing that at all on the plant floor.

Dino not at all. Right. And so and so now you have this gap now. So the first question is, is do you care?

Craig The answer should be yes for anybody that you ask that question

Dino too.

Dino So who, who should you be talking to [00:16:00] to solve this problem? Because you already, demonstrated you can't do it by yourself. 'cause if you could, you would. Yeah. Right. Because we see that, right. I mean, part of the work that we do, because we go in there now, we're bringing these tools with us. We find all the things that I just mentioned.

Dino And it's usually a surprise to the organization.

Craig They have

Dino no idea, and it looks at it, it's like, well, hell, I don't know what to do about it. I don't know why there's four or five different remote access technologies put in those panels that are out there on the plant floor, you know?

Craig Mm-hmm.

Dino The OEM put it in there when they put, when they brought you the system and stood it up, they put that in there so they have access. So if you called them and they needed, and you needed help to figure out, to calibrate the machine, for example.

Craig Yeah.

Dino Or work on some type of maintenance or, you know, change its operation because you, you're making a different product with the same equipment.

Dino And it doesn't have any idea what's going on and why they're doing it, Yeah. The question is, is do you wanna solve that problem? You know, and if you don't, if I. It is not going to do it. Resources, skills, gap, you know, doesn't think it's their responsibility. They don't want [00:17:00] to be accountable, all of those things.

Dino Well then who should be stepping off?

Craig but at the end of the day, and it just, it's, it still mind boggles me, but at the end of the day, the organization, the entire enterprise, the organization is responsible for figuring this out. And when you ask. Six people that should care in an organization of various levels, and six of them say, I don't know, it's not my problem.

Craig , But at the end of the day, no one is doing anything because all six of 'em are pointing their finger at somebody else, and there's a gaping hole in the security posture. I'm baffled to be honest with you, with just, I'm baffled.

Dino No, you know, it took it probably two decades to get to the point to where they are, you know, in, in a, in a bad

Craig way. Well, why can't we, in the OT side learn the lesson and say, look. It has made a roadmap for us. We need to adopt to different tools, different procedures, but the framework is there and [00:18:00] we're not gonna let it take us 25 years.

Craig We can do this in five pick us time. That's, that's reasonable. But you and I both know it's been 10 years and the progress made has been almost non-existent.

Dino Yeah. Well again, the assets are different. You know, the capital plan, it's different for this and um, you know, obviously the life cycle. Is much different for, OT assets compared to IT assets.

Dino And, do I ever see that changing? It's always gonna be a decentralized approach on the plant floor where it is more centralized. You're never gonna be able to change that, dynamic. It's not like you're gonna spend hundreds of millions of dollars to try to standardize all your manufacturing facilities.

Dino Oh, no way. The same automation technology, IE Rockwell or Siemens, or take your pick, the same thing with the network within those plants, the applications in those. Plants, the drives in those plants, you know, they're not gonna spend that kind of money. Now, if you're building new Greenfield. That's a different conversation then you really should be thinking about that.

Dino And even then we see that with, whether it's the data [00:19:00] center stuff that's being built, some of these others, they still are not implementing a cybersecurity solution around SCADA systems, control systems.

Craig Well, and there's a lot of, back to the, the brownfield, Greenfield, there's a lot of, let's call it re onshoring.

Craig Taking place. So there is some new greenfield development that has been at least. Allocation of funds have been announced, whether they follow through or not. Different conversation down the road, but there's a lot of that happening. So from a greenfield, organizations need to be taken advantage of that in standardizing and saying, our security.

Craig Partner, our security approach, our secure technology is X, Y, or Z, and every single panel that goes in this manufacturing environment is gonna have Y in it so that we can collect this data. We are gonna standardize on a, a networking platform, either Cisco switch. Or or whatever they [00:20:00] use. And every panel's gonna have this mic model in it.

Craig And if a vendor comes in, I know it's difficult, but they need to have a hard conversation and say, look, this is our message. Go forward and we need to do this and we need you to adhere to it. Doesn't always work that way and I recognize that, but it's. It needs, especially for the greenfield, brownfield, again, should be taking the same approach as they are retrofitting and updating outdated panels.

Dino Yeah. But if they're looking at equipment and they might be looking at five or six different, vendors, OEMs. Supply them the machinery. Yep. And so you're, and you got these bids coming in and they're gonna vary and, they're looking to cut cost. That's why you find a lot of layer two unmanaged switches and a lot of equipment.

Dino 'cause it's cheap, you know, because they're trying to compete to win the business. Right. At the day, at the end of the day, the only thing they're thinking about is that thing is supposed to put milk in a bottle. You know, or pasteurize that milk that, that's all they're thinking about. I

Craig get it.

Dino Right. And they're not thinking about, and we're [00:21:00] caught

Craig in that same scenario sometimes when we are as an integrator, bidding on a project. And the client is dictating, here's the number you have to get to, and we're trying to say, this is important. You should consider this. And at the end of the day, I don't know that we would walk away from something if a client said, here's your choice.

Craig You either put this in or we'll find someone else to do it. I don't know what, how that would work.

Dino Well, there's always that, right? But I mean, don't get me wrong. I mean, I, I've seen both those arguments where it's either that you're gonna do it our way or we're gonna go find another partner.

Craig Yeah.

Dino Or I've seen the, the folks at the plant saying, I really want this piece of equipment and we are gonna follow whatever they're gonna tell us to do.

Dino And I don't care what the standard. S are with Yeah. What some IT groups trying to tell me I should be doing, or you know, it doesn't matter. I just need for this thing to do X and I really like these cheese, gas shaker canned machines that they're made of Switzerland, you know?

Craig Right.

Dino Yeah.

Dino if you're the stock, you're always gonna have blind spots.

Dino You [00:22:00] know, I mean, from a stock perspective, you're not gonna have visibility to the, the last mile

Craig No.

Dino In these manufacturing environments. So are you okay with that?

Craig maybe that's part of the risk. maybe their acceptance of that unknown risk is some level of acceptability.

Craig I, I don't know. But every organization, it's gonna be different.

Dino Well, I mean, it'd be great if you could get it and OT to work together, but trying to, you know, it's perception versus perspective and trying to figure out the other side's perspective. And I don't know how much of that is being done per se, between these two groups.

Dino Right. It's hard to, it's like. Politics almost, you know, perception you're trying to convince somebody of to change their perception is, is like pushing a rope up a hill, right? You're just wasting your breath. The question is how do you gain their perspective, And that's what

Craig I have dogs and cats living in my house and they both get along fine.

Craig Sometimes there's fighting, but overall they eat the same food. Occasionally. Sometimes they don't like each [00:23:00] other and they go to their own rooms, but it's okay.

Dino Well, but again, back to that it ot relationship again. How do you get them to understand each other's perspective and, and do they want to work that way?

Dino And it's hard, right? Again, back. So the global Think Global Act local, basically you'd be telling the IT people, 'cause you know, the it, the OT people are in the plant, they're not going anywhere. Right? They're, they're not going

Craig anywhere

Dino yet. Wherever that plant is, that's where they are.

Dino It people are usually somewhere else, you know?

Dino So how do you get that brain trust that's within that IT organization that come in and be part of everything that's going on in that plant? Which means that you'd have to basically live there or at least spend a lot of time there. Right? You can't show up every other year. Maybe twice a year, maybe you've never been to the plant.

Dino That's not gonna cut it. You have to be part of that community.

Craig Maybe the plant manager needs to invest part of their operating expense. And buy some steel-toed shoes and pass 'em out to the IT teams. Mm-hmm. To come down and learn what those assets are, what those [00:24:00] assets do, how they intertwine with some of the IT network that they're responsible for, and see if they can figure it out.

Craig But you're a thousand percent correct. Get it? It has to be a collective collaborative effort.

Dino You have to attach them to the plant teams. Yep. Be part of the startup, be part of the, the operational runs, you know, the morning meetings, you know, the shift changes, all of it. The machine changes, product changes, activity going on in that plant.

Dino You have to be somehow become part of that.

Craig Well shy of, of the IT team doing that. At minimum, the OT teams need a liaison like design group that can speak both. Both sides that can be there to make sure that as those conversations are being had, their best interest from an operational standpoint and a security standpoint are being heard and addressed from a SOC or an InfoSec team, right?

Craig there's resources out there. Don't [00:25:00] go alone by yourself, right? We've said that a hundred times. Choose a partner.

Dino You can't put the round peg in the square hole. So you need to go out there and figure out, why can't I do that? Right. Well, how do I convert my square peg round to get it in that hole?

Dino Right. And the only way to do that is to be part of that, that organization. Like I said, the plant people aren't going anywhere.

Dino So you somehow you have to become part of that world, right?

Craig great conversation. I think we've got some more work to do and I think that there's definitely opportunity in that.

Craig A whole SOC conversion plan.

Dino Yeah, well think OT soc. 'cause it's different than it soc.

Craig Yes, for sure.

Dino Yeah.

Craig Feel free to reach out if you got questions. We're here to help you guys.

Dino Yep. Intro/Outro: Thanks for tuning in to the Industrial Cybersecurity Insider. To stay up to date with our latest episodes, be sure to click the follow or subscribe button now, and if you found this podcast helpful or have a topic you'd like us to discuss. Intro/Outro: Please leave us a review or let us know. [00:26:00] Thanks again for listening. See you next time.