OT Cybersecurity: Is the Purdue Model Still Useful?

Ken [00:00:00] Two of our production lines are running on that server right now. We're not going to be upgrading that. But then it was like, okay, well, shoot, I gotta get OT a seat at this table. Intro/Outro: Welcome to the Industrial Cybersecurity Insider. In each episode, we dive into the world of industrial cybersecurity. Join us as we cover the latest trends, innovations, and practical insights as we talk with leaders and practitioners across the industry. Gear up and let's get into this week's episode.

Dino Hi. Welcome back everybody. I got a good one for you today. Today I'm joined with Ken Cully from Rockwell Automation, and we're gonna kick off a two-part conversation on some challenges regarding OT cybersecurity. So Ken, welcome to the show.

Ken Hey, Dino. Thanks for having me.

Dino Give a little background on you and how you got to where you are at this point—where you been.

Ken [00:01:00] Yeah. Well, man, I have been a lot of different places. My first encounter with OT was probably, oh gosh, over 20 years ago. And actually, I mean, my first job in high school was technically working in a process environment. Not automated—it was all manual labor, book bindery. That was interesting.

Ken But my first job as a student engineer back when I was going through university was with Husky at one of their gas plants. They've since sold it off to another company here in Alberta. But I spent a couple of summers out there doing little bits of ladder logic, database programming, SCADA system stuff.

Ken Second time I was there, I was helping rip out the old SCADA system, put a new one in. And since then I've just kind of always ended up in the orbit of OT, right? I worked for—another student gig was at a water treatment plant pipeline company. And then when I graduated, none of that materialized into anything as a career.

Ken I actually wound up doing IT for a little while, before my wife and I ended up expecting our first, and that necessitated [00:02:00] sort of a change-up in terms of household income. So I took a position with a company called MatriCon.

Ken If you worked in the OPC space, that's a name that's fairly familiar. And so I joined the cybersecurity group there. They got acquired by Honeywell a couple of years after that. I stayed with Honeywell for a couple of years, then I left for a while and went to Inter Pipeline—back into the pipeline business.

Ken Came back to Honeywell, and then when my team at Honeywell kind of dissolved in the post-pandemic era, I had an opportunity to jump over to Verve Industrial, marking the second time in my career that a man named Rick Conn hired me into a role. The first was at MatriCon. And then, of course, Rockwell came in about a year after I joined Verve and bought the company.

Ken And so I've been with Rockwell ever since. And I kind of keep moving between roles within Rockwell. I started with their delivery group—actually [00:03:00] installing the security software, back when it was known as Verve. And then, kind of as the name change was happening, I moved on to what was called system support because we decided we needed sort of frontline support operations—client-facing stuff.

Ken And then that responsibility got handed off to another group, and so now I am running what's called delivery readiness, which is kind of a combination of training and working with clients ahead of security installs to make sure that their environment is ready for us to actually come in and put the software in place.

Ken Yeah.

Dino And so a little background for our listeners: Ken and I met a few weeks ago in Milwaukee at an OT cybersecurity training program that Rockwell was putting on. Ken was leading it. I'm actually an ex-Rockwell guy myself. I worked for Rockwell back in the teens, from the 2015–2018 timeframe, specifically working in the OT cybersecurity arena for them.

Dino Just to get everybody kind of up to speed on this connection and this relationship: the topic we were going to talk about today is the Purdue Model, and has it outlived its usefulness, right? I have a perspective on it, and Ken reached out to me and said, “You know, we should talk about this.”

Dino So I just kind of want to open it up, Ken. I know you saw what I had written, and I would just like to get your view on that Purdue Model. Where do you think it—has it outlived its usefulness, or is it gonna be there for the foreseeable future? And I'll give you my perspective on that for the audience.

Ken Hmm. I'm kind of of two minds about it because, on the one hand, the model itself is getting on in years. It's been around for—gosh, I can't even remember when it was first promulgated, right? Like, it's been—yeah. And I mean, it sort of rose to, at least in my experience of OT, it sort of rose to prominence on the back of NERC CIP.

Ken [00:05:00] There was one of the first major, at least in the US, government-backed regulatory requirements: “Okay, you should be, in this particular operational context, implementing some fundamental cybersecurity principles.” And network segmentation was one of those, and the Purdue Model really kind of, I think—at least that's when it really came on my radar as like, you know, this is how you should be, or this is a good framework for how you should be doing this, right?

Ken And it makes sense at a framework level, right? You should be putting degrees of isolation between the things that are closest to your process and the things that are internet-facing. And there should be a couple or more levels between those two things, depending on a variety of factors, right?

Ken The makeup of your plant, the particulars of your control environment, the geographic distribution of multiple locations, right? If you have multiple locations, all of these things kind of factor in. And with a little bit of massaging, all of that stuff kind of fit well enough into Purdue. It always felt a little bit aspirational to me.

Ken [00:06:00] Like, I don't think I ever actually saw a pure implementation of it anywhere, and that's not really surprising, because the reality on the ground often necessitates making some compromises and some choices that might move you into a place where you're not in pure alignment with Purdue, but it still satisfies what you have to do operationally and from a regulatory standpoint, and it works.

Ken And it's Purdue enough, it's secure enough, it's segmented enough. Rounding the corner now in like 2020, 2025, I try to refer to it less as a strict guideline. It's definitely more in the framework.

Ken [00:07:00] If at any point in my career I was using it as an actual guideline and this is how to do it, now it's more just like a framework, a definition. But sometimes you have to reach for the definition even if there's something better that you could point somebody towards, because there's still flat networks out there in OT environments.

Ken And even if the Purdue model is getting on in years, even if it isn't necessarily the best approach for network segmentation, the most secure approach for network segmentation, it is a form of network segmentation, and it's easy to explain, and it's better than flat.

Dino Yeah. Well, the CPWE—you know, the converged plant-wide Ethernet design, right? So there's an architectural model for how you would design a network, right, and how you can set up those security control points in those different areas, levels of the Purdue model, or even at the cell zone.

Dino [00:08:00] I view it as a people, process, and technology challenge, right? The technology is not the issue, right? The convergence, per se, from a technology standpoint has moved quite afar into the environment, right—especially when you think about networks and applications, per se—and we've witnessed that.

Dino Even though there's some nuances with OT-specific security models and technologies, to me it's still a people and process challenge, right?

Dino I've yet to meet a plant manager that's also the CIO, right, in my view. Because if you think about IT/OT convergence the way that it's being touted from an industry perspective, that's kind of the role that you're positioning that CISO or that CIO to be.

Dino I know that sounds ridiculous from the standpoint of when it comes to safety and process and operations—how are you gonna get an IT organization to be aligned and transparent and very collaborative in that control space without being disruptive, right, and even want to own it?

Dino I mean, you talk about large flat networks—yeah, we still see them all the time. Very large companies still have that type of setup in their plant. But what we're not really witnessing is the handoff between IT and OT.

Dino [00:09:00] That's why I use that Waymo as an example, right? We talk about a connected physical system where you've basically taken the driver, the OT person, out of the driver's seat, and you let technology move in society and transport people around, all driven by technology, right, with no operator sitting there in that front seat of that car.

Dino And when it comes to the plant, I mean, we're just not there generally speaking. Maybe in certain industries potentially, but I haven't seen it yet where OT is gonna give up control.

Ken No. And I mean, at some level you're never going to be able to completely pull OT personnel out of the way. And whether that's because QA still often has a human element to it, right—you’re just literally putting eyeballs on things.

Ken [00:10:00] Depending on what you're manufacturing, you might still be using tools as well, but you still have human eyeballs on the process. You still have human eyeballs on the end product.

Dino I call it the human in the loop, right?

Ken Yeah, exactly. And there's many other places where the human is still inserted into the loop.

Ken I remember being a young, dumb engineering student trying to run calculations on pressure in a gas line. My supervisor gave me one of my first tasks at Husky: “Yeah, just calculate me the line pressure on that one.” And I applied all the principles I'd been learning in my classes to that date, and I got an answer that was mathematically correct.

Ken [00:11:00] And then the lead plant operator’s just like… and all he did is literally incline his head, and he's like, “You're off by about 15 PSI.” He didn't do the math—he could just hear it in the line because he'd been working the plant for 50 years.

Dino And you have that, right? But as you and I both know, I call it the silver tsunami, which—I can say that because I've got the silver hair.

Dino We're losing that tribal knowledge in these manufacturing environments that can pick things up just by sight and sound and activity, to know what's going on—whether things are going well or things are getting ready to go sideways.

Dino How do you get that knowledge into a younger workforce, right? Or leveraging AI, which is a whole different conversation, to bring to the forefront into a production facility that's making whatever goods are being made.

Dino Again, back to the people and the process: if you really want to see a true IT/OT convergence, that dynamic has to change. Again, it's not a technology issue per se.

Dino [00:12:00] We see it all the time. You and I—the firms we work for—we make our livelihood working in manufacturing environments. We know who it is we're talking to every single day, and what our responsibilities are, whether it's to put in new control systems and new machines, or whether it's the infrastructure that stuff rides upon.

Dino We don't have a lot of interaction with IT. And I'm not saying that's right; it's just the nature of the beast.

Dino And I don't know how you change that dynamic, where CIOs and CISOs—the IT leadership—is tapping in to your organization and my organization to help them with whatever solutions and strategies they're pursuing inside these manufacturing environments, whether it's to make them more secure and safe, and/or improve their operational efficiencies.

Ken You know, it's funny you mention that because you're right. I mean, the technology is there. Although, let's give at least a cursory nod to the fact that technology tends to persist in OT environments a lot longer than it does in IT environments.

Ken [00:13:00] There's multiple reasons for that. I'm sure you've talked about it on your podcast. I know I've talked about it on mine.

Ken On the people and process side, it's funny because especially when I was at Honeywell, I often ended up in this interpreter role, right? You would have a company—whether it's a power plant, pulp mill—they're trying to do cybersecurity.

Ken There are standards they're trying to align with. There's audits and gap assessments and all of that stuff. And I'm the one who's getting brought in because it's a pulp mill running a Honeywell control system, or a series of pulp mills. I'm the one getting brought in to do those assessments and audits and deliver findings.

Ken And a lot of times it comes down to interpreting between IT and OT.

Ken [00:14:00] It is like watching my wife deal with the frustrations that she has to sometimes. She's a nurse, and the healthcare system here—keep changing names, I can't remember what it's called right now.

Ken They did a whole bunch of overhauls to how they do staffing scheduling. Whereas before it was entirely phone-based—she'd have to call in if she wanted to book a shift, they'd call her. Then it became like, well, you could go to this portal, and then we could text you notifications when shifts are available.

Ken And now it's driven by two different apps, and it's all hooked into their Azure cloud, Microsoft authentication, blah, blah, blah.

Ken She's got me in the house, so I can sit down and be like, “Okay, we do this here, then we jump to here, then we jump to here.” I think I've already lost her at that point, but the point is she's got me in the house. I can set that up for her. I can show her how it works. I can show her again three months later if she needs a reminder.

Ken [00:15:00] And then she kind of just sits back and she's like, “My average coworker is 12 years older than me. They are going to die.” And there's something to that.

Ken And you kind of see that in OT as well because you get people like my plant operator who can incline his ear and tell me the exact PSI in the line better than my math can. But if you tell him he's got to start using MFA, he's not gonna have any idea what that even means, let alone what it entails.

Dino Why does that matter, right?

Ken Exactly. And it's one of those things where it's hard to illustrate to people why it matters until it really, really matters.

Dino And to your point, even MFA—I mean, I've worked in plants where shift change, the operators don't log out and the new operator logs in with a unique ID.

Dino [00:16:00] They use the same ID—some guest ID—to get back into the machine centers. They never log on or log off in that environment because they forget their passwords, and then you gotta get a hold of somebody to reset it for you, and to them, that's losing time.

Dino The message that I always heard early on in this game is security just gets in the way of getting things done. That was the OT mindset, and if you bring it up to them today, they'll tell you flat out, “It's not my problem. That's IT's problem.” They push it off.

Dino And to me, the narrative needs to flip, and this is where I think our ecosystem—the OT ecosystem—has to get better at this.

Dino Meaning we have to grow and mature and start bringing in—just like we did with safety around machines—we've got to start designing security solutions and technologies into these machines that carry through.

Dino And if you're really working well with IT, you can give them the hooks they need to get the information they need for compliance and risk and auditing: asset inventory, risk and vulnerability, so they have a way of tracking and measuring it on their end.

Dino [00:17:00] Not that they're necessarily gonna do anything about it. They can lightly nudge in certain areas where you might want to think about spending capital in the next year or two to get rid of these 20-year-old control systems you got—the Windows 7 machines you still have in your environment.

Dino Standardize on your networking platform, for example. Implement firewall policies within that environment where IT has a lot of relevant skills and knowledge and capabilities to assist, but what they're missing is what's operationally important to that plant.

Dino How can they do those things without being disruptive and causing headaches and/or downtime?

Dino And my experience—I say this all the time for IT guys—for them who've already had their hand slapped or have been poked in the eye, it's like trying to pick up a porcupine. No matter what you try to do to pick it up, you're gonna get stuck. So they just learn to leave the damn thing alone, and somehow that needs to change.

Dino But that means that IT capability—because going back to the Purdue model, the anatomies of these plants, even if you've got 30 plants, no two are the same. Those machines have been out there and deployed in different eras.

Dino [00:18:00] So you really have to understand the anatomy of the plant and how it operates: line changeovers, shift changes, maintenance windows, product swaps—whatever they might be doing. You gotta get in tune to that.

Dino As an IT person, to be able to implement your cybersecurity toolsets without being disruptive and still get what you need out of the environment.

Dino The area in which you work at Rockwell today—and other cybersecurity tools, platforms that are geared for that OT environment—have a lot of rich context and a lot of information, but I don't think IT knows how to map that, per se, to move forward and improve that cybersecurity posture.

Dino Which is really the end goal: how do I improve my cybersecurity posture?

Ken That's something I've talked about on my cast before. I'm sure you have too, right? You've got that old box over there. Maybe it's running Windows 7. I almost chuckled because I've seen older, much older.

Ken [00:19:00] But it's hooked up to something that's making a lot of money. That paper machine over there—technically that's a Windows 98 box hooked up to it. But we got a contract with two major American news magazines. This is the only paper in the world they're willing to use.

Ken Our downtime is measured in euros because they want their paper, and it's a massive legal headache to do anything because, okay, cool, that paper machine vendor—I don't think they exist anymore. So it's not like we can just call them up and say, “Hey, do you got anything that runs on Server 2022 these days?” They don't exist.

Ken It's a complete replace capital project. That's how many months of downtime, how many months these major magazines are not getting the paper, the only paper they're willing to print on—but they're gonna find a new supplier. Or there's gonna be significant legal penalties attached to that.

Ken And then on the flip side too, you talk about being sensitive to downtime. I can remember a couple of times in my Honeywell days when we had some critical changes that needed to be made.

Ken [00:20:00] This was a regulatory thing, compliance thing—they were facing fines—and we were just waiting on an outage. You get the call and it's like, “You have 36 hours.”

Ken It's like, “Dude, I'm not even in the same country right now. It's 10 hours for me just to fly there and drive because nobody builds power plants or pulp mills anywhere near pleasant touristy places that have frequent flights to them.”

Dino And just the inherent knowledge of the information you need to collect before you even go on site, right, to even begin tackling a problem.

Dino [00:21:00] When we're looking to set something up and we're meeting with the key stakeholders that are involved, we're trying to get our hands on IP and VLAN addressing schemes. We're trying to get configurations out of switches and firewalls. We're trying to get drawings and documentation—site drawings.

Dino And back to the earlier point: if the plant's been around for 30 or 40 years and maybe changed hands a couple of times, that stuff gets harder and harder to find. The tribal knowledge is not there. So then you're in a huge discovery effort the first time around, just because they tell you something.

Dino I do the same when people tell me, like, remote access: “Well, how do you get internet support to this?” “Well, you don't. You gotta come on site.” Then I open up the panel and there's a Tosy box sitting in it or a Cradlepoint cellular modem. Some VPN concentrator. Or there's a jump box.

Dino Or they think because they got dual NICs in their PLCs they're safe and secure because you can't get to the control side of what that other NIC is running on.

Dino And when you start putting it in context like that—and it's usually with IT and OT together—to have that conversation, because it's eye-opening for IT, and it's also letting OT recognize what we're trying to solve here.

Dino [00:22:00] Because this is the target. These control systems are the target of this security strategy that your company's decided to move forward on, and so we have to get our arms around this plant.

Dino And they may have one pulp mill on the West Coast, and then we go to another pulp mill down in the Southeast, and they're not the same. It's not like you can replicate what you did in one in the other. You still gotta go through that discovery phase because they don't have asset inventory in that environment. They're not really sure what kind of remote access is going on in there.

Dino They have different networking technologies being used in those plants, different control systems. Might be Rockwell on the West Coast and Siemens in Southeast. And that's where IT kinda gets lost because that's just not their model: standardization, centralized approach.

Dino That's not your plant floor. That's not the way it was built. And a lot of those plants run and operate independently. They have their own P&L. They pick different partners that they want working.

Dino They like this particular system integrator that's local to them versus one that might be more national, where you can get that breadth and depth across your plants to start standardizing and centralizing and put a strategy together.

Dino [00:23:00] When you go back to the Purdue model, again, the Purdue model to me is just a map at the end of the day. It's not saying you have to live within that Purdue model—you already do. It's just the map of your environment.

Dino I know where your IO is and stuff down at level zero, and what's in level one, and what's in level two, and what's in level three. We usually don't get too concerned about what's in level four and five because that's IT's world.

Dino It's when you get into level three where it's truly an OT environment. I've yet to see any companies where they've moved any of that into the hands of an IT organization to manage and support and to strategize on how to be successful.

Dino The business we're both in from a cybersecurity perspective—I’ve seen lots of OTIDS platforms—even though yours is not quite that. Implemented, and it's been in there for years, and you're seeing a third or less than half of your assets in your environment. You don't have an accurate asset inventory, which means you don't have an accurate understanding of the risk and vulnerabilities within your industrial environment.

Ken Yeah. And it does begin with that: you don't know what you have, you don't know what you need to defend.

Dino That's security 101. Every security framework, regardless of the industry you're in, the vertical you're in, the very first thing you have to have is an accurate, up-to-date asset inventory.

Ken And once you've got that, all sorts of stuff becomes enabled at that point. You can start doing risk assessments, crown jewels analysis.

Ken [00:25:00] What are the critical systems? Can't lose these. What are the less-than-critical systems? If I lose that, I might be okay for a day or two. What's gonna trip the boiler in five seconds?

Ken You can start figuring out, especially if you are in a fairly flat network, what are the points that we can segment at? And Purdue comes in a little bit useful there as well as just like you say: a map.

Ken Not so much as strict guidance of, okay, those things you must wall off as your level zero and those must be your level one, but more where the communications need to go.

Ken The part of Purdue that I like to hang onto the most is the whole idea of one-up, one-down communications, right? There's never—especially coming down, going from a level four reaching down into the environment—you want those connections between level four and anything below it highly brokered.

Ken [00:26:00] And really you never want them to go past level three. Or if you have a 3.5, that IDMZ or DMZ—whatever we're calling it, it has many names.

Ken But you want the communications to be tightly brokered, especially if they're flowing down into your OT environment, and to a certain degree out as well. Control communications—anything that can actually change something within your OT environment—you want to keep that as isolated and as far down the stack as possible, and as far away from the internet as possible.

Dino Coming from the lower levels up, we see a lot of PLCs, for example, that are trying to reach something that's outside that level three or three-five.

Dino It's trying to get to four or five, or even the internet. In the Purdue model, I put the internet at level six, even though there's five levels in the Purdue model.

Dino [00:27:00] But to me, the internet is level six. And it's not that it's getting out, but it's trying to get out. It's knocking at the door. And when you turn around and say, “Well, why is it doing that?” the client doesn't know why that PLC is doing that.

Dino It's whoever did the programming and development of it back in the day has left that in there. And it just takes a screw up: it could be a firewall update that what was once closed is now open, a configuration change in the environment, or somebody setting up a remote access that's going around that.

Dino And all of a sudden now that PLC is able to get up and out into the internet or into the enterprise—sending a signal all the way up. And we see that all the time. That is a regular occurrence: devices in the levels two and one, three, trying to get out of the box they're in, the box they're supposed to be in.

Ken Right. And all of a sudden you're on Shodan. Oh, dear.

Dino Yeah—and we've seen that too, right?

Dino [00:28:00] An IT leader who should be concerned about that—how do they get their arms wrapped around that if they're not gonna work with the OT people and pore through that information, or the integrators and the OEMs who are also playing a role in those plants?

Dino That's the third leg of the stool: you got IT, you got OT, and then you got those outside OEMs that work in your plants every day.

Dino Remote access, people on site—they got a role to play to maintain and support, or do startups, whatever the case may be, and they're in your plant. You're not really tracking what they're doing.

Dino And what they have is their workbook—their laptop that they're using to communicate with that stuff. They bring in their own stuff. If I go to 10 plants, eight of them are gonna let us walk in with our own laptops and plug it into their environment.

Dino Eight in 10—because they're not in a position to hand off computers to people showing up to do work in their environment to make sure it's got the right EDR package on it and the right services, and it's been scanned for malware and all of that.

Dino It just doesn't happen. And it's an expensive proposition for them.

Dino [00:29:00] I used to work for a very large adult beverage manufacturer, and that's what we did. You come up to our plant, we're gonna hand you a laptop, and this is the one you're gonna use.

Dino But then we had to keep expensive software on there. We had to keep Studio 5000 software up to date and on those machines. That stuff isn't cheap.

Dino That dynamic is something, again, I think IT misses on. They wouldn't let somebody do that in their environment if they went in to go work in their data center. They're not gonna let some contractor or consultant walk in and plug into their data center environment right onto their network.

Dino It's not a good practice. But in the industrial space, we find that to be true a lot.

Ken Commonplace.

Dino Very commonplace.

Ken I've seen it live. I've seen it live.

Dino We do it today. That's the business we're in. We do it today, and I know probably the Rockwell field guys that go out there and work in plants too probably do the same thing for the clients they're supporting.

Dino Again, circling back around to the Purdue model: it's just a map of where things sit within your plant, generally speaking.

Dino [00:30:00] And so then, if you can start isolating by whether you want it at the level, the cell, the zone, the line, and start building out your micro-segmentation—have something that is, using your words, brokering that conversation between whatever it's talking to within the environment to make sure that it's okay, versus things that it's talking to that's outside that zone.

Dino It could be even the same plant—level three to level three—but it's from packaging to brewing. Why does my control system need to talk to the brewhouse? Maybe the filler does, to go to the release, or to utilities to call for steam or hot water to clean the lines, whatever the case may be.

Dino But map those out, and then make sure you have a mechanism in place to make sure that they stay in their lane.

Ken Yeah. Versus just wild communications.

Dino So again, Purdue map, Purdue model—it has its place until you get to a fully autonomous AI world that's working flawlessly.

Dino [00:31:00] Again, back to my Waymo—even though I did catch a good story the other day. The Waymo thing's been popping in my head since I used one in Atlanta last week.

Dino There was a guy who put his luggage in the trunk of that Waymo, and then got to his destination, I guess the airport, and got out and was trying to open the trunk to get his luggage out, and the car drove off with his luggage in it.

Ken Oh, sorry, sir—your session has ended. I'm on to my next customer now.

Dino Again, there's still goofy things that can happen. It doesn't seem harmless—because it was obviously problematic for him. But on a plant floor: downtime at 100 grand an hour, damaging a piece of equipment, having to sewer a batch of beer or destroy product because things didn't work out right—no human in the loop to catch it before it got too far out of control.

Ken It's amazing how quickly those sorts of errors add up to more than anybody who could be deemed responsible makes in a year.

Dino [00:32:00] My position is I don't think IT wants to own that, Ken. That's my belief. They don't want to be on the hook for things like that. Right or wrong, I just don't see it.

Dino Because otherwise my phone would be ringing every day from IT leadership wanting to know what it is that we're doing for them in their manufacturing facility. I got 30 plants. You're working in six of them today. You got 15 people out there working in these three plants doing startups, doing maintenance and support. What are you guys doing? How are you doing it? What tools are you using? What's the activity and tasks that you're being asked to do by my company?

Dino So I can get my arms around this as I'm trying to build out my cybersecurity strategy—to me, that's the miss. Right now I see that as the miss, and I don't know why.

Dino I know Rockwell's been doing a better job of getting to IT leadership to have these conversations. But those are the big companies with deep pockets that are trying to do the right thing and get involved and engage. But that's such a small percentage of the overall manufacturers that are out there.

Ken When I was at that pipeline company I mentioned, they had no OT cybersecurity program whatsoever.

Ken [00:33:00] I'd come from a Honeywell ICS role. Technically I was not in an ICS-facing role at this pipeline company, but I just started building what I could.

Ken “Oh, here's an old server.” I'll throw something on here, and I can at least start inventorying the network and watching for stuff. Just do what you can.

Ken Here's an old workstation—maybe I'll get licenses for three different antivirus softwares, and then if someone wants to bring media into the environment, cool, you gotta pass all my tests. It just lives on my desk.

Ken But eventually they brought in a big outside consultancy to build them a company-wide cybersecurity program. They were about six months into that process, and all of a sudden the consultants start showing up with clipboards and taking notes in the control system and putting tape on the servers: “Okay, we need to upgrade this, we need to upgrade this.”

Ken I was doing some switch maintenance: “What are you doing? What's going on here?” And they explained it.

Ken I'm all for those kinds of programs, but obviously they were coming in with absolutely no context. You can't just be like, “Oh, here's this server—we should upgrade it to the latest and greatest supported model.”

Ken [00:34:00] That runs two of our lines. Two of our production lines are running on that server right now. We're not going to be upgrading that. But then it was like, okay, well, shoot, I gotta get OT a seat at this table.

Ken And at the end, I think they did find a good balance between what was IT's responsibility and what skill sets they needed to ensure they had on the OT side to supplement or complement what IT would also be assuming responsibility for.

Ken But a lot of times it comes down to communicating those realities: the complexities of OT, the roadblocks that exist to doing things in an IT way, even if it is something as simple as upgrading your servers every few years or upgrading your desktop PCs every few years or pushing all the updates that you can when you can.

Dino I know you've heard this term: think global, but you gotta act local.

Dino [00:35:00] If you got 30 plants, it's a resource challenge internally. Depending on how fast you wanna move in this journey will determine how many resources you need to execute that plan.

Dino You need people that are close to the process, who really understand how that plant operates, and are committed and willing to do that.

Dino Now 30 plants—okay, you might need 25, 30 some-odd people working on this instead of just two, unless you plan on spending five to 10 years doing it.

Dino And by the time that rolls around, it's a whole other set of problems you got, versus: “I wanna get this done in the next 18 months.” Well, you're gonna need an army, and you're not gonna get that internally.

Dino Those organizations that self-perform, which I know you and I talked about in Milwaukee—that's a heavy lift. Regardless of the technology, to do it right and be consistent and stay on top of it and be successful, you got a resource issue.

Dino Which is where I flip around: why aren't you leveraging the system integrators to help you with that? A lot of them have practices. They have partnerships with these technology companies. They've been working in your plants for years, decades. They know a lot. Tap into that.

Ken It seems like the best way forward.

Ken [00:36:00] And maybe that's why it's a really great thing that your group and some of the others that were there at that training—like, we're actually now getting our product line, the SecurOT product line, asset management and inventory: find what you have so you know what you need to defend.

Ken We're starting to get that now into SI partner channels, and that could be a really, really good thing.

Ken But you are exactly right. These are the people who have almost that same level of plant familiarity as Mr. I Can Listen for 15 PSI Variations, but they understand the technological side, and it comes back to that interpretation layer.

Ken They're the ones who can speak to the IT side of the house and take what the IT side of the house says and speak to it in plant-operator terms on the OT side, to people who are highly technical and to people who are very process-wise, but not necessarily computer savvy.

Dino Organizations like ours are a trusted entity to that OT organization. You're not there if you're doing a bad job. They’re not gonna ask you back. They’re not gonna let you get involved.

Dino If you're a lousy integrator, you're disruptive in the environment, or your technical prowess is way down on the scale, you're not gonna be in their work in any way.

Dino [00:38:00] So if you really wanna be successful, and you wanna get that asset inventory, and you wanna get your risk and vulnerabilities well understood, and you wanna start forming a plan on how you wanna execute this, you're gonna have to tap into that resource—that third leg of the stool.

Ken Yeah, we are.

Ken I don't know if all of you out there—if you got hair the colors of mine and Dino's, you might remember some of those old cop shows where they'd do the crossover episode. The whole plot would start on show A, and then you'd have to tune in to show B the week following to finish out the storyline.

Ken [00:39:00] So we're trying to do something like that here. Dino will be joining my crew over on the OT After Hours podcast—little passion project I've been running out of Rockwell for a couple of years now.

Ken And we're gonna keep this conversation going because there's a lot more here to unpack.

Dino And I don't know how many podcasts are actually at the level that we're talking about.

Dino There's consulting-related, big broad brush strokes: you spend a lot of money to get—not even a playbook—but just “you need to find an OTIDS, fill in the blank, to help you get a better idea of how to improve your cybersecurity posture.”

Dino [00:40:00] The question then is: how do you get that spinning tire on the road? Because a lot of companies out there will sell you all the parts to build a car, but if you don't know how to build a car, you're not gonna have transportation.

Dino That's what I've witnessed with a lot of clients. They try to self-perform, bought these tools through IT channels, generally speaking, and the stuff either never gets out of the box because the plant won't implement it, and they don't know how to force it down the plant's throat.

Dino Or they'll get it into the plant and they'll capture 20, 30, 40% of their assets maybe in their platform.

Ken Yeah—because if you're trying to do it bespoke-like or with less than complete buy-in, there's just gonna be areas that you're not allowed to wander into.

Ken “Oh, you can't connect to that switch and put a tap port on it,” or, you know, “yeah, you're not deploying agents.” It's not gonna happen.

Dino Right. If you don't speak their language, they will—if you show up without the proper PPE, take your pick—they're gonna put you in a box, and you're gonna stay in the box until you decide to leave the plant.

Ken That's the joke I always used to make.

Ken [00:41:00] That's a hard ask too, because now you're adding a whole other layer: you need somebody who's highly technical, understands the plant intimately, but also can show up at the plant and speak the language.

Ken With an SI, you've been working on the plant for years, so hopefully you've already built that relationship.

Ken But imagine someone coming in from the outside: you gotta show up at this plant, you gotta be able to speak the language, you gotta be highly technical, but you also have to be enough of a people person that you can sit down with that plant operator and, within about a day, convince them that you should be allowed to come back the next day and have significant levels of access to their kingdom.

Ken It's not easy to find people that check all those boxes. You can find highly technical people. You cannot necessarily find highly technical people who can think on their feet and are outgoing and conversational. That's a different thing entirely.

Dino A lot of times we'll go into the plant and the IT guys are the ones initiating it, which is great. They're the ones that crack the door open to have the conversation.

Dino [00:43:00] But as soon as we get on the plant floor and get ready to go—we put the uniform on—that's when the IT guy is like, “Yeah, no, I'm not going on the tour. I'm not going out there and crawling through that plant for the next two or three days.”

Dino It's not something they want to do. They'll work on the network. Again: the network they can control and manage—that's their responsibility: firewall, network.

Dino But after that, everything from that IDF down into the control—Purdue model, anything at level three and down—they're out.

Dino They're like, “You guys have at it. You work with the electricians and the operator, maintenance guys, and engineers. You're gonna have to go deal with them to get the things you want.”

Dino Which is fine for us. We're good with that. That's not a problem because we do that every day anyway.

Dino But for them it's like, “Yeah, I have no interest in doing that. I didn't bring my safety shoes today.”

Ken Must be nice—not to have to always travel with checked baggage because I've got two pairs of steel toes and all my arc flash gear.

Dino I had to laugh at Jessica when we were leaving after that training, because she was on a startup in Vegas at a food plant, and she flew from there to Milwaukee.

Dino [00:44:00] When we were leaving to go—because we would travel together to get to the airport—she had her hard hat with a carabiner connected to her backpack. Because she had her safety shoes in there, she had her hard hat with her. That's how we travel.

Dino Because I don't want to ask the plant for anything, because some plant managers or the engineering team are like, “You don't have your own stuff,” they're not going to give it to you, so you're stuck. You can stay up on the mezzanine where the tourists hang out, but you're not coming down here.

Ken You can't see it, it's just off camera over here, but there's two suitcases and two backpacks.

Ken It comes down to what kind of trip is this, right? For Milwaukee, cool—I’ll take the smaller backpack and the smaller suitcase because I'm just in the office.

Ken [00:45:00] But the other one—that's where the PPE's already tucked away ready to go, the extra pair of steel toes, the bigger backpack that holds the extra gear.

Ken And it's just how you roll because where are you ending up? But being cognizant of that fact and being able to show up looking like you belong there can go a long way.

Dino It definitely goes a long way with those OT guys.

Ken Bringing them treats also helps. Find out what they like and bring them a little bit of that the next day.

Dino Plant people are hard to get out of the plant. You just go on lunch or whatever because it takes 30 minutes to get out of the plant—wherever it is you might be—and then 30 minutes to go someplace to eat because the plant's out in the middle of nowhere, and they can't be gone for two hours.

Dino So I eat cafeterias and vending machines a lot at the plant.

Ken [00:46:00] I think the best rapport I ever had with a plant ops guy—and it was a long project—but it was about Thursday of the first week and he's walking us out and he sees the rental car I'm driving. I think it was like a Ford Edge, one of the earlier Ford crossovers.

Ken He's looking at it and he's like, “Hey, which hotel you staying at?” I'm like, “It's this one.” He's like, “Okay, I'll be there tomorrow morning. I'll meet you outside. Can I drive this thing?”

Ken I probably shouldn't have let him because I don't think my employer's insurance—this was pre-Rockwell, so I figure statute of limitations probably fine on it. He didn't get into an accident anyway.

Ken He had a daughter, and she just had a kid. He was looking to set her up with a vehicle. He liked the look of the Edge. It was kind of low, it was wide, it handled well on the road.

Ken So I let him drive us to the plant on Friday morning.

Ken And just things like that. We also figured out which restaurant in town was his favorite, so we went and had dinner there one night. Then we had way too much leftovers, so we brought him lunch the next day.

Ken [00:47:00] This was this big Asian place—order large trays of food to your table. But just finding those little human elements. And like you say, they can't always get off plant, but if you can bring a little humanity back to them, it goes a long way.

Dino Yeah, it does. All right. We'll meet up again, and this time we're gonna flip the script. I'm gonna head over to your podcast.

Dino For our listeners, please review the show notes, and we'll catch you next time. Intro/Outro: Thanks for tuning in to the Industrial Cybersecurity Insider.

[00:48:00] Intro/Outro: To stay up to date with our latest episodes, be sure to click the follow or subscribe button now. And if you found this podcast helpful or have a topic you'd like us to discuss, please leave us a review or let us know. Thanks again for listening. See you next time.