OT Security in Hindsight: Visibility, Authority, and the Executive Disconnect

[00:00:00] LuRae: From blind spots in your network to bold predictions about the future of OT Cybersecurity. This special rewind episode blends expert insights from three powerful episodes. Get ready to uncover risks and rethink resilience and control system integrity and cybersecurity.

[00:00:17] craig: Where should organizations be spending their money today? For organizations that are stepping back and saying, okay, the board said, here's a check. Go fix this. Mm-hmm. Where did they start? What makes the most sense?

[00:00:32] Bart: Every company, every asset owner that I've seen is in one of two phases.

[00:00:36] Bart: I'm working on visibility, I'm working on architecture, and it's not monolithic. You can gain some amount of visibility. To then some amount of architecture, particularly places that have global sites. It might be some sites, furthermore, others, if you're lucky and you have homogenous sites, then that happens.

[00:00:52] Bart: I've never seen that. Usually it's all through acquisition and you have 500 different configurations all over the place, plus an archaic. Routing and switching infrastructure that can't even handle more, so you can't do tap and span ports. So everybody's in one of those two phases, and I think that's the key to recognize because I think half of what I try to do in teaching is provide the therapy that you're not alone, the existential angst, you feel you're here with friends who all feel it too.

[00:01:17] Bart: So you're in one of these two parts. Then second, going back to my comment earlier about how to build trust. Okay, so the board's bought off on this. Go and meet the operational executives. And when I say meet with them, listen, I had a consultant call with it, architectural group, and they were like, well, yeah, we met with the senior vice president, and she didn't seem that interested.

[00:01:39] Bart: And I was like, well, you met with her. Did you ask her what her priorities were? I. They all blinked at me and they were like, oh, we didn't think about that. Your job with going to an executive is to make their lives easier, particularly the revenue producing executive that controls all of North American revenue and its production.

[00:01:54] Bart: Maybe asking what she's interested in will get her attention and her support as opposed to just being like, well, ma'am, we're here to make security happen for you. And then from there. Individual sites, plant managers are demigods. They run their fiefdom with they do for p and l and safety, and you're coming in there.

[00:02:14] Bart: Mm. You're gonna have to win them over the same way. Yeah. So the remote access, like I said, is the most common, easiest way that I've seen to gain that win-win across. Those are my recommendations. You could be either in that visibility or architecture. And then ask, ask, ask. So now you can tie what you're trying to do.

[00:02:32] Bart: Again, don't force it. Don't try to pound something in that doesn't fit instead. Alright, you want that? Well, that's not what I was thinking about. So what do I need to do to gain some security benefit from providing you something towards your goals?

[00:02:45] craig: We've seen many times where organizations, the IT side will procure a tool or a technology, and then we'll ask all the questions.

[00:02:55] craig: Everybody's on board, we're ready to go. We're gonna start next Tuesday, be at the plant, and you walk in the door and a plant manager says, what are you guys doing? Well, we're here to do this project, whatever it is. He's like, oh, no, no. He said, I shut down. In six months, I'm closed for one week. I've got four weeks worth of stuff to do.

[00:03:14] craig: You go see my boss, who's the CEO or the COO, and if they prioritize whatever it is you want me to do and put it in my list, I'm happy to. If not, you gotta go away

[00:03:24] Bart: and yeah, don't surprise them. And so another area that you can find that is disaster recovery and business continuity planning.

[00:03:32] Speakers 1: Mm-hmm.

[00:03:33] Bart: That is fundamental to how that plant manager thinks.

[00:03:36] Bart: The good news or bad news is based on how you think about it. So back in 2020 then Director of the cybersecurity infrastructure Security agency, cisa, Chris Krebs and I gave a talk at RSA and we predicted the coming scourge of ransomware. So ransomware had been around, but it hadn't really hit the apex, unfortunately.

[00:03:55] Bart: We saw that. Mm-hmm. Dovetailed with COVID, and hence going back to 2021. And my point is, never waste an emergency. That can be an opportunity. And so. Ransomware is now a kitchen word. Mm-hmm. Your grandma knows what ransomware is. Now, grandma doesn't know how ransomware works anymore than the 500 times. She asks you how to work the her phone.

[00:04:17] Bart: Grandma says how you turn it on, it was off. But guess what? That's the same level that your business executives work out. So good news, bad news, they know what ransomware is. They know ransomware is a threat. They do care about business continuity planning and disaster recovery. They have budget for it.

[00:04:34] Bart: They have attention for it. So that's another area that you can try to work and tie to, and that's now the advantages you have in the greater state. Like I was saying with the ICS village, we were doing it for years because there was no great crisis, so nobody cared. When you hit in a hydrocarbon based economy, when you hit folks not being able to get gas.

[00:04:54] Bart: The average citizen suddenly cares.

[00:04:56] craig: Oh, absolutely. When people are putting gasoline in trash bags in the trunk of their car, 'cause they don't think they'll get it anymore next time, well, first off, the fact that the gasoline didn't immediately, instantly dissolve. The black plastic trash bag is still beyond me, but maybe it didn't.

[00:05:13] craig: I'm not sure.

[00:05:14] Bart: I think that's more credit to the plastic bag, frankly. And part of why please use paper bags and recycle because yeah, this stuff does not leave the environment. It's proof. Greg Craig's story and note that the gas didn't disintegrate the bag.

[00:05:27] craig: I know, it's crazy. So as we look forward, what do you see shaping the industry?

[00:05:33] craig: Are there key? Indicators, key technologies or areas where the industry is going to drive. And I'll preface it with this. I saw something just published in the last couple days there. Yep. Secure by demand, let's call it that. It was secure by design with the emphasis on procurement, instilling upon organizations, you must now do this before we will buy from you, which gets back to a secure by demand mentality.

[00:05:59] craig: So something of that nature. Is there something else? Where do you see us going?

[00:06:04] Bart: Again, since we're all in visibility and architecture toward better architecture in the next five years, I'm hoping that the majority of asset owners have built a defensible architecture. 'cause let's be frank, it takes years.

[00:06:17] Bart: Years, mm-hmm. Years. This isn't a six month project. This isn't a 12 month project. This is years. And the bigger you are, the longer it takes. Something I don't talk about very often 'cause it takes away from my elite hacker cred. But that. British aerospace and defense company I built from scratch with a team around the world that I also had to build from scratch.

[00:06:35] Bart: The only fully functional figuration management database I've seen anywhere, and it took us four years to get 70% deployed before I left four years to just do a an it CMDB. I wasn't even pulling OT assets in. That was four years and I had a team of 12.

[00:06:51] craig: Yeah, if you do the math, and I'm a organization with a hundred plants or 150 plants in my facility, and they're all different, and they're spread around the globe on seven different continents.

[00:07:02] craig: That math equates to a great big number with a lot of zeros after,

[00:07:09] Bart: by site, by site. You have to do each site individually. If you could figure out how to do more one at a time, then. God bless you. You've cracked some executive code there to make that happen, but I'm skeptical, so it is years. So that's my hope is that we continue down this path of that defensible architecture.

[00:07:29] Bart: Okay. And then what's after that? I don't know. Now we're into a grab bag of fun things.

[00:07:33] craig: That's always exciting though as new things come on. If I go back to your story, I'm gonna guess you probably don't drive a Tesla, which is a computer on wheels, probably a early fifties or sixties car that has zero electronics in it.

[00:07:47] craig: That's manual ship. That's a hundred percent manual in nature.

[00:07:51] Bart: Actually, I drive a British racing green Jaguar with cognac, Windsor leather. It is that nice, beautiful color combination.

[00:08:00] craig: Okay, beautiful. So it has some technology in it.

[00:08:06] Bart: Going back to car hacking, the technology that by regulation shifted everything was tire pressure monitoring system TPMS in 2006.

[00:08:15] Bart: Two frequencies guaranteed access in combined with the fact that can buses, just like we try to segment processes an ASK donor environment, our OT environment. You had generally three can buses and of course, what's the most important part in your car as a driver and a consumer infotainment system?

[00:08:34] Speakers 1: Yeah, so

[00:08:35] Bart: something running, again, the OT folks are gonna laugh, right?

[00:08:38] Bart: Something that's a couple of generations old Windows or Linux. Mm-hmm. Is now my central brain to being the thing that keeps the three important can buses, including the priority one, segmented from each other. Well, you do the math.

[00:08:51] craig: Yeah, not pretty. So as we look to wrap up, is there one piece of advice for organizations that are listening today that are starting the journey?

[00:08:59] craig: Maybe they're beginning the journey, they're on it. Is there one thing that you could say, if I could go back or I recommend you do, what might it be?

[00:09:09] Bart: The most common fallacy I see across everything is everybody wants to complete some project. And after 2, 3, 4 years of putting this in, then they want to do the risk assessment.

[00:09:22] Bart: Think about that. What if you got something wrong? Why not catch it earlier? Right? We all know this from manufacturing. The earlier and I catch something in quality control, the less the price of the defect. Well, it's the same thing for a security issue, which is the same thing as a defect. So. Try to bring in risk assessments in partial components.

[00:09:42] Bart: Again, this is where purple teaming is really valuable, so bring that process into as part of your deployment, to check your progress as you go and adjust. 'cause you're gonna save yourself a lot of time, a lot of money. A whole lot of emotional pain with that being the scaffolding to test to your design, to deployment as opposed to afterward

[00:10:02] craig: reminds me a lot of like a minimum viable objection so that you start with what is it?

[00:10:08] craig: Are we on the right path? And then you scrape and you start over and you modify and you adjust. And then, 'cause you're right, you don't want to get four years down the road, roll out all of your plants and realize that there's a critical flaw and you gotta start all over. That is a bad day for somebody.

[00:10:24] Bart: And yet that is the most common wisdom that everybody is executing.

[00:10:30] Dino: companies are starting to create OT cybersecurity positions within the organization. And it's a combination of both engineering and plant teams and the IT teams. And from our experience, those organizations that have a really tight relationship between IT and ot, they're aligned.

[00:10:47] Dino: They're very collaborative, they're transparent, they, they recognize each other's strengths and weaknesses and, and they leverage each other. And their partners are starting to build a coalition around how do we provide a cybersecurity strategy for our business? And so the S four does a really good job of one, bringing all of the technology partners in, the leaders, the visionaries, um, activities that are going on in this space, use case studies, what they're witnessing around the world.

[00:11:17] Dino: They have a lot of different events in there, but a lot of the, um, vendors that Gartner has published in their Magic Quadrant report, attend and participate at the S four conference.

[00:11:27] craig: Well, a selfless plug for Dale and the team that sponsor promote and run the S four conference, Dale Peterson. They, that conference is designed for the OT ecosystem as it's evolving, as it's becoming more prevalent and the tools and technologies that are there for that.

[00:11:49] craig: Organizational structure. It's designed to promote that was started out of the operational side and has continued to grow and evolve. It's a gathering place for that ecosystem to be at the cutting edge of what's there because it is such an important shift as organizations are trying to figure out how do I apply the same?

[00:12:15] craig: Frameworks to secure and protect my OT infrastructure as I do my IT infrastructure. And there are differences in the way that it's applied, but the frameworks can be similar in the overarching piece of that, right.

[00:12:31] Dino: Also how it's funded, because on the OT side, a lot of it's CapEx and OT is obviously for primarily opex, and it's not that OT doesn't have opex, they do.

[00:12:41] Dino: But in order to replace end of life and end of support machines on your plant floor requires a capital project to do that. It's not like you're gonna get an OPEX project that's gonna come in and say, I'm gonna do recon control and upgrade PLCs, replace PLCs, upgrade my SCADA system. Replace my SCADA system, update my network.

[00:13:01] Dino: Replace my network. Those types of activities traditionally, and typically in the manufacturing world, on the plant floor, usually fall under the umbrella of, of a capital project. '

[00:13:11] craig: cause of the life cycle it takes to complete it. To do it. The cost associated it. Yes. The way they

[00:13:15] Dino: depreciate it off with off their books.

[00:13:18] Dino: You know, the way the accounting rules handle. And that's why a lot of that stuff falls into that particular piece. So as an organization, you're gonna have to figure that out. That blend between CapEx and opex. Yep. When you do have capital projects, and it's something that you know from an IT leadership they might wanna try to get your uh, arms around is what capital are we gonna spend in the next three to five years and what's it gonna be focused on?

[00:13:40] Dino: That's the time that you really wanna start talking about funding your OT cybersecurity technologies in a lot of ways, right? Yeah, it's not. For most organizations, this is all net new stuff. And because there's a lot of unknowns within these manufacturing facilities. If you have a lot of plants, if you have, you know, a dozen or more plants, it's gonna take a bit to go through each one of them.

[00:14:01] Dino: Right? Think globally, but you gotta act locally. What you apply to one plant and how you get to it is not necessarily gonna be the same at another plan. Right. On how you get to that information. Right. I mean, the technology would be the same and you can execute the same way. Meaning that how you get to that data, but some plants are, are, uh.

[00:14:21] Dino: More standardized than others. And some of 'em have a lot of d varying different types of automation technologies in there that they use. And uh, I know we've talked about that in in previous podcasts that we've done. Yeah. But it is unfamiliar and unknown. And so you have to have an organization that really knows how to go in there to do this work and not be disruptive.

[00:14:40] Dino: Right? You can't shut the plant down while it's working or you gotta work around their maintenance windows and schedules that they put out there that you have to come in behind and, and work while that plant. Down or portions of that plan are down to do some of this work. But just keep that in mind when you start pursuing OT cybersecurity strategies, and don't just pick a tool for threat hunting.

[00:15:01] Dino: If that's what your intent is from an IT perspective, if that's what you're looking for, you're kind of missing the boat a little bit, right? You really need to look at a technology that meets the majority of IT to meet the OT needs, right? Because you want them to see value and benefit of, if you have a cybersecurity OT IDS platform today, and if I'm working in your manufacturing plant.

[00:15:22] Dino: Installing a packaging line or doing some lifecycle replacement, I should be seeing information from your O-T-I-D-S platform to give me a better idea from an engineering perspective what I'm up against inside this plan. What are the weaknesses that are in here? What are the vulnerabilities that you have?

[00:15:39] Dino: What's the remote access look like? What kind of things should I be looking for and maybe implementing for you and designing into these machine centers is, uh, complete the project that we were brought in to do in regards to doing that refresh project.

[00:15:53] craig: As organizations are going down that budget cycle, that approval process and your IT leadership is trying to incorporate the holistic enterprise wide security strategy to build into that CapEx portion for the OT security as well.

[00:16:13] craig: And there may be a portion of it if you look at the way that it outsources and this SOC and their. Leverage partnerships with other third party providers. There may be a piece of that as you're trying to leverage. How do I support the operational side from a managed services of who's gonna interpret and understand all of this net new work that's coming in?

[00:16:38] craig: Maybe there's a, a CapEx and an OPEX component. Within that as they're trying to understand what that looks like

[00:16:47] Dino: and set the ground rules too, right? And understand them. Because a lot of the OT guys are not big fans of cloud solutions, and they don't want 'em, they want things to be on prem because in their mind, if it's instrumental to running the plan.

[00:17:00] Dino: You lose your WAN or you lose a cloud piece or whatever. They don't want that to impact them. And the other thing is they don't want a lot of their information to be somewhere that it's not within their control. I would say from an IT leadership perspective, you need to start helping them understand it.

[00:17:16] Dino: One, all of these platforms that are out there, again, back to the Gartner Magic Quadrant report, all of them provide cloud-based solutions. Many of them provide on-prem. They all provide a cloud-based solution. So now's the time to talk to your OT leadership on the values and benefits of, of cloud and why it's relevant and it's important, and, uh, help them with that.

[00:17:38] Dino: Otherwise, they're gonna fall back to on-prem solutions. They're gonna tell the OEMs and system integrators that, that are coming in and driving some of these o OT cybersecurity initiatives within the plant, and they'll do it with or without you because they're gonna, their, their ecosystem is bringing this to the table.

[00:17:55] Dino: And starting to ask those questions. And a lot of times we catch it flatfooted because they either have a tool that doesn't necessarily fit round peg square hole, or they haven't been sharing, or they haven't been looking at it.

[00:18:08] craig: Well, and as we look at the. The shifting landscape, the changes that are, that we as a country have seen in the last, I dunno, 60 days, let's call it with Doge and the implementation of new policies, procedures, guidance from the federal government.

[00:18:28] craig: There's a chance that the accounting rules and regulations could potentially change and shift to be more favorable, and the tax regulations could shift and change to be more favorable for some of these projects. As we as an country are looking to secure and protect our. Critical infrastructure, our manufacturing, and how we can do that.

[00:18:50] craig: So now may be the time to see what you can do as an organization to get some of these projects in there and really begin bolstering your cyber presence

[00:19:00] Dino: as we're seeing in, in our business and the things that are coming back on shore. Yes, sure. And so obviously those are gonna be capital expenditures and you're gonna start seeing, uh, some retooling and you're, and when you start seeing that type of activity within the manufacturing arena, that's the time to start thinking about your cybersecurity strategy.

[00:19:20] Dino: If the money is being set up in a set aside for OT cybersecurity, and yeah, that's the time to do it, right? So whether there's tax incentives that are driving it, onshoring, that's driving it, retooling of your plants. You've got going on and you need to start, that's the time to start trying to figure out how do I set money aside in order to improve my cybersecurity posture within my manufacturing environment.

[00:19:42] Dino: Well, you gotta bring all the sides together. You gotta get, yeah, as I used to say, you gotta get all liars in the same world. Right? And I don't mean that in a bad way, but I'm basically saying those that are responsible, the key stakeholders, you the decision making teams need to be involved and engaged in this journey.

[00:20:00] craig: Well as manufacturing shifts, as more come back to the US that the onshoring, as you mentioned a while ago, look at AI and how it's playing a prevalent role. The data centers, I saw a statistic last week or early this week were 65%, I believe, was the number of the AI data centers around the globe are focused in the us.

[00:20:25] craig: Look at the production of those data centers and the power. That's taking to do that. What's happening from a, an infrastructure and an onshoring, it's really becoming prevalent of we are trying to make sure that we're going down this road correctly. Right. And we're seeing that in

[00:20:43] Dino: our business. Right.

[00:20:43] Dino: Because we do a lot of data. Yeah, for sure. Right. When it comes to the power systems for, for. You folks out there, you know, our organization focuses in the semiconductor business, but also in the data center business, meaning you've got building automation, building management systems, power management systems, and, and we're wrapping cybersecurity because those data center companies are going in with cybersecurity in mind.

[00:21:05] Dino: Absolutely you, they're not an afterthought for them. No. It's part, part of the project going forward with those guys.

[00:21:12] craig: People are ignorant in the fact that they are not educated on what's available, what's there, because this is still fairly new. The IT tools and technologies do not apply to the OT space. They're disruptive. You cannot apply them in a linear, and people are not. Educated in the fact that these tools are different from a remote access.

[00:21:36] craig: If you are not choosing a tool that has audit capability, that has over the shoulder viewing, that has full recording capability so you can see and has granularity to get down to protocol. To a port to a particular assets IP address. You've got the wrong technology. But if you were to ask an IT person that's educated on the IT tools and technologies, they're gonna say a VPN's fine.

[00:22:03] craig: 'cause we use it every day, all day long in the IT corporate space. But it's different. And it, back to education,

[00:22:11] Dino: to me it still goes back to asset ownership. At that point, it doesn't care what happens to that control system, per se, 'cause they don't have to fix it. It's up to the operational teams to figure out how to get it back up and, and running.

[00:22:24] Dino: Right? And if they can't find a mechanical issue that shut it down, a motor that burned up, for example, right? That they gotta replace the motor in order to get the filler back up and running. If it's not something easily identifiable, the number one priority for that site is to get that packaging line back up and running, right?

[00:22:40] Dino: Because the, the revenue has stopped.

[00:22:42] craig: Organizations are being misled. Rob Lee, and everybody knows Rob from Dragos. He made a comment which was a thousand percent spot on. He said, you ask any CEO of any manufacturing organization and they can tell you exactly where the revenue comes within their organization.

[00:23:02] craig: And that's the manufacturing. When you talk about. Enterprise wide security. It's only the non-revenue generating portion, the IT side that's getting all of the funding, all of the focus, all of the attention. When all of the revenue is coming from the other piece of it, it's, there's a gap and the.

[00:23:26] craig: Executive level responsible party. The CEO, the board of directors are being misdirected by the CISO or the CIO because they don't understand the other half of the house.

[00:23:39] Dino: In the enterprise space, they try to blanketly cover.

[00:23:42] craig: Yeah.

[00:23:43] Dino: Firewalls and EDR, which has some positive effect, sometimes negative, but just say for the most part, a positive effect.

[00:23:51] Dino: But you can't take that same mindset and approach and apply it as you get deeper and deeper into that control system, right? You gotta think globally, but you gotta act locally. That's the disconnect, right? That's where it cannot. They don't have the resources, they don't have the skillset, they don't have the knowledge of what's exactly going on at that particular level on what it takes for that packaging line to run.

[00:24:15] craig: Well, here's another curve ball into that situation you mentioned earlier. If you've got 20, 30, 40 plants in your fleet, whatever the number is, let's take four of them. None of those four are gonna be the same from an it. Enterprise. You can put endpoint protection on every laptop, every desktop, and it's the same you can control because it's a uniform environment.

[00:24:39] craig: In the manufacturing, OT especially control space, it's all different. Those four plants are gonna be different. You may have the same team set 'em up, they may all be greenfield, they may be. Close to the same, but they're different. And that's where you run into snags.

[00:24:57] Dino: Even in a greenfield environment, you're buying equipment from all over the world.

[00:25:01] Dino: Yeah. Built by thousand different OEMs that are, that are involved in these machine centers. And so then the question is, how are you going to herd those cats?

[00:25:10] craig: Especially when you have an acquisition. We just bought three plants, or we picked up a dozen plants, or we added to our facility from this manufacturer because they had something that we liked better.

[00:25:21] craig: Again, you have no idea what that other organization's cyber hygiene is and what you're bringing into your environment. You have no clue.

[00:25:30] Dino: And even then, when it comes to m and a, those organizations that help you with that. Aren't even schooled well enough to be able to help you find, well, you already have malware in that plant.

[00:25:39] Dino: You got a dozen Windows, seven machines in that plant. When to replace those Windows seven machines is gonna cost you another $25 million. Right? Yeah. To to do recon control or rip and replace. What would a CIO or CISO do if they found a window seven machine in their enterprise? Strip it out root and stem, right?

[00:25:56] Dino: Well, you can't do that on the plant floor, so now you have to pivot and determine how am I gonna protect and secure the best I can that Windows seven machine. And if you think a firewall is the answer again, you're missing the point.

[00:26:08] craig: Yeah, for sure.

[00:26:09] Dino: Somebody has remote access into that machine, number one or number two.

[00:26:13] Dino: Some guy's gonna show up and plug into that machine and you're never gonna see 'em. Yeah. Or they're VPN their way in, all the way down to that machine and you don't even know what they're doing once they're there. And there are technologies where you can say, well, I can't spend $5 million where replace that window.

[00:26:26] Dino: Seven machine running that particular process area. But there are technologies out there where I could do something like a virtual patching or I can segment the network. Right. But it's on the control side. It does not design and build networks on the control side. Purdue model level three and up, they got a lot of latitude.

[00:26:46] Dino: You get down below level two and one, it has no latitude.

[00:26:50] craig: Well, they have no, they have no experience.

[00:26:53] Dino: Right. So trying to throw a blanket on top of it with your firewall and thinking that you're gonna call it a day. Mm-hmm. You're missing the point. Or even if you do get an O-T-I-D-S platform, then you're back to, well now you're only seeing 30% of the assets, you're missing 70% of 'em.

[00:27:07] craig: And if we bring this back to the conversation at the beginning. It's how do you begin securing and protecting all of the additional things that are there that you have no visibility into? You gotta bring it back, right? It's gotta be there. You gotta start

[00:27:22] Dino: with assessments aren't gonna, aren't gonna cut it because those are valid the day after the assessment's done.

[00:27:28] craig: Yeah,

[00:27:29] Dino: for sure. These, these environments are not static. They're very dynamic and assets come and go all the time. Applications come and go. Users come and go. New protocols are being inserted in the environment. Unsecured protocols are already in the environment. So the as assess, does the snapshot assessments aren't valid anymore?

[00:27:46] Dino: No. And why would you do that? 'cause we have tools now that can continuously monitor. This environment. Yeah. Passively not destructive like an EDR package running on my hmis or a firewall that doesn't understand an industrial protocol and decides to block it, which is preventing my utilities from sending steam down to clean these vessels out that I need so I can make my next batch of whatever.

[00:28:08] Dino: Firewall's going, I don't know what SIP is, and it blocks it, or S seven from Siemens and ignores it. And so there has to be some continuity when you start inserting these tools in there. Again, back to that acting locally, because what you do at one plant to solve a problem isn't gonna be the same rules that you're gonna apply at the next plant.

[00:28:26] craig: No,

[00:28:26] Dino: right, because that back to the, all the plants are different. That's a Honeywell plant or it's an Emerson plant, or. It's a hodgepodge of stuff, running my ECP and a bunch of other different things. And so again, you gotta get back to working locally in order to really dig into this. You can't just like safety, right?

[00:28:42] Dino: Safety is on the site.