Partnership in Action: When Legacy Systems Meet Modern Cybersecurity Threats

[00:00:00] CSI - Dino Bulasalachi & Debbie Lay and Patrick Gillespie - Debbie: And they had cyber insurance, and they knew that they had to do multifactor authentication. But they didn't get it upload, they didn't get it fully implemented because they had people culture that didn't want change.

[00:00:12] CSI - Dino Bulasalachi & Debbie Lay and Patrick Gillespie - Debbie: Those OT operators didn't want that change in their environment and from the top level, they weren't being pushed that, so they had a half bake solution, , in their environment. And because they didn't implement. Now the insurance company's saying, we're not paying that $5 million because you guys didn't fully implement.

[00:00:57] CSI - Dino Bulasalachi & Debbie Lay and Patrick Gillespie - Dino: Hi, my name's Dina Bus, and today I have Patrick Gillespie from Guidepoint Security. And Debbie Lay from TX one. How you guys doing?

[00:01:08] CSI - Dino Bulasalachi & Debbie Lay and Patrick Gillespie - Patrick: Doing good. How are you?

[00:01:09] CSI - Dino Bulasalachi & Debbie Lay and Patrick Gillespie - Dino: I'm good. So, , Patrick, I'm gonna start with Debbie. 'cause ladies first, right? It's, that old school Lemy. why don't you, , tell us a little bit about yourself , and your role at TX one and maybe something that you're working on currently.

[00:01:22] CSI - Dino Bulasalachi & Debbie Lay and Patrick Gillespie - Debbie: , So yeah, Debbie LA I'm a solutions architect for TX one. I'm based outta Dallas. I have been with TX one for the last three years. , Prior to coming to tx. One, I spent 25 plus years in the IT cybersecurity, side, always from the vendor perspective. , But three years ago, , started to make the change into ot, , and that's me.

[00:01:43] CSI - Dino Bulasalachi & Debbie Lay and Patrick Gillespie - Dino: Yep. And Patrick.

[00:01:44] CSI - Dino Bulasalachi & Debbie Lay and Patrick Gillespie - Patrick: Yes, sir. Yeah. Patrick Gillespie. I'm the OT practice Director at Guidepoint. I'm based in Arkansas. , I've been at Guidepoint about three and a half years, so. My team of OT engineers essentially, , support Guidepoint clients nationwide. , From a more of a CISO perspective, , to help our CISOs understand the challenges in ot, and then how we work with, , you know, Dino and Debbie and their teams to essentially help them, you know, secure their OT environments.

[00:02:11] CSI - Dino Bulasalachi & Debbie Lay and Patrick Gillespie - Patrick: what's even possible to do with today's technologies and things. So , before Guidepoint, I was actually offensive security. Primarily for, banking and credit unions for several years. But prior to that, 11 years before that, I was, , actually a CNC programmer building elevators, and I went and built freight trains for eight years where I learned network architecture and industrial controls.

[00:02:31] CSI - Dino Bulasalachi & Debbie Lay and Patrick Gillespie - Patrick: So, full circle, back to ot. So, yeah, it's great to be here.

[00:02:35] CSI - Dino Bulasalachi & Debbie Lay and Patrick Gillespie - Dino: Yeah. Thanks Patrick. I mean. in our three organizations here, you know, one being a, a technology partner, and then two that kinda lead IT consulting and services pieces. , Both look at this kind of differently, right? I mean, I obviously, I come from an industrial manufacturing perspective. , Patrick has that background, but his organization didn't start in that realm.

[00:02:56] CSI - Dino Bulasalachi & Debbie Lay and Patrick Gillespie - Dino: on the industrial side more and the it and the enterprise realm, and of course Debbie working for an automation or a, . Cybersecurity technology firm. Right. and so I guess what I would like to start with is what are some of the challenges that you guys are seeing as clients are reviewing and beginning this journey into looking at OT Cybersecurity specifically in their industrial, , environment?

[00:03:21] CSI - Dino Bulasalachi & Debbie Lay and Patrick Gillespie - Dino: Patrick, let's start from you being in the enterprise side, your organization, you know, very large organization, global company. , We've have a lot of manufacturing clients. So what are some of the things that you've witnessed? Good, bad, challenging, and different?

[00:03:35] CSI - Dino Bulasalachi & Debbie Lay and Patrick Gillespie - Patrick: for sure. So guide Point's clients historically have been to CISO and still primarily is even when we're supporting their industrial environment. So, so guidepoint of, cybersecurity. Var. Were a value added reseller. We do not. Create our own products like TX one. We, you know, essentially partner with TX one to, you know, resell their technologies and then Guidepoint implements them for our clients.

[00:03:57] CSI - Dino Bulasalachi & Debbie Lay and Patrick Gillespie - Patrick: So, coming from the CISO perspective, the good that I've seen since building the OT practice is that. The CISO is close to the board. So, , you know, if we were selling, for example, to the OT asset owners, the plant managers, you know, we may have to go to 50 plant managers or 200, but selling to the CISO and getting that board buy-in early. Oftentimes a driver for that is cyber insurance is now starting to ask about OT cyber or the board in general. There's so much more awareness about securing operational technology, all the remote access methods into ot, especially since COVID, , you know, more and more nation state threat actors are targeting our nation's critical infrastructure, so on and so forth. You know, we're able to get, enterprise wide buy-in for ot. Technologies like TX one, we're able to provide that asset visibility, threat detection, you know, enforcement, once we get a baseline start actually, you know, blocking, , anomalies or malicious traffic in OT or between IT and ot. So, , the bad that I see or struggle and knowing had a, conversation this morning about this is. Just those have never had budget for the OT side. So they're often having to either take budget from their IT security budget, which, you know, it still, , struggles, , there's never enough money, seems like put towards the cybersecurity. So, , they're either having to take it from it or try to figure out a way to get new budget for something that's. Never before been spent money on. So when I built freight trains, , for American Rail car, they, they were founded in, , 1898. As American Car and Foundry. So working for a manufacturing company with a very long history and culture is typically not very cybersecurity focused. So it definitely can be challenging for our CISO clients to get that funding in order to adequately protect the environment.

[00:05:46] CSI - Dino Bulasalachi & Debbie Lay and Patrick Gillespie - Patrick: So, a lot of times, sadly, a lot of things come down to money. but again, once we get that buy-in, show the value Of protecting the communications between IT and ot and also with third party risk management. Then we're able to, work with Dino's team to help us go deeper into ot and then also, you know, with Debbie and TX one to essentially, you know, provide that, security.

[00:06:09] CSI - Dino Bulasalachi & Debbie Lay and Patrick Gillespie - Dino: Yeah, funding's a very important piece. , Ironically, I just got off a, earlier call today with one of our strategic partners, Rockwell Automation and, , we were talking to their cybersecurity group and. One of the interesting stats that they put out that they were showing is that a breach in an industrial arena.

[00:06:25] CSI - Dino Bulasalachi & Debbie Lay and Patrick Gillespie - Dino: So if it makes it its way into that space, costs between five and a half and $6 million per breach at $125,000 an hour. Right? And sometimes you have to wonder. the board has to know that, right? You would, I think, I know the plan managers do, right? When they have unplanned, unscheduled downtime, they know they're losing revenue.

[00:06:46] CSI - Dino Bulasalachi & Debbie Lay and Patrick Gillespie - Dino: and so now it gets back to the funding challenge, right? When you think about that, and none of these solutions that we're talking about, especially at One Plant, , cost anything like that, right? even the resources, if you decided to build your own practice or, , wanted to rely on managed services, which both Guidepoint , and design group do is that changing the narrative? Any, you know, , you know, Debbie, I don't know if you see that, and if you do speak with CSOs quite a bit yourself, just like Patrick does, we normally don't. it happens, but it's, it's usually rare because most of the time we're working with all the individual plant.

[00:07:22] CSI - Dino Bulasalachi & Debbie Lay and Patrick Gillespie - Dino: , Fiefdoms kingdoms, as I call 'em, and not necessarily working with the CSO per se, but is from a technology company perspective, are, are you seeing the same, , challenges with the IT leadership from a funding perspective?

[00:07:36] CSI - Dino Bulasalachi & Debbie Lay and Patrick Gillespie - Debbie: Yes, absolutely. I mean, we're dealing with the CISOs, we're talking to them, and there's just so. Much noise going on in the OT environment today. We have, you know, this 30 plus years of IT cybersecurity solutions from a technology perspective, now being forced in trying to say, you need our solution to secure your OT environment. So we really help our customers and really, let's look at what. Is most at risk within your environment today? What is your most concern? Is it, you know, the IT to OT convergent point or is it somebody walking into that has physical access, you know, to your OT environment and really helping them get through that noise so that we can, you know, work with that budget that they do have because we go through the financial impact.

[00:08:20] CSI - Dino Bulasalachi & Debbie Lay and Patrick Gillespie - Debbie: It's pretty simple math for manufacturing to understand if we're down for it. Amount of hours, what that's gonna cost you. But still getting that, mindset, , of change and that top down leadership of like, we need to secure our environments. And so that's, you know, a big challenge in OT is still just changing mindset.

[00:08:41] CSI - Dino Bulasalachi & Debbie Lay and Patrick Gillespie - Dino: there's another piece to it. And because of, TX one types of technology, we'll talk about obsolescence a little bit. we find and experience, we come across a lot of end of life, end of support. Assets in these manufacturing environments, right? Which usually, typically requires, you know, capital money in order to replace that equipment or to upgrade that equipment.

[00:09:02] CSI - Dino Bulasalachi & Debbie Lay and Patrick Gillespie - Dino: , And so in that context, they're getting hit from both sides, right? I, I've got an aging. Infrastructure control system, environment, and I, I need to implement a cybersecurity practice, technology, service, and solutions in the space. And at the same time, I got old stuff. and sometimes that IT and OT organization aren't really, from a capital perspective, aren't looking at it the same way.

[00:09:25] CSI - Dino Bulasalachi & Debbie Lay and Patrick Gillespie - Dino: Right. so Patrick, when you're working with those CISOs and CIOs, do they talk much about the capital plan? Per se on what that vision is. Meaning that we're gonna spend x amount of dollars a year just to upgrade from PLC fives or, you know, 25, 30-year-old machinery out there. And the technology that runs those, , while they're trying to still get a cybersecurity solution in place.

[00:09:50] CSI - Dino Bulasalachi & Debbie Lay and Patrick Gillespie - Patrick: they never bring that up, honestly. I don't think they see that level of, Manufacturing facility, you know, typically they're more responsible for the front office users that are at that production facility, maybe supporting for, you know, sales orders or maintenance tickets, , purchasing, procurement, those kind of roles at the manufacturing facilities.

[00:10:11] CSI - Dino Bulasalachi & Debbie Lay and Patrick Gillespie - Patrick: Maybe they're responsible for some of the printers that are maybe throughout the OT environment. , But typically I don't. , Even think our CISOs really oftentimes know what PLCs are, , which makes it challenging because, you know, if CISOs are starting to inherit risk, you know, we still have not seen them inherit the assets or the remediation of those assets.

[00:10:32] CSI - Dino Bulasalachi & Debbie Lay and Patrick Gillespie - Patrick: So, which can definitely be a challenge, which whatever we do, when we start working with a ciso, whether that's doing OT asset discovery or you know, architecture review or even a OT pen test, if that's. You know what they need to get leadership buy-in. You know, we try to get the OT asset owner for the site we're working on and the CISO and their team together because it's best whatever solution they go with. Whether that's like TX one for visibility and segmentation or import detection, you know, whatever the solution is, it's best to have both sides. Part of the decision making process to have that support. Because if even if a Cisco has board level support and get funding and they buy a tool When we get down to the OT asset owner, if they don't support it, it can be very, , political on, what assets they, or networks they even give to the CISO or our deployment team. Right. , and then the companies. Typically not getting value out of the technologies they pay for.

[00:11:32] CSI - Dino Bulasalachi & Debbie Lay and Patrick Gillespie - Patrick: You know, that's where the deployments go much better and they get much better visibility a lot quicker, in a more cost effective manner if, both sides are , on the same page, even though if they're coming at it from very different perspectives.

[00:11:44] CSI - Dino Bulasalachi & Debbie Lay and Patrick Gillespie - Dino: And we see that a lot, meaning my business partner, he, the words he like using, we, you know, you're spot on. The CISOs are definitely, . Being tasked with the responsibility, what they're kind of missing is the authority. Right. And that responsibility of production on that plant floor safety on that plant floor definitely kind of falls to a different animal, right?

[00:12:03] CSI - Dino Bulasalachi & Debbie Lay and Patrick Gillespie - Dino: That being the o OT side of the house. And, and so we're back to the whole IT TO OT convergence conversation, , which gets very murky and muddy and, political, at least in my experience, depending on, on the type of organization that you're dealing with, right? I mean, some of 'em are being driven by regulatory requirements by.

[00:12:21] CSI - Dino Bulasalachi & Debbie Lay and Patrick Gillespie - Dino: Insurance requirements breaches that they've had, you know, but when we're on the plant floor and we're talking about OT cybersecurity, even with, our engineers who are in the field all day every day, nobody really knows what the plan is. When you say, Hey, what is your OT cybersecurity strategy?

[00:12:37] CSI - Dino Bulasalachi & Debbie Lay and Patrick Gillespie - Dino: I see you got a tool, you bought this x ot IDS platform you have in here. So whatcha you guys doing with that? Right? Is there any data in there that, you know, that we would like to get our hands on to help us with this project that we're gonna execute over here? There might be some really good information for us to help us, whether it be risk and vulnerabilities, asset inventory, remote access, malware in the environment potentially.

[00:12:59] CSI - Dino Bulasalachi & Debbie Lay and Patrick Gillespie - Dino: , and the, the plant people are kind of like. I don't know. That's somebody in it's realm of responsibility, right? , Which is one of the reasons why, you know, it takes a village. You know, working with organizations like Guidepoint who have the relationship with the IT leadership and they're credible and they're accountable and they're trusted advisors.

[00:13:19] CSI - Dino Bulasalachi & Debbie Lay and Patrick Gillespie - Dino: It's like, how do you keep moving that down into that industrial environment per se? So,

[00:13:24] CSI - Dino Bulasalachi & Debbie Lay and Patrick Gillespie - Debbie: to that point, you know, and , Patrick, you brought up a great point about not adopting the solution, right? Trying to force it into an OT environment. I think we've had a perfect example. Recently come back up in the news was, you know, Hamilton, the city of Hamilton that suffered that ransomware attack back in 2024 and it was 80% of their systems.

[00:13:45] CSI - Dino Bulasalachi & Debbie Lay and Patrick Gillespie - Debbie: And that included some OT operational stuff that was impacted also by that ransomware attack. And they had cyber insurance, and they knew that they had to do multifactor authentication. But they didn't get it upload, they didn't get it fully implemented because they had people culture that didn't want change.

[00:14:03] CSI - Dino Bulasalachi & Debbie Lay and Patrick Gillespie - Debbie: Those OT operators didn't want that change in their environment and from the top level, they weren't being pushed that, so they had a half bake solution, , in their environment. And because they didn't implement. Now the insurance company's saying, we're not paying that $5 million because you guys didn't fully implement.

[00:14:21] CSI - Dino Bulasalachi & Debbie Lay and Patrick Gillespie - Debbie: it's really interesting how it's all intertwined together, how they, they do.

[00:14:26] CSI - Dino Bulasalachi & Debbie Lay and Patrick Gillespie - Dino: Here's a great example of an MFAI saw just two weeks ago touring a plant where the username and the password for the HMI were written on the panel with a Sharpie to gain access to the box which means you could log in anywhere with that information, so anybody walking by with a camera or just a good memory would have information on how to log into their environment, username and password, right into the industrial control systems.

[00:14:50] CSI - Dino Bulasalachi & Debbie Lay and Patrick Gillespie - Dino: Crazy, right? that was just two weeks ago. I saw that. So, , so let's shift gears a little bit and talk about, let's talk about TX one and some of the technologies that you guys have and how they apply in this industrial space. 'cause you guys got a pretty good sized portfolio of products, , made for the industrial space.

[00:15:09] CSI - Dino Bulasalachi & Debbie Lay and Patrick Gillespie - Debbie: Well, yeah. 'cause that's what we do. We focus in on securing the most vulnerable pieces in an oak. OT environment itself. And the first one we come to the table with is something we call portable inspector, right? Which is basically this asset discovery and, , to be able to scan that asset, make sure that it's free of malware because we have a lot of ot, equipment. they don't have an endpoint solution on today, so they have no idea if there's malware running on there or not. They don't know it's not broke, don't fix it. So with a simple portable inspector, you can go in and, and you can scan those assets without putting any agent on there. Collect a full asset inventory and be able to match that to a vulnerability database, which is really nice.

[00:15:51] CSI - Dino Bulasalachi & Debbie Lay and Patrick Gillespie - Debbie: So it helps with that supply chain vendors coming in from the external with removable , media. we can make sure that those are free of malware. And then moving farther into the OT environment, there are hmis and systems that you can deploy an agent on so that you're doing real-time scan, making sure new, , files that are being introduced into that environment are free of malware. makes us really different. When you think about an endpoint security solution, is the fact that we're OT application aware and that's. Traditionally IT solutions. While they might be able to do that AV scanning, they're not OT application aware. And it becomes very critical by not understanding those applications from an OT perspective. 'cause it's an IT based solution. You will have false positives and those false positives will break processes. In your environment, , while you're scrambling to put in the exclusions and everything that you need to have happen so that the system does not block those legitimate. So I think that that's really key when we talk about OT is making sure that any endpoint security solution that you put in place does not cause more harm than good. And then the third piece of it is really from the network perspective. We're going into these OT environments where traditionally they're just one big flat network. We talk about mitigating because we have legacy assets. So best practices and visibility tools will tell you, Hey, that's xp. You need to put that on its own segment.

[00:17:14] CSI - Dino Bulasalachi & Debbie Lay and Patrick Gillespie - Debbie: Do you have the capability of doing that? A lot of these OT environments have unmanaged switches. They've been out there for years. What do they do with this big flat network? So our network appliances allows you to strategically place these within the OT environment to provide that segmentation, and then be able to create policies and learn policies on how, network traffic is traversing, who's talking to who. And then do things like virtual patching so you can actually set up the system to say, I know I have these XP systems out here. Microsoft doesn't even have a patch available for them. But how can I turn on the virtual patching and leverage the fact that I'm in the network protecting that asset to make sure nobody exploits those known vulnerabilities? So those are really our key focus. is basically malware free, , agent free scanning, , based solutions for endpoint protection and networking based solutions to protect those assets.

[00:18:10] CSI - Dino Bulasalachi & Debbie Lay and Patrick Gillespie - Dino: And do you find that when you're pitching these technologies to a client. The group that's most receptive to them, are you getting to the OT people because they're the maybe the ultimate say so? Or is it something that it, because my experience is that sometimes it isn't aware of a lot of those intricacies around control system operation.

[00:18:31] CSI - Dino Bulasalachi & Debbie Lay and Patrick Gillespie - Dino: Right. And so are they sure enough to be able to say, yeah, this, this is the right tool for that. You know, are the OT guys the ones that are more adapt to. Gravitating towards a TX one solution per se.

[00:18:45] CSI - Dino Bulasalachi & Debbie Lay and Patrick Gillespie - Debbie: I see, , adoption a lot from the OT side. , Because you're meeting some use cases that they immediately need, that they've been doing manually or they know has not been best practices, but they haven't had a solution in place. So that portable inspector, , they don't have to be super technical. They have it in their pocket.

[00:19:01] CSI - Dino Bulasalachi & Debbie Lay and Patrick Gillespie - Debbie: They can go over and scan and get that asset inventory. They need that, you know, it's traditionally been done manually, managing spreadsheets and those types of things. So they can do that now with a simple to use. Portable inspector stick and they can meet their insurance requirements for malware without actually putting an agent that scares them. Anytime you put something on their systems that wasn't there before, that's a scary, , proposition for them. And so I think also the

[00:19:27] CSI - Dino Bulasalachi & Debbie Lay and Patrick Gillespie - Debbie: networking side is very. Appealing to them because they can extend, you brought up how expensive some of this OT equipment is and the life cycles of those By putting in mitigating controls from the network perspective, they can extend the life of those very expensive equipment that they have in their OT environments.

[00:19:45] CSI - Dino Bulasalachi & Debbie Lay and Patrick Gillespie - Dino: So Patrick. Based on some of the things you're hearing that, , Debbie's describing as you guys are going through your, , , reviews and scoping efforts, , what kind of feedback do you get from who you're working with? Especially on the IT side, right? When it comes to talking about that planned floor, let's talk about the good, the bad, and the ugly.

[00:20:05] CSI - Dino Bulasalachi & Debbie Lay and Patrick Gillespie - Dino: what do you normally hear? when you're having these conversations, 'cause you know what the best practices are, you know what these technologies are capable for, you know, what you're pursuing, what kind of pushback and or noise do you get when you're engaged in these conversations?

[00:20:21] CSI - Dino Bulasalachi & Debbie Lay and Patrick Gillespie - Dino: If you've got on the IT side, even if OTs in the room, I don't even know how often OTs in the room when you get a chance to talk to 'em up front, just because of the unique nature of where you guys are coming in, through the IT door.

[00:20:32] CSI - Dino Bulasalachi & Debbie Lay and Patrick Gillespie - Patrick: Yeah, actually we sell a lot of. OT advisory services to help the CISO and their team get ready to meet with their OT asset owners. So we help prepare them on why are the OT asset owners, why do they care so much about availability and safety and uptime? And they typically could care less about encryption and authentication and you know, those kind of things that CISOs and security teams care a lot about.

[00:20:58] CSI - Dino Bulasalachi & Debbie Lay and Patrick Gillespie - Patrick: So, One. You know, we won't help them get on the same page to achieve the same goal, but they have to understand that they can't just come in. Say, Hey, you're, gonna do this, you know, we're from the C-suite we're from the board, or, you know.

[00:21:14] CSI - Dino Bulasalachi & Debbie Lay and Patrick Gillespie - Patrick: 'cause a lot of times if, you know, people come in with suit and ties, ot, asset owners are gonna be a little apprehensive anyway, so, , so we do a lot of preparation for 'em. Essentially, yes, we start with the ciso, the IT side, but you know, again, whatever we do, whether it's advisory or an actual service or, . Or doing a POC of TX one. You know, we're, we're trying to include at least for the, first site, you know, what's your highest priority site? Or maybe top three or five, because if we do a POC or an assessment, you know, I don't recommend doing it for every assessment or every location because you have your highest priority site or maybe you have a one manufacturing site and maybe a distribution facility, you know, maybe we review one of each of those. cause those are very different then they're able to make the right decision. Right. Oftentimes, they can make one decision for. Visibility or, you know, one decision for segmentation or endpoint detection. You know, they're not gonna put in 20 different endpoint detection vendors at 20 different OT facilities.

[00:22:13] CSI - Dino Bulasalachi & Debbie Lay and Patrick Gillespie - Patrick: So, you know, there's a lot of cost savings there that we can provide based on our, guidance and experience, , from a consulting perspective. I would say the ugly though would probably be, the system. Like, one of the questions I usually start off with is, do you have an OTS at inventory of your hardware and software like. They're always, no, they, really don't have a clue. and if we meet with the soc, you know, if there's an incident and we're doing a tabletop exercise and that ransomware spreads into ot, when it comes to the SOCs terms, like, you know, who are you going to call? You know, are you gonna call, you know, The, front office people there at the plant, and hopefully they know the right person. You know, do you have a, you know, asset owner list? So a lot of times, our systems are starting from nothing. no budget, no, , no history of knowing what assets are out there or vulnerabilities. , A lot of times they're not. Ready, to deploy a lot of tools that the organization has to mature with the tools where again, it doesn't get, you know, a lot of value. So, , but yeah, I mean, the good is when we have like a manufacturing facility that, you know, we're able to bridge the IT and OT together, and then they're able to work together to, essentially we're trying to protect the OT environment from the IT environment. We're not here just to protect you from nation states and the internet, but we wanna make sure if somebody does something stupid in it, that it, it's not gonna affect your uptime in OT, essentially. So, we just definitely have to pitch it very differently to the OT asset owners from an anomaly perspective or, . We can create custom alerts based on, temperatures or based on, , machine states. You know, there's a lot of data that's great for these IT and CISOs to get out of OT to make better business decisions, but then that comes at the cost of connecting 20 or 30-year-old systems to your network. So, you know, so that's a little bit of the good, bad, and ugly.

[00:24:05] CSI - Dino Bulasalachi & Debbie Lay and Patrick Gillespie - Dino: Yeah. I would always say that if you're having a, a material breach in your industrial environment, your first responder is the operator. somebody's gotta get that equipment into a safe state, get your product into a safe, place so you're not destroying product or equipment.

[00:24:19] CSI - Dino Bulasalachi & Debbie Lay and Patrick Gillespie - Dino: So, no, it's a great point. Debbie, can you, , give us an idea of one of the latest projects that you've been working on, you know, with a client, what was the problem that they had? What were they trying to solve? And then what was, , TX one's solution for that?

[00:24:33] CSI - Dino Bulasalachi & Debbie Lay and Patrick Gillespie - Debbie: Yeah. Most recently I think I was dealing with a healthcare provider. Had these very expensive imaging, , systems that, , were becoming end of life. , They had an XP operating system on there, but the imaging systems themselves were still doing. What they needed to do. And so when they looked at, you know, the vendor saying We're end of lifeing, you know, our imaging software on that version of software, it was gonna cost them millions to, , upgrade. And it's not, again, it's always those downstream things that I find interesting. It wasn't just the, the fact of the hard dollars to replace the imaging machine or to upgrade the operating system from XP to, you know, windows 11. It was the fact that once they do that. You start making changes now they had to look at the walls where the imaging systems work. How is that going to impact, you know, the thickness of the walls, which are things that I just don't traditionally think about. So to be able to go into that customer and say, look, we can mitigate the risk that XP poses because it's an out of date. End of life operating system from the network. You can put a simple network device in front of your imaging machine and you mitigate the risk that that XP poses.

[00:25:43] CSI - Dino Bulasalachi & Debbie Lay and Patrick Gillespie - Debbie: So now you can continue that life and build in more, , time to get to the point where you are going to be able to replace that system or upgrade it.

[00:25:52] CSI - Dino Bulasalachi & Debbie Lay and Patrick Gillespie - Dino: last question has to do with ai. Do you guys think that a lot of clients are out there? This is like the Hail Mary for them in solving their cybersecurity is gonna be ai.

[00:26:03] CSI - Dino Bulasalachi & Debbie Lay and Patrick Gillespie - Patrick: From an IT perspective more so than ot. I know with OT a lot of the tools do passive analysis, right? You know, TX one can go into monitor. Mode, you get a good baseline before you start changing things, but, I think using AI based on the behavior of OT assets is good, , to solve a lot of the manual, , interpretation of those false positives or verifying a true positive, you know, all that stuff.

[00:26:28] CSI - Dino Bulasalachi & Debbie Lay and Patrick Gillespie - Patrick: So I think AI can definitely be used. , Oftentimes I think, not even ai, but I think. CISOs think that one tool is going to solve all their problems in ot, whether that has AI or not, right? So that's where we have to come in and, you know, say, you know, they have 20 or 30 different tools, at least in IT security, you know, there's.

[00:26:49] CSI - Dino Bulasalachi & Debbie Lay and Patrick Gillespie - Patrick: the same controls need to be done in OT and you're not going to get that from any one, you know, one technology. But yeah, I think, I think AI will help defend, but I know attackers are definitely using AI to attack the OT environments for sure.

[00:27:03] CSI - Dino Bulasalachi & Debbie Lay and Patrick Gillespie - Debbie: I, don't hear it much from the folks that I'm talking about. Out because. they don't want a human touching their machines or, or making the changes for ai, , just kind of is like, no, no way. But I do believe what Patrick is saying from the support side, the SOC side, I think AI is definitely gonna play a role there.

[00:27:19] CSI - Dino Bulasalachi & Debbie Lay and Patrick Gillespie - Debbie: And even as a hardware manufacturing, we can leverage AI to help us, baseline traffic better. You and offer up some good policies. So you're not starting from ground zero. But I still think for a time to come, human intervention is gonna be required for sure. On the OT side.

[00:27:36] CSI - Dino Bulasalachi & Debbie Lay and Patrick Gillespie - Dino: Great point. On, on the baselining of, of it. You're true. Any last thoughts? Anything you guys wanna share with the audience that you didn't get a chance to, say?

[00:27:45] CSI - Dino Bulasalachi & Debbie Lay and Patrick Gillespie - Patrick: I get asked a lot 'cause you know, I'll bring up to our ciso, you know, typically when a company subcontracts to another company, usually they don't say, Hey, I'm working with so and so. But you know, for working with. It's, , Fairweather Design Group. I do. , you know, we have some shared clients and a lot that. , that are not shared currently. , To where they ask, what do you do with them? you know, they're a Rockwell Platinum partner. So really kind of helping our CISOs learn that there's benefits from having, you know, somebody more IT centric security, you know, where we cover more of the convergence. So the convergence is assets there. It's typically networking equipment owned by the ciso, or they actually have authority there to do things. So that's where we start with our visibility with, starting to see what protocols are communicating between IT and ot. And then to help, you know, sell an OTs secure mode access solution.

[00:28:38] CSI - Dino Bulasalachi & Debbie Lay and Patrick Gillespie - Patrick: And then essentially. Work on segmenting the two from each other. And then that's where we work with, you know, design group, Dino's team comes in and helps us go deeper at each of the sites. So if we deploy, you know, TX one at 10 sites, with Dino coming in, helping us do the walkthroughs, they have decades of, you know, automation experience that my team does not have. So they're able to help provide that. Better visibility, better classification of the assets. . So yeah, definitely appreciate all your help, Dino, and, and of course TX one for sure. You know, KX one helps us bridge a lot of these gaps with their technology. So close with

[00:29:13] CSI - Dino Bulasalachi & Debbie Lay and Patrick Gillespie - Dino: Thanks, Patrick.

[00:29:15] CSI - Dino Bulasalachi & Debbie Lay and Patrick Gillespie - Debbie: I was just gonna say, you know, from a vendor perspective, we can have the best solution out there. And it's not the silver bullet, there's not just one solution, but I, I think our best agreed solution. For OT are the best that's out there, but we're not gonna be the best if we don't have partnerships that help us integrate, you know, with clear goals, thorough assessments, and effective implementation to avoid just costly gaps and systems where, you know, they didn't get deployed correctly. I just think it's so, key that we, go in as a force team together.

[00:29:46] CSI - Dino Bulasalachi & Debbie Lay and Patrick Gillespie - Dino: Yeah, that, that's a good point. 'cause a lot of times we'll find a, a client is, is chosen a technology and they never get it implemented or deployed. They kind of started and then they, somewhere along the line they just lost their path, you know, to keep going forward or the information became so overwhelming of what started coming outta that plan floor.

[00:30:04] CSI - Dino Bulasalachi & Debbie Lay and Patrick Gillespie - Dino: They just, they got fatigued and didn't know what to do next. So. All right. Well I thank you both for your time.