Equipping OT Cybersecurity Frontlines With Training and Tech with Cloud Range CEO Debbie Gordon

[00:00:00] Jonathon: if there's one main lesson to learn before you go in and knock on anyone's door, it's about think about safety.

[00:00:05] Jonathon: physical and cyber safety. And that's got to be the primary goal. with any engagement in the operation environment, regardless of who you're speaking to

[00:00:42] Dino: Hi, my name is Dino Boussalaki, and today we have Jonathan Gordon, who's a OT cyber security analyst, but I'm not going to speak to everything that he is, his role is and what he does. So, John, welcome to our podcast.

[00:00:57] Jonathon: Hey, thanks, Dan. it's good to be here.

[00:00:59] Dino: Yes, so why don't we just begin with, where you are today. And where you've been, it brought you to this point, dealing with OT cybersecurity.

[00:01:08] Jonathon: Yeah, it's always interesting question and the answer tends to come out differently. Um, just trust for me to hear something different myself. So, I'm currently the directing analyst for industrial cybersecurity at TakePoint Research. At TakePoint, I guess you call it a boutique analyst, very, very, very small Gartner type analyst firm that is solely focused on industrial cybersecurity.

[00:01:30] Jonathon: And it's interesting when we started about seven or eight years ago, we're very much focused on OT and ICS cybersecurity, right? Really looking at the lower levels of the Purdue. And over time, as we spoke to more and more asset owners and operators, we realized that there's a lot of different types of technology.

[00:01:49] Jonathon: Within the industrial organization, and so our focus really, I guess, over time, sort of step back and look at the industrial enterprise and the cyber risk to the enterprise and what what's what the main focus is really about what risk can actually impact their ability to to service customers or to deliver a product or deliver a service in particular, if it's critical infrastructure or manufacturing, so that that's very much our worldview.

[00:02:15] Jonathon: Today, we track, I think. It's about 10 or 12 different categories of, technology. and we have another about six categories of, services and integrators that track as well. So it's, very much evolved over that time. And, most of my day, or at least a significant part of my days is speaking to, um, as I know, and there's an operators and vendors and integrators as well.

[00:02:37] Jonathon: And our main mission, I guess, is to help clients navigate. this evolving world of industrial cybersecurity. So, it's great. I get to learn and listen and share knowledge and hear and discuss and do these type of things all day and, and help people figure out what, their next steps could be.

[00:02:54] Jonathon: So, um, doing it for quite a while and, find it fascinating. And, hopefully we'll continue for a while yet. Yeah,

[00:03:00] Dino: interesting point I wanted, I'd like to dig into a little bit. So, dealing with the vendors, obviously, you have these, cybersecurity vendors that are out there. And then we're talking about the asset owners. And that can be a pretty good size gap. So, what have you been able to help?

[00:03:15] Dino: Connect those dots for those, technology companies and mainly around their business development folks, And even some of their engineering teams, the system engineers, as I call them on the automation, not on the automation technology side, but from the vendor side, the software companies and, and this asset owner connection, how do you drive that narrative?

[00:03:34] Dino: From a group that's software developing down to these asset owners and knowing that there's a piece in the middle that we're going to call it, you know, that you got to get through or get a line collaborative and transparent. So what kind of strategies or what has been your experience with

[00:03:51] Jonathon: that's a really, um, Great question, special question. It's a question I don't think I've been asked before, because it incorporates a lot of different aspects of what we do. so we do speak to a lot of vendors. I think we're tracking at last count about 130 vendors that, have. claims, but verify claims that they have some sort of offering in the OT slash ICS, cybersecurity space.

[00:04:12] Jonathon: So, not just an IT cybersecurity offering. So, there are quite a few from when we started, and some of them are what we call sort of OT platforms. So they have different components to and different parts of the solution. And some of them are just sort of one solution type products. And, a lot of them are software vendors.

[00:04:31] Jonathon: in the early days, where we saw quite a lot of VC capital coming into the market. And a lot of these software vendors looking at the problem and like they do, they look at a problem, they come up with a solution, they're told in software. and then they, you know, They put it out in the world and they hire some marketing people themselves, people, they go, okay, let's go and sell it.

[00:04:50] Jonathon: It's a great solution. , the problem, what we call problem, what Americans call challenges is that, it's not a market or environment where you don't just buy a PC or buy a standard, there's not expand about the industrial environment, which again is quite different from the IT environment, the IT enterprise environment.

[00:05:08] Jonathon: So the first issue that we saw early on in the market, pretty much all of the vendors that were focused on software. We're thinking, okay, we have the software. This is how we've always sold software. We go out and sell it. The problem was you're not selling Microsoft office or even a file software to people that necessary.

[00:05:26] Jonathon: I understand it or be does it fit into their environment and. What's so incredibly important when you look at the industrial space, regardless of the vertical, every vertical is different. has a huge body of knowledge, right? If you go from power, you go from power generation to power distribution, it's already a different, different market, different space, different knowledge.

[00:05:48] Jonathon: So how does the software vendor who knows nothing about these spaces, even if they have a decent product, they can't have that conversation. and they can't build what's the most important thing is that trust. and so we noticed that very early on, and I think the better vendors also noticed that early on, and they started either building out that knowledge internally about those particular verticals and then focusing on particular verticals where they could go in and speak to the CISO, speak to the IT, speak to the OT, if there was such a thing, speak to the operations, speak to the engineering.

[00:06:22] Jonathon: And as you would know, you need a different hat. You need a different approach and you need a different language to all those people. selling to I. T. I. T. Has been around for 30 years. O. T. itself has been around a lot longer, but not O. T. Cyber security. So, you're right there. I would call them gaps, but they're more like chasms between those areas.

[00:06:43] Jonathon: And I think that The key thing that both the IT people and the software, people should understand is that if there's one main lesson to learn before you go in and knock on anyone's door, it's about think about safety. there's one thing that everything that happens in these environments, it's safety, right?

[00:07:02] Jonathon: Yeah, physical and cyber safety. And that's got to be the primary goal. with any engagement in the operation environment, regardless of who you're speaking to, but also know your audience. And I think that's probably more of the work that we do on the vendor side is getting to understand their audience is not.

[00:07:22] Jonathon: One shade of gray, right? They can be very, very different and the stakeholders are very different and they're looking at different things. It's just a much more complex environment, which again makes it super interesting and much more interesting. But yeah, there are a lot of gaps and abound.

[00:07:39] Jonathon: And of course, there are always people that have already been burned by deploying something that's IT into the OT space and having, untoward consequences and those types of things.

[00:07:49] Dino: and speaking of vendors, let's talk about a specific group of vendors. Let's talk about the automation technology vendors and I'm going to talk about Rockwell, Siemens, and Emerson and GE and Honeywell, OEMs That are part of their ecosystem. Have that been part of your discussions, you know, when you talk about the vendors, are we talking about these software vendors?

[00:08:11] Dino: What kind of experience or trends are you starting to see with those groups, right? I mean, because traditionally, to your point, they've been around for a long time. they've operated independently, if you will, right? machines were siloed. They weren't connected. We know that ship has failed on the connectivity that we have on the plant floor.

[00:08:28] Dino: How do you see their role? And they've been investing, but how would you score them in this cybersecurity journey? It's

[00:08:38] Jonathon: well, it's probably a mixed scorecard, but it's also very interesting because, to be fair, they don't have it easy right there. They have. All of the challenges there. They're an OEM. they're actually manufacturers themselves in most cases, so they have all the problems of manufacturing and then the security within their own environment.

[00:08:58] Jonathon: Then they have the issues of product security. So what's actually inside? And now we're seeing all that work around S bombs and H bombs and trying to understand what it is that you're actually delivering for clients. they also have big service arms, right? All of all of the companies that you mentioned are also in the services business.

[00:09:16] Jonathon: And, some of them will have features inside PLC. So things like that. And some of them sell industrial firewalls. So they have everything, which means they also have all the challenges in those. from those different areas. And I think, they also don't play well together, right? They don't interoperate very easily or very well.

[00:09:35] Jonathon: And companies, large manufacturers of critical infrastructure, provides tend to have a mix Of OEMs. So, they like to see the world through their, colors, green or red or, or whatever it happens to be. But it's very different once you get out of the field. So, for them, it's quite challenging, both in terms of, their products themselves are vulnerable, where we see it every day that vulnerabilities are announced in their products.

[00:10:00] Jonathon: so they have the product security issues as well. And I think when they are building solutions. they tend to build solutions better based around their own products, but again, that generally doesn't happen when you actually go out in the field. You see, you'll see a honey well in the Siemens and Iraq.

[00:10:16] Jonathon: Well, and Yeah, and it goes on and on.

[00:10:19] Dino: for them to demonstrate that they're agnostic, in this cybersecurity journey, to your point, you get into an environment and it's not all rock well. It's not all seamless. And so you have disconnects their strategies. so what should companies be doing account for that, right?

[00:10:36] Dino: The fact that you might have multiple automation technology vendors and dozens of OEMs who are providing you machine setters. that still think in their silo and, I need something broader than that solve this challenge.

[00:10:51] Jonathon: a definite challenge, especially for smaller providers. I mean, we always in our industry, we tend to think about the big guys. We tend to think about large manufacturers, you know, 10, 000 or hundreds of thousands of employees, et cetera, across the globe that take a smaller manufacturer. What kind of power do they have to face down one of these and say, this is how we do business.

[00:11:12] Jonathon: very challenging. in fact, was at an event not too long ago. Where I was talking to one of the aforementioned OEMs and they were complaining about the remote access vendors, saying that one of the secure remote access vendor had come in to one of their clients and the client had standardized on this particular vendor and so now if They wanted to come in either do maintenance or to upgrade or even to do something on the equipment that they had deployed.

[00:11:43] Jonathon: They had to go through now and learn another platform. And so it's the complete opposite that industrial organization had said, okay, we are going to standardize. All of our vendors, integrators, third party consultants, and even employees are going to come through this standard remote access platform.

[00:12:00] Jonathon: We're going to get away with all the other platforms that we have. We're going to be doing logging and monitoring and managing, etc. And that's part of their compliance. But the flip side was that OEM now had to go and learn another platform. And if that happened in all their clients, they'd be using it.

[00:12:16] Jonathon: umpteen number of platforms that different clients that have to know how to use, et cetera. So, it's interesting that sort of way of looking at it is very different, depending on which end of the barrel you're, looking down. but I think from the, enterprise side, you have to try and keep your vendors honest.

[00:12:33] Jonathon: you have to try and manage the vendors, and they have to come to the table because in the end when you judge, the impact and the outcome is judged on that process. And if you want to get to a level of security, you want to move that maturity forward, they have to be part of the process. I think that's, evident in a lot of our research is that when we look at the roles and responsibilities in these projects, and whether it's secure remote access or network Or whatever it happens to be, you need to bring in your suppliers.

[00:13:02] Jonathon: They're not, outside the ring. They need to be part of those projects and part of that process. Otherwise you'll end up with a process that just won't work because sooner or later, someone will try and work around what you've put in place

[00:13:14] Dino: Yeah, glad you brought up remote access because that is a huge one. And our experience is we usually find somewhere in the neighborhood of four to seven or more different types of remote access technologies in a single plant. Right. and IT is unaware of what, the OEM has implemented into that machine center.

[00:13:34] Dino: so, yeah, that's a great point on secure access obviously COVID really, kick that door wide open, you know. Because of the restrictions of people being able to travel to get on site. so a lot of organizations cobbled together a lot of different remote access technologies. and sometimes they just, technology they chose was just the cheapest one they could find.

[00:13:55] Jonathon: or the one that then you,

[00:13:57] Dino: Or the one that they knew.

[00:13:58] Jonathon: Solution, that's what engineers do, right? You need a solution. put something in place.

[00:14:03] Dino: Yeah. and from a cybersecurity perspective, that's one of the hugest vulnerability risks that we uncover in the work that we do. Right? So, I'm glad you brought up remote access because that is a big one. And there are some great, tools, platforms specifically for remote access in the OT environment.

[00:14:20] Dino: And trying to get IT to recognize, a standard, you know, which IT is really good at, right? Standardization, they've been doing that for a while. but you get into an industrial environment and the standards, well, you have to question, really, do they have any, you know? I mean, it's just the number of different types of switches.

[00:14:39] Dino: That we find in a manufacturer is is boggling, right? And it can be in a dozen or more, that we find in those machine centers. as we see this, market unfolding, right? And One of the last stats I heard, and you can correct me if I'm wrong, is that there's like 5, 000 or more different cyber security technologies in the marketplace, right?

[00:15:01] Dino: and how you sit through, all of that, FUD, I think, was one of the words that you used, but just, you know, what tools are best for you and your environment. So, what do you see, strategically being done? I mean, see regulations, you know, it's helping clients drive some of this.

[00:15:17] Dino: Cybersecurity insurance. It's been driving, clients to improve their cybersecurity hygiene and posture. generally, what else are you seeing, you know, out there that's, this, OT cybersecurity industry?

[00:15:30] Jonathon: think, and again, different people will sort of define, even define the industry different because really, not something that everyone agrees on. But the way we look at it per our definition, as I said, is anything that can really impact your organization's ability to service their customers or deliver the product or, even sometimes if you can't build a customer, you can't provide the service. So, it really depends is the answer is usually in the consulting area. But in general, I think, regulation compliance we've seen. So these, increasingly, stringent. Sort of requirements and focuses coming from governments and also industry bodies, depending on who moves quicker or slower.

[00:16:09] Jonathon: , so depending on what sort of vertical you operate in, so if you look at the TSA post colonial pipeline, there's, a lot of things that have been coming out, with the maritime industry, the automotive industry. There are other industries that are moving as industries, before they're pushed.

[00:16:23] Jonathon: And then when you look at bigger types of regulations like that, then it's 2 in Europe and those type of things, then, of course, you have the CSF and the, 6443 and which are coming sort of more standardized, more accepted and building solutions around. So I think. again, I sort of mixed up regulations, compliance and industry standards all in there, which a lot of us tend to do, but regulation and legislation is driven by the government, where industry can also promote regulation and these, Frameworks are more sort of industry best practices, which again, they tend to, um, interact and intertwine.

[00:17:00] Jonathon: the next bit, , also intertwines with 62443, et cetera. So, yeah, we're seeing, I think, more awareness. and more bodies sort of driving that, which is, depending on who you ask, could be a good thing or, can contend to add layers of, complexity. right. If we look at no except that there's a huge layers of complexity that's tend to slow things down.

[00:17:21] Jonathon: and the challenge there is how much do you focus on compliance as opposed to risk mitigation and security? Again, these are sort of older. Discussions that just keep going on. but continues to be innovation. and what's more interesting also is this collaboration. I think the industry is getting better at collaborating.

[00:17:40] Jonathon: in some ways, there are events that take place, people get together, both grassroots and sort of more high level organized events where stakeholders can come together with vendors or integrators and can really sort of focus on understanding what can be done and what's the sort of next best thing to do.

[00:17:58] Jonathon: and getting actionable insights in those type of things and on the technology side as well, we sort of go through these waves of, innovation. and as we discussed earlier, you get, you tend to get innovation and then some of the larger companies will swell up some of the smaller companies and the innovation tends to sort of slow down a little bit and then we'll get the next generation.

[00:18:20] Jonathon: So, I think the peak as we go through is higher, but, it's sort of those gaps in between the waves, but I think at the moment we're starting to see some innovation. obviously we have the impact of AI now. we recently did a survey, think we surveyed almost 300. so these are people with OT cyber security, directors or sisters or, people that work in OT cyber, some title or another, we asked them various questions around AI, machine learning in OT cyber security.

[00:18:50] Jonathon: I think of the things that stood out for me was the overwhelming majority. I think it was something like 85 percent of people said we can't do without it. , we know has upsides and downsides, but we're already at a point where we can't do without in some form or another. so that was, interesting and scary at the same time.

[00:19:06] Jonathon: because obviously any new technology that comes along comes with promise either, of, efficiency, right? Putting in increasing efficiencies. We're getting more data. All of this connected and, um, industry 4. 0 etcetera is all about creating efficiencies and, making things work better and getting more information.

[00:19:24] Jonathon: So you can take better, Decisions quicker, but every technology comes with risk. And so it's our job and people that work in this space both understand the risk and identify that and communicate that to their leaders and their management as they go along. I think, we're also changing, And somehow, some ways, to better focus on the business, which I think is critical as well.

[00:19:46] Jonathon: anybody working in the industrial cybersecurity space, again, it's a very new, role, It hasn't been around that long, but it's a role I think that's maturing quite quickly. And anyone, whether it's a CISO in the industrial environment, they're starting to understand that they can't afford just to be technical people, even if they come from an IT background, or they come From a, control systems background, they need to be able to speak the language of business.

[00:20:11] Jonathon: And I think that's something that's also changing the faces of the industry, even as we speak, as they realize they need to be able to understand how to communicate with other people in the organization in their language, not, in our language. So it's not PLCs and DCS and Modbus. it's how do we build a business case for this project?

[00:20:32] Jonathon: And then how we show the return if you like on the business case. So again, it's always about risk. It's about risk to the company, but you need to put that in terms of value to the company. and so how do we speak that speak? And that's something that we've started to see also creeping into the, to the industry as well.

[00:20:50] Jonathon: a lot of things and again, a lot of different technologies coming in as well. And I think 1 of the things that you need to be careful about is there's a lot of technology that comes in from the space. So, I think in this sort of last way, if we look at, we mentioned AI, but which is sort of invasive, it's everywhere.

[00:21:07] Jonathon: It doesn't matter what you do, but, um. The zero trust, that's come in over the last few years. and now we're seeing things like, attack path analysis, for example, these type of things or, breach attack simulation. All of them have potential to be a positive thing, but you really need to pull it apart and put it back together from an OT perspective.

[00:21:28] Jonathon: And that's always the challenge when new technology and new approaches come into this space. I think you need to look very carefully The benefits, but also the downside, right? We have to go back to that tenant. If you like that, it's safety first, right? Safety for the environment, safety for the workers, safety for, yeah.

[00:21:47] Dino: I'm going to pivot to something a little different here. I want to talk about the supply chain, right? And, old enough to, live through Y2K, was working for a very large global adult beverage manufacturer, and when Y2K was, approaching

[00:22:02] Jonathon: you had, some big parties then at the time.

[00:22:05] Dino: well, and we were trying to solve, making sure that all of our systems were going to work, right?

[00:22:09] Dino: And verifying that, but we also had to push it out to our supply chain to make sure that they could still deliver. To us, the goods that we needed to make the products that we need. And also all the way through the shipping and distribution out the door. let's talk about cybersecurity, the supply chain, right?

[00:22:26] Dino: What is your experience or what are you guys seeing in regards to large organizations trying to influence their supply chain? To improve their cyber security posture.

[00:22:38] Jonathon: it's probably the toughest, area, especially if you're not a big customer, because then all the powers on the other side. so the larger companies and some of them, you know, even we mentioned it, even the OEMs have the same challenges, right? They put pieces of other people's technology and hardware and software and IP into their products and then package them up and send them out.

[00:23:00] Jonathon: Yeah. Do they know what's in there? how do they update them? Who updates them, et cetera. and we've already seen, several, we won't name it specifically, but not necessarily cybersecurity related, but we've seen the impact of, supply chain. many times already. So it's an area where I think, the larger companies have an advantage.

[00:23:21] Jonathon: They work together with their vendors and look at product security and how that, how secure products and what are the vulnerabilities when they're shipped? What's the process to address those vulnerabilities? but also beyond once they're actually deploying in the field. do we know what's in? So if we get another log4j, do we know what's actually impacted?

[00:23:42] Jonathon: And then what's the solution? Is it a critical part of our network? Is it a critical part of our business? Or is it something that we can continue on until we get, that patched? Or do we get some compensating controls in place? So I think it's definitely the hardest part. because you can't do it by yourself, A lot of the stuff that we sort of focus on, look at, we talked about remote access, or monitoring, or network monitoring, or asset inventories, and then, segmenting. These are things that asset owners, maybe with some help from guys like you, can get done. But the supply chain is literally, it's a whole ecosystem, that you can't do by yourself.

[00:24:22] Jonathon: So you need to sit down and you need to work with your suppliers. and again, I think like what we said before, you need to hold them accountable and get them to come along that journey with you.

[00:24:33] Dino: John, we talked about several things. I kind of like this open up. Is there anything that you would like to convey to the audience that we haven't touched on?

[00:24:42] Jonathon: there are a couple of areas where, so we're focused the moment I think Another area that quite interesting to drive the industry and help mature the industry is the concept of diversity. we talked about collaboration, but diversity. a lot of people talk. A lot of people say there's not enough.

[00:24:59] Jonathon: people in the industry, there's not enough younger people coming in or talented people coming in. I think that one of the issues that we have as an industry, If you go to an S4, it's quite obvious what the persona of someone in the industry looks like. And I think one of the biggest challenges is diversity bringing in, People that have potential and talent with their engineers or people from the operation side or cybersecurity from the site.

[00:25:25] Jonathon: It takes collaboration and it takes a diverse mindset to address these problems if we keep sort of thinking with the narrow. Mindset that we have, we're not going to be able to solve some of these complex risks and cascading risks that we have and organizations need to break down those, silos and ensure that operations, I.

[00:25:43] Jonathon: T. All these people work together. So you need to have more people coming in. that includes, Whether it's a background, age, sex, we need to really branch out. Otherwise, we're going to be out of address these things. So that's 1 area. And I think that the community as well as another 1.

[00:26:00] Jonathon: we're actually next year. I'll give a plug. We're putting some events on the virtual events open to everyone. And the idea there is to bring. experts together from the industry, but also bring our community people together and really try and focus on sharing knowledge and, the concept of these events, is about what can we share that's doable in the next 6 months.

[00:26:21] Jonathon: So how do we get to that next level? what's the plan? What can we do? What should we do? And then have sort of people brainstorm and come in and talk around and share best practices and, experience around that. I think, again, that's a way of sort of building, sort of sharing knowledge and building up that diversity.

[00:26:38] Jonathon: So everybody is, welcome to join and we can share details on that later.

[00:26:43] Dino: Diversity is key. You know, I don't know if you've heard the term peak 65, but you know, with the baby boomers here, you're going to have over four plus million people hit retirement age over the next four years, so that's 20 plus million people, and a lot of work these industrial manufacturing environments.

[00:27:00] Dino: and to your point, It's like for every two that leave, maybe only one is coming in and you're going to need diversity in order to fill that gap unquestionably.

[00:27:09] Jonathon: the knowledge also cuts across that, because I think losing knowledge, with everyone that, goes, we lose a ton of knowledge that's in their, heads, so that they're not sharing it, or they haven't been able to share it with enough people, and it dissipates, and we have to kind of start again, which is, a real shame.

[00:27:25] Jonathon: So I think that knowledge is that it goes hand in hand with getting more talent in and building that diversity to create an industry that will. be able to support the future of what it is that that other people are trying to do. we don't exist without the business, right? The business makes something, it provides a service.

[00:27:41] Jonathon: That's what it's about, but we're there to help them do it safely and securely. and hopefully mitigate some of these bigger, potential impacts. So for them to go on their merry way and focus on this innovation and get products quicker, faster, better market, that's what we need to focus on. And I think, yeah, getting, building a more diverse, better, stronger industry is going to be key for that.

[00:28:04] Dino: Yeah. Well, Jonathan, thank you. I appreciate your

[00:28:07] Jonathon: Yeah, thank you.