Securing Critical Assets: What Every CISO Should Know

[00:00:00] LuRae: Welcome to the industrial cybersecurity insider. In this episode, we're rewinding the clock to highlight lessons from the trenches of OT cybersecurity from the challenges caused by unexpected it scans on operational networks to the dangers of unsecured remote access. And the dynamics of deploying patches without grinding production to a halt, we've seen it all.

[00:00:21] LuRae: Join us as we walk through real world scenarios and arm you with the knowledge to keep your industrial system secure and your operations up and running. It's time to learn from the past and secure the future. Let's dive in.

[00:01:04] Dino: It's again, it's an industrial environment.

[00:01:06] Dino: You know, you might be walking a million square foot facility. You're going to be out there for maybe two days crawling through it. And sometimes you got to work around the weekends and maintenance windows, whenever they just to gain access to the machine centers. We're not when they're not in production.

[00:01:18] Dino: So, yeah, I mean, that's part of the job. And I will tell you, there's a lot of folks that they're not interested in doing that. That's just not someplace they want to be. But on the OT side, they do that all day, every day. So you might as well just keep it with them. Again, you've said this many times in many podcasts.

[00:01:35] Dino: You gotta think globally, but you gotta act locally.

[00:01:39] Craig: You need that local tribal knowledge. Yeah, absolutely.

[00:01:41] Dino: You do, and it's not going to be some IT person sitting 500 miles away in some corporate office thinking that they can do what they need to do on that plant floor in order to do a better job of protecting it or finding out what's going on down there without going out there and really understanding it.

[00:01:55] Dino: And so it takes that level, you have to get to that piece to build that collection capability at those lower levels within that industrial environment. Anybody who says oh we don't need to collect information down there, you can't take them seriously. You just can't because we see so many vulnerabilities down there and people might say, well, we're patching, you know, they never patched that stuff anyway.

[00:02:16] Dino: Okay, that's maybe true, but it doesn't mean that you can't segment and then it's the remote access we find down there. That's the kicker because nobody knows who's coming in and accessing that environment. They have no idea and it

[00:02:30] Craig: changes all the time So once they put this solution in let's say that they've done a pob They had us or somebody else come in and do a bake off and they choose a technology And they decide what they want.

[00:02:41] Craig: They put it in what happens in who's going to help them operationalize Who's going to help them understand the data because it's like you say this a thousand times a month drinking from a fire hose It's just coming as fast as it can. What do they do with the data? How do they begin to make let's call them?

[00:02:58] Craig: actionable decisions, risk decisions from the organization on what do we do with this stuff now? How do they manage that?

[00:03:07] Dino: You can't manage what you're not measuring. Can't manage what you're not measuring, right? So until you get to the point where I have a true asset inventory. The very first thing you got to do, you got to get an accurate asset inventory.

[00:03:19] Dino: And a snapshot in time is not good enough anymore. And some regulations it's changing. That model is changing and we have the technology. And so when we were having this discussion with the CIO, not too long ago, her comment was, do you have any idea how much it's going to cost to do that? And I'm like, yeah, I got a pretty good idea.

[00:03:35] Dino: And then it's like, where are we going to get the people from? It's not going to be you. It's going to be the people who work in this environment, who are accustomed to these machine centers and work in here every day and know how this plant operates and know if I lose this group of machines over here, this plant goes down.

[00:03:51] Dino: And if you lose them, who gets remote access in order to try to fix it? And how do they get in? And then once they're in. How do you keep them where you need them instead of letting them wandering through the underbelly of that control environment and go from plant to plant, machine to machine, right? You don't know, you know, cause you're not watching it.

[00:04:08] Dino: Asset inventory, identification. That's job one. Remote access. If you're thinking VPN is sufficient, again, you can't be taken seriously. Right? In this environment, there are two tools out there that are specific for these control systems. And if you're not looking at them, you're not paying attention. And then you can start building in your defensible architectures.

[00:04:27] Dino: You want to do continuous monitoring, you know, and it's not easy to put in collectors. That's a thought process. That's an engineering process. Decision that has to be made and maybe some negotiations again with the OEM. It's like, if I want to take out the, the cheap Parchman switch, you put in there, it doesn't span or Phoenix contact, for example, and I want to put in a smarter switch that can I get a span port on it, or if I can't take the switch out, can I put taps in there so I can get a span port, put my collector in there so I can collect that information.

[00:04:57] Dino: That's not an overnight decision. That that's going to take a little bit of work and time to get that in. So for you customers out there who have bought. Armus or Clarity or Cisco Cybervision or Nozomi, whatever, every machine center that you got come into your plant that the engineering teams are buying throughout the year, lifecycle replacement expansions, there's always machines coming in and out of that environment.

[00:05:22] Dino: If you're an Armus shop, you should be specking in collectors into that machine center with the OEM that you're buying that stuff from. And if you're not doing that, why aren't you doing that?

[00:05:32] Craig: But I will say part of the process and part of the concern is the human capital. These organizations, you know, we see it all the time, don't have trained resources.

[00:05:43] Craig: The teams that they have that are in that OT environment already have 5, 6, 8 jobs, they're working 75 hours a week getting paid for 40 or 50 or whatever it is. And all they want to do at the end of the day is go home because they don't want another job. And this is another job for them.

[00:06:02] Dino: You know what they do?

[00:06:03] Dino: They spend six and seven figures for maintenance support from the OEMs to maintain and manage the support that stop. So why wouldn't you just do the same thing for this?

[00:06:14] Craig: Absolutely.

[00:06:14] Dino: Or if you don't have it inside, even, even to manage the machines you have today requires support from your OEM and you pay them a quarter of a million, half a million, million dollars a year, depending on the size and scope of your organization or plans you have to do that work.

[00:06:29] Dino: Well, you're going to have to do the same thing for this. You're going to have to put the same effort in there with organizations who work within that environment.

[00:06:39] Craig: Yeah, you know, you take organization like ours or the many other ones around the country, the same things, where they focus on industrial ideas, industrial cyber platforms.

[00:06:50] Craig: They're familiar with the tools and technologies, the techniques, the environment, the practitioners. You got to have somebody that understands.

[00:07:00] Dino: You know. We had a client, they wanted to put in an EDR. I'm not even going to tell you which EDR platform it was, but it was a million dollar CapEx project to do it.

[00:07:08] Dino: And their industrial control system, compute platform, their HMIs, their engineering workstations, their historians, application servers, are VMs predominantly, not very much bare metal out there, just VMs. That 1, 000, 000 CapEx project to put EDR cost them OPEX to fix what that EDR system did to their ICS environment because of the resources that it consumed to run.

[00:07:32] Dino: And not only did it break applications, it slowed things down and they had to buy more storage, they had to buy more memory, they had to buy more processing capability just to run that EDR package.

[00:07:42] Craig: But then you continue down that rabbit hole, what was their loss of production because of the downtime that product caused their manufacturing environment that they can't get back?

[00:07:54] Craig: One million, you add the eight, now you're at nine, plus the other stuff, so you're at ten, plus, it could have been a 25 million hit to them for a 1 million project.

[00:08:03] Dino: And that was an IT push, right? Hey, we're doing this on the enterprise. Surely we can do it on the control system side, right? And then went down there and did what to the bed.

[00:08:11] Dino: And so that's what happened. And this happens a lot because when it really comes down to, when push comes to shove, we're talking about quality and safety and production process integrity. The only people that really have skin in the game are the people who work in those plants to make that happen. At the end of the day.

[00:08:28] Dino: And we see

[00:08:29] Craig: this

[00:08:30] Dino: because when we drag the IT guys down into the bowels of that plant. Nine in 10 of them just walk back to where they came from and say, yeah, that's not my problem. I don't want to mess with that stuff.

[00:08:41] Craig: Yeah, well, it's not their problem,

[00:08:42] Dino: yeah. Well, yeah, it is. And because they see Windows 7 and they see these Layer 2 unmanaged Phoenix Contact switches out there that were put in 10 years ago or whatever, they don't want any responsibility for that stuff.

[00:08:54] Dino: They don't. You know, I'd love CIO that wants to say, yeah, I want responsibility for that. So that means you're going to be the new plant manager. Your job is to make sure the plant runs every day.

[00:09:04] Craig: Yeah,

[00:09:04] Dino: that's your job and you got 30 plants in your fleet. Yeah, right

[00:09:08] Craig: but at the end of the day though all of this still Falls from the ownership if you look at the ultimate ownership of who's responsible It's the ceo and board of directors.

[00:09:19] Craig: There may be a risk manager. There may be a board of governors. There may be And EHS and safety. There's going to be all kinds of layers that are responsible, but it all is going to ultimately roll up to a C level and the board to help manage this. And I think that's again, part of that disconnect is how do they align with teams that Understand how do they bring the right resources to the table, whether that's a tabletop exercise to do alignment within the organization, pick two or three technologies and start doing a evaluation, choose some success criteria for your organization, what makes the most sense for you, what's important for you as an organization.

[00:10:06] Dino: There's three things I've learned that they'll spend money on, and I heard this directly from a very large global beverage company, safety. Always. Quality. Always. Yep. And cyber security. They will spend money on that. Without a doubt. If you get any one of those three things that kick you in the teeth, and you will, the checkbook will come out.

[00:10:26] Dino: my experience traditionally has been getting OT people. To learn networking and cybersecurity, and because they're already used to working in that industrial environment, it's hostile as it might be in what I mean by hostile, it's dirty, it's noisy, it's dangerous, and it's got all these activities going on.

[00:10:45] Dino: It's the concrete floor. It's always been easier to work with those groups because they know the things inside the four walls of that plant. And teach them some of these skills. I've seen this with networking, and I've also seen it with security. It's much easier to work with those folks than it is to take an IT professional and move them the other direction and say today, or for the next year, you're going to work in the industrial space.

[00:11:08] Dino: Your new job is not working for the CIO per se, but you're working for plant operations, plant management, or. Engineering or whoever's responsible for those assets, right?

[00:11:19] Jim: You come from the O. T. side, so you're always going to say those guys are easier to train than those guys over on the I. T. side, where I come from, but I'm not going to disagree with you there.

[00:11:29] Dino: Well, it's gone in your uniform, right? I mean, sometimes you gotta wear the safety shoes and the hard hat and the high vests. This vest and the safety glasses and hearing protection, eye protection when you're out there on the plant floor, right? It's not air conditioned, right? Yeah.

[00:11:41] Jim: You know, and Dina, I think that's a big part of it.

[00:11:43] Jim: You got to live the life. You got to understand the four walls. You got to understand that environment you're working in. You got to understand what's job one when you're working at a plant.

[00:11:51] Dino: Safety.

[00:11:51] Jim: What's job two is production, running it out the door. Reduce unplanned and scheduled downtime. That's foreign to the IT realm and you coming out of there.

[00:12:00] Jim: That's back to that availability versus confidentiality. Yeah. And so that gets foreign. So I tend to agree in this space and where we are now, I think there's a lot of opportunity to go, okay, can we take people out of the operational floor? And I think part of it is generationally, if you think about it, your engineers and your, your operators now.

[00:12:19] Jim: They've grown up with computers, so they have some basic knowledge. They understand. They go, everybody's got one now. You, 10 years ago, you guys that were engineers, did they? Well, no, maybe it was introduced a little later in life, but where we stand right now, your operators or your engineers or your maintenance managers, those guys, they already have a basic understanding of computers.

[00:12:40] Jim: But what they've got is they get that core of understand what's going on in the four walls, right? Yeah,

[00:12:44] Dino: you make a great point. That's an excellent point. It's time is calm because in order for this to really work well, because again, culturally you mentioned culture. Sometimes these ITOT organizations are very polarizing.

[00:12:56] Dino: They don't mesh well together. And so IT will stay away. You know, like I said, they will keep an arm's length distance away. But when you start talking about cybersecurity, those people on the plant floor immediately are going to point their finger at IT and go, well, that's their job. That's their responsibility.

[00:13:11] Dino: It's not my responsibility. And then when you look at the machine centers, you start opening up those panels and you show the PLCs and those HMIs that are out there on the drives and the robots and the AGVs and the pumps and motor control centers and all these, again, physical connected systems. IT will turn around and tell you, yeah, well, that's not my responsibility.

[00:13:30] Dino: And so if it's not yours, then. Who's is it?

[00:13:33] Jim: Right. Well, let's talk about that then from the IT side. So we talked about like the OT group, and then I think generationally, culturally, you're getting to a point where they've got the core understanding of how they plan. And if they've got the potential and the desire to go into this space, I think it's an easier transition, like you were saying.

[00:13:50] Jim: But from the IT side now, right? So how do you get the IT side over? And I'll open with a couple of comments. And I'm going to say most, if not all. I know that was spread. The career in IT, the only thing at most, most of IT, and then you get down into cybersecurity IT, well, they're a little different.

[00:14:08] Jim: They're a different breed, right? And finding the ones that got into cybersecurity and the IT, they're not the same people that are going to step on that floor. And they're quite frankly, probably the people that the guys on the floor make fun of. I mean, you always say they're going to go you with the sandals and the shorts and the hang 10 t shirt get off my plane for you and I didn't trust for it, right?

[00:14:29] Jim: Not necessarily

[00:14:30] Dino: sandals and shorts, but not having the proper PPE on and being caught in the wrong spot, right? And escorted out.

[00:14:37] Jim: Yeah. Yeah. Because I mean, it's not often that they're sitting at their desk and their monitor might fall over and kill them. So they're not, they're not looking for these physical things.

[00:14:46] Jim: You're walking, you're going to get run over by a forklift or a machine door opening or chains moving or just all the different things that could go on a plant that doesn't even touch the realm of somebody that's sitting in a cyber security. So then we start thinking about, well, it's cyber security and they're on the I.

[00:15:01] Jim: T. Site and We've interviewed kids and experienced people coming through here trying to find the right mix for us and what we do. And it's different, especially with the cybersecurity. And don't get me wrong, there are cybersecurity roles out there that are in dire need that are very, very technical.

[00:15:18] Jim: They're very technical, they spend a lot of time in there and what we call screen time, they might even have 10 screens or whatever that might be. A lot of that generation that's gone and trained in cybersecurity think that's what all cybersecurity is about. And some. are probably, that's where they should be.

[00:15:33] Jim: But trying to take those people and move them into OT, I think is the wrong answer.

[00:15:39] Dino: Yeah, well, and I think what we've witnessed too is you have that skill and those solutions on that IT side. But what we've witnessed is them penetrating into the end goal. You know, trying to do their due diligence, trying to do the right thing, want to do the right thing, but only to cripple the right.

[00:15:57] Dino: So you have the inverse of, I'm trying to do the right thing. It's like no good deed get punished. Right. And so here they to, to do their due diligence and try to learn about the plant floor with the tools that they have. And these control systems, you know, You know, outside, you know, outside pressure, so to speak.

[00:16:14] Dino: And so they fail, right? They'll calm fault, they'll go safe. And all of a sudden I'm back to my problem, my number one and two problems. I got a safety issue and I've got downtime, you know, which is costly. And we see that, right? We see that everywhere we go. Yeah,

[00:16:28] Jim: you and I have fought that battle on a couple of times, the guys on the floor are like, Hey, I mean, all this is further the divide, right?

[00:16:35] Jim: It furthers the divide and says, you guys, I don't know what those knuckleheads are doing in there behind the screens, but all I know is our line shut down this week for a couple hours and they probably did it.

[00:16:46] Dino: They pushed out a patch or they booted a switch or their port scanning and ping sweep in my control systems.

[00:16:52] Jim: So I'm going to take that a little further now. So that's up. Big group of cybersecurity, people that think that's cybersecurity. And a lot of people that are in cybersecurity think that's what cybersecurity is sitting behind the screen and looking at that stuff. But if we're trying to get somebody out of there, just like we talked about getting the OT guys kind of to come, come across and trying to get the IT guys to come across, I can't get my arm around this, come across so that they can meet in the middle.

[00:17:16] Jim: One of the struggles that I see is there's a lot of people going into cybersecurity and think that. They think that's what cyber security is and they think, Hey, I at least didn't get a job, but there's nothing out there. Well, I shouldn't say there's nothing. It isn't as evident out there that there is this other discipline and it should be another discipline, quite frankly.

[00:17:37] Jim: How do we find a way to go, Hey, are you interested in cyber security and like to wear steel toe shoes? Because we got a

[00:17:45] Dino: great job for you. Well, to me, it comes back to the ecosystem of suppliers in this space. OEMs, the system integrators. So you can take the big ones like Rockwell and Siemens and Schneider and Emerson and GE.

[00:17:57] Dino: And then you get into those specific OEMs that build those machine centers. They're going to have to start. Bringing a lot of these tools and technologies and services through that channel, because they're the group. They're the trusted advisor that the O. T. People buy from, right? And when they start speaking that language, and I'm talking about their trusted advisor who that manufacturer buys from.

[00:18:21] Dino: They're going to have to start bringing this conversation to the table. They're going to start putting some of these tools in the equipment that they provide. And they're going to have to start working through a bigger, broader view of what kind of safety and security measures from a cybersecurity perspective do you have in your plan?

[00:18:36] Dino: You

[00:18:36] Jim: bring up an interesting point and we hadn't even thought about this. I know we talk about this all the time. So there's engineering schools out there and Rockwell and Siemens and those guys and Schneider's all the other guys. Our providers and they probably put stuff out there for those schools for their engineering school.

[00:18:50] Jim: Absolutely. We need to get that same thing over into the comp sci cybersecurity program. Yeah. So Rockwell, if you're listening, you know, give us, give us a call. We got a couple of programs we can talk to you about. At least right now, today's generation to find out that that is an option. Why isn't? that connected at the school level, because I'm sure they're funding at some level.

[00:19:12] Jim: I mean, we don't, we don't have the Rockwell money yet to fund the cybersecurity. And they provide their

[00:19:18] Dino: technology to the schools. Rockwell, you know, they give them PLCs and SCADA software for their engineering programs, Purdue and Rolla. And you can think of some of the big engineering schools that participate in these programs.

[00:19:30] Dino: But I haven't seen that cybersecurity piece as a part of that. And right now, when you look at those cybersecurity tools, you know, what are those that are specific for the OT space? And it's not that any of these companies own that just yet, right? These are still independent organizations, software companies, Dragos, Nizomi, Clarity, Armus, what have you, are part of this ecosystem.

[00:19:52] Dino: Right now, they're not really attached to any of those automation technology vendors. They, they are partners. Don't get me wrong. There's been investment. Don't get me wrong. But, you know, getting it into the university level, like that executive from the meeting that I had on Monday was asking that specific question, right?

[00:20:07] Dino: Is this happening? And the short answer is not in a broad. Brush stroke. It's not, you know, there's some smart folks that figured out we need to do this and they've started, but we got a long way to go.

[00:20:19] Dino: Anybody that knows anything about industrial control system infrastructure will tell you, do not scan actively into these OT environments, just blindly. Or scanning any of it, right? You don't do it. And, and some have learned, painfully, they've learned to quit doing it. And we've seen exclusionary lists and we've seen a client that took us a while to get the security team to sit down at the table, because we recognized they were scanning the control system network, the plant, and the plant was complaining about it and everybody was ignoring them.

[00:20:46] Dino: And the networking team that was involved in the project was thinking, well, isn't this just normal? By the time the security people showed up and sat down at the table, they were showed what they were doing, it's like, That stuff's supposed to be on the exclusionary list. It was at one time. And the question then becomes is how do you keep that from happening?

[00:21:00] Dino: We have the technology and the tools to do it today. It's just that when you get to the OT environment, as you go through, what we've witnessed is not everybody has a good understanding of how this stuff's put together.

[00:21:11] Jim: I want to take this and then go to the next step. So the OT guys, they know this goes on, right?

[00:21:17] Jim: And they just try and work around the IT guy. So this is another lesson from the field that you get machines connected on their own path, right? They find a way around the IT and whether it's from disruption or whether it's because it's difficult to work with, or it's just easier, we've seen this where those machines are plugged in to say a vending network, right?

[00:21:37] Dino: Yeah, take Fastenal machines. So they're out there providing PPE, for example, right? And it's down inside the plant and it's very easy to connect it within the confines of that plant network that's right next to the networks that the control systems are that are probably also connected to the same network.

[00:21:52] Dino: And that's where you'll find those things that have remote access up and out. You'll find cellular modems in those things that have access out, but they're still connected to the plant network or the customer network per se. And so it's not uncommon. We find it all the time. It's so easy. Somebody's looking for a jack to plug something in an ethernet jack.

[00:22:08] Dino: And the next thing you know, somebody's doing exactly that.

[00:22:10] Jim: When I plug it into this. People call me and they don't help me fix my problem. When I plug it into this, they may open up other problems, but at least they get their machine back running. And then

[00:22:19] Dino: you listen to some IT guys sit there and go, we have network access control.

[00:22:23] Dino: Right. We got NAC. You plug in and if you're not recognized or you don't have the right credentials, you don't get on. And it's like, on whose network? Your network? What about plant network? But for them, we're going towards NAC. We're looking for segmentations. Yeah, but you're not there. And even if you are there and moving in that direction, how do you stay there?

[00:22:39] Dino: Because these are not static environments. They're very dynamic. We've been working with a client, but the plant manager told us he's got people from all over the world accessing his plant floor every single day. Right. Think about that for a second. And he doesn't know what they're doing. And IT doesn't know what they're doing, but they're in there every day.

[00:22:55] Dino: They show up on site, they remote in. And so when you go down, and so what does that person do? So when you get in there and there's unsecured protocols, there's open ports, there's host scans, you got the login failures and monitoring that stuff. Default passwords, unencrypted passwords. We find all of these insights demonstrating the vulnerabilities and weaknesses in this environment and who's doing anything about it.

[00:23:17] Dino: If you don't know it exists, how are you going to chase it down and try to solve the problem to fix it?

[00:23:21] Jim: Right. Interesting point from there is you're not going to find it till you get out there on the floor, right? Because those plant managers aren't broadcasting that back through the organization, are they?

[00:23:30] Jim: No. They're not going to say, Hey, just so you know, daily reminder, we had who knows who come into our network last night and work on our machines. We don't know. That's something they don't share, but you've got to find that out when you're on the floor, right?

[00:23:42] Dino: Yeah, it's just like the conversation we had recently about the Apple devices, right?

[00:23:46] Dino: Now somebody would look, when you see an Apple device, if it's connected to the BACnet network, which is the environmentals of the building system or some testing system that you have because of the type of business you're in, and that's connected to the network, then all of a sudden, yeah, you do have a Mac sitting out there that's not being monitored.

[00:24:01] Dino: There's no EDR and there's nothing. But it's connected to your network within that environment. And somebody would sit there and go, those tablets are not OT assets. Well, okay. Now, from a risk perspective, who owns that? And this is where you get the deer in the headlight. Look, IT didn't buy that. And we don't use that asset.

[00:24:17] Dino: And OT is using that asset and it's valuable to what they're doing, but they're not the security team. It's not their responsibility. Nobody's telling them you've got to do a better job of doing, being cybersecurity experts and professionals in your environments. Here's some money, here's some tools. So here's some expertise, skills, any of that stuff.

[00:24:33] Jim: No, they're just worried about getting it out the door and making sure that machine's running.

[00:24:36] Dino: And they've been taught, OT's been taught over the years, because I've witnessed this, I've lived through this, what the controls people will do is they'll just put multiple network interfaces on their equipment.

[00:24:45] Dino: That's how I keep IT out of my hair, right? I put two NICs in my PLC. I'll put two NICs in my server. I'll put two NICs in my engineering workstation. And now I have a device that's It straddles both worlds and IT is not responsible or accountable for the other side of that house. But yet, the machine is connected to their network.

[00:25:03] Dino: So now it's a conduit, either way, up or down, and they choose to ignore it.

[00:25:07] Jim: And that kind of leads to this other point that I wanted to touch on, which was, I mentioned before, they're not advertising certain things, right? Because sometimes they're afraid of it going away, right? And we see this all the time, we'll be walking on the floor and well, is that machine connected, right?

[00:25:25] Jim: You open it up and so what's that? But yeah, it's connected, but can I leave it there? And we're in the business of identifying these things and offering up mitigations on how to handle that. But again, they're not going to advertise. They're not going to communicate it because they've been successful working around the IT controls and the IT network and the IT support, and they've been successful doing it, they want to keep doing that, they don't want that other headache that you said, where everybody sits around, who is responsible?

[00:25:51] Dino: Yeah, ultimately you can think it'd be the senior leadership who I think that have been misinformed by their teams by assuming that the message coming to them is that we're air gapped. Those things aren't connected to my business system network. Those things are separate, right? They must be separate because obviously there's different groups managing them, so they have to be separate.

[00:26:09] Dino: Somebody needs to inform them that either they're being lied to, or that's just the ignorance within the organization doesn't understand what they've done to themselves, right? Because everywhere we go, there is nobody immune from the things that we find that when I listen to one thing, I just take it with a grain of salt and say, yeah, okay, I'm taking notes.

[00:26:27] Dino: I'm listening to you now. Let's go see what's really going on versus

[00:26:29] Jim: reality. Man, you're just leading, and by the way, Dino hasn't seen this list, and I'm just checking off things. I should have made it into a quiz show. And we hear this all the time, right? This is our policy. This is our policy. This is our policy.

[00:26:41] Jim: But until you get on the floor and find out what the real practice is, does policy really matter in that case? Because that's what we take practices over policy. That's what we're trying to identify.

[00:26:51] Dino: And some of the projects we get involved with, even though the scope, they want it to be narrow, right?

[00:26:56] Dino: Because as soon as you start digging, if you're standing in a hole and you're digging, what are you supposed to do? Yeah, quit digging, right? And the problem is that they've got this problem. So you've started this digging process and now we're finding all these vulnerabilities and all you want to do is.

[00:27:08] Dino: Shift back to the focus of to stick to the scope. I don't need for all these other risk activities to float up and, and, and get beyond my control to be able to manage this, right? And it's an interesting dynamic when you start going into these engagements and people start realizing what they've been communicating is not what the organization really fully understands about that environment per se.

[00:27:30] Dino: Are we safe? Again, we can talk about this. This is another podcast. What are the feds been doing? Chasing these terrorists. These hackers have been breaking in to organizations, right? It's going on. You got the feds out there because businesses don't know what's going on from China in their own backyard here in the States, for example.

[00:27:48] Dino: And so the feds and they're hunting them down, trying to remove what they're doing. And then after they do what they do, then they'll come back and talk to the client, again, business owner and say, Oh, by the way, we broke into your building and sorry, we destroyed a bunch of shop. We shut down your plant floor.

[00:28:00] Dino: Didn't mean to, but we had to go get these bad guys.

[00:28:03] Jim: Yeah, I'm with you. That's just generally my impression is because the government has changed tactics and are those tactics that they're using add more risk to the OT environment if you're not managing appropriately.

[00:28:13] Dino: I'd say they don't even realize that they're impacting this business to produce the goods

[00:28:16] Jim: that they make.

[00:28:17] Jim: They're not sure. They don't care. That very first lesson from the field, which was, you know, the scanning disruption to prevent disruption. So how does it go? The cure is just as bad as the disease. Something like that. Anyway. Yeah.

[00:28:29] Dino: We'll save that for another podcast. Cause we've got some good stuff on that.

[00:28:32] Jim: Another thing that we always hear, you were mentioning outside access, but we'll go into places all and there's no outside access. And then you've got to answer the question, who fixes that machine? Well, except for this. And I think in addition to that, I'm saying the majority of the machines, I'm thinking back at least in the past year, the panels we've opened up, they all have remote access built into the machine, right?

[00:28:54] Jim: And if you told an IT security person, you got six different methods of remote access and who knows who has the. Those IDs. And like you were mentioning before, the plant managers know people are coming in, right? Bob, do the IT security guys though? No. So what's

[00:29:09] Dino: his job at that point? When something like that happens, what's power do they really have?

[00:29:13] Dino: We know that somebody over in India has remote access to your plant floor. Unfettered, right? You have no idea what they're doing once they're in there. Oh, no, by the way, this machine is actually connected to the enterprise network of the organization, right? It's connected. So what's your job at the end of the day?

[00:29:29] Dino: What are you supposed to do? This violates policy, every bit of it. The risk is ridiculous. What's more important. You're going out there and ripping that remote connection out of there or let the plant, let that piece of equipment shut down and which might ultimately shut the plant down and now you're losing hundreds of thousands of dollars or millions of dollars a day or whatever it is.

[00:29:45] Dino: What is your role when it comes to that? We had a CIO. What did they say? If there's a machine

[00:29:49] Jim: connected to the internet. Why should I care? It's the thing, cause their scope, you mentioned it before the scope is okay. I'm just worried about stuff on my network. Shouldn't this gets to that overlapping security resilience and operational resilience, right?

[00:30:01] Jim: And okay, your scope should be the business, right? Not just what's connected to your network. Yes, those are vectors, but if your scope and you're providing security services for the business, that's why you should care, right? Because

[00:30:14] Dino: somebody has the ability, 15 year old kid can send 500 camera video streams to your PLC that's sitting on the internet and shut that piece of equipment down.

[00:30:23] Dino: It's sitting at a key critical spot within your plant. If that machine goes down, your plant starts slowing and then it stops. stops when that response was given that CIO didn't have a response to that, but it wasn't like they were going to cop and say, Oh yeah, you're right. That's a bad idea. They said nothing.

[00:30:37] Dino: That's

[00:30:37] Jim: the chasm. I didn't have to cross at some point to go, what is my role? Just my network that what I can see and what I know about the security. Really what's your

[00:30:47] Dino: job when it comes to OT? If you find bad stuff, what are you going to do about it? The plant's going to tell you, if I don't have this plant shuts down, who trumps who at that stage?

[00:30:55] Dino: We know who wins every time, right? Yeah, then it gets back to the point.

[00:30:59] Jim: Then why isn't OT leading this? But yeah, we have to beat on OT a little bit too, right? We can't let them off the hook.

[00:31:06] Dino: Yeah, trust me, I say it all the time. They need to grow up and be big boys and girls and mature and start really understanding what their cybersecurity hygiene looks like in their plan and start caring about it.