The Air Gap Myth: Why Your Plant Is More Exposed Than You Think

Matt [00:00:00] you can't protect what you don't know that you have, right? And I think that's the number one thing is there's all of this, I wanna call it noise out there, that you gotta go do this, you gotta go do that.

Matt We have to go put this tool in, put this tool in, and it gets overwhelming, and that's what it stops a lot of, or what I see that delays a lot of these, decisions on going to do something

Intro - Outro Welcome to the Industrial Cybersecurity Insider. In each episode, we dive into the world of industrial cybersecurity. Join us as we cover the latest trends, innovations, and practical insights as we talk with leaders and practitioners across the industry. Gear up and let's get into this week's episode.

Dino Hi, this is Dino Busalacchi, and today I have with me Matt Pike from Rockwell Automation. Welcome to the show

Matt Hey, Dino. Thanks for having me on here. Appreciate it.

Dino Appreciate you,attending today. So, I- [00:01:00] we always like to kind of, dis- discuss your journey, you know, to, that brought you to this point, you know, and especially around OT cybersecurity, which is, I want to, I don't want to say it's a fairly new phenomenon.

Dino obviously manufacturing's been around for decades. but a- as we've seen, the complexities and a lot of the connectivity and obviously security concerns entering into our space,we really like to find out what brought you from where you came from to this point, and so let's, let's start with that.

Matt yeah. It- it's always an interesting story to see where people come about, especially in industrial cybersecurity. I don't know why that's such a, you know, a, a good topic people want to get into, but I kind of just fell into it. you know, it, it started out early in my career within IT, kind of like a lot of folks in, in our industry do.

Matt They go into IT. I had the opportunity to start out at a large automotive manufacturer doing kind of on-site support IT. At the time was not really an industrial cybersecurity auto, you know, OT type of, of structure. IEC 640.3 was around, but not, [00:02:00] not real pre- prevalent, right? so getting the experience of having that on-site support IT was actually OT experience.

Matt So looking at all these different devices such as PLCs, looking at even, even different types of robots, Fanuc robots, and all that, and, and things connected into them. it was a lot before this IT/OT convergence came around, and so just kind of taking that experience from there, that really interests me.

Matt I love to see things work. I like to love to see things, how, how it gets manufactured. so really being able to take that and then see the details, ins and, and ins and outs of things you don't see in IT, and it's a whole different world, and I think that was just really interesting to me is trying to take these IT concepts and kind of evolve those into an OT, manufacturing process.

Dino The things that, that we, you know, that's what, what most, factories are doing. They're, they're making products to support, things outside of it, and it's really cool just to see that. A lot of the time in an IT seat you don't get to see that and see the challenges that they're facing. So I think it's just a really, really interesting, industry itself, Yeah. So you're talking about the IT piece. I mean, you and I both heard the IT/OT convergence word terminology [00:03:00] probably for the last 10 or so years. I still see some challenges with that. I'd be interested in your perspective on, you know, why do we still have this gap, you know, just between what should be a, a solid partnership.

Dino I mean, you look where you began, where you started, working in manufacturing, but from an IT perspective, why hasn't that really turned into more of an aligned, collaborative, transparent relationship in your view?

Matt Yeah, and it's, it's an interesting answer because it's not the same for every single manufacturer you come in contact with.

Matt I think the overall arching factor is, is the fact that we're trying to apply modern cybersecurity principles to- Print in environments that were never really meant for those, right? we've got a lot of legacy systems that are meant to last 15 to 20 years plus, and now all of a sudden we have this bucket of things we have to go do, whether it's cost or a- added people or, or process to change that never existed before.

Matt it's almost like a culture shock, right? So that brings a lot of challenges in itself. you know, we've got legacy systems, like I said, that's designed to last for many, many [00:04:00] years untouched. Now they're having to go through and, understand those environments a little better, and then go apply principles to them that, that folks were never intended to even know or, or, or implement.

Matt so IT systems, it's pretty straightforward, right? We know we, we've always been able to patch those systems. We can take them down. We can, schedule outages for things like that. in the OT world, taking a system offline to patch it was almost unheard of for a lot of environments, right? taking those, those environments is really just a, a big culture shock, I think, in, in trying to take those principles and apply it and make it make sense, right?

Matt Because OT operations, they've got, they've got uptime. They have to make sure their produ- their production stays up. They've got product that goes out the door. They've got a service to meet, a service deliverable. If that doesn't get met, things happen, you know, domino effect down the chain.

Dino so having that IT/OT convergence, whether it's technological, but also people-wise, is extremely important, but it's also something that's still a, a work in progress for a lot of organizations. They're not seeing eye-to-head and eye-to-eye on how things should be done and all that. It's just a big, big overall culture shift, I think, Yeah. You know, I, I always view Rockwell's position, within the [00:05:00] company through your clients, you guys have, have a different position, I think, than a lot of your partners and the system integrators do. And one of the things that I recognize, especially when you're talking about the, the IT leadership,we don't really have a lot of interaction with, IT executives, right?

Dino Even though we've been working with these clients for years, some case decade two,and s- we're doing big projects. We got people out there doing maintenance and support activity. but we don't get phone calls from CISOs and CIOs that are being tasked with OT cybersecurity, for example, to tap in to probably, you know, a, a very talented resource that's pretty knowledgeable of those OT assets and that environment and the processes, you know, production, et cetera.

Dino and again, you guys are kind of in a, you're a different animal. how do you see that? I mean, maybe you guys are having better conversations with that IT leadership to help with that,partnership between IT and OT, but from our purview, not so much. So I'd be kind of curious to hear what Rockwell has [00:06:00] to say about that, you know?

Matt I-I-I-It's always, i-it's always a challenge to get to the right people you talk to. a lot of the time we even have CISOs come to us directly. Some of them are, are very in tune with what, where their delineation is of responsibility. They know Rockwell Automation. They've seen it where their factories have millions of dollars worth of equipment sitting in there.

Matt Why have we not contacted them, right? it's also a fact of, a lot of CISOs that they still don't understand the weight of what manufacturing has to do, and they think that, because of their practice they've known for years and years, that they can take an IT tool and throw it on there and, and just expect it to work.

Matt And I think that, that's the gap really is the visibility and awareness of, you know, what manufacturing has to offer as opposed to an IT solution. So, so like I said, it's ki- it's kind of a mix. We have CISOs and, and executive leadership we're talking to. They're very aware. They're very aware that they need to do something.

Matt a lot of the time it's, it's really Rockwell Automation versus a, like a tool or a tool set So it gets r- a little challenging that they think a tool can go and fix their problems when really it's a people and process issue before a tool even [00:07:00] gets implemented. how do you go and do this? What do you look for visibility?

Dino How do you go and remedy these things? What people do you have on staff to go and take care of these issues? That's the issue. That, that's when we do talk to leadership, that's our, that's our bigger, more important things, is helping them find a strategy that's gonna work for their organization, not just a toolset that they can go and implement, Yeah. Well, yeah, 'cause I, you know, Rockwell would be viewed as, as a trusted advisor, right, in, in this space, in my view. But how do you feel about some of these, the third parties I'll call them, whether it be consulting organizations, you know, your, your IT VARs that are, that are incumbents that sell a lot of security tools to these IT groups.

Dino Do you, do you see their role as, as being a positive influence or more detrimental in the whole strategy of this O- OTIT convergence play?

Matt Yeah. I, I think if anyone can drive awareness, that's a positive, right? Any kind of awareness period, whether it's, whether it's a con- consultancy that gets them on the right path to start, start thinking and looking and, and just scraping the surface of what they need to do, I think it's, it's very positive.

Matt at the end of the day, Rockwell is the [00:08:00] largest automation, you know, provider in the United States. very, large global presence. Been around since the 1800s, right? We, we know automation better than anybody that there is. We know how to conform systems and, you know, the majority of folks we talk to, they have the Rockwell automation install base, and we know how to talk to that of not just a cybersecurity practice, but we developed your applications, we developed your hardware.

Matt Let us show you how to actually implement that through, you know, our right standards and processing and policies that, that we've helped implement. I think it's, it's more just anything to drive awareness and visibility is always a positive. getting to the right place after that fact to actually go and do things, that's really important.

Matt can't speak to how they do their practice of course, but you know, if there's a consultancy in, in, in ISR and all that that, that can go and drive something, that's great. But sometimes it's trial and error. If this tool is gonna work, if this process is gonna work and all that. But Rockwell automation takes that, that factor out of just we're not a reseller, we're not just a, an, an added value VAR, right?

Matt We are a strategic partner to help with that overall strategy to understand what do you need to go do and what do you need to go fix and, and the right type of, of [00:09:00] roadmap, kind of, kind of process, but.

Dino you know, not, not every manufacturer is, like in North America, unquestionably Rockwell is the 800-pound gorilla on this side of the pond.

Dino do you don't see obstacles the way clients may view you because they're not 100% Rockwell, right? 'Cause they got some Siemens, they got some Schneider, Emerson, GE, what have you, and they're, y- y- and you guys, I know from your practice, you guys look at it, you're agnostic, right? You're, you're not trying to sit there and go, "We're just trying to push Rockwell, technology down," you know, per se.

Dino But to apply your practice from a security perspective, from a networking perspective, it doesn't matter to you guys, right? I mean, in, in, in my view.

Matt Correct. Yeah, that's, that, that's the, the main principle and why we, why we do what we do. we have full-time consultants, principal consultants and everything.

Matt Anything we do within cybersecurity is fully vendor agnostic. you know, we, we even, we acquired a new company that was just called Berg Industrial for,for visibility down to the asset layer. because of the deep presence we can [00:10:00] get into that and u- utilizing native drivers for every type of vendor, that software was acquired, it's now our security platform.

Matt We're able to use that to get into assets of, of any kind of, of manufacturer that's out there. and that's very powerful. So cybersecurity is not going to say you need to conform just to Rockwell standard and this. It doesn't matter what you have. The more vendors you have, the more vulnerable you likely are.

Matt So for us to understand those, that's really, really important on how to do that. We've got, we've got a lot of our clients that are, that are all Honeywell customers, that are all Siemens, that are all, you know, different, different vendors out there, and we don't care, right? It's not, it's not up for us to say and dictate, "You shall go do Rockwell."

Matt It's not that. It's the fact that we need to understand what your visibility is and what vulnerabilities are associated no matter what you have. So that's correct.

Dino Yeah, I want, to touch back on something you said earlier about secure by design, right, which I think is very, very important. And one of the things that, that, that we struggle with, and I'd be interested in on your thoughts on it, is especially because you guys are also a systems integration firm, is, you know, I view clients that really got a, a, a firm s- [00:11:00] strategy to move forward on how they want to improve their cybersecurity posture, that there would be language in their RFQs and RFPs coming out to these system integrators that they're hiring to do these integration jobs, expansions, brownfield, greenfield, lifecycle, what have you, to, to help, spearhead and assist with those deployments, right?

Dino But I never see any language out there on how to do secure by design. And, and the flip side of the narrative is Rockwell also, you know, putting some emphasis on your proposals that you put out there that says, look, even if the client isn't really doing a good job of, you know, providing a, a ser- cybersecurity strategy for their manufacturing facility, we as an organization, as an integrator that's coming in to, to do, let's just call it a, a greenfield expansion project of some sort, do you guys bring language in to say, "In order for us to operate in this space, here's our secure by design principles and strategies on things, tools that we're gonna bring to the table to secure and protect, provide overwatch on what we're [00:12:00] doing while we're here"?

Dino If a client hasn't, you know, matured and advanced, to, to a stage where you guys would say, "These guys are good, they got... they know what they're doing," versus those organizations that don't, you know, which is there's still a lot of them out there, how do you compensate for that, you know, like from a cri- you know, critical point?

Matt Yeah, yeah. I mean, secure by design is, is everything we do. So even going into our Rockwell products on the floor, PLC and IO, right? All of those are... They go through a strict IEC 64 or three process to make a secure by design, product. And if that product doesn't meet a standard, then it gets scrapped, and you kind of go back to the drawing board almost for all those, different features that they didn't meet.

Matt So even from our, our automation standpoint, secure by design is very critical. When we go in conversations with clients and they have,system integrators involved and all that, that's great. We wanna see, we wanna see that local support and local help for our clients. we, we do also wanna make sure that the right prin- principles are being met.

Matt If there's any questions that come up, if there's any doubts about anything, there's a lot of coordination we can do with our OEMs and everything to make sure that when they are implementing a system [00:13:00] or a skid, that we could help them understand what a, a true bill of materials should look like, what a secure practice should look like for implementing those, those systems and things like that.

Matt So there's a lot of conversations around those, where Rockwell comes in as just an advisor to help, kind of understand what those security requirements are and make sure that they're being met.

Dino Yeah. 'cause I've, you know, even in our, practice for, as, as a system integrator, it's still a little bit of pushing a rope up a hill, you know, to get that, to get that topic on the table for...

Dino You know, just a simple example would be incident response, right? What are we supposed to do if we're in there working in that environment, you know, we're gonna be there for the next six months to a year, and there's a material breach? What are we supposed to do if there's a breach? You know, what is our role?

Dino and I rarely, well, not rarely, I never see any language, in those contracts and those, agreements on how to handle that. Do, do you guys... How do you guys handle that or, per se?

Matt Yes. I mean, it, it, it gets, it gets really challenging when, when we go to those conversations because [00:14:00] greenfield, brownfield, whoever is, you know, owning those projects and things like that, as long as we have the right folks we're talking to, such as the CISO level or the executive leadership or somebody in IT that can, that can put a stamp on something and say the BS, let's do it, those conversations would really re- revolve around them.

Matt Because incident response and all that, we have dif- all kinds of solutions for incident response. We can provide globally, with boots on the ground, we can provide and all that. it's not always a topic of conversation that gets brought up from that level. It's more or less let's get it in, get it done, and, and move on.

Matt And I think that's something that's good to stress on is,start thinking a little bit outside that box, right, when we go into these conversations to bring that wording in there, bring the language in to say, "We're- we have, you know, a six to eight-month gap here where we're doing implementation, we're doing testing, we're doing all this stuff, putting all these SKUs in.

Matt Who's gonna be responsible for assessing what's going on? And also when something, if something does happen, what is our actual response mechanism for that?" and so that goes back again to bringing it back all the way to the company standard, is building a golden standard for the company, and then letting that [00:15:00] trickle down to those projects, right?

Matt So when the new project comes up, there's no guesswork. It says, "We know that we need to put this in." However, we need to step back and start looking at these specific s- standards and make sure people are meeting them. have a response plan in place to make sure... A lot, a lot of folks don't even have response recovery, policies in place.

Matt they focus, and this ki- kind of gets into a lot of the dynamics with shaping things, but-

Dino I get the deer in a headlight look when that, that, that topic comes up, you know.

Matt there's been ... it's, it really, really interesting to go into, to a room of folks that y- large companies, small companies, whichever, mostly large companies, and like, "Well, what do you have for a response?

Matt What do you have for if something were to go down, or what's your backup pro- policy and project?" Like you said, there's, there's, they're steering headlights and no- nobody really knows. And that's, that's one of the things that's really critical is not going through and seeing a full list of CVEs or a full list of vulnerabilities and going, hitting those one by one.

Matt It's how prepared are you for an attack? What is your response mechanism, and what can you do to restore the processes? And that's, that's one of the bigger pieces that a lot of

Dino folks miss. Well, and, and so do you guys bring in your tools to [00:16:00] have that overwatch? So whether it be Secure OT, I know you're also a Clarity partner.

Dino I know you work with Dragos. so do you make those tools a, as part of your, your project plan? You know, when you're, when you're scoping a job and, and pitching it to the client. You know, to ... If you're doing a, a brownfield or greenfield expansion, do you guys add that into the mix?

Matt Absolutely. Yeah, that's always, one of our main, categories that we do when we're looking at scoping those projects is cybersecurity.

Matt whether it's, it's coming in with tool sets and, and designs and things that they need that they, they've asked for, or coming with education pieces to say, "Hey, you know, I don't know if you guys have thought about this, but this is what we do. That we have our, our whole slew of partners that can help and come and do this.

Matt We have our own tool sets we can put in." but really it's just visibility and making sure they have the, the overall, awareness of all that. So yeah, we have, we have a full team dedicated for them. We have cybersecurity representatives that, that are on each of those teams for-

Dino Yeah, and my point would be that would be as part of the project, right?

Dino Meaning that it comes with it, right? Is, is make it part of their capital project, you know. I mean, if it's a $20 million job, we're [00:17:00] not talking about that kind of money to put visibility I have overwatch over the area, the boundaries of where I'm operating within your plant, you know, is my view. shift the gears a little bit.

Dino We talked about AI, right? So w- what is Rockwell's view of what AI is going to do, and what, what's missing in these environments to even be able to, to run it? and where are they... What's it gonna take for them to get to where they need to be, and what kind of timeframe are we talking about here?

Dino 'Cause to me, every time AI is, you know, is advancing at, at a rate of speed that's just un- unfathomable sometimes. So, you know, how are these plants gonna even be prepared for it? In, in your, in Rockwell's view, you know?

Matt Yeah. And, and I think you, you said it, you said it best, right? AI is advancing at an unfathomable speed.

Matt And I think our manufacturing plants that, that we're talking to and, and, and some that don't even have the awareness yet, they're, they're, they're still far behind on even having anything set in stone on the right [00:18:00] designs, the right tool sets to even run the operations the way they need to for a secure environment, let alone bringing in a new i- introduction to AI and what it can do for you.

Matt so I think that from Rockwell perspective, we are embracing AI to a safe degree, right? And incorporating AI to make tasks, you know, more, you know, e- kind of easy to get to, making things a little more, I, I guess, I don't wanna say easy, but it's one of those, you know, you're just trying to get things m- more, more productivity is to, to push that, right?

Matt There's a boundary, though, between what Rockwell would push and what a client should ingest themselves. It all comes back to policy procedure. You need to make sure the right policy procedure's in place for utilizing AI in the workplace, whether it's for IT and, of course, manufacturing states. in the manufacturing wor- world, AI is still, it, it's coming into, into light.

Matt There's a lot of things we can do. We can sift through more data we couldn't before. We can find more, anomalies or, or, or, or, anomalies in things that, that we didn't think we could before to get more out of manufacturing. so adopting that is definitely something that is on the roadmap.

Matt I don't know if it's the number one thing that manufacturers should look at. but I [00:19:00] think that as Rockwell incorporates AI as much as we can to different products, different solutions, different software systems, we also have the consultancy behind that to help make sure that they adopt AI in, in a proper way.

Matt But, I, I would say timeline is, is really, it, it's hard to pinpoint. It's definitely years down the road, before, you know, a lot of plants are gonna be utilizing AI to its full potential, because of, one, the rapid growth of that, but also the slow progression still we have with security in the workplace, with the cybersecurity practice for IT/OT convergence in the workplace, so within those environments.

Dino Do you th- do you think from, on the AI front that the, the bad actors are gonna be able to leverage that? you know, A, 'cause we know the risk and vulnerabilities in the manufacturing environment are pretty significant, right? 'Cause to your earlier point, we just, they just don't patch, right? You know, and we still have many clients, as you, as you know, that don't even have the cybersecurity practice or tools, right?

Dino I mean, I just went through one with a company, a breach, supply chain related, product that was supposed to be shipped, [00:20:00] couldn't be shipped, had to be sent back because the, the, their client couldn't take it, you know. So they had to destroy product, change it into something else, convert it into something else, and, based on a breach, right?

Dino But, do you see the bad actors in the AI realm speeding up and taking advantage of a lot of the risk and vulnerabilities that are inside these OT environments that are just ripe for the picking, in my view, just because stuff hasn't been touched in years, right? Infrastructure that's weak, visibility that's not there.

Dino You know, just the whole things, you could go down the whole list of things that you should be doing to get better that are, that aren't happening. do you think, do you think AI is going to be the, you know, the, the shot across the bow that wakes them up?

Matt I, I think 100%, yes. there, there's been a lot of, a lot of AI, playing in a part of these bad actors that are, are happening right now.

Matt you're able to build reconnaissance at a much faster rate. You're able to go through and see what folks are actually doing to, to plan the attack. you're, you're doing much more advanced [00:21:00] attacks at this point, some that can replicate themselves, some that are, changing the way that they're being adopted.

Matt I've seen an article the other day that, there's a ransomware that because of AI it's able to change when, how it's getting detected. If it gets detected by a certain tool, it rewrites itself to then go and try again in another tool and keep going, right? So, I think just the efficiency of AI, bad actors are taking that into their pocket as well.

Matt Some of that comes back to manufacturers, one, adopting it, but also adopting it in, into a, a mature level, and also ensuring to have the right strategy to, to combat things like that. AI is definitely... It's- I think it's been a great,technological advance the last few years. I think it's been amazing.

Matt However, there's also the double, double-edged sword where you have the bad actors are gonna utilize that to their advantage. and unfortunately for us, that advantage is gonna be even more streamlined because folks can sit there, they can get into the systems that are not patched pretty easily.

Matt Taking an AI tool that can automate those tasks is gonna be pretty substantial.

Dino Yeah. Yeah, I don't disagree. it's, it's one of the things that I think about a lot, you know, because I, [00:22:00] I have a, a pretty good insights on, you know, what most of our clients' environments look like. and,to me, AI just ha- has a huge potential to just be very disruptive if it's targeted.

Dino Because, I'm sure you've heard this, but most, most of the time, you know, when you think about cybersecurity breaches, it's always through IT, it's always coming through some email phishing attack. I mean, we... You and I both know that there's been some very specific control system malwares that have been created,

Dino not at a large scale. We don't see a lot of it, right? And so that perception is it's not targeted. The OT environment is not a target. They're not writing, you know, malware to go after Rockwell PLCs, generally speaking, right? It's always coming in through the Windows environment. My argument's always been, yeah, but those HMIs are the...

Dino are also running on Windows operating systems are controlling those machines out there. But they're alwa- they just, it always seems to get downplayed, you know, that those... Because there's still a perception, another one, is that they're air-gapped. They're not connected, you know? And, you know, I don't know how [00:23:00] we move past that.

Dino You know, I don't know how you guys are, are able to, to, facilitate that, but we still have groups that believe that, I'm protected because my PLC is not on that network." And I, I argue that it is, but anyway. I don't know how you guys see that as, you know, whether... And whether AI is going to be able to develop more,malware related attacks that are specifically going after control systems.

Matt Yeah, no, I, I, I would... We have that conversation all the time that, well, this is air-gapped, this isn't, this isn't touching that thing. And, and the argument basically is the fact of so you have no data going to your historian for that, that SKU. Well, yeah, we can get data from it. Okay, if you can get data from it, it's not isolated, it's not air-gapped, right?

Matt There's very, very few systems that I've seen in my career that are truly air-gapped, and a lot of those are because of regulation. You're, you're looking at a lot of probably, you know, government, military type of, of application, things like that. in, in your food and beverage, even oil and gas, even in, you know, various different,you know, pharmaceutical and all that, most of everything is connected.

Matt even if [00:24:00] it's not, we need more and more data out, out of the, out of the manufacturing plant anymore. You know, plant manu- or plant, plant managers and, and leadership, they're, they're not gonna settle for well, it's air-gapped. We need that data. We need to understand that to make business decisions to go and do s- things with the product or do more shipping or whatever the case is to improve their process.

Matt They need that data. and, and at some point somebody has plugged a card in somewhere, they've plugged a network cable in somewhere that th- they might not know about. So that really goes back to the visibility piece is really you, you need to understand what you have before you can understand how to secure it.

Dino Yeah. Well, it's the first tenet of every security framework, right? Asset inventory and, you know, and, and the question is do you proceed at continuously versus a snapshot but time, right? and, and then let the conversation fall. because, you know, I've seen, you know, hundreds of, OTIDS platforms rolled out over the last decade.

Dino But you know what I don't see a lot of, Matt, is I don't see the east, west traffic monitored with collectors and sensors at that level, you [00:25:00] know, down in that level two and one area of the plant. You know, even though they've had a tool for several years, so use Clar- you say Clarity if you would like. and I know SecuriOT has a different approach to that because you guys can crawl through the network, you know, versus just sitting there passively, but I don't see the collectors.

Dino I mean, we're a panel shop. We build panels for very large companies. We're not putting sensors in these panels for clients that have already invested in, in an OTIDS platform to extend their visibility, you know, past just north-south and go after the east-west. a lot of them say that the east-west data isn't,isn't that important Says who?

Dino I, I, I... One, one of your guys, I, in one of my Rockwell training classes I went to, I think he said it best when, for this exact same comment was, "Well, that's just one opinion." somebody who says that the East-West traffic is not important, right? I mean, well, that's just your opinion. You know, whoever's saying that, obviously you probably don't know what's going on down there.

Dino [00:26:00] But anyway, I don't know if you guys see it any differently. I mean, 'cause to me, visibility, I... The first question I always ask is, are you talking about 100% visibility? Is that what you're really after here? And of course they might say yes until they realize, what are we talking about to do that? what it takes to do that.

Matt Yeah. Yeah, I mean, that, that really comes down to what we categorize, and it's an, it's an industry practice, nothing we came up with, but defense in depth. defense in depth is, is really the, the best way to explain that. and let's say you just care about, asset management. Okay, well, you're not getting any East-West traffic.

Matt You're not looking at actual, anomalies that happen on the network. You're not looking at, you know, threat detection pieces. You're not looking at what's happening on all the devices, communication to communication. so defense in depth comes in, in play of where you have your perimeter network security, you have your, your endpoint security and endpoint management, secure remote access solutions.

Matt You've got your endpoint hardening, device hardening and stuff. There's so many different layers that when we come and talk about these things, it's like, like light bulbs come on. Like, oh, we need to think about that. You know, we just thought that we could put this tool in and, and we're [00:27:00] secured. And it's really taken kind of the same practice of, of an IT methodology, of IT's got sec- defense in depth.

Matt You have remote access solutions in place, then you have to go through multiple firewalls to get different places. You gotta go through a jump host to get... You know what I mean? There's so many different pieces. On the OT side, it's, you get into one thing and you pretty much have access to all. so I think having...

Matt Yeah, very, very common. So I think, you know, having that defense in depth methodology going in mind,that's what's really helping drive these conversations is, it may not be important now, but having the r- having it in the right approach really, really matters. So having your full architecture, knowing what you have down to level zero, how do you protect that from there, and what layers do you add on from that to, you know, if an attacker does this, you know, this happens, this adversary does this, you're helping to try and mitigate, where there's nothing, no such thing as prevention.

Matt It's actually, right, mitigation. So you're mitigating attacks as much as you can when you hit those different points within the, the framework,

Dino No, again, i- so, and, and my thought process on this, Matt, to help expand that, right, is, is attaching it to the capital project, right? Because invariably [00:28:00] when you come up to this conversation specifically and the cost associated with trying to deploy further and deeper down the defense in depth strategies you're describing it- who's gonna pay for it?

Dino Who owns that, right? And the plant sit there going, "Well, you know, that's IT's responsibility." And IT doesn't really have a really good grasp of what's it gonna take to do that and what's it gonna cost, right? and so my, my position on it is, well then, why can't it be part of the capital project? If you're gonna do a life cycle replacement or some expansion, whatever it might be, a n- new integration effort, then i- if you have a plan and a strategy, you should be implementing it as part of that capital project, right?

Dino Again, if it's a $5 million project, y- you can't sit there and tell me you can't come up with 50 or 100 grand to, to add into this in order to get the things that you need in order to increase your, cybersecurity posturing, you know, to harden it, in my view anyway.

Matt Yeah. Yeah, no, that's, that comes back to the IT/OT [00:29:00] convergence, back to the people process, right?

Matt Of not even just who's gonna do what, but who, who's gonna pay for this, who, who's gonna be responsible, and that really comes into what we love to do as an organization, is fill that gap from a people process standpoint. from then, then on you're just building policy procedure on how to continue to grow with it.

Dino Yeah, 'cause it's not a technology challenge. it's a, it's a people and process. Yeah, it is. Yeah. well, I know we're kind of getting close to the end. I want to make sure that I give you the floor to talk about anything that you would like to talk about that we didn't cover So if there's something that you'd like to bring to the audience, now is a time for you to do that.

Matt Yeah. No, I, I think that,if I ... Yeah, if I can get a fi- final piece of advice, I mean, really goes back to, you know, y- you can't protect what you don't know that you have, right? And I think that's the number one thing is there's all of this, I wanna call it noise out there, that you gotta go do this, you gotta go do that.

Matt We have to go put this tool in, put this tool in, and it gets overwhelming, and that's what it stops a lot of, or what I [00:30:00] see that n- maybe stops or delays a lot of these, these,decisions on going to do something, is that there's so much out there to go do that they just kind of get overwhelmed and then they don't really know where to start at.

Matt So the starting piece for most folks is you don't know what you have to go implement before you know what you actually have. So I, I would, I would ensure you have a good asset visibility strategy, whether it's a, it's a tool, whether it's, it's someone like, like ourselves or girls, help to go and figure out what exactly is on your factory floor and the vulnerabilities associated with that, and then you have a strategic advisory to help you go and make those decisions to, whether it's, it's capital projects or whether it's doing, adding more people to go do things, or even doing full upgrades and things of, of that nature.

Matt I mean, it's, it's goes back to the, the, to the basics of you don't know what to secure until you know what you actually have. So that'd be my piece of advice is to cut out the noise. Don't go buy a bunch of tool sets yet. Don't go and, and, and spend a bunch of money on tools that may or may not work.

Matt Start with a strategy and understand what you have, and then put the places in, put the pieces in, in place and build that block out.

Dino All right. Matt Pike, everybody, from Rockwell Automation. Thanks, Matt.

Matt [00:31:00] Appreciate it. Thanks, Dino.

Intro - Outro Thanks for tuning in to the Industrial Cybersecurity Insider. To stay up to date with our latest episodes, be sure to click the follow or subscribe button now.

Intro - Outro And if you found this podcast helpful or have a topic you'd like us to discuss, please leave us a review or let us know. Thanks again for listening. See you next time