The Blind Spot Between IT and OT Isn't Where or What You Think

Craig [00:00:00] IT should not be the adversary of OT. They should be the collaborators that empower OT to be successful. And properly built cyber training programs work in that fashion. Everybody's rowing in the same direction towards the same goal of quality, zero defects, uptime, and availability.

Intro - Outro Welcome to the Industrial Cybersecurity Insider. In each episode, we dive into the world of industrial cybersecurity. Join us as we cover the latest trends, innovations, and practical insights as we talk with leaders and practitioners across the industry. Gear up, and let's get into this week's episode.

Dino Hi, I'm Dino Busalacchi, and today I have Craig Taylor with me from CyberHOOD. Hi, Craig. Welcome to the show.

Craig Dino, it's great to be here. Thanks for [00:01:00] having me.

Dino So, as I, as I like to begin these, these, conversations is really kind of dig into your background, your bio a little bit. How did you get to this point in regards to what you've been doing for, with your career in this industry as we, we tailor it around cybersecurity?

Craig thanks for asking. So, to know me and to know what I've been doing for the last, say, 30 years, you go back to my education. I got a psychology degree where I learned how people change their behaviors, right? What rewards change behaviors, what punishments do or don't change behaviors. And, I decided very early in that career, my degree, that I wasn't getting a PhD, so I went out into the big, bad world and started working for a firewall vendor 30 years ago, 35 years ago, before there was a worldwide web, Dino.

Craig So this is a long, long time ago. Fast-forward a few years. In 2001, I got my CISSP, which is like, in cybersecurity, it's like the bar or the medical examination to become a, a [00:02:00] lawyer or a doctor, et cetera. I've had that for 25 years. My number is 23, 24,399, so under 25,000. Now there's 3 million of CISSPs in the world.

Craig So I'm in the very early beginnings of these things. And- 14 years ago, I founded a company called Cyberhoot to change the way we do cybersecurity training and cyber literacy education. Because I saw every person I spoke to in IT and in cybersecurity was thinking, "We need bigger sticks for clicks. People are making mistakes that are leading to ransomware.

Craig We gotta stop the clicks. There's something wrong here." We were seeing breaches, we were seeing just well-intentioned people across the industry heading in the wrong path, the wrong direction, Dino, of punishing bad behaviors. And I don't know if you're a parent, but I am. Punishing bad behaviors only goes so far.

Craig You have to reward good behaviors to replace the bad behaviors, and then the child develops into a wonderful [00:03:00] model. Or dog training. You can train with a, a l- a shock collar or treats, and I'll tell you what, the dog and the owners that I've talked to enjoy the treats much better than the shock collar approach.

Craig So we gotta stop treating our employees that way, and that's what I've tried to build here at Cyberhoot with my, our learning management system, to teach people common sense, real-life skills to avoid the mistakes that have led to breaches that we see in the news every day.

Dino Yeah. So, our background obviously is in, in the, from my perspective, is industrial and manufacturing.

Dino I'm guessing you have clients in, in, in the manufacturing space, right? can you talk about some of the dynamics that you've witnessed between IT, which we all know and love and who they are, and then there's the OT group, which is the operational technology folks, plant floor people, which is where I kind of live and breathe and spend most of my time.

Dino Can you tell me about some of the experiences that you've seen as you're driving through these, these [00:04:00] cybersecurity strategies, trying to change behavior, which is key, because I, I can go into what I see as behaviors that, it's not so much from a cybersecurity perspective, even though we use cybersecurity tools to track it, but for things that are disruptive in the environment.

Dino things that shut the plant down, for example, right? That cost real money, or, damage product. just the money aspect of it. So what kind of conversations have you seen and what, what have you witnessed in that particular arena?

Craig Well, because of this negative relationship where IT has been sending out these gotcha emails for 20 years, OT folks are like, "I know it's a necessary evil, but you are always causing us delays.

Craig You're slowing us down. You're making us do these videos that we don't want, we don't have time to do, and we don't see the value. Can't you just block all this bad stuff so it's not our problem to deal with? I don't see... I can't translate as a, a leader on the shop floor in the manufacturing space [00:05:00] how this is our responsibility to fix."

Craig The human error or the mistake or the human in the loop is the weakest link here, but I don't see it. So try to convince me. Show me how this benefits us, because we have this many widgets to produce this week and we're behind by 10%, and if we don't get caught up, people don't get paid. So how do we justify this?

Dino Which is how the plant gets comped, right? Safety, production, right? those are the two driving things predominantly for them. Being safe and making my numbers.

Craig Right. So therein lies the answer, right? If you wanna make your numbers, you have to be up and running and available. And if you have a human who is going into their email on the shop floor to check their work schedule the next day, and they get an email from the CEO and it says, "Hey, here's our new day off policy, our new dress code policy.

Craig Click here to read it," but it's a phishing email, and it didn't come from the CEO, you [00:06:00] risk shutting down your plant with a ransomware event. And so it's not complicated stuff. This is something anybody can learn. It's a little bit of knowledge with a whole lot of common sense, and we've been going about it the wrong way in the sense that, like use that dog analogy again.

Craig If you shock a dog so many times to try and train it on some behavior, it gives up, it goes in a corner. And this is the best scenario, right? It could become violent, but it could go in the corner and say, "Leave me alone. I don't wanna do anything." You're... We've been treating our employees that way, and they no longer wanna participate.

Craig They want the magic bullet for IT to say, "Block all the bad stuff, just let me get my job done," and that's not how the world works. For years, we've known humans are the weakest link in any cybersecurity program. So the converse is also true. If you said to the plant l- leaders, the OT leaders, "Hey, your metrics are availability, production- Part of availability is avoiding downtime [00:07:00] from a security event.

Craig So this is in your own best interest to educate your staff with these minor, little tiny exercises that teach them the good behaviors that need to replace the clicks. The good behaviors are, when you get an email and it says it's from the president, you hover over the sender. Is it from the president of your company or not?

Craig Is it from the shop floor leader or not? And the way you det- you decide that is you look at the email domain, and you practice that over and over again. And you look for an email that has urgency, emotionality, secrecy, or authority telling you to do something, and that's a h- red flag to say, "Whoa, wait a minute."

Craig Nothing is going to be the end of the world if you don't action it immediately without thinking. So any of those emails are designed to get you to react and click without thinking. Follow PAR. We love acronyms. PAR: pause, assess, report. Pause, assess, report. Train your staff [00:08:00] to do that and to t- to teach them how phishing works in a positive reinforcement approach, in a gamification approach, and the...

Craig You can harp on the posi- the personal benefits. You can harp on the uptime and the consistency of our operations not being impacted by the... Look, you and I both know this, but for your listeners, AI is creating so many more attacks with so many more, so much more damage when they're clicked, that you cannot afford to ignore this human problem, or you will be bit.

Craig And we see it every day in the news. I'm sure you've got all kinds of examples of this. So the solution is pretty simple, but you have to go about it in the right way with rewards and treats, not punishment and shame and shocks

Dino Yeah. Well, in our industry, because of the separation between IT and OT, it, they're not well-aligned, transparent, or collaborative.

Dino Generally speaking, they're not, right? In a lot of these meetings that we attend when you can get both [00:09:00] sides in the same room, you feel a little bit like a marriage counselor, working between both of them. And,and getting the plant to buy into it, where I think the, the... I call it the three-legged stool, right?

Dino You got IT, you got OT, but then there's this, this group of organizations that are the system integrators, the machine builders, the designers that they, the manufacturers buy this equipment from, buy this technology from. and IT doesn't typically, generally speaking, I'd say 99% of the time, don't have a role in any of that.

Dino Got a capital project, we're gonna put a new packaging line in for this new, this new product that we're bringing in- into the marketplace, and from the three years it takes from the time they decide to do that to the time that you're actually making, something out of that packaging line, IT's role is, is minimal or nil.

Dino And that's from selecting the, the technology, the operating systems, the network design, the strategy, the compute platform, the database, [00:10:00] the SCADA software, the, the, the whole wide range of technology that normally people would say, "Well, that's... Isn't that IT?" Right? Is OT a shadow IT group?

Dino And it's not, because at the end of the day, the asset does not belong to IT. Now, I'm not saying it's right, how you put them in a position of, of being a trusted partner Right? And I've been watching this for, for years, decades. I, I'm in the camp that the OT ecosystem has to get better at this.

Dino where they're teaching their engineers about phishing, teaching their engineers on how to build a safer, secure-by-design, control system to run the filler of that robot, that reactor, those mixing and blending vessels, that auger, whatever it might be, right? And, and this has been, this has been the rub.

Dino This has really been difficult, because the OT folks, again, are focused... You said two of the three correct things on a plant is performance, it's availability, and then quality, right? Yeah, is the third piece, right? [00:11:00] 'Cause that's how they determine how well they actually run and do. they- they're metriced on that.

Dino Outside of being safe, right? Safety's always job one, but job number one and a half is reducing unplanned, unscheduled downtime, and some of these,programs that IT sometimes is trying to jam down on them just gets in the way, to your point. it's overrunning my budget, it's delaying my startup,

Dino I was supposed to be-

Craig Well, it also leaves a bad taste in everybody's mouth, right? If you have IT sending out these gotcha phishing emails to say, "We have to do this because otherwise we get ransomed, and then everybody's down, and we got nothing to produce." So we justify it, the means justify the ends, right?

Craig And that's not true. IT should not be the adversary of OT. They should be the collaborators that empower OT to be successful. And properly built cyber training programs work in that fashion. Everybody's rowing in the same direction towards the same goal of quality, zero defects, [00:12:00] uptime, and availability.

Craig All of that matters. And IT's role has unfortunately been on the wrong track. They're on this train towards, like the Titanic heading towards the icebergs. They're saying, "We gotta send bigger, better phishing attacks to, to convince people, because that's what hackers do." But at the end of the day, if you can do it in a way that is empowering and lifting and not deception-based, right, where you're tricking people, but rather you're empowering them.

Craig And you have to remember, it has to be short. It cannot be disruptive, 45 minutes, right? I've seen, you may, you might have seen this, Dino, where they pull everybody into a room once a year for two hours to do their, not- Maybe they do their safety training in the morning and their cyber training in the afternoon.

Craig That's like going to the gym at the beginning of January and saying, "I'm gonna work out for four hours and get in shape." You're gonna get hurt. It's not gonna stick. You're gonna give up and quit. You have to do it in little tiny bite size 30-second, one-minute intervals once a month as part of your [00:13:00] day-to-day stuff, and it has to be viewed as empowering and uplifting Shift the culture

Dino Yeah, and, and, and, and shifting that culture, to your point, is one of the things that we recognized, and I, I don't quite understand it, is why the IT leadership, whether it be the CISO, the CIO, the InfoSec leadership, networking teams, they're not- They're not working with the system integrators.

Dino I mean, we work for s- we're one of the large- we are the largest food and beverage, system integrator in North America. R- regardless, we are, without a doubt. from Fortune 10s all the way down to, to smaller groups. We don't get phone calls from IT leadership who has a cybersecurity responsibility on how we might be able to help them.

Dino They're, they're ... I don- I don't understand why they're not trying to ... If, if we try to reach out to them, they think they got it, right? and I would say, "If you got it, then what is your plan? Because we're getting ready to do $10 million worth of [00:14:00] work at three of your plants over the next year and a half.

Dino What should we be doing to help you with your cybersecurity strategy?"

Craig How do you put into those ... You said it earlier, you said, "We measure and bonus leadership and employees based on these metrics," right? One of those metrics has to be, cyber preparedness of the human being. If it's elevated to a something that everybody has to do, because we all operate on the internet today, we all have email, we all have, the, the one door into any manufacturing floor is the calendaring system, and the scheduling system, and the email communication system.

Craig And if we don't recognize that a human can be, needs to be educated in that space, and have it as a reward mechanism, right? We need to talk about rewards here, because if we create a reward for these compliance and participation, and we make it [00:15:00] gamified, and we make it so that people are not shamed and punished for failures, but rather rewarded for completing things and for reporting things, then that culture shift that we all want of like, "Hey, I see a problem over here, but if I say something, everyone's gonna get upset.

Craig The floor's gonna shut down. We're gonna ha- not gonna make our numbers." But maybe that avoided a critical problem in the future that would have been led to days of shutdown. That's the culture we want. If you see something, say something. If you can improve something, you do so.

Dino Yeah. Well, and I, and I think that OT ecosystem, their supply chain, their vendors, again, the, the s- the m- the system designers, the integrators, need to be a part of that discussion.

Dino if I go into 10 plants, if these, one of our controls engineers goes into ... We go into 10 plants, we take our laptops, Craig, and go plug it right into their environment, right onto their plant floor. No review, no making sure it's safe, making sure there's no malware on it, Nobody's tracking what are you connecting to, what are you communicating with.[00:16:00]

Dino Nobody sees th- nobody's watching this. And I'm speaking at it from a practitioner standpoint because this is what we do all day every day, right? Now, whatever's being communicated to the top, saying that our policy is not to do that, well, I can tell you that the plant manager who's getting comped on making X amount of widgets, he wants to get that equipment back up and running just as quickly as he can.

Dino And I quote, "Security just gets in the way of getting things done." In fact, really, they'll, they'll say that, right? I've had a... And I had a CIO tell me flat out, he goes, "I don't want to be the SCADA cop." Right? Well, then whose job is that, right? it just sits out there and just drifts around, and there's no ownership on it, So how, how do we, how do we ground it is really is the challenge, between these two... three groups in my view, IT, OT, and their partner community that helps them design and manage and support their plant. Because a lot of our clients don't even have controls engineers. We are their controls [00:17:00] engineers, right?

Dino They don't build equipment. We build equipment. We design that equipment. We do the integration for them. We put the network out there for this stuff, right? It's not them. they might put somebody out there to administer to a point. Oh, we got an IT guy at the plant. Well, he's got a V mark, and he don't cross it, and it's when things go from data To connected physical systems that are kinetic.

Dino And that's when, that's usually the dividing line between those two groups. And there's a lot of technology on that connected physical side.

Craig I think you go back to the empowerment argument, where IT is supposed to empower you to get the job done, and building systems and processes that don't delay getting the job done, but rather create smoother, simpler, easier paths to getting consultants, getting integrators onto the machine and the equipment they need to fix it without taking a laptop that we don't know the sanctity of and plugging it right into the, the network port on the floor, right?

Craig [00:18:00] You could have a jump box, and you could have your laptop sitting beside that jump box if IT did, did a good job, and say, "Okay, you can go from this jump box to the equipment on the floor, and you can get anything off your laptop if you want right here in our, in our situation room," right? And you have everything you need.

Craig There are ways to do this better and secure and to set up ahead of time, but IT has to be the enabler. They have to be not the adversary. And part of the problem with it being an adversary is that they've been sending a lot of ... They've been setting up roadblocks to getting the job done. IT has to be the remover of roadblocks and the builder of bridges with OT to be successful.

Dino They do. They do. And then, and it, and the OT guys n- need, need to work with them. But here's what I would say. It's, one, it's a resource problem. if you got 50 plants in your fleet, and you got an IT staff that's got, is primarily focused on the enterprise for the most part, generally [00:19:00] speaking, and then you assign a couple of people that are your OT cybersecurity, folks, you don't have enough of them Right?

Dino I mean, the, at 50 plants, you're talking about probably 60 or 70 or more system integrators working in those plants, right? Because you have on average three to five different integrators working in a single manufacturing facility. some specialize in packaging, some spec- specialize in utilities or mixing and blending or, chemicals.

Dino some of them have very unique niche verticals. and so a manufacturing plant could have, several machine builders and integrators working in their facilities, and it's, it'd be... it's whack-a-mole for the IT guys to even try to keep up with this. Which is why I would say that they should think about IT should find out from their OT counterparts, who are your top integrators and machine builders you work with?

Dino Who are they? I want to meet them. I want to [00:20:00] talk to them. I want to find out what their capabilities are. What kind of practice do they have? What kind of partners do they have? What kind of rut can... Do they have a cybersecurity practice? and, and start digging into that, versus going down the path, I'm just gonna go find my typical IT var I buy from, who sells me firewalls, who sells me CrowdStrike, who sells me some cybersecurity services on the enterprise side, and going to them Without really having the fundamental understanding of, well, how does the plant operate and run?

Dino What are its maintenance windows? What are its production schedules? What does it make? What kind of equipment does it have? It's got Siemens, it's got Emerson, it's got Rockwell, it's got GE in it. it's got all these various automation technologies in there. It's not standardized. It's very decentralized, and it's old.

Dino The life cycle is different. our life cycle's measured in decades, not, three, five, seven years. it's 10, 15, 20, 25 years. I have clients that got stuff that's been out there since the '80s.

Craig Oh, heck yeah. Yeah, and gosh, in the, in the days of AI, if, if AI breaks into just one machine [00:21:00] and looks at that network, it's gonna find the ability to break into just about any of that aging equipment, right?

Craig We've seen this in the recent Mythos,frontier models, that it can break into just- it can bro- it broke into the NSA with the most secure networks. But the reality is, you- we've got finite resources that are overwhelmed with things to do. we have to build in the incentives to make cyber security, enabling, but also minimized in terms of impact.

Craig And so how do we do that? It, I think there was the Mutual of Omaha leader said, "Show me the incentives, and I'll show you the behaviors your salespeople will have." What are the incentives? So if we don't make-

Dino Charlie Munger.

Craig Charlie Munger, right. Munger said that. So senior leadership needs to understand the shortest path to making cyber security an enabler, and to reducing its impact and its delays on other things, and [00:22:00] also avoiding the catastrophic failure system scenarios, is to find reward mechanisms and incentivize compliance, incentivize engagement, but minimizing the disruption of that engagement.

Craig And when you make it a priority at the senior leadership level, and you do it with a positive outcome approach where you're looking for the rewards of good behaviors, not the punishments of bad behaviors, you begin to build a culture, and the bridges between OT, IT, and integrators that are so incredibly needed.

Craig You shift that focus from fear and punishment and shame and, and delays and roadblocks to bridges and enablement, and hey, if we, if we just take this w- we're gonna get to this destination. We have three or four ways to get there, but if we go down this secure way, we won't have to backtrack and redo things.

Craig We'll have the training in place so that we know how to do it safely, securely. [00:23:00] The users are gonna be compliant. All of that really has a, a, a hidden benefit where you have fewer outages, fewer claims, fewer insurance issues, fewer catastrophes. Look at Tata Motors and,Range Rover. Are you... I'm sure you're familiar with their major incident.

Craig They were reconstructing things. Yeah. Actually,

Dino actually GP, right?

Craig Yeah. that's the worst case scenario we're trying to avoid, and the leaderships of any companies that you're integrating with are fiduciary duties to protect against that So how do we make that a priority?

Dino Yeah, well, you're, you're 100% correct about AI, right?

Dino Because the vulnerabilities inside these manufacturing environments because they don't patch, not on a, on a regular consistent basis, if at all. Or they've got equipment that's already end of life, end of support, that you can't get any updates to it, right? And then, what are you doing to, to micro-segment, virtual patch, other, other avenues, to, to harden that cybersecurity [00:24:00] posture within your manufacturing environment.

Dino And we just do not see the strategies coming into the, into this realm. To the, to your point, an AI event, there's the, the FBI and, and the NSA just published one that just came out, regarding Siemens PLCs, right? A known exploit that's in the wild right now. It's hot, and I know I've got clients that have got Siemens environments that they haven't patched in years that have that vulnerability.

Dino Unquestionably, I know they do, right? And they haven't done anything to mitigate it per se, except, hope is not a strategy. And, and that's what they're working on, right? It's not. Air gapped. No, you're not air gapped. Nobody's air gapped. Those days are gone, And anybody that says that is, is lying to themselves, right?

Dino Because that's not what we find when we go out there. They say that to keep the wolves o- off their butts, in my view, when I hear those comments about, "Well, that piece of equipment is isolated, it's air gapped." And then it's

[00:25:00] like, well, how do you support it? Well, they'll... And then all of a sudden the jump box question comes into play, or there's a VPN concentrator in there or a cellular cradle point modem.

Dino Or Johnny shows up with his laptop when we call him, the local integrator that helps you maintain that machine, and he walks out there and plugs in, and he's got... And then of course he's got a hotspot on his phone and it's connected in, and nobody's watching. Nobody's looking over their shoulder to see what they're doing, There's no tools in place to do it. There's nobody watching the activity in this space, and we st- we do it. I mean, I'm not, I'm not just spouting this off and saying these are hypotheticals. I'm telling you that I've got 2,000 engineers that work in this organization that go out and work and do that kind of work today.

Craig Well, the, the, I guess you come back to the human in the loop, right? The human at, in the chair to try to pull this all together. Your 2,000 staff members, if they're well-trained on cyber literacy skills- They're less likely to

[00:26:00] have introduced some malware or remote access tool onto their laptop that they're then gonna go into the field and lead to a major breach, right?

Craig And you as the owner or the, the leader of a integration company, it's your fiduciary duty, it's your own best interest to have highly educated, positively reinforced individuals who are not afraid to say something if a mistake is made. we had an incident not too long ago where a woman got a, this is in a manufacturing, but it could've been.

Craig A woman, co- contacted a CPA firm, "I didn't file my tra- taxes. Can you help me?" They said, "Sure. Let's meet." They send out a Zoom link. The woman gets on the, tries to get on the Zoom link at the appointed hour, and emails 10 minutes after the meeting is supposed to start, "I can't get in, but I have Teams.

Craig would you join my Teams meeting?" That was all a ruse to get someone to click that Teams meeting link, because it installed a remote, RMM tool that then downloaded Screen Connect that gave the hacker direct [00:27:00] access to the inside of that CPA firm. But because they had a culture of if something's not right, don't be afraid to say anything, we're not gonna punish you, we're gonna reward you for reporting things quickly, she realized her mistake.

Craig She had clicked a link that she hadn't known the sanctity of, introduced a hacker into the environment. Within 30 minutes, the IT team came in, quarantined her laptop, prevented a ransomware breach, which is ultimately what would've happened, right? But they were targeted. Now, imagine on your shop floor, you have a integrator who gets targeted on a, a meeting with a Siemens vendor.

Craig Siemens vendor says, "I need a meeting. You gotta join my Zoom link. No, here's your Teams link." And then, boom, they're on your shop floor because of that one errant click. If your staff have been educated to inspect every link, and to understand you cannot react to things, you have to follow PAR, they're gonna be more resilient to identifying and preventing the thing from happening.

Craig But then if a [00:28:00] mistake is made, they'll report it more quickly in a positive reinforcement, culture where everyone's working together. Where OT, IT, integrators are all cohabiting together in a very u- unique and pos- positive way.

Dino Yeah. I'm waiting for those days to show up. I am. it, and even, even sometimes you can get inklings of it, right?

Dino But when it's a very large manufacturer, even a medium-sized manufacturer, it's just not broad enough, y- I would venture to, I will tell you this straight up, s- 50 to 60% of the manufacturers out there today haven't even really started looking at a cybersecurity strategy for their manufacturing environment Have not, right?

Dino And you got, and you got 30%, 40% that have started doing something. Maybe started looking at a tool, maybe started putting some governance and policy around, maybe put some programs in place. And you got 10% that are actually running a pretty good game plan. But it, it's a [00:29:00] marathon, it's not a sprint, And you've got... I got a client that's got 140 plants around the world. It's gonna take them several years to roll out the cybersecurity strategy that they're looking at, Just because-

Craig you're right, Dino. I'm not sure how much time we have left, but I, I wanna ask this question then of the, the senior-most leaders listening to this.

Craig You're hearing Dino talk about a systemic problem in the manufacturing OT space, where cybersecurity is either a check mark exercise or nonexistent. And we know that Tata Motors and Range Rover were down for months, couldn't produce a damn thing because they had a major ransomware breach. So there's clear and present danger here.

Craig So then what is the answer? Where do you go to begin to kickstart this gap that we all can agree exists? Go to your incentives, go to a partnership model where the incentives reward collaboration that is works for everyone. IT

[00:30:00] can't be the no, no, no people. They have to be the yes, but let's do it this way that's more successful or more secure, but it also achieves the same goal OT wa- OT wants.

Craig And find those incentives. Put it into the safety realm. Put it in... If we treated cybersecurity like safety, we'd be miles ahead, right? Because having a plant down or someone losing a finger, those are very significant, serious consequences. We have to acknowledge that, and we have to pull it all together, and the incentives for positive growth do exist and can be put in place to modify the behaviors of your staff and the teams working together.

Dino Yeah. I heard something interesting, just earlier this week. I was talking to a colleague of mine who works for Cisco Systems. In, in German, the language, the German language, safety and security is the same word.

Craig Really? I hadn't heard that. That's really interesting.

Dino And don't ask me to, to say what it is.

Dino He did. Actually, I, I got a young German kid [00:31:00] working for me who speaks both... He actually is leaving for Germany this weekend to go see his family. But yeah, safety and security, it's the same word. 'Cause I, I sometimes say we put the wrong vernacular on cy- cybersecurity, from a safety perspective, and especially in our world, right?

Dino It, it... We should've called it digital safety maybe,

Craig I agree. And the time to do it is now, not at the end of a barrel of a gun when you've had an incident, and the ransom wants to be paid, and you don't have any options. You're out of options at that point. You need to do that proactively now when you're not staring down the barrel of a gun.

Dino Yeah. Well, I g- this is where I give the Europeans a, a little bit of a shout-out because their Cyber Resiliency Act, the CRA, is actually driving this message to demonstratingly proving that you have a secure-by-design approach and delivery of the equipment that you're selling, at least in the European markets, right?

Dino 'Cause we as an OEM who make machines o- overseas and in here and ship overseas, the [00:32:00] CRA requirements are starting to hit on this side of the, the pond, It's just here, unless it's critical infrastructure, your power, water, transportation, banking, communications, whether the, the government has view into that, at least, do you h- at least have an asset inventory.

Dino At a minimum, do you have that? from there I can give vulnerabilities and risks based on the asset inventory you have, and I will tell you that very few, do that in a continuous fashion. They might do a snapshot, this year.

Craig But then it degrades over time, yeah.

Dino Right. It degrades, and it changes, and you only got 60 or 70% of the assets in the inventory, right?

Dino 'Cause nobody's really going out there, and digging through these plants out- outside of an, an organization like ours to really determine what's out there on your plant floor, especially if you've grown through mergers and acquisitions. your plant floor is just littered with just a whole bevy of old stuff, risky, vulnerable stuff, end-of-life, end-of-support stuff, flat networks.

Dino There's, there's no, [00:33:00] stopgaps, i- within that environment at all, It's just, it's the Wild Wild West, and it, it's amazing that the banks loan money to these folks to be able to do that. Insurance companies still trying to provide them some level of cybersecurity insurance, that they provide.

Dino But we've also seen companies that, have had to do an, an, a minimum of an asset inventory because they're either gonna lose their cybersecurity insurance, or their premiums just went, through the roof, And, and then the CFO sees that number, and it's like, "Well, it was $5 million.

Dino Now it's $22 million," So It was fun. th- thanks for the time. are you, are you attending any events coming up here in the future, any cybersecurity events? There's one in Nashville in October, the ICS Cybersecurity Conference.

Craig I am not. I, we, we are solely focused on the, the human model and getting, better awareness out there that is rewarding and viewed as a personal benefit for the individuals as well as a professional benefit.

Craig Because, anything you learn about cyber literacy applies to your personal life as well, and can be viewed as a benefit, right? If you have to pay

[00:34:00] bills online or refund money on Facebook Marketplace sales, and somebody paid you $300 for a $100 item, please, for the love of God, don't send $200 back to them, because that was a fraudulent credit card.

Craig You're never gonna get the 300. You're gonna be out your $200. So everything we teach, it benefits the individual as well as the professional, and it brings that IT person to the OT person to say, "Hey, we're all in this together. We're gonna make this work together, and the better we col- collaborate and see things and say things, the better off we'll all be."

Dino Yeah. All right. That's good. Thanks, Craig.

Craig My pleasure, Dino. Thanks for making time today.

Intro - Outro Thanks for tuning in to the Industrial Cybersecurity Insider. To stay up to date with our latest episodes, be sure to click the follow or subscribe button now. And if you found this podcast helpful or have a topic you'd like us to discuss, please leave us a review or let us know.

Intro - Outro Thanks again for listening. See you next [00:35:00] time