The CISO's Impossible Task: Protecting Plant Floors They've Never Seen

[00:00:00] You can't come in with your, your security mindset and say, disconnect. Stop, prevent, and then be disruptive, right? Because what a OT will do, and what we witness them doing is they'll listen to a point, and then when it comes to, to where it's becoming problematic for them to be able to produce goods, they're gonna go back to doing what they've always done.

Intro Welcome to the Industrial Cybersecurity Insider. In each episode, we dive into the world of industrial cybersecurity. Join us as we cover the latest trends, innovations, and practical insights as we talk with leaders and practitioners across the industry. Gear up and let's get into this week's episode.

Craig Hello, I'm Craig Duckworth.

Dino And I'm Dino Bussi.

Craig And today we're gonna be talking about the role of the ciso, how it's evolving, what it's becoming, and [00:01:00] where it should go as it relates to the operational technology environment. What are your thoughts, Dino?

Dino my thoughts is, is there a metric demonstrating just how far the CISOs have gotten involved in the industrial cybersecurity space, in your opinion?

Craig I don't think there is a metric, but in my opinion, I would say they've not gotten as involved as they should because when I interact with clients and organizations. There's still that divide between the IT and the ot, and the CSO doesn't always have the support and buy-in from the asset owners, which are those engineering teams, the plant team.

Craig On the concrete that own the assets, who are responsible for remediation, responsible for maintaining, responsible for procuring, installing, tuning, and startup of those OT [00:02:00] assets. So I don't know about a metric. I know it's not where it needs to be, in my opinion, if that helps. Well,

Dino to your point, I would agree, right?

Dino I mean, most of the work that we do to be successful in implementing cybersecurity solutions and strategies and technologies and services, we kind of move through it to ot, right? I mean, it will at least recognize that this is an issue. They recognize that they need to do something. I think they're handicapped, hamstrung a little bit because to your point, their relationship and ownership to those assets on the plant floor are kind of out of their grasp.

Dino Out of their reach, right? Because they're, they're not responsible for 'em. They don't own them. Right. And, you know, coming from the OT world. We don't have CISOs pounding down our door, wanting to get more involved from the OT ecosystem, who build the plants, who build the machine centers, who program the [00:03:00] control systems to run those manufacturing environments.

Dino They're not engaging that. that ecosystem to understand that environment better, if that makes sense. Right? and so the OT people that own the assets that are responsible for making the goods, there's a disconnect in this space. You know, there's network, There's a network connectivity, right?

Dino And it owns part of that network in the plant. But there's usually always that DAC and that DAC is right around when you get around those kinetic devices. Mm-hmm. You know, those connected physical system controlled by digital outcomes. And that's where it tends to drift off in the work that we do.

Dino Right. And so when you start thinking about OT, cybersecurity platforms per se, , and we've witnessed, organizations, it, two organizations and manufacturers who have bought these tools, these platforms. But yet the OT ecosystem isn't, receiving any information on what those OT IDS, for example, platforms are doing.

Dino they're not part [00:04:00] of the collaboration. And so from a CISO perspective, it's like, how do you change that? Right? If a CISO's, you know, mindset is you got a Windows seven machine out there, you need to take it off the network. That's their thought process. It's like, when their first thought process should be.

Dino We're making beer with that window seven machine. Taking that off the network doesn't help the business. Right? It doesn't help it. So then the question should be, how does that CISO and his or her staff interact with the owners of that Window Seven machine to better secure it? What are our options?

Dino What can we do? Yeah. Versus just saying, get it off my network. Well, one, it's not really on your network, number one. And number two, to replace that piece of equipment might cost millions of dollars. Mm-hmm. And number three, you can't patch it. You know, there's nothing that you can really do to it. So their first instinct is get it off.

Dino Well, that shuts down my

Craig plan. Well, the CISOs, I would say. Similar to everyone else. they don't know what they don't know. Their [00:05:00] primary focus predominantly has been on the enterprise, meaning the carpeted space. have traditionally not been part of the OT ecosystem as we say. And two, they're, you know, from a remediation standpoint, a.

Craig Microsegmentation a compensating controls in your Windows seven example. How do we put some controls around this device to alert alarm, to protect, to encrypt, to whatever defense and depth play you want to put to better secure the environment from that. Machine so that you can still manage your risk and serve the business needs.

Craig That's where you gotta find that fine line. You know, the CSO has a lot of. Responsibility when it comes to protecting the organization, they've gotta manage the it. And in cases when they're tasked [00:06:00] with the OT environment, they have to learn, they have to be educated. how is it different?

Craig How is it similar? What can they do and still be able to present that. Information to the business, whether that's the board, the CEO, the risk and governance, and how do we address risk? What is our risk tolerance? Where do we fall and what can we do to better support the business? But at the end of the day, the business has to run the business that CSO can come in and say, we're gonna do everything and a hundred percent zero.

Craig Trust everything. You can do that, the business shuts down. But you can do that. That is a, an option, not a good one. where's that balance?

Dino you have to be able to determine what the bumps in the road are. what are the top two priorities of any manufacturing facility?

Dino Safety. Safety and removing Unplanned, unscheduled downtime. You have to come at it from that mindset as a ciso, right? You can't come [00:07:00] in with your security mindset and say, disconnect. Stop, prevent. And then be disruptive, right? Because what a OT will do, and what we witness them doing is they'll listen to a point, where it's becoming problematic for them to be able to produce goods, they're gonna go back to doing what they've always done.

Dino somehow the narrative needs to shift back to that OT ecosystem that are the suppliers of these solutions and these technologies and to some extent are tier two, tier three responsible support. Partner with that manufacturer. Right. It's like you buy a car. Yeah. There's certain things that you can do, but when it really comes to troubleshooting issues you're having with your car, you know when the engine light comes out or the air code comes out, you take it to the shop, To, to solve the problem. Right? And it's the same thing on the plan floor. My filler is not running optimally, right? Or it's, dragging or it's stopping. It's become problematic. So I have to have somebody come in and take a look at it. And they come in from a whole wide myriad of ways to get in there, right?

Dino [00:08:00] What is it? The recent staff, most clients have at least a handful different types of remote technologies in their plans, you know, for these, third parties to gain access to it. So from a CISOs perspective, it's whackable, right? I mean, and the staff that you need, if you got 30, 40, 50, a hundred plants in your fleet, Having to deal with that and think of the, the resources that you need to, to do that, right? Yeah. And so the mines. Shift should be, I can't do this with internal resources. I can't do this with resources that are unfamiliar with what these control systems are and what they do. Mm. But now I have to become more engaged and involved with the suppliers of these machine centers that I operate inside my manufacturing facilities.

Craig I would argue that probably is the cso, ultimately the decision maker for what risk level the organization's willing to take, or does that fall to the board of directors or governance? The CISO should help implement the plan, but is he [00:09:00] authorized to say, take that machine off of our network and the implications stopping production or whatever comes with that, or is it someone else's risk tolerance? You know, I agree. He should say, okay, board of directors or governance committee, or whatever that term is, help me understand our organization's risk. Appetite and here's the situation.

Craig Help me guide. Maybe there are compensating controls that can be put on that, that are a different approach, not just a rip and replace.

Dino Well, What is the situation? Do they even really know?

Craig There is no, there is no, just straight up, they don't,

Dino not definitively you, not when you've got hundreds and or thousands of assets in your manufacturing environment that come from all over the world.

Dino Right? You know that were built by third parties. H how are you as a CISO gonna be able to, to cast a net around that? Right. and what is the [00:10:00] posture that most of them take? Mm-hmm. They wanna put in a firewall. They're looking a way to segment themselves between IT and ot. And call that a day.

Dino Right. Versus how do I ensure that that packaging line and that filler that's $80,000 an hour worth of revenue keeps doing what it's doing? Versus coming in heavy handed and going, well, we're gonna come in here and we're gonna put, Sentinel One or CrowdStrike on your hmis, which is not a good idea, right?

Dino Because those are disruptive technologies, right? That's round peg, square hole, and not recognizing that there's better ways of doing that, and you can integrate into those platforms and use tools that are down there to comprise you everything that you need. To do your risk assessment and to be able to get your asset inventory and to have your logs and your audits and the things that you need to have to determine how that environment's working and what's my baseline cybersecurity posture, and then what can I do to ratchet it up?

Dino that requires, you know, significant level of involvement between two groups that inherently don't work well together.

Craig I give you a, a really interesting [00:11:00] stat that I learned last week at a conference. So the average ciso, how much time do you think they get in presenting to the board?

Craig On an annual basis regarding cyber hygiene of the organization. You think board meetings, CISO es to stand in front of the board and present. What's the average amount of time across the annual 12 months that you think that that CISO gets to present a cyber posture? OTIT, whatever is in their control to the board.

Craig Take a guess.

Dino I, I'm gonna stab at it. My guess is it happens once a year. It probably happens for a two to four hour meeting window.

Craig Okay. Normal CISOs. Present to the board on a quarterly basis, you know, that's when they get to present quarterly basis. The average amount of time is 17 minutes a quarter that they [00:12:00] get in front of the board to present everything cyber from it to OT to enterprise wide.

Craig Some, and they average, they get between five and 20 minutes, but the average is 17 minutes. A quarter to make their position for funding, for guidance, for recommendations, for whatever they feel is necessary. There's no way that they can adequately understand the OT environment good enough unless they are.

Craig Part of that ecosystem and are immersed in it more so than they are to be able to communicate what is that real risk in 15 minutes if they forwent everything on the IT side.

Dino and then to be able to talk about an environment they know little to nothing about. Right, right. It's one thing to talk about the enterprise, which is probably what they outta that 17 minutes, that's probably 15 minutes of their time is talking about the enterprise.

Dino Probably 16 and a half, but close. [00:13:00] Yeah. They may not even get to talk about what the heck's going on the plant floor. Right. So, and the average tenure of a CISO too is still pretty short, right? Still 24 months. Less than three years, yeah.

Craig Less, yeah, a couple years. Alright.

Dino So, and so again, if you have a lot of plants in your environment, you know mm-hmm.

Dino A dozen to a hundred, that becomes exponentially more difficult. Oh, true. People to manage.

Craig it's easy to get lost in the weeds and not fully understand what you're being asked for when you're trying to navigate something completely foreign or unknown to your skill sets.

Dino mean, you could always use the sports analogy, right? Where, you know you're playing football, but the IT executive team is playing soccer. They know soccer really well. That's their game, right? Yep. It's football, but it's soccer versus us NFL football, a very different sport, right?

Dino Mm-hmm. And yet, and yet you're trying to coach that, right? You know, with really not a real good fundamental understanding of how the game is played. [00:14:00] Oh yeah, for sure. And including the players that you need, the training that they need, the resources required, the rules of the game, you know, and the plant floor is that way.

Dino Again, safety and unplanned, unscheduled downtime are the top priorities in any plant. It's not. You need to get that device off by network. Right. Or you need to redesign your network, you know, and that that could take you a year in one plant. Yeah. To be able to do that without being disruptive.

Craig Well, I think that there's a couple things that, in my opinion, that that really should begin shaping our industry and moving toward, and that's more of a collaborative approach.

Craig How can the IT teams and the OT teams work together? You know, can they become one organization that reports to. A particular leader that has responsibility over both that understands equally as much the importance on. Uptime safety as they do on risk [00:15:00] governance. And how do you marry those two and bring together a, a collaborative team, let's call it a working group for lack of a better term, that has two or three engineers on it.

Craig a couple different controls, engineers, plant manager, some process control, some IT people, some risk, and almost like a, a committee of of cross-functional.

Dino It has to be external resources on that. It can't be all internal, right? I agree. You can't do, you can't do this inside, even if you're a very large global company and think that you're doing the right thing, right?

Dino You need just like audits, right? If you're a publicly traded company, you're gonna have third party audits. It's just a requirement, right? That's it's if and ORs and butts about it,

Craig right?

Dino So the same thing needs to happen here. There needs to be external resources with the capabilities who probably understand your vertical pretty well.

Dino Right. Probably have a lot to do with the plants that they built your plants, they put a lot of the machinery into those plants. They program those [00:16:00] machines, they maintain those machines. That relationship is what needs to be fostered and that's what I don't see happening at a scale.

Dino It provides direction and strategy in regards to improving cybersecurity posture in your industrial control

Craig environment. Yeah. The, the at scale is, critical to what you just said. there are organizations that can help and guide that can't necessarily deliver and they say, here's what you should be doing, and then they leave it to the organization to figure out how that works.

Craig And I bet you if I've talked with one. A plant engineer. I've talked with a thousand of them, and every one of them is working. 60 hours a week getting paid for a standard 40 because their salary, they've got 15 jobs, they're barely getting 12 of 'em done, and they for sure do not want extra work to do to try and figure something else out.

Craig Wow. They are all passionate and they all are very driven to do. What's right [00:17:00] to help the organization, but there's only so many hours in a day and they just can't continue to, do and do and do and do. 'cause they're, are they

Dino focused on what they know? They do. We've seen that. I mean, we've seen Sure.

Dino CIOs that basically will turn a blind eye to the plant because they don't have the resources, they don't have the time for all the things that you just described. So they gotta focus on the things that they can focus on and, and the things that they know. Right. Right. And the landscape is changing, the threats are evolving.

Dino Right. You know, I mean, look what came out on the news today and how they're using pagers as weapons, right? Well, yeah. the landscape is continually evolving. You know, and it's no different. And so how do you stay abreast of that? and if you're not working with, outside groups, especially outside groups that have just a deep understanding, that are deeply rooted into the OT environment and how these machines are, are set up and how they operate and how they're connected and what they're supposed to be doing.

Dino How are you gonna marry that relationship? You know, and I'm not saying that it can't be [00:18:00] done, but what I witnessed is that it's not being done. I mean, how many, how many businesses have we been into that have bought a tool that it's got and the OT guys aren't receiving any benefit or any value from the data from an OT cybersecurity platform that the IT guys.

Dino And or their partners that they work with.

Craig And OT still trying to catch up to it. I get it. Its had a 25 year running head Start Conceptually, I fully get that. But they have to make changes and the landscaping is changing so quickly. prior to today when the pagers started blowing up, I would've never given one second of thought to, should I put my phone to my ear and make a call?

Craig to me, that's scary. the technology is there. I get to different environment, different situation, but as. Organizations are now trying to figure out what is right and what is wrong. Other organizations, there's no line [00:19:00] they won't cross. Whether that is geopolitical, whether that is sabotage and chaos, whether that is ransomware, what makes no difference?

Craig We that have, I would call morals and values are really. Different than organizations or people or whoever that has no distinguished, they're just, they just go, go, go. And they don't care what damage is done. Right.

Dino and for those that are relying on cybersecurity insurance to bail 'em out are in for rude awakening.

Craig that's a mistake. Yeah,

Dino it is. Right? Because there's a lot to think that, right. I got a $20 million policy. Well, that's to help you remediate and mitigate what happened to you. Right. it is not for the business disruption that you had no, for the millions of dollars you've probably lost by not making goods for a while.

Dino Right. That's money that's gone. Right. Your operational costs they're, they're just gone. but there are people out there that say, well, I got a big insurance policy, I'll be okay. It's like, no, you [00:20:00] won't. you have 30 plants, shut down for a few weeks, do the math. Right? And you, you probably know those numbers because you went through COVID.

Dino Yeah. You got a pretty good idea. there's that aspect of it also for those that are out there relying on cybersecurity insurance to, to get 'em out of the spot.

Craig Well, if, you just do some, some real quick dirty math. if I'm an organization and I do $12 billion annually, billion dollars a month, and I have a cyber event, and my facility is offline for one week, not a real long time, but for one week.

Craig That is $250 million, $250 million for a week. That's a big number. let's say that's 12

Dino plans. Right. And now you've lost 12 plans for that week. More like a month because the average downtime impacted once these things, you know, evolve and those breaches, those material breaches get into your plan, you're looking at a month or longer.

Craig Yeah, for sure.

Dino To get it to get back up and running.

Craig Yeah. It's not an [00:21:00] easy overnight process. It gets more expensive. the requirements from a vendor, and again, I heard this from the conference last last week, is how are organizations on both sides. The end user, pushing back and requiring secure by design and a new word that I heard, which is interesting to say the least, is secure by demand.

Craig Meaning that, we will not procure this unless you do X. Whether that is added into it, modify it, give us the code so we can validate it, whatever that is. But how

Dino often do you think that's happening? I mean, generally speaking, I would

Craig say not vary, but I look at our organization and some of the pushback that we're receiving then and that we are giving from a procurement vendor relationship.

Craig From a supply chain, you know, look at critical choke points regardless of where it is. [00:22:00] If you rely on one vendor to supply a particular thing in your environment, but that vendor, let's say you make beer and you buy your can from X, Y, Z. So does every other beer maker in the country, if that can maker has a problem and it affects all the beer production in the country, that's an issue.

Dino They'll be filling up a lot of kegs.

Craig They'll be doing a lot of something, that's for sure.

Dino and then don't forget, you also have the SEC who's imposing rules, especially on publicly traded companies, you know, where you have to disclose to your investors within, what, 48 hours or something like that?

Craig 72, I believe.

Craig Yeah. If you have

Dino a material breach, you know, so they can decide on whether they wanna stick around or not to leave their money with you. Right, right. And so again, attack to your brand and to, your investment. Supply chain is all at risk, right. Is, I mean, we make this sound like it's such, it's, unachievable.

Dino It's not though it, it's not though. [00:23:00] It's really, really not, not, it's about putting the right players in place Yes. And having these conversations and Yeah. And have real conversations to get past the, the myth and the hearsay and the naysayers. Right. and it needs to be humbled, I think to some extent because their practices don't always fit.

Dino In that controlled system environment?

Craig it's gotta be, cooperation. It's gotta be teamwork. It's gotta be both sides wanting to solve the problem. Right. But you gotta start somewhere. You, can't. Continue to ignore it. You can't let it go You gotta reach out to organizations that can help you, that can support you, that are working in that environment, that are there to be a partner to you and say, look, we know we have problems.

Craig Help us understand the extent of how bad they are. And help us work through, prioritize and figure out how we can start addressing them. Yeah, but you're right. You [00:24:00] can't, you gotta pull your head outta the sand. You gotta look up, you gotta stand tall, you gotta march forward and you gotta say, we're gonna eat this elephant one bite at a time.

Craig If it takes us five years, we are going to do

Dino this. Well, it, it's either that or they're focused on other problems. I guess they feel that are bigger.

Craig Whoa. You know, you can't be lucky every single day. I'm just gonna tell you.

Dino Yeah.

Craig Every day. You know the bad guys only gotta get lucky one time. You gotta be lucky every minute of every day to make sure that nothing happens.

Craig You can't. Statistics don't lie. Statistics are not on your side.

Dino Yeah. You gotta get to the No. Right. It can't be philosophical. You gotta get to the no.

Dino and to me the no is you need to know e exactly how that plant operates. Right. You know, physical connected systems, controlled by digital outcomes.

Dino How is that all put together and how does it work?

Craig Great conversation. We could talk for three weeks on this and it would still, you know, still be there. I think it was, [00:25:00] hopefully organizations can take from this, they can go back to their leadership team, their internal teams and say, okay, what questions do we need to start asking ourselves to get to the know, as you would say, and how do we start addressing the gaps that, that, come outta that.

Dino Yeah. And educate yourself. Go to events, you know, man, sex coming up in October. You Chicago and there's SS four X 25 that's in after the first of the year. There's Rock occupation fair. There's many, many events that, that you can go in and get educated in this space. And I, and I encourage it people to participate in agree real events that, you know, that there's technology conversations being had.

Dino Oh yeah. And then there's our podcast, you know, so you can look at it from, you know, a practitioner's view of folks that work in these manufacturing environments every single week.

Craig Yeah. Nope. Great conversation. Dino. Thank you very much. Hopefully the listeners get something out of this. Guys. Have a great day.

Intro Thanks for tuning in to the Industrial Cybersecurity Insider. To stay up to date with our latest [00:26:00] episodes, be sure to click the follow or subscribe button now, and if you found this podcast helpful or have a topic you'd like us to discuss. Please leave us a review or let us know. Thanks again for listening.

Intro See you next time.