The Hidden Cost of Siloed OT Security Tools

[00:00:00] Dino: Look for their OT business units within their organization, right? To see what they're doing, see what they're up to, see what kind of technologies capabilities, who are their partners in this particular space.

[00:00:09] Dino: 'cause the partners are different. one of the things that we've recognized is that there's a lot of very large. Technology companies out there, successful ones that have entered into the OT space, but they still lack the resources and understanding to work on the plant floor.

[00:00:23] Intro/outro: Welcome to the Industrial Cybersecurity Insider. In each episode, we dive into the world of industrial cybersecurity. Join us as we cover the latest trends, innovations, and practical insights as we talk with leaders and practitioners across. The industry Gear up and let's get into this week's episode.

[00:00:53] Craig: Hi, I'm Craig Duckworth.

[00:00:55] Dino: Hey, it's Dino Bussi. Good to see you guys.

[00:00:58] Craig: Hey, so I think today, Dino, we should talk about maybe a recap of S four. The very large leading global cybersecurity conference that we just got back from. What do you think?

[00:01:13] Dino: Well, one of the coolest things for me was getting to see the US hockey team within 24 hours after they won the gold medal on the street Miami.

[00:01:21] Dino: So it was quite the event. They, the storms in New York diverted them from landing in New York to flying into Miami, and they decided to do their tour on South Beach, which is where we were at the S four conference.

[00:01:33] Craig: That was, I give you that. That was awesome. The big double decker bus coming by being escorted by the police.

[00:01:40] Craig: That was cool.

[00:01:41] Dino: Got some great pictures of it. So that being said, how do you think the kick key keynote kickoff session went? I

[00:01:52] Craig: would say it made me feel very connected, literally. So it was. The theme was connected. and I fully agree with Dale. Dale's approach. for those of you that don't know, Dale Peterson kind of runs and sponsors and has created this S four cybersecurity OT conference 19 years now.

[00:02:17] Craig: Yep. So it's been around a very long time. and this year's theme was connected and we talked about various aspects of how the. Plant floor is beginning to be more connected to the IT infrastructure, to the network that is feeding data for business decisions. How we. Yep. How we as practitioners and participants and those looking to figure this out, need to make sure that we don't forget the human interaction and connect with peers and partners and others that are in this field to help you, that no one is alone.

[00:03:00] Craig: So it was a lot of different levels of that connectivity, but I liked the way that he went.

[00:03:07] Dino: What I saw is it's the inflection point of what ai, which is really driving this connectivity, right. and the world generally speaking, but even on the plant floor. Right. and we've always known that there's been connectivity, right?

[00:03:21] Dino: We have our isolated networks as people like to still call 'em. But at the end of the day, and that's always been a blind spot to our IT colleagues in regards to them trying to do their due diligence around cybersecurity when it comes to, their assets, the asset owners, right. And those assets have always been hard for them to gain access to because it's not.

[00:03:42] Dino: Traditionally and typically the responsibility of dealing with them on a day-to-day basis. and my position on that is primarily because of safety. Right? And operations, then cybersecurity. Right? You have cybersecurity, which these tools, platforms, this conference we're at is really all designed around, but.

[00:04:00] Dino: It's really about those key critical things when it comes to manufacturing, right? Safety's always job one, reducing unplanned, unscheduled downtime, right? Is really what they're after. And and when you start connecting things, those lines get blurry and it gets complicated. And when you're having issues, it gets harder to resolve them.

[00:04:17] Dino: So, the vibe was different this year, I think, in regards to this, OT environment and how cybersecurity fits into the overall picture at an enterprise.

[00:04:29] Craig: Yeah, and it definitely fits in. I look at part of that AI adoption, part of that inflection, as you mentioned, of how to make it more efficient for organizations to interpret that data.

[00:04:43] Craig: How do you query with a, with an AI system and give you data from within that OT network to make smarter decisions, to make better risk decisions? Off of the true data without something that would normally take three or four weeks, now, maybe takes an hour or a day.

[00:05:05] Dino: And not only that, we're starting to see AI being built into the technologies that these vendors are bringing to market, right?

[00:05:15] Dino: With for that, we're seeing that with Cisco and we're gonna see these with others where you're gonna start,they're building AI technology. Into their tools to help assist in learning more about your environment on things that have either changed or, how to approach a particular problem that you're after.

[00:05:33] Dino: So, there, there's that component that I found kind of interesting, even to the extent with whether it's Docker containers, for example, where they're starting to put. applications in that space to help in with this visibility into those environments. Not only just the visibility, but also be able to collect that data and make decisions, again, prompting being built right into the, this Fortinet suite of products or the Cisco suite of products.

[00:05:58] Craig: Well, again, those doctor containers are. Put in that hardware. It's already there. It's already a compute that's there. You don't have to have something extra. You can leverage that little bit of compute space that's already there to give you that sensor type. Piece

[00:06:16] Dino: Well and just be conscientious as a buyer to look, to make sure that those components are in place and in a minimum shell is there that all you gotta do is modularly, slide something in to get that compute platform down at the edge, right?

[00:06:27] Dino: Or make the effort to determine that I want that tech, that capability built into my edge products.

[00:06:35] Craig: Right? Yep. So if we were at all the different partners, we saw all the different. Asset owners, we saw all the different vendors that we saw. What would you say if, for someone that's not been there. what would you say that they missed besides just the general, the conference as a whole, but are there certain technologies that are new that are, just, let's call it bleeding edge or cutting edge that, or things that changed?

[00:07:04] Craig: What's your thought?

[00:07:05] Dino: and the irony to that question is that we did meet some people who had gone there for the first time, and for them it was like drinking out of a fire hose, right? These, and these are, seasoned, technology professionals been at their jobs for, several years, decade, even at school level coming into the market.

[00:07:22] Dino: this is a different, it was a different beast for them, right? Because they're so accustomed to working within, mainly probably their IT circles, partners. He. Even large technology companies have pockets within the organization that focus on the OT environment. It doesn't mean that the entire organization has the same,understanding of it as a lot of their internal OT groups that they have within that same company.

[00:07:47] Dino: and so if you're a manufacturer,you should be really looking. So if you're a Cisco shop, a Rockwell, not a Rockwell shop, but a,t at Fortinet, any of these big it. Look for their OT business units within their organization, right? To see what they're doing, see what they're up to, see what kind of technologies capabilities, who are their partners in this particular space.

[00:08:07] Dino: 'cause the partners are different. one of the things that we've recognized is that there's a very lot, there's a lot of very large. Technology companies out there, successful ones that are, that have entered into the OT space, but they still lack the resources and understanding to work on the plant floor.

[00:08:23] Dino: and so you really, and they're starting to build those relationships with organizations that have that capability who do that all day every day. That build the plants to build these machine centers who maintain those control systems and the underlying control, networks and infrastructure applications that they reside on.

[00:08:39] Dino: And so you gotta be able to tap into those areas, right? And so, and I think that would be one of the key things that if you haven't been there, is trying to understand the organizations that are there and what are their role. What are their roles in this space? Right, And they're probably closer to you than you realize, because the big IT company you're working with probably has a group that's focused on this.

[00:09:00] Craig: They do, but I would. I would advise a very, a very small word caution. A lot of the very large IT VARs have business units that focus on the OT side. That doesn't mean they can deliver that last mile, as you call it in the OT space. They're focused on providing technologies that are applicable to the OT environment.

[00:09:27] Craig: Maybe not the delivery piece. So just know that. Do some homework as well, but yes, you are a hundred percent correct. They all have them.

[00:09:35] Dino: And it's broader than just technology, right? It's a geopolitical aspect of it. It's a regulatory aspect of it. It's like the Cyber Resiliency Act over in Europe, right?

[00:09:43] Dino: And what it's really changed in, in the European front and their advancement in the cybersecurity, hardening postures over there, the requirements regulatory perspective, compared to other countries, maybe not so much,

[00:09:56] Craig: And if Europe. A lot of times will lead the way. Look at GDPR versus data privacy in the US it's not always the same caliber.

[00:10:07] Dino: It's not. And they, and by, and they, then they can treat it differently. But I, but their advancements, I would say and regulatory. Drive based on vertical, especially critical infrastructure, environments where, you know, you have to have power, you have to have water, you have to have communications, you have to have transportation, things of that nature where you wanna make sure that those companies are doing their due diligence to protect those assets.

[00:10:30] Dino: Right? and then as we move into life sciences, food and Bev Chemical, the oil and gas industry is another one in their critical infrastructure bucket that, that's been moving in that direction. But,it's not. It's not seamless, sometimes it's based on vertical and it also is based on your own internal organization's maturity around technologies per se.

[00:10:50] Dino: Because a lot of companies we work with, they, a lot of that is outsourced even on the IT side, primarily on the IT side. and when you see that, the organization is not necessarily well aware of what's going on, at what an A conference like S four would show them that's out there in the marketplace.

[00:11:07] Craig: Yeah, so I'm just trying to think back. So as we, as I get to, if I were mentally walk down the hallway, let's call it where the prime rooms are, which is where the vendors set up rooms and they do demos, and they do conversations that focus exclusively on them. If I kind of walk down that hall, I'm trying to, and I'm sure I'm gonna miss somebody, but , I got ForeScout, I got Fortinet from a.

[00:11:30] Craig: Intrusion prevention. I've got TX one from intrusion prevention. We've got Rockwell was there with their secure ot. We had, op, SWAT was there, there was SEL was there, there was clarity was, I mean, all of the. I would call them the significant OT centric technologies. All had a presence. Nazomi was there.

[00:11:55] Craig: They were all playing in that space and trying to make sure that it was very well represented, and Dale does a good job. Of the ticket, let's call it allocation, to make sure that the asset owners are very well represented. They have an opportunity to go and attend and see this firsthand because it's, it doesn't do any good, in my opinion, to have a conference with just vendors.

[00:12:21] Craig: If you don't have an opportunity to talk to asset owners and really figure out. What are they trying to solve for? Where are they in their journey and how does the technology apply to them and in their different paths?

[00:12:35] Dino: Yeah, I mean, you give a shout out to Dale. Well run event orchestration.

[00:12:40] Dino: I mean it. He's put together and run very well. So kudos to him on this S four conference. So he is doing a really good job and a great mix to your point of asset owners, technology groups, industry experts, integrators, partners, it's a marketplace, for this particular type of,

[00:12:59] Craig: that's a great, Analogy, it's like the marketplace on Amazon. It's where everybody can come together to look at all the different stuff and then figure out what your path forward might be. I like that. That's a, that, I hadn't thought of it that way, but you're very spot on.

[00:13:14] Dino: So, so, moving forward, obviously he wants to grow this right?

[00:13:19] Dino: And so he is moving the venue to another location in Florida, Tampa next year. I think, is where it's gonna be. and try to draw in more people, right? Because he, he was kinda limited where he was at on a number of people that could attend. So by, by moving to another venue of larger size, maybe he'll be able to double it maybe in the next year or two.

[00:13:36] Craig: Yeah, so I think that next year is February the eighth through the 11th. If I remember the slide right that he had, it's gonna be in, in Tampa where it was last year at the, I believe. I could be wrong, but, more information will come out, but I believe it's at the JW Marriott on the water. So it's, again, it's a, it's definitely a larger venue.

[00:13:54] Craig: but, all that stuff will come from Dale and the S four conference in the near future.

[00:14:00] Dino: So, so for the listing audience, depending on, whether you're in the technology side of things, the consulting side of things, you're an asset owner, it's definitely an event worthy of your attention if you are pursuing and being asked to go after what, what's going on in the OT cybersecurity field?

[00:14:18] Craig: Yeah. There's, back to the, connected theme of it. there are peers, there are colleagues, there are. Technology vendors. there are partners, there are everyone there within that ecosystem to help support practitioners that are advancing their own organization's initiatives.

[00:14:39] Craig: It's again, back to what we've said. There's no reason for anyone to take this journey alone because there's all kind of support network available to reach out, and everybody that I talk to, Dino, and I think you or anyone I would ask, would say the same thing, was receptive to helping me to answering questions to anything that I would need.

[00:15:04] Craig: I mean without, no, I mean all the cooperation and Coopertition aside, they're just willing to help.

[00:15:13] Dino: Oh yeah. No, it's a great event. and,if AI is coming at you like a freight train, and I, it's probably for most organizations it is, I think it's gonna drive, your. Your willingness and your company's request and requirements to gain a better understanding of what it takes to run a manufacturing facility.

[00:15:34] Dino: Right. And we've always talked about asset, visibility. When you look at the security frameworks, visibility has always been key. 'cause that's how you get to determine what your risk and vulnerabilities are like. But I think AI will help speed that up, but at the same time, speeding that up means that you gotta start putting certain controls in place to be able to deal with it.

[00:15:52] Craig: For sure. And you look at, there were a couple examples that were given about just risk in general in the OT space about how you make decisions and what's something that you know. Might have taken a week, two weeks in the past. Now, with a simple AI query within that OT space to gather some information, maybe now takes a couple hours or a day, as an example.

[00:16:18] Craig: Again, I don't know the logistics of it all, but again, it significantly reduces the amount of time to get the same output.

[00:16:27] Dino: it's how do you,how do you shorten the learning curve? And when you think about the, the silver tsunami as I like to call it, right? You got all, a lot of folks that have spent decades working in these manufacturing facilities that are retiring out and newer people are coming in.

[00:16:42] Dino: How do you get 'em up to speed quickly? And, when you got, control systems out there, machine centers have been in those plants for years and decades. how do you bring somebody up to speed on how, what it takes to keep that equipment running? As effective, effectively, and as efficiently as possible.

[00:16:57] Dino: Right, and I think ai, I don't think, I know AI is going to be the tool to help with that, to prompt them through based on conditions on what it is they, that is probably causing the problem that needs to be fixed or focused on.

[00:17:11] Craig: Well, and it also goes back and it supports and helps with it OT convergence, to, to your point, if you've got a junior controls engineer that's coming in outta school one or two years or whatever, and then you've got a senior person that's been there for 35 years that's trying to exit and trying to sunset off into the thing, how do you take that knowledge that the.

[00:17:36] Craig: The senior person has, without calling 'em old and transfer that to, even if it's a language model that the young junior person could query to get that information and try and help teach them before it's all lost

[00:17:51] Dino: and it's happening Now, getting back to what I state stated earlier, a lot of these technology companies are building that into their products.

[00:17:58] Dino: and helping to make sense of that, right. and how they're parsing data and how they've got prompts built in there that are being,built ahead of time. And so, based on all those years of experience, that to really shorten that window, that learning curve.

[00:18:11] Craig: Yeah.

[00:18:11] Craig: No, I agree.

[00:18:14] Dino: So, I looking forward if your company is,if you're in the manufacturing space, critical infrastructure space, and you're on the technology side, the engineering side, the operation side, you might wanna think of S four as an event that you want to attend in the future.

[00:18:28] Craig: Yeah, I would plan for that.

[00:18:30] Dino: Will that be a waste of your time?

[00:18:32] Craig: True statement? Yeah. Yep. And just make sure you follow S four and Dale Peterson. From an operational standpoint. a lot about the event comes out. I think tickets go on sale September-ish. Time. Window. Yep. And they go fast.

[00:18:48] Craig: they're fairly limited, so make sure that you're, they're looking at this in advance. You're planning, you're budgeting. and, we'll kind of keep it posted on our podcast and our website for updates as a year goes along. it's a great event. I can't say enough about it.

[00:19:03] Craig: We've been several years. We always find insights into that.

[00:19:08] Dino: Make some new friends while we're there.

[00:19:10] Craig: Yeah, absolutely. But again, whether this is your very first foray into this ot cyber arena, or if you've been. A very mature, deep, rich bench on your team that's got years and years of experience, you are gonna, there's gonna be something for everybody at this show.

[00:19:29] Dino: Yeah. And if you can, if your OT folks listen, try to get some of your IT people to go. And if you're an IT person, try to get some of your OT people to go to this event, right?

[00:19:39] Craig: Yeah. If you go together and walk around and collaborate, that'd be even better.

[00:19:44] Dino: Until next time.

[00:19:45] Intro/outro: Thanks for tuning in to the Industrial Cybersecurity Insider to stay up to date with our latest episodes.

[00:19:51] Intro/outro: Be sure to click the follow or subscribe button now, and if you found this podcast helpful or have a topic you'd like us to discuss, please leave us a review or let us know. Thanks again for listening. See you next time.