The Hidden Reason Most Manufacturing Cybersecurity Programs Fail

[00:00:00] If you're gonna go explain to the C ffo, Hey, I wanna buy this new shiny thing, we need it. And it's not in the budget, go. No. But if you're like, Hey, these systems here are at risk, if these things go down, we lose a hundred dollars a minute. You can do the math. I need $50,000 to make that, you know, 50% less likely. Oh, cool. That's an easy conversation.

Intro Welcome to the Industrial Cybersecurity Insider. In each episode, we dive into the world of industrial cybersecurity. Join us as we cover the latest trends, innovations, and practical insights as we talk with leaders and practitioners across the industry. Gear up and let's get into this week's episode.

Dino Hi, this is Dino Busi and I have a guest today. I have Will Kovski.

Wil How you doing? I'm doing well, man. I'm glad to be here.

Dino Yeah. Welcome [00:01:00] to the podcast. so I usually like to begin with your journey into this OT cybersecurity realm. So let's, talk a little bit about your journey to get to where you came from to where you are today.

Wil Um, man, I, I did not have probably the traditional journey. I don't think any, maybe nobody had a traditional journey in ot. and like we were talking kind of before the show, I'm by no means a deep OT expert. I've been working, been doing cybersecurity and it for 26 years now. Most of that time I spent in consulting and managed security organizations.

Wil And during that time I just gravitated towards, there's a problem, I'll go fix it. So like, I built lead pre-sales, I built the channel, I built a few practice areas. I was a product manager. You know, I've done a lot of, a lot of different things and, I ask a lot of questions and I a pretty good, strong sales mindset for, you know, business cases.

Wil and I was at an organization that wanted to do operational technology. As a start, we're doing [00:02:00] managed security for ot, right? So this is the early days of clarity and whatnot. and I was like, should we be doing that? Like, what's the market like? I started asking all of the, the questions about have we even done the research?

Wil Do we know if our clients are gonna buy it? 'cause at the time I had had multi-billion dollar manufacturing clients who still didn't run IDS, you know, they were just running a, a stateful firewall and that was it, right? So I'm like, you guys are gonna get them to spend money on. Putting stuff on the shop floor where they don't think there's a problem.

Wil so all those questions basically got me into Cool. you can build the product and service out for us. Yeah.

Dino so when you're having these conversations, so you'd spend a lot of time in front of clients, right? Mm-hmm. and so are they primarily the IT leadership or is it the board, or is it a combination of both?

Dino And, and do you see them kind of getting their OT colleagues to the table and or their partners, you know, organizations like ours, which, you know, we spend, you know, our livelihood being born in [00:03:00] manufacturing is on the plant floor, right? Mm-hmm. Company as an OEM, as a system integrator, you know, we pr, networking, cybersecurity.

Dino So tell us a little bit about how those conversations go. I've seen your, don't say this and say this. I think it's brilliant. I mean it is brilliant and I'd love to, for you to talk about that because I think that's really relevant in the conversations with some of those risk people, the board, executives, you know, throughout the organization.

Wil Yeah. It's funny you mentioned the, how do you, you know, who first off, who you're talking to always depends and kind of tailing off of the story I had there where I was like, who's buying this? so when I learned about it and realized, okay, this is the solution, the service and why it's relevant, I was like, okay, cool.

Wil I get this. And then, what I would do is we would go to the manufacturing organizations. And usually they like, you know, this was 15 years ago at least. maybe more or less. But, You know, we'd go in and they may not even have, like, there is no it, right? The [00:04:00] OT organization, the shop floor has their own operating officer and they kind of do what they do.

Wil And sometimes we'd be talking to the enterprise risk management team. 'cause they, again, those organizations might not even have CIOs or CTOs or anything like that. So there might be, so a lot of times you're talking to like network managers. And the goal was like to get the business owners in the room somehow, like the people that cared.

Wil And the easy thing to do is go, how do you make your money? And they'd look and go, those Rockwell devices, those Siemens devices that shop floor over there, that cranks out the widgets and that makes money. And then I go, what are you doing to protect it? And. There's no response

Dino or, well, it's not connected to anything, which is not true.

Wil Oh yeah. Everything's air gapped. We all know that's true. nobody throws in. Yeah, nobody, definitely didn't plug in a Windows NT server 30 years ago so that the vendor could do patches. 'cause they didn't want to come out though. Theyll just shop every six months like that. Definitely doesn't have.

Dino Or fix it, you know, if something's not working right, you know, you're gonna wait for somebody to get on a plane and show up a week or 10 [00:05:00] days later. That's coming from Germany or Italy to, to work on that piece of equipment that's critical to your process. And I've had some plant people say, yeah, we do.

Dino And I, and I know they don't, you know, they, they eventually cough up. We got a jump server, we got a cellular cradle point. There are some VPN concentrator or we plug the cable into the enterprise network to get the machine online, you know, to them to get to it. So there's always a method to it, how they get into that space.

Dino Right.

Wil Well, and it's funny you mentioned that 'cause I, was led to believe, and I think this is true, a lot of the companies that create like the DO security for the OT environment spawned from asset visibility. Right. I'm pretty sure Clarity as an example, like before they were doing security.

Wil They were there to help you know what assets you had, right? What was actually on the shop floor, what was running, how can we be more efficient, you know, why is that machine down, 30 hours a week when it could be running and cranking out, you know, money for us. And [00:06:00] so I think the security was kind of born outta it.

Wil So to go back to your point of. Most people don't even know what they have. They think they do, but every one of us who's ever done an auditor assessment has walked around and always, always found things that people didn't know was there.

Dino Yeah. We just did a project, this summer with a very large, adult beverage manufacturer who's had a tool, you know, like a clarity tool in their environment for several years.

Dino Right. you know, throughout their, manufacturing environments and they were 135% off. On the number of assets that were actually in the plant compared to what they were using the DIDS to collect for 'em. So, it happens every, every time, you know, and it organizations that, lead a lot of these efforts, but don't spend any time on the plant floor and I mean, really on the plant floor inside those control system, you know, panels that are out there to make the determination, what am I missing?

Dino Versus what am I, you know, seeing with the tool? And, like, your questions just don't say this, say this. This is a classic [00:07:00] example of well, you can trust, but I, I like to verify, you know, is, is the role that I, especially if you're gonna hire me to come in and take some role and responsibility and service and some supporting and maintaining your environment.

Dino and that's just the case. Oh, we see this stuff morph into shelfware. We've seen that too,

Wil I see that happens so much and usually the culprit is, well, it's two things. It's OCM. There's no organizational change management that's associated with us implementing something new and impacting the way everybody works.

Wil So that's one thing. And because there's none of that, there's no adoption. And when you get people who are like. sort of outside the OT world, MFA is kind, actually probably in the OT world too, a little bit like MFA is a big example. It automatically, it changes everybody's way.

Wil They log in and do things. Mm-hmm. And if you don't explain to them before why they need to do it, how it's gonna be helpful, how to do it, and they just come in the next day and it's like that everybody raises their hand and screams. And everybody who's in charge of revenue and uptime are like, unplug that thing.

Wil We changed our mind.

Dino Yeah. Well things like MFA, that it's [00:08:00] few and far in between. we have clients that we're gonna lose their insurance if they didn't. yeah. Put in MFA. but I will tell you, on average the work that we do. You'll find 5, 6, 7 different, avenues of technologies that are being used to get into that, one single plant.

Dino And if you've got 30 or 50 plants in your fleet, well you can do the multiplier , and find out exactly how many different tunnels you may have in your environment you're aware of. Right? And, and it's not necessarily it's fault. Because a lot of that stuff is put in by the plant. and by their, suppliers, their OEMs and their system integrators that slap that stuff in to provide service and support to that client.

Dino And it is on the wiser, you know, I mean, a Sia, VPN sitting out there and, and a machine center, it was just part of a, capital project that, you know, $20 million piece of equipment and the cost of putting that thing in was just buried in there. Or, you know, those things are cheap and somebody just ran off and went and bought one and mm-hmm.

Dino Installed it. [00:09:00] And again, it is just not, they're not on top of it and you're not gonna get on top of it if you're not spending any time on the plant floor. that's the biggest challenge I've seen and with some of the IT people that I've met, is they've either never been to the plant or they haven't been there in years.

Dino And when they do go, it's just a very cursory visit maybe to work on something and they're in the office environment or, or doing a tour guide, walk through the plant and not really getting into the nuts and bolts of what's going on out there.

Wil Right. That kind of like we talked about my piece of content on the board speak, but that kinda leads to like a deeper seated problem in all of that is, for those individuals on the it, cybersecurity, on the technical side, on the, in the corporate world.

Wil In order to be able to communicate with the business and get the buy-in you need for the technology or the security tooling or whatever, it's, you have to be able to explain why it matters to the business. And if you don't know how the business operates, [00:10:00] you can't do that. Right? So when I have, people asking me, you know, how do I convince my.

Wil Board or my CEO or COO or whoever to give me money to do these things. I'm like, well, what's the company's mission? And then tie that down. What's that person's metrics? What's your metrics? how is you buying this shiny thing going to help with that? Then it's not because if you're gonna go explain to the cfo, Hey, I wanna buy this new shiny thing, we need it, and it's not in the budget.

Wil Oh no. But if you're like, Hey, these systems here are at risk, if these things go down, we lose a hundred dollars a minute. You can do the math. I need $50,000 to make that, you know, 50% less likely. Oh, cool. That's an easy conversation, right?

Dino and I want to go down your board speak too, 'cause I think that's important, but No, you're spot on about the downtime, right?

Dino I'm playing schedule. Downtime is, priority number one, right? How do I reduce that? Safety is always job one, but yes, top two is how do I reduce unplanned, unscheduled downtime? And to your point, you know, hundreds of thousands of dollars, millions of dollars a day, [00:11:00] hundreds of thousand dollars an hour of downtime, these things pay for themselves because it's not just cybersecurity.

Dino there's a lot of benefit to that, but it's also process integrity. And what I mean by that, these tools can catch things that are disruptive, get themselves bad behavior on the client or their vendor's part that's disruptive or it, you know, mm-hmm. Um, doing things and trying to do their due diligence.

Dino You know, to do a better job and not realizing that they're, they're messing up the, control system, communications and, and they fault or they stop because they wanna go safe. And, then, then that whole investigation begins. Then if they can't find a mechanical issue and they can't put their finger on what happened, they just wanna get back up and running.

Wil Yeah. I was talking to somebody about, about this, 'cause like, like you said, it's not just about is there a breach, but like it's because safety is paramount, right? That is the number one thing. So if you start to see, , slower production on something, that's a flag to go indicate what that is and you can go see it and there's somebody on the shop floor going, yeah, I slowed it down.

Wil There was [00:12:00] an issue with this. We're working at blah. Okay, cool. Now I know what's going on. Like, , everybody on the shop floor is happy that's going on. The people operations are happy because yeah, they're slowing things down to fix the issue, but that's better than letting it go and blow up. And then like really being down, down.

Wil So. That visibility that you get from some of that technology and, and those processes. Like, that's the other thing too. there is no buy this thing to solve a problem. Everything is a program, right? Everything that you buy, that you implement has a program associated with it that requires people and processes to run and manage.

Wil And. Execute and evolve on. It doesn't matter if it's the simplest little bit of technology or if it's like, you know, a huge, giant thing that's gonna just change the way that you look at the world. You have to have the people and resources behind it.

Dino and those are in short supply mm-hmm. In this space, right?

Dino I mean, and, and that's why we're seeing managed services change a little bit. I mean, the IT world has been doing managed services for quite a while, right? And to help 'em with their enterprise systems, applications, their [00:13:00] infrastructure, yada, yada, yada. On the plant floor side, we're starting to see that. I mean, organizations like ours exist from an engineering perspective because clients don't have an engineering team.

Dino Right, right. To be able to do those, integrations sort of, or to design those machines and, and program those machines and, all's they are is support and maintenance piece, but they actually hire engineering firms like ours to come in there and do that work. and in all honesty, that's how you can tell an organization that's really got their, act together is because the CIO, the CISO who owns that OT cybersecurity responsibility, is gonna have to make some new friends.

Dino And those friends are, those groups, right. The third leg of the stool as I call it. You got it, you got ot, but you got those system integrators and those OEMs that play a critical part. And that's the piece that, that I see that's missing. In my view, you know, to your board speak, do you have a relationship with your key partners that you spend millions of dollars a year with to help you run these [00:14:00] plans?

Dino and the answer is no, they don't. 'cause otherwise my phone would ring a lot more often from a CSO or CIO that says, Hey, you're working in a handful of my plants and I need to know more about your practice, your organization, your partnerships, your capabilities, and I have an OT cybersecurity strategy.

Dino I need to get up off the ground. I might need some help.

Wil Again, this is hilarious. 'cause I just recorded a podcast with somebody else where we talked about, like CEOs asking questions they should ask the ciso, and one of those was like, do you know about our third party risk? Have you assessed that third party risk?

Wil And, you know, the guy I was chatting with was like, the, ultimate answer is yes and. They're involved in our recovery practices, they're involved in our tabletop exercises. We are communicating on a regular basis. We are aligned on roadmap. especially in the supply chain where it's so critical.

Wil Right. because if they're. Something gets hacked or gets, has a problem, and then that flows down to you, then [00:15:00] that hurts everybody. I mean, we've seen that happen a couple times. so having that relationship and that level of, engagement between both parties is, mutually beneficial and should happen.

Dino Yeah. and the things I've seen hamper that a little bit are, or your consulting groups that the IT people tend to normally, attach themselves to, I'm not gonna go down the list. Sure, sure. Or you probably guess who they are. And a lot of the, software companies that provide these cybersecurity technologies mostly have IT sellers as part of their, business development organization.

Dino And the plant floor is an area they're unfamiliar with. Right. They just wanna sell the product, get it to it's hands, call it a day. It's up to them to figure out how to really make it valuable and actionable and get that visibility that you want and organize and prioritize everything they wanna do.

Dino And, and that's been another miss, right? Because again, you circle back around to, our ecosystem as I call it, the OT ecosystem. And, we have to do a better job. Right. And part of my job with my company [00:16:00] is, educating our partners and directors and, our client facing folks, , to start having that discussion.

Dino What is your OT cybersecurity strategy? What kind of tools are you using? Here's what our practice is. Maybe we can help you, you know, , and if you're not having that, leading that, because that's where the accountability and credibility comes. The OT people trust the folks that they work with all day, every day and have for years.

Dino And so if they're starting to have those conversations , with the people that they're normally doing business with, it kind of changes the whole dynamic to some extent. And it is usually relieved 'cause Oh, it's like, oh, they got buddies. Yeah. Who actually understand this. You know, they can help us, But I've had CISOs and CIOs tell, I've heard, I don't wanna be the SC a cop. Yeah. And I just keep it and OT separated. , I don't wanna mess with it.

Wil And I think a lot of them do. and. A lot of it is, is just education, right? and then it comes down to like, it's also a business problem because again, if you talk about like company goals and pushing down metrics, KPIs, who cares where you're down to, the individual contributor.

Wil how many people on the shop [00:17:00] floor go to work every day and cybersecurity is part of their job. You know, their mission. Probably very few, right? Yeah. And because they are, they do separate through. and you're right on the, the vendor thing. I, I did have the privilege of working for one organization, but it was very large organization, very tied to, a really big vendor in our space.

Wil you know, they were, we're doing digital twins and like huge projects with manufacturing organizations. So yeah, cybersecurity's coming along for the ride. That was kind of, you know, but that's, like you said, not a lot of organizations are doing that from the larger firms of the smaller and the people that it work with aren't necessarily the people that the OT would work with.

Wil I've worked with a lot of, IT and security organizations who just don't have this capability or don't have that understanding. And like, I remember when I was building the, practice area, for one of my, past employers, We know if these things go off, we have to tell somebody about it. But everybody that's in a traditional cybersecurity SOC doesn't know what to do when, like, the PSI is off on [00:18:00] this, gauge over here, right? Or this regulation, it's kind of like clinical systems, right? And healthcare, if something's wrong with the MRI machine, the IT guy doesn't go and fix it.

Wil There's, so now you've got this whole other distributed like. organization of vendors and partners that have to deal with things, or you need to start training people who can say, oh yeah, that PSI regulator's messed up because of dot, dot, dot, right?

Dino Yeah. Yeah. You bring up a good point because there's a lot of point solutions in those plants, and there's no correlation across to your exact point on why is my filler not running optimally?

Dino Per se, you know, or why is the conveyors, you know, backing up and, why is the pressure off? Why is the temperature off per and there's no correlation that's capturing information and data from multiple, um, data sets around that plant floor to help determine what might be causing that.

Wil it's a different world and then again, the remediation part is all very different. So it's, um, super fascinating to me. But I would also agree, like you said, there's, And we're working on that. By the way. There's a gap of PE like there, like honestly, if as I'm saying this, [00:19:00] I'm thinking about it.

Wil 'cause there's a huge, huge problem in cybersecurity in general. We have a lot of people who wanna work here. and not a lot of jobs, especially at the middle and entry level areas. but I feel like OT is probably very underserved. I think you could probably have, make a good case for some people with some mechanical and and technical backgrounds on the shop floor to become a little network savvy and, and start to, supplant.

Wil I know like Mike Holcomb, buddy of mine, he's always, you know, given out educational content on little, little plug for him on it and all his YouTube and LinkedIn stuff. there's a lot of stuff that can be learned and this is. This area, cybersecurity's, like security itself is still new. I mean, I was doing it before it was called cybersecurity and I've only been doing it for 26 years.

Wil So OT is probably, you know, still an infant.

Dino Well, and in the IT world, you're right. Yeah. They've had a long run at it. Right. I mean, they've had a couple decades of, of working on this and in the OT world, not so much. Right. And, I was just a Rockwell automation fair right before Thanksgiving.

Dino And you know, one of the biggest, holes That [00:20:00] they would say that's out there is cybersecurity in the manufacturing space. Of course, they would say that, you know, via a, a manufacturing technology provider, and supplier. But I witness it all the time, right? Which is why we had to build a practice you know, in this space for OT cybersecurity because it just did not exist.

Dino Very few places to go and get it right. And they're used to going to the IT vendors that they're used to. They have cybersecurity practices, but, their, expertise in that plant floor area is really weak, you know, and they expect the client to figure it out and the client's not gonna figure it out by themselves.

Dino You know? Yeah. It's not, that's why we have a lot of 'em that will say, we're not gonna build a practice. We're just gonna hire you guys. Just like it would've done. Right. They would've provided, yeah. You know, if I don't wanna manage my network and my ma email systems or my CRM or my applications, I outsource it to firms that do that.

Wil you can even look at the product landscape. You know, Microsoft Defender for iot O OT was Cyber X. Mm-hmm. [00:21:00] Right. It was actually one of my favorite products when I was building practice. You know, alongside Clarity Niomi know a lot of these other ones. They get, you know, Palo Alto bought and acquired stuff for medical iot.

Wil Like The IT organizations or the cybersecurity, like peer place cybersecurity companies weren't looking at this space.

Dino Mm-hmm.

Wil the innovators built some stuff and they were like, oh, cool. Let me make some money. Yeah.

Dino Like

Wil I can, yeah. Yeah.

Dino It's a very decentralized environment, you know?

Dino It has done a really good job of standardizing, right. And centralizing, yeah. That is not your plant floor. You know, the lifecycle's different. Right. We're talking about equipment and assets that are out there measured in decades, not in three or three or seven years, you know? I mean, and so it's very hard, to figure out an automated, a centralized approach like putting in a Palo Alto or Fortinet firewall.

Dino Great technology, but very complex. And you have to have people with some great skills if you're gonna put that stuff in there because you know, it's intrusion prevention systems. And if it sees something doesn't, it doesn't like, it'll just. Block it and [00:22:00] stop it. Well, now you just shut down my $80,000 or packaging line, you know?

Wil yeah. And up until a few years ago that. Fortinet firewall didn't know what OT was. It was just like, what is this network traffic? And then somebody had to make a decision to be like, well, I, I guess that's okay. Or it's not right. Right. P-L-C-H-M-I, all that stuff is very different than, it's not the same, you know, it's not the same world, but we live in, in the IT world.

Wil And, and I would, you know, a really, really smart network engineer could probably look at some things and be like, oh yeah, I get it. But you know, a lot of other people who are more, linearly trained and knowledge-wise, they're gonna be confused by anything that's out the ordinary.

Dino Yeah. I mean, we still run into it. People that work in manufacturing environments and have for a decade or more that still don't know the, what the term s Cada or DCS or, or HMI, they, they, they'll ask that in the middle of a conversation, which is fine, but they don't know what this stuff is. And it's connected to your network.

Dino Yeah. Right. but they don't know what it is. And again, it's because they, no, it's not

Wil because it's air.

Dino I'd [00:23:00] never find that. I, I, I mean, I guess if I was walking in a nuclear power plant, you might, yeah. You might get me to say uncle on that, but, I never find stuff that's there. Yeah. I've done some stuff. I still walk in

Wil Yeah.

Dino With my laptop. You know, if I go to 10 plants, eight of them will let us walk in with our laptops and plug it right into their environment.

Dino Our engineers do that every day. I got 500 engineers out there working in across the United States with their laptops, and they go out there and we're just one of the vendors. There's usually several system integrators or OEMs working in these manufacturing facilities on any given day, you

Wil know? Yeah. it's funny because as much as those plants, like they, they should understand physical security.

Wil A lot of them don't. someone who sold a lot of pen tests across multiple areas, Those are the ones that pen testers love the most when they could go into like a utility organization or a substation or something, and it's just not that hard.

Dino Well, and they've just like pushing patches out was disrupted.

Dino Pen testing is, is also disruptive. So then they, they figured out that that [00:24:00] was, disruptive and they said, well, we'll do it when there's plant downtime, what does that do? And then everything's offline.

Wil Yeah. You know. Well, and I learned. Early on in my life, the patching is not you do not have to be a hundred percent tomorrow.

Wil Like you, it has to be contextual and it's very much Okay. Especially in, you know, we talk about the CIA triad, right? Confidentiality, available, integrity. Mm-hmm. And manufacturing and healthcare. The A is the top.

Wil like availability is what matters most. Yes, we will try to protect things, but when it comes to somebody's life or us making money with this machine, like we're not gonna change it.

Wil Yeah. And so because of that, it's fine to be like, yeah, that critical patch. Okay. But like, let's actually do the threat model. How would somebody execute that on the shop floor in the environment and cause it to impact it? Okay. The likelihood is 1% we're okay, the likelihood is 60%. Is there a compensating control we can put into place?

Wil Mm-hmm. Because again, even then, like, well, the 60% chance that [00:25:00] happens is gonna cost us what? And what's the impact of that machine going down for however long time takes to run? Or how long do we have to take it down to run the patch and then maybe it doesn't come back up. Yeah. Like that's the other thing.

Wil FDA systems and stuff like, you know,

Dino well, and in some ways they try to solve it by moving away from bare metal standalone machines to VMs. Mm-hmm. Because that. Put a patch out and, and it broke the application switch. Yeah, you can switch back pretty quick. but then you still got Windows seven machines out there, right?

Dino I got a client that's got thousands of VMs that are Windows seven hmis, or you have an OEM back to that decentralized. Approach. You've got OEMs that they're like, don't touch that machine. 'cause if you change, if you try to upgrade it, and, or put a firewall in it or do anything that may manipulate the traffic, I'm not gonna support you.

Dino Your warranty and, and is. Yeah. And so you leave it alone. Which isn't a good answer either. No. So. there's ways to tackle the problem without being disruptive. To get the metadata that you need is make informed decisions and determine how you wanna move and [00:26:00] set a path forward. Right? Yeah. Otherwise, this stuff turns in, into shelfware as we've seen it.

Dino and on the budgeting side. the question there is, I, it, you know, I think in a lot of cases wanna see OT get some skin in the game and start thinking how they're gonna fund for some of these initiatives. Right? And the value, well, the, not the value, but the situation on the OT side is you got CapEx capital Yeah.

Dino And you got OPEX X, and that's the one that always gets squeezed, right? That's one. Yeah. And it's hard to get capital too, you know, because if you're talking about, you know, multi-millions of dollars purchase, yeah, it's gonna take a few years to, to get it built, designed, get it in, which I think is the best time to start thinking about that kind of stuff, right?

Dino Is during that capital plan and the capital investments that you're gonna make. But it needs to help OT structure their budget, I think on this, you know, where it doesn't have to carry the burden all to themselves. let OT step up and get some skin in the game. But that means their ecosystem, their of their supply chain [00:27:00] needs to also participate, you know, and, and have the capabilities, have the practice, have the partner relationships, to be able to provide, you know, these technologies and these services and these designs and, architectures of all of it, you know, help 'em,

Wil yeah.

Wil On, on the budget sign, it's like. what I consider probably is the, well, the, the quickest way to fix it, let's not say there's a failure. The quickest way to fix it is, again, taking those high level, what's the company want to achieve, and pushing those down so that the people working on the shop floor are responsible for the production, manufacturing, have accountability to.

Wil It and cybersecurity, right? That that is part of their, it can't all be on the ciso. now and this is something that I think a lot of people confuse. as security professionals, it is not our job to make decisions. It is our job to find the risk, tell you what it potentially is, could cost, and here are your options to Fix, mitigate, or transfer, and then the business [00:28:00] decides. And so that accountability set in the hands of the people who are responsible for that floor and making things run and be like, Hey, here's your risks, here's your costs. Like this is part of your budget now. Right? Just like everything else, if somebody buys a new ERP system, a new HRIS system, whatever it is, there's security requirements built into that acquisition, right?

Wil There's process and that's just where we have to get, where Security just has to be part of all of your business process. And I think OT is just the kind of last frontier.

Dino Yeah. Well, just like safety is on the plant floor. Yes. You know, that's job one. Right. And you know, we've, we've spent the last two decades, you know, when I started working in manufacturing, you didn't have to necessarily have, safety shoes or safety glasses or hearing protection, you know, tied up.

Dino Five this best. and now that's a requirement, you know, and that, and that's one of the things where it still, I've seen them get run off the plant floor off because they show up without their proper PPE and the site managers like, you guys gotta go. You know,

Wil you can't be here. We [00:29:00] need that. That's what I wanna interrupt you.

Wil That's what we need. Like those site managers, those safety guards, and I've, and, and every industry has them. You need those people who are as passionate about cybersecurity as they are, like physical safety. Like those are the people we need.

Dino Right. But we try, we call it digital safety, you know?

Dino Yeah. But it's a message that gets lost in translation to the, to the organization. It gets back to your board speak, you know, of, of, how do you get that leadership to really, to start putting an emphasis on it. It's not that it's not happening, but how do you get it down to where you need it?

Dino Right. And if you're a big organization that's got a hundred plants, you know, 50 plants, it's, it's a journey. Right? it definitely a journey.

Wil like that's my sort of, closing argument to all this. Like, it's a journey, right?

Wil At the end of the day, you're not going to just be secure tomorrow. Like you have to be like, where am I at today? Where do I want to get to? Where you wanna get to, maybe where I want to get in six months, 18 months, two years. Like it's, just longevity and you've gotta [00:30:00] adapt to the technology that's moving.

Wil It's about having a mindset that is, you know, again, just like safety risk, risk aware first.

Dino Yeah. Well, it's been a great conversation. I, I don't know if there's anything specific you wanted to cover that we didn't talk about.

Wil Ben, do you know I'm here for you and your audience, but whatever I can, if I can help somebody, teach somebody, I'm happy.

Wil That's, that's all I care about.

Dino Perfect. Well, appreciate the time. It's nice to meet you. Will good to meet you too. Appreciate being on the show. Merry Christmas. You too.

Intro Thanks for tuning in to the Industrial Cybersecurity Insider to stay up to date with our latest episodes. Be sure to click the follow or subscribe button now, and if you found this podcast helpful or have a topic you'd like us to discuss, please leave us a review or let us know.

Intro Thanks again for listening. See you next time.