The IT-OT Knowledge Gap Costing Organizations Millions

Teaser [00:00:00] Prioritizing the fundamentals in this hygiene industrial environment, which is very much important. Your very basic expects thought they were completed, but usually they are not, especially in OT site. Small things like asset inventory or manage vulnerabilities or implement some strict network segmentation. Intro/Outro: Welcome to the Industrial Cybersecurity Insider. In each episode, we dive into the world of industrial cybersecurity. Join us as we cover the latest trends, innovations, and practical insights as we talk with leaders and practitioners across the industry. Gear up and let's get into this week's episode.

Dino Hi, this is Dino Busak and today I have with me Ade who come, who is currently in Dubai. Is that correct?

Adeel Yes. Dino, yes. Dino, I in Dubai.

Dino Yeah. Well, [00:01:00] welcome to the show. this is, the first time we've met and so I'd, I'd like to learn a little bit about you and your background and how long you've been working in the, field around cybersecurity.

Dino So if you could give us your audience just a brief bio.

Adeel Thanks. Thanks, Dino. It's a pleasure to be here, especially, you know, alongside with you who is like seasoned cybersecurity expert for like, I think four decades of global IT and industrial control systems experience. So I'm really, really happy to be here.

Adeel as of me, I'm into as a, like a cybersecurity standard and a researcher, with over 16 years of experience now. And, my career span from technical roles, to the GRC roles. So not only on the hands on expertise, but also the business oriented perspective. currently I'm engaged at as virtual CO for some of the organizations.

Adeel I have 50 plus industry certifications, including C-I-S-S-P-C-E-H, project management and others. whereas [00:02:00] I'm author of three books in cybersecurity and AI space, and I'm doing my doctorate also in the same space, into cybersecurity and ai.

Dino Perfect. Well, it sounds like you, you're really, one heck of a researcher based on your credentials and your experience, is there any particular verticals that you focus on, or are you across in the manufacturing space, or is it wide open as far as the, clients that you work with?

Dino or the research that you do in specific fields?

Adeel No, it's wide open. earlier I used to be more emphasizing on the IT part, but as soon as I realized, that OT is not only about, you know, operations but also, life set at stake and, you know, there other much bigger stakes here. So I focus more on OT side now.

Dino Yeah. So I, I understand you, you've also written some books. So you wanna tell us about some of the books that you've written?

Adeel Sure, sure. the first book was in like how AI is transforming [00:03:00] security operation centers. Uh, the so and like actually my idea initially was that how we can simplify cybersecurity.

Adeel Which is like, you know, a huge topic. So while, while writing, you know, I came down to this, small area that how AI is transforming soc, earlier it was like how AI can transform the cybersecurity, but it was like a. I must say that a big fish to fry. Yeah. So that's why, you know, it, it shaped up in know AI transformation of socks.

Adeel then I wrote the know the book on AI and us, that's the ethical choices, the, the accountability, that's not that technical book, but, you know, in the responsible ai, your ethical ai, perspective. then the third book was basically the first book, second edition, which was more focused on.

Adeel Practical ways instead of, critical, you know, deployment methods [00:04:00] of, so, so there I'm talking about the use cases, and, you know, which vendor or like, you know, as per my own research that, which are better and you know, what we can do, and how legacy talks are not helping and how, AI is transforming this, this industry.

Dino I agree with you on, on, the SOC conversation, and I'd like to, you know, making the case for an OT soc is, definitely a different conversation. a lot of, clients that we've worked with that have SOCs, um, whether they're, third party groups that they've hired or they have their own internal, but on the OT side.

Dino there's a gap. There's missing because most of those IT groups don't have a fundamental, really good understanding of what's inside a manufacturing facility. Generally speaking, they, 'cause they don't work there on, you know, on a regular basis. They're not part of the operations, they're not part of the designing and development, of an engineering of these control systems and machine centers that are out there.

Dino And so there's a gap, right? but I do see. the case for an OT soc becoming [00:05:00] more and more relevant. So, have you worked or been involved with assisting and consulting organizations to develop an OT SOC specifically?

Adeel Yes. for a few instances there were like, um, where clients were looking for, you know, the OT socks, and it's a heck of a problem because, you know, the legacy systems and there's a data gap.

Adeel then there are like false positive, the operational risk, plus the context and, you know, like, you know, the tunings are required. The systems are extremely old. How you can, you know, like, integrate those, data logs, into the SOC platforms. And if you are doing it, then, who is accountable if, if the AI is taking those actions.

Adeel So, it's like a heck of problems. And I, I must say that, frankly speaking, there is an implementation gap still today. where, you know, these issues are still going on and they are not addressed.

Dino Yeah, I, I have a view on that and, and we've mentioned it before in prior [00:06:00] podcasts where I believe that if you are an, an IT executive, or even the board, of a, a large manufacturing organization or critical infrastructure, is that the gap that you're describing to me is that, that IT leadership is not reaching across to find out who is doing the majority of the work in these manufacturing facilities.

Dino System integrators, engineering firms, OEMs, and building that, that bridge, because of this gap, right? I and I work in that world, right? The world I come from is on the engineering side, and we don't have CISOs or CIOs calling us to find out about a $20 million machine center that we're developing and designing and implementing for their manufacturing facility to find out what the heck we're doing.

Dino What are we putting in there? what is your capabilities? What is your practice? What are your partnerships? Right, to assist them with their OT cybersecurity strategy? So either one, they don't really have an OT cybersecurity strategy [00:07:00] or the plant floor is out of bounds for them and they don't want any part of it.

Dino And I've seen both of those. I've seen CISOs tell me flat out, I don't wanna be the SCADA cop. Right. I don't want that job. Well, if you don't want it, then how do we get your OT people engaged in this conversation where they're starting to work with their partners, build the practice, find out who's got those partnerships and start moving the needle, right.

Dino How to get better.

Adeel True, true, true. Yeah. You know, I'm more inclined towards the first thing, because, you know, CSOs. They don't have any playbook, any, policy, any system, any framework, which is talking about ot. So, and usually, they are coming from IT backgrounds and now they are cido for a manufacturing unit.

Adeel And, like frankly fitting, I came across some cis who don't know like what Elda, what is a plc? Right?

Dino Right.

Adeel So there's a huge gap.

Dino Yeah. Well, and the flip side of that is the OT [00:08:00] ecosystem, as I call it, needs to get better at this, right? Meaning that If you're not getting direction from the client, then you should be thinking about how you can bring cybersecurity tools to, to your projects so you can be successful.

Dino If the client's out there in left field and not paying attention, we see that a lot, right? They, they're not ready. They're not there. That doesn't mean that the OT ecosystem who's getting ready to embark upon. a greenfield or a brownfield or an expansion or a lifecycle replacement of control systems for the client that they don't bring these tools in to help them in a system with the projects that they're running, the client.

Dino And if the client wants the data, finally you can give it to 'em. They want participate. Great. You know, the InfoSec team, bring 'em in. But you have to be successful. and these tools are very valuable to that, right? If you want microsegmentation, you wanna follow some type of regulatory requirements. You want to find out if there's rogue assets in the environment, malware in the environment, right?

Dino You want to know that [00:09:00] before you go in there and start working on a six month to a two year long project for millions of dollars, and find out that you know, you're tripping over yourself because there's things in the environment that are being disruptive to you.

Adeel 2, 2, 2. I summarized this in one word, that is it ot, cultural gaps, you know, so, right.

Adeel It'll take time. But, you know, we are trying to align from both side, as you mentioned. the OT side is also, you know, advancing. and, you know, the IT side is also, trying to evolve, but, it'll take time.

Dino Yeah. Well, do you think it's doable? On this, this, uh, convergence as they call it, right?

Dino And, and, and fixing this culture divide. 'cause you know, like I said, I've been in the industry for almost four decades. That's a long time. You can tell by the gray hair. And, um, I've never seen it and OT really that closely aligned. With what the technologies that they use in each other's environment.

Dino Meaning that if somebody decides, I want Rockwell, or I want Siemens, or Honeywell or [00:10:00] GE, or Emn, take your pig. It plays no role in that. They don't. Right. So the controllers that we're talking about, the hmis s SCADA software, the dcss distributed control systems and infrastructure, the computers that they run that stuff is completely independent of it's decision making.

Dino Generally speaking. I'm not saying it's right, but that's, you know, in almost four decades, that's what I've witnessed.

Adeel Do you know, my hope is, with the ai, what I feel like is that AI will come up with some solution, which will be, like a black box, which will help talk IT and ot. So obviously, there are hundreds of cybersecurity IT vendors only.

Adeel in, out of any spaces, cybersecurity is the most complex because of, how many systems and how many layers or how many vectors we need to secure. And then there is another chapter, totally another chapter, which is the OT side. And again, as you mentioned, those vendors, we never say that Siemens is [00:11:00] a cybersecurity vendor, right?

Adeel So the only thing is that there need to be some, bridge boxes, some black boxes, which I'm sure that, you know, AI can help us achieve. I give you example of, this matter technology. Smart, smart devices, right? So smart devices was a chaos, till, you know, four or five years back. but now we have this matter, right?

Adeel So that framework is, establishing the iot connections, so that they can talk with, with it easily. Similarly, I'm sure that there will be some, framework or some black box which AI can help us build, which will bridge this gap.

Dino you know, it's interesting. AI, to your point, might be the thing that smashes these atoms together, right between IT and OT to actually, you know, start bringing these two groups together because, you know, it has a lot to offer.

Dino They, they have standardization, they have policies, they have governance. They understand, technology pretty well, right? We're on the OT side. [00:12:00] It's a mishmash of stuff. You can't go into a single plant and not find 3, 5, 7 different automation products in there. The lifecycle, of those, those assets is measured in decades, not in a few years, you know, compared to the IT space.

Dino So those are the challenges, right? I mean, I, I can tell you that I've. Had it, people who find a Windows seven machine in their environment, their, their first response is get it off the network. Well, it's running a $5 million piece of equipment that's generating $2 million a day of revenue. Right.

Dino It's not just something I can rip out Right. And replace. So, so then their position is, well, I just wanna ignore it. Right. It's ostrich sticks Exactly.

Dino Hand in head in the ground, and it's, it's outta my, outta my control. That's not the right answer either. but AI though is, is an interesting concept because I think that's gonna challenge both sides to have to meet in the middle.

Adeel when, when we are creating the policies, especially in the risk appetite and risk tolerance, I'm sure you have also seen [00:13:00] this, that OT is the biggest thing, which occurs in that, in that thing that, you know, they are tolerating it or they they have that, you know, that window is only for ot, not for it.

Dino Yeah.

Adeel Which is, which is a huge risk.

Dino do you work around the country or do you travel in, into, to do the work that you do or.

Adeel Yeah. Do you know? So, my focus is, middle East Africa region, the EMEA region, but you know, some countries of Asia also.

Adeel So that's, that's my usually the target area area, whereas, I've been there into, in San Francisco. So last, RA, I was a speaker there, so I know some of, like, you know, my clients are from, Canada and America, so I know a little bit about that side. But frankly speaking. In this side of the world.

Adeel the legacy systems are like so old, that, you know, we, we even don't know the names of those opting systems, which they're using still today.

Dino Yeah. So I, I being a researcher and an author, do you have any [00:14:00] recommendations for our audience on types of events or conferences they should be attending?

Dino Maybe in regards to this, if, was there any that stick, you know, pop out to you? For example, have you, have you been to S four? Have you ever heard of S four?

Adeel No, I never been on.

Dino Yeah. it, and it is purely an OT cybersecurity conference. It's been around, believe it or not, a deal for probably over 20 years, maybe 25 years.

Dino Wow. so yeah, you think about OT Cybersecurity and, and then there's, there's actually an event that's pretty, uh, relevant to our space. It's been around for that long, but, I just didn't know if there was like, RSA black hat, you know, the tradition, there's the IT ones. But then trying to find those OT conferences are few and far between, you know?

Adeel And you know, there is one Intersec, which I attended, I think that was two weeks back only in Dubai. last year it was in real. So they are moving in this Middle East region. Intersec is basically for physical security. but they have all these giants which we talk [00:15:00] about. You know, the Rockwell, Siemens, Honeywell, they're all there, into, you know, all kind of OT stuff.

Adeel so now this first time they had the cybersecurity, installs. which were amazing. So I visited them. conference might be, it's in, where, it's usually it's in in America or location.

Dino Four. It's, it's always been in Florida. down in Miami.

Adeel Uhhuh. It's Florida going

Dino here. Yeah.

Adeel Here.

Dino Yeah. but I've been going the last several years and it's a pretty good conference.

Dino You know, it's where, you know, you can actually find, asset owners. That, are trying to figure out their OT cybersecurity plan and you got a little bit of a mix between IT and ot, so,

Adeel cool.

Dino it's getting better. It's just, it's been a slow role in my opinion.

Adeel Sure.

Dino You know, the other thing I would say is that, you know, are you familiar with Clarity and ARM and a z and that out of all of those, you know, they go back 10 years ago.

Dino All of those in, automation, intrusion [00:16:00] detection and cybersecurity firms, the only two of them that come to mind that are still independent, that haven't been bought, and that's, clarity and Dragos, the rest of them. ARM is just recently acquired by, ServiceNow. indige was bought by. Tenable.

Dino Cyber X was bought by Microsoft, Cisco bought Centro. I know there's been a few others in there, so we're, we've seen some consolidation, but at the same time there's still two outliers that are still true to their, their roots when they, when they entered the market space a decade plus ago.

Adeel Yeah. And you know, and I'm seeing this trend also that those, IT vendors are creating another arm or another business unit or another name of the company, for the ot, just like Trend Micro, they have TX one, right?

Dino So

Adeel that is another direction.

Dino they're one of our partners, TX one is. So yeah, we, and then their, plays a little different. They're trying, they, started from the IPS side, the intrusion prevention system side, and they're starting to drift into IDS on detection versus the ones that I just mentioned were purely [00:17:00] intrusion detection systems.

Dino Right. That, that integrate into ipss if you want, proactive, policies to be, implemented based on findings

Adeel really.

Dino ail is, is there anything that you'd want to cover that we didn't cover? I wanna make sure that I give you an opportunity to go wherever you want to go in this discussion.

Adeel Yeah.

Adeel I always say that, back to basics, prioritizing the fundamentals, in this, hygiene industrial environment, which is very much important. Your very basic aspects, which we thought that were completed.

Adeel Usually they are not, especially in OT site, small things like, asset inventory or manage vulnerabilities or implement, some district network segmentation. And all, frankly speaking, these are also, like some of the attacks which I'm seeing, in today's day and age. they came from these basic, things which we have not done.

Adeel So that's number one. Number two, I need to mention about this, third party access control. I'm sure you will also echo this thing. That's a [00:18:00] very common blank spot. in vendors and contractors, especially on the OT side.

Dino Well, what I will say to to that point is, a lot of the OEMs and system integrators, they just, they don't keep up with their patching. And, and you know, I've witnessed where, you know, a client who has significant risk and vulnerabilities, maybe even stuff that's being exploited in the wild today, where you got an OEM saying if you change the firmware on that, machine, or if you add something into it, you're gonna avoid the warranty.

Dino They're not gonna support you. Right. So, you know, they're making, client sometimes fight with one hand behind their back, they're not allowing them to do their due diligence. and that then that's a little bit of a rub because they're falling behind the times.

Dino They're not, keeping their patch levels up. They're not continuing to do their research. they wanna sell a piece of equipment. They expect it to be out there for 15, maybe 20 years, and you don't touch it. It does what it does. and they're still in the mindset that, well, it's air gaped, it's not connected.

Dino Anything. You don't need to worry about cybersecurity. And that's just not the case anymore. Everything [00:19:00] is connected at a minimum, if I go into 10 plants, eight of them are gonna let me take my laptop and go in there and plug it into their network. You know, and I can have cellular modems on it, or I got wifi on it.

Dino I got Bluetooth on it. You know, they have no idea what I'm connected to. They, they don't know. And that, and that's the majority, especially when you get into these mid-level players, you know, they're, the Fortune one hundreds. The big companies with deep pockets might have some rules behind that, but even then.

Dino If you got a system that's down and you're losing a million dollars an hour or you know, $500,000 a minute or whatever it is, they wanna get that thing back up and running. They don't care what it takes, just get it fixed, you know? and I've seen that. Right. and that's the difference, that, that's where it falls off, because they don't wanna get that close to the fire.

Dino They don't wanna get that close to the things that generate the revenue that are kinetically dangerous. They don't want to touch 'em. Right. And so that's [00:20:00] where I go back to the OT ecosystem has to do a better job. We have to engage in that strategy. I, I run into those challenges even with my own firm when we're doing, you know, feed studies initially for clients and, you know, the client that doesn't have a cybersecurity strategy, they'll, they'll put one word in the RFP that says cybersecurity.

Dino One word, cybersecurity. And to your earlier point, well, cybersecurity is a big damn word, right? I mean, it's a boil the ocean kind of term. And, and so what are the requirements? And when you start digging into it, they're like, eh, that, that, that's beyond me, not me. I'd be right. So

Adeel anyway.

Dino Well, I appreciate your time.

Dino It was great talking to you. It was great meeting you. I'm hoping we get to meet in person someday, maybe at a conference for

Adeel sure.

Dino You know? For sure, for sure. A really good one to go to if you, if you get a chance. Next November is, Rockwell's Automation Fair. It's gonna be in Boston next year. That's a really good one to go [00:21:00] to.

Dino That's, a really good show. and you're, you're working with one of the, at least one of North America's largest automation technology companies. And they, the cybersecurity is a big component into their, business model.

Adeel Lovely, lovely. I will definitely reach out to them and, you know, hope so.

Adeel I can attend in November.

Dino Yep. will put the links to your books in the show notes, just so you know.

Adeel Thank you

Dino some As our, our listeners are listening to the podcast, they, they can get to your books.

Adeel Thank you. Thank you, Dino. Point of nice

Dino meeting you. Thanks Ade.

Adeel I speaking to you. Have a nice day.

Dino Yeah.

Adeel Cheers. Have a nice

Dino evening. Intro/Outro: Thanks for tuning in to the Industrial Cybersecurity Insider. To stay up to date with our latest episodes, be sure to click the follow or subscribe button now, and if you found this podcast helpful or have a topic you'd like us to discuss. Please leave us a review or let us know. Intro/Outro: Thanks again for listening. See you next [00:22:00] time.