The Real Cost of Delaying OT Cybersecurity Investment

Craig [00:00:00] from a physical standpoint, you kill a person or two, that is a whole different level of liability from a cost standpoint, from a regulatory standpoint, from OSHA, from insurance.

Craig And these potential for death, for environmental disasters, that's a whole different level, and that, it really brings it up a notch or two. Intro/Outro: Welcome to the Industrial Cybersecurity Insider. In each episode, we dive into the world of industrial cybersecurity. Join us as we cover the latest trends, innovations, and practical insights as we talk with leaders and practitioners across the industry. Gear up and let's get into this week's episode.

Craig Hi, welcome to another episode. I am Craig Duckworth, and today with me I have

Jim [00:01:00] Hi, I am Jim thanks for joining us,

Craig today I thought we would talk about trying to build budget.

Craig So as you know, everybody try and goes through a budget cycle annually at some point, depending on what their calendar year, fiscal year is. And how do we take a project that's traditionally not been in a budget cycle for OT cybersecurity, create that budget process, create that need, that roadmap, and, and really be able to bring this topic to the executives, to the board, and, and, and move it forward?

Craig So we wanna talk about budget.

Jim Yeah, and that's, that's a great case,a great topic. you know, it, it feeds into the whole IT/OT divide that we're constantly faced with, that we talk about, that we live every day, right? uh, so the question, you know, will be, well, whose responsibility it is, right?

Jim who's supposed to be asking these questions? [00:02:00] Is that the OT side? Is that the IT side? Is there another side?

Craig it's a great question. I- What I will tell you is traditionally the asset owners are the ones that, that I've seen in the past, get and ask for budget. Think of the IT side for just a minute.

Craig You, your past has been IT related. If you're looking to do data center refresh or asset refresh on the IT side, the CIO would be the one asking for the budget. If on the OT side, if they're looking to add a hardware or equipment or a, let's say, in manufacturing, a packaging line or some sort of hardware expansion, they, OT team would be the one to ask for the budget.

Craig This one is a little tricky and a little different.

Jim right, I'm with you. 'Cause the OT guys, well, they're the asset owners, right? And they, they own the machine [00:03:00] centers, the processing, the cash registers for the company, right? But the IT owners on the other side, everybody assumes they own security, right?

Jim And cybersecurity, right? And that's where that gap falls, right? That's the gap, right? So the guys on the OT side, you talk to an engineer, a controls engineer or maintenance engineer, and they go, "Well, the cybersecurity is that group," right? And right, right. And then, and then the, uh, the IT guys are going, "No, no, no, no, we, we do cybersecurity over here.

Jim We're not even allowed on the plant floor," right? So this, this, you know, we've seen some on both sides, right? Some on both sides actually start stepping up and saying, "Hey, we might need to do something 'cause we're not doing our cybersecurity over there, right, on the IT side. And then the OT guys, they need to ask that question too, going, "Hey, wait a minute.

Jim who's doing cybersecurity for my machines," right? and regardless where it starts up, this conversation has to start, right? And whether it's starting on the OT [00:04:00] side or the IT side, or they're actually together singing Kumbaya, which is very rare from what we see, the,the conversation has to start somewhere within that organization because it still needs to make its way up to the executives, because the executives have the power of the purse, right?

Jim They got the budget. and h- how are they gonna get money to move any of this stuff forward if they haven't even started that conversation, right?

Craig Well, yeah, and I think that in a situation where organizations looking at OT cyber, that's traditionally not something that is in a budget cycle from the past years that...

Craig So someone's gonna have to create that need, create that use case, the business case. what's the business case to present to the executive leadership, the board, whoever is the one that's gonna say, yes, we need to carve out X amount, and we need to allocate it to whoever is gonna be responsible."

Craig The IT budget for OT cyber if they're [00:05:00] responsible for security. The OT budget for OT cybersecurity if they're the asset owners. Whoever gets the money, someone's gonna build the case and present it to say, "Hey, we as an organization need these funds, and here's why." Then it can be decided who's gonna pay for it and where the money's coming from once the organization says, "Yes, we are all in agreeance.

Craig We need to allocate X amount for the project."

Jim And, and, and that's where y- you get these organizations have to realize the conversation's going up. And it's going up to executives that have 100 other things to do, and the case really needs to be based upon, I need to make this one of the top five, f- top 10 things.

Jim Uh, I was, am reminded of a story, and you know me, I had former CIO roles, and, and i- it's, uh, a buddy of mine, he, he runs a company and, and, he, he always laughs at [00:06:00] me. He... I mean, he's, he's running the business and he's like, "Yeah, usually with my CIOs, I, stop listening after about one or two minutes," right?

Jim So if you can't convey that message in one or two minutes, so don't overcomplicate it. And, and so let's talk about some of those big topics that are relevant to those executives, right? That might go, I might listen for another minute or two if you say and can tie it to these words, right?

Jim one of which is just the liability, question. I mean, that's a, that's a great one to say, "Uh, well, what's our liability? What happens if this stuff gets hacked?" and the reason why I like that one is because, you know, more and more, uh, y- the trend is more and more liability on the executives if they don't do something, right?

Jim And that hits them personally in the pocket and they're like, "I don't know about your world, but I don't wanna get sued," right?

Craig No, not at all. Well, i- it kinda goes back to [00:07:00] that- You know, are you taking steps to improve and get better period over period, as an organization? You know, you talk about liability, then you're dragging in a CFO potentially, you're dragging in governance and risk, maybe that's legal, into the conversation.

Craig Because someone's gonna say, "Okay, if we don't do this and we know about responsibilities or liability or risk, and we take no action, then the organization has huge liability." It's different to say, "Hey, if this happened, there's a, a 1% chance and it's a, it's a non-starter, and, you know, we're willing to roll the dice, and it's okay because there's really no punishment, no penalties."

Craig Eh, that's okay, but when you look at today's environment, that's really not the case, especially when you talk about OT. You mentioned in the beginning, that's the cash register. That's the piece of the [00:08:00] business that allows everyone to get paid.

Jim And it's, and, and I'm no, insurance expert or legal expert on this, although we try and play some on TV every once in a while, right?

Jim But we talk to 'em. We all

Craig s- We talk to the executives. We all stay at the Holiday Inn Express. Right, right, right. We can be

Jim what we want to be,

Craig right?

Jim but it's, it's, I believe it's around, and there's variations of, but duty of care, right? So if I know something's wrong, I gotta fix it, right?

Jim If I, if I know the floor is wet and somebody, and I don't clean it up, and somebody slips on it, then I got a liability. It's, uh, to me, that's how I, my feeble mind,you know, comprehends it. And then so that, that's where they have to talk about, well, I always love saying this, is the, y- from cybersecurity when you get into OT, it's not, it's digital systems controlling physical outcomes, right?

Jim And the IT side's always worried about the digital system controlling the digital outcomes. Well, now all these machines are connected and, and they're running things, and then now the impact can be, well, there's [00:09:00] disruption, right? What about business disruption? What about, what if it, if it stops a line and you've got spoilage, right?

Jim What about the potential equipment damage or even cleanup if you're dealing with certain products like plastics that harden in that?

Craig So I look at it, and that's all important, but I go back to the liability and the risk. When you mention digital machines controlling physical outcomes, there's a different risk level in a data breach.

Craig You know, you spend $15 a person, and you mail out some things, and everybody gets a security monitoring notice or whatever. On the opposite side, from a physical standpoint, you kill a person or two, that is a whole different level of liability from a cost standpoint, from a regulatory standpoint, from OSHA, from insurance.

Craig That's a... And these potential for death, for environmental disasters, that's a whole [00:10:00] different level, and that, it really brings it up a notch or two.

Jim Yeah, way to bring us down here, Craig. I mean, those are- I'm just trying

Craig to be honest.

Jim But no, those are, those are realistic depending on some of the manufacturing processes that go out there.

Jim you know, we're out, we're out in the field, I was just out there this week. Uh, the, I mean, a thing can go boom, right? Like, the, yeah, the, it's out in the middle of nowhere because of the possibility of an explosion. Well, what if you're not taking proper care of this, and proper care as, well, I'm connecting all this stuff to the network, I might as well try and figure out how to protect it from a cybersecurity standpoint because that stuff can explode, that stuff can, uh, uh, hurt individuals, and you hear about those things all the time.

Jim And, and again, it's not for all manufacturing facilities, but it's still the same concept that you have to go, they're using the same type of equipment out there, right?

Craig It, those are just elements into what it takes to build the case. each manufacturer should look at their own processes and say, "Okay, what [00:11:00] processes do we use?

Craig What's the risk to us, to the environment, to the people, to the organization as we build this case?" And everyone's gonna be different. There's gonna be similarities, but they're all different.

Jim Yeah. so we talked about, the potential nastiness and the bigger impact that, that,you know, cybersecurity on the OT environment- can, can happen.

Jim Let's, let's talk about, well, okay, now that we've got our executives' attention and say, "There's some big stuff that can happen," they're gonna go, "Well, are we ready for it?" So what questions, uh, you know, do we need to ask? 'Cause we're talking about the impact. Well, th- this stuff is impact. This is big. This isn't, uh, you know, losing some digital outcome.

Jim This is some physical impact and financial, major financial impact to businesses. Y- you know, so, so how do we know then if I'm, you know, I'm client guy and I'm saying, "Hey, that's great. It can be bad, but I, I don't [00:12:00] even know if f- are we ready? Are we not ready? I don't know." which b- if I was an executive, I'd be like, "Well, are we taking care of this?"

Jim what do I start asking myself, right?

Craig Right, yeah. And it, it may be as simple as, one, a, a tabletop exercise, a- as a, a perfect example. Who's, who owns it? who's gonna be responsible from the organization? Someone has to own this. It's not gonna be the CEO. It's not gonna be the board of directors.

Craig There's gonna be a line somewhere. Is it gonna be the COO? Is it gonna be VP of operations, because that's the manufacturing line? Is it gonna be risk and governance and the CFO from a financial standpoint? Who's gonna own this piece of it? And then that's a starting point, from alignment.

Jim Yeah.

Jim Yeah, no, that's, and, and it's, it is a great starting point because that's the fir- one of the first questions they have to ask, right? Whether you're from the IT side or the OT side. That's sort of asking, what about this gap? who owns the cybersecurity piece over [00:13:00] this? And when you ask that question in the right group, you're gonna find, you know, everybody going, not it."

Jim You know, what is it? Nose goes. I don't know. Not it. I'm not, I'm not, you know, and then- Hot

Craig potato. Hot potato.

Jim Well, I thought you guys were doing... I thought that was... Well, no, we just c- you know, and that, that's a great starting point to start, uh, to realize really where you're, you're at in this process.

Jim you know, and, and there's some other questions too that you can start digging down into, which, again, I, coming from the IT side, I've said this in other ones, in other topics, but y- like a clear visibility of what you're doing, like your inventory that's out there. Okay, well, what do we got out on the floor, right?

Jim I mean, we, you and I just got off a call and our guys are at another site, and he,the engineer that they're working with, great guy. He seems to have a lot of control over it. He's amazed at what he can't see now that we're out on the ground with him, right? And this guy had a better handle over his organ- or over his facility [00:14:00] than what we see mostly.

Jim And so for, for me, the IT side, I always figured engineers, they got their list together. They, I mean, they're engineers, right? they're detail guys. They should know everything out there. They don't. They don't. They don't have it. Stuff changes. They got three years... Yeah. Yeah. And they can't keep track of it, and maintenance is in and out, and they have third parties.

Jim and so that- that's sort of that n- next question is, you know, well, that visibility, which I'm a big, you know, you can't protect what you can't see. So what do we have? Okay, if we're not really- protecting anything, well, what do we have that we're not protecting, right? And we gotta, you gotta get in there and ask that question, right?

Craig Yeah, you know, there's, there, there are a lot of visibility tools that are out there today. You know, we work with many, many partners that, you know, provide intrusion detection and offer full visibility on that OT network. You know, there are ways to do proof of concepts, proof of value, to, to work with us, to work with [00:15:00] vendors, to say, "Okay, how do we identify the visibility and determine what's our asset count look like?

Craig What do we have?" Back to your point, you can't protect what you can't see. And one thing that I see a, a lot of organizations miss that when they start with just a vendor is they're getting a price, which is a good place to start, of what's the software gonna look like for what we believe we have.

Craig But you- then you gotta get it in, you gotta get it tuned, you gotta get it commissioned. There's some services pieces that go along with that, that a lot of times the software manufacturers forget, let's call it forget to tell them that it's gonna be needed to do that work,

Jim Yeah, there's, uh, yeah, there's two things I wanna touch on what you just said.

Jim One is the, on the, the, the ladder. Is it the former or the ladder? The ladder. The last thing. Uh, the capa- yeah, no, the ladder with the Ts. the [00:16:00] capability, right? That you've gotta build a capability. If we're talking about, an environment, uh, that has a gap, well, that means you don't have the capability to cover it, so what are all the things that need to go in there?

Jim You can't just, there, there's nothing out there that you can go, boom, we're gonna flip a switch, and now we're covered, right? It, it takes time, it takes effort, it takes input. And how, how you organize that, think about that as you're putting your budget together. It

Craig takes resources.

Jim Yeah, resources to do that.

Jim the other thing that I wanna touch on is, the former now, where you mentioned, like, the proof of concept. So you're building a case, and uh, so what we're seeing is more of these proof of concepts, proof of values, pilot sites, right, uh, for these multi-site organizations because they ask the question.

Jim they did a good job, and they started going, "Well, hey, our impact is big. who owns this?" We're like, "I don't know. What... if the impact's big, uh, well, what do we got that we need to protect?" And they're saying, "Well, we don't know." okay, but how much money should we [00:17:00] spend 'cause how big's the problem?

Jim And so, so what's really compelling to the executives is having real data in a real plan, right? Having quantifiable data by saying, look, and we, we do this all the time, right? We go out to the plant the first time and, and they're saying, uh, it... We use this example all the time, 'cause it's all the time that we do this everywhere we go.

Jim "Uh, no, we don't allow remote access. We don't have any remote access. That's not allowed," right? And we go, and we're, okay, that particular plant had five points of entry that you guys didn't even know about. You don't even know who's coming in. You don't even know who's on the other end, right? And so now, now you've got a quantifiable piece of information.

Jim And, and that's not the only thing we find. You know, we find the XPs. They're like, "Well, I thought that XP was over here." I mean, this week we found an, a network that nobody knew about, and it was the guys in the lab trying to get equipment working that they just plugged into a switch that [00:18:00] was there, and they created their whole network that has all this other issues that could take the whole facility down,

Craig right?

Craig Trust but verify.

Jim Trust but verify. And, and to be able to find that and say, look, hey,A- and we do all sizes, right? We do single site and we do global sites and multiple sites. But, uh, you know, let's say you got, eh, 15 sites out there, 20 sites. Who knows what that number is? And well, how big is the problem?

Jim I don't know, but you could start with, okay, then let's carve some money out to address it, and let's take one site and get some quantifiable information and go, we found, 12 major issues with this one site. Here are the real things, right? and now, now you, they can extrapolate that to the bigger picture, you know?

Jim And that always gets to something I said, which is the, you gotta be getting better. So don't get paralyzed in this thing and go, "Well, geez, they're not carving out a lot of money. It's, it's tight, and it's, it's a, it's an off year," or whatever that might be. You go, well, that risk is still there.

Jim That risk [00:19:00] doesn't go away. All the impact's huge. and you know you have an ownership problem, you know you have a visibility problem. then try and figure out a way to kind of get started in that, right?

Craig Yeah, no, you're, you're spot on. it's important that, that cross-sampling, and then we hear this all the time, "Oh, well, that's just one of our facilities.

Craig That's the worst one in our booth. The rest of them have none of that stuff. It's all... Everything is rosy on this side of the fence. That's just the only one that's bad 'cause we bought it from some other organization, it's old, and it's not really indicative of the rest of them." You can't really go with that, though.

Craig So no, you're right.

Jim Yeah. Yeah. You know, a- and each of those sites are different, each of those sites have their own nuances, and each of those sites have mixed equipment, old and legacy and new, and each of those sites have that gap. It's unique. Uh, you know, that's the... You know, we talk about the think global and act local, that you got to really understand the local.

Jim But I think, you know, from the ca- from [00:20:00] the subject of trying to make a case for this,that's a, it's a great way for a company to get started to say, "Okay, do we s- you know, do we see anything? We've asked the question. We know we have an issue, so let's, let's sample it, right? Let's sample it.

Jim Let's take one site and go, 'What does that one site look like?'" Now we have that quantifiable, information, and now you can get your CFOs in there and all your bean counters, and they can extrapolate, geez, if this is here and we're... You know, what's the impact of that financially? maybe we should be,you know, addressing it."

Jim one of the other things I wanna touch on is that, that the executives need to think about is in this whole risk and s- uh, OT cybersecurity scenario is just the cyberse- security insurance in general, right? Because that's usually the case.

Jim We talk about IT and OT all the time. Well, there's sort of that risk management, financial budget owner that's sort of the third leg of the [00:21:00] stool, and they get that. They get, "Well, okay, OT cybersecurity. Hey, well, we're talking about risk, and we're talking about how much money we should spend. What's that O- o- that I- or that cybersecurity policy for the company doing?"

Jim Because sometimes that's removed from the entire conversation, although b- by a, a different group. and you start asking their que- their, them questions about it, and they go, "Yeah, that policy, I'm not sure what we're filling out. I'm not sure what we're buying." and they're probably not buying the right stuff, and they're probably not answering the question, and you got to loop that in the whole thing, right?

Craig Oh, what I-- Yeah. And well, and part of what I would say on that, and then, uh, I want to get back to another, another thing that came up is they're probably-- the rates are more than likely going up substantially. Their coverage is more than likely going down. They're probably seeing more and more exclusions if they're able to get coverage [00:22:00] based on what their manufacturing environment looks like and the, the cyber hygiene of, because the insurance companies are getting smarter.

Craig They've really taken a hit the last couple years, and they're beginning to ask those questions of manufacturing clients, and they're not just allowing them to check a box

Jim Yeah. Yeah, yeah, yeah, 'cause they're not a charity. They're, insurance companies are around 'cause they make money. They're going to make money on you, right?

Craig Yes, they are. So let's, let's go back. So from an organization, they, they really have a couple things they can do. One, they can do nothing. They can s- they can basically do nothing. I think that's a very poor choice, but that is always a choice. You know, they need to look at what's their loss if the manufacturing doesn't manufacture?

Craig You know, somebody, financial analyst or the CFO, they know what their cost of downtime is per hour or per day, or whatever their measuring [00:23:00] stick is. So if, if something happened, and they would identify this in a tabletop exercise or whatever, in the event your manufacturing is offline or, pick a timeframe, one day, three days, whatever you feel from an organization your recovery might be, what would that cost be?

Craig And then kind of work back into a number of, okay, our let's call it loss opportunity is X. Okay, so what do we need to do to protect that on the front side?

Jim Right. 'Cause I, you know, I... And I've run large departments and large budgets before, and somebody always comes up,

Jim and they come up and they go, "Oh, okay, we need to do this." And I say, "Well, what are our options," right? That's gonna be the first executive's cost and, or question, right? you know, so-and-so comes up. I'm not real familiar, and this, this very intelligent person comes up, puts a case in front of [00:24:00] me, and says, "We need to do this."

Jim And I'm always going, "Well, okay. Well, what are our options?" And then what you just said is always an option, right? Do nothing, right? Do nothing. Well, that's an option, guys. I, I'm not saying it's the right option, but it is an option. We see a lot of companies do that and go, "Ah," And then what we see in, in contrast to that is all right, well then- well, what, what can we do when we start talking about the OT?

Jim Well, okay, well, over the last 20 years, we've connected all these machines up and connected them to the internet, so that, that's why we need to protect them. We go, "Okay, so if we don't need to buy all your OT cybersecurity plan, what, what do we do with the equipment?" You can go, well, you can go backwards, you can disconnect everything, but you're gonna feel that pain too, right?

Jim all right, well, why do we need to go do that if we have all this old legacy equipment out there? Why can't we just go out and just replace all that legacy? Let's w- we refresh equipment all the time in the [00:25:00] IT side. We don't have XP out there, Windows 7, Windows 10. Let's just go out and replace everything.

Jim Okay, well, you can replace everything then, and, and you're not gonna have the money to do anything after that. I mean, that's millions and millions. You're talking machines. So you're really left with the option of you really need to move forward and reduce some risk, right? and so if you just kinda... I- I- I- If someone's making the case to an executive, you can present those as options.

Jim Look, okay, we can go backwards, or we can do nothing. We could just let it run, and you know all these risks out there. Or we can go backwards, disconnect everything. Or we can just replace all the legacy equipment, which any financial person is gonna go, "Holy cow, do you know how much those machines cost?"

Jim That, that, that'll put us in financial ruin. And all right, well then what's, what's left? Well, what's left is we gotta move forward and reduce our risk here, guys, right?

Craig but on the, the, [00:26:00] along that same line, and I heard this yesterday at a conference I was at, is when you're looking at that risk, you need to build in the probability of that happening.

Craig What's the probability that that risk is gonna occur? And it's not practical to believe that you are going to eliminate every vulnerability in your environment. It's, you physically don't have enough money, you don't have enough time, you don't have enough resources. That is not an option to... it's a goal maybe, but realistically, we need to say, okay, here's, once you've done the visibility, once you understand what your risk is, sit down, prioritize, say, okay, here's our top three, five, 10 things that are the most costly, the most riskiest, whatever that criteria is.

Craig Here's a game plan, a roadmap for six months, one year, three years, long-term, over five years, and really begin determining [00:27:00] what that looks like. But this is a, it's a marathon. It's not a sprint. This is a long haul. Organizations forget that.

Jim Yeah. A- and I mean, that, right, and, and, and that's a great point with the risk management, right?

Jim So there, there's a risk management group out there. They have a mis- risk management process. Maybe it is part of the CFO. Maybe you have an entire group out there, which is the likelihood. But they have a risk register from a business side, too, right? and that, this needs to be part of it.

Jim Cybersecurity's probably on it, for most companies. I hope that it is you know, for the top 10, and if, if you read like public statements now, uh, yeah, or the public reports, uh, I forget, you know, they're, they're required to, to put something in there about the cybersecurity. Cybersecurity is a real business risk.

Jim What's missing, and that's where you kind of have to leverage that and go, "Okay, are we doing the same thing with the OT cybersecurity and the risk management, and take that same approach," right? Because cybersecurity, [00:28:00] uh, I- is getting funded because the business does realize that is a risk.

Jim how do they realize that? they did some math behind it on what's that impact, and they know that that's real. You need to do the same thing for the OT cybersecurity and go, "Okay, in addition to cybersecurity, OT cybersecurity is becoming more and more of a risk as these threats evolve, as, as technology comes up, uh, you know, i- is connected, more connected.

Jim As new technology comes in, as the legacy technology gets older, uh, those risks are increasing." Uh, so that needs to make your risk register if you've got one. If you don't have one, well then, the, uh, yeah, good luck, right? Um, you should have a business risk register. whether how formal or informal that process is, that should be on there, and that's gonna give that executive visibility to where they, you know, go, "Rut roh, Raggy," right?

Jim Did I get it right? Rut [00:29:00] roh,

Craig Raggy. Y- yeah, and that register could go anything from we accept that risk because it's low and it's marginal, to that is an immediate funding and a priority for the organization, and we will move with that within the next quarter or whatever their time windows are. And everything in between.

Jim Because if, if, yeah, if it's not an immediate, well, it'll become an immediate when they do have a failure.

Craig I've s- we've seen all the, we've seen all those means. Cybersecurity budget before breach, zero. Cybersecurity budget after breach, here's a blank check, fill in what you want. So yeah, you don't wanna be in that situation.

Jim Yeah, and that, you know, and that's the message to the, the executives as you're building the case, right? Because executives are focused on creating value for the business, right? and this is, uh, protecting value for a business, for the business case. I, I still believe, and we've-- I think we've done some on the actual.

Jim There, there's [00:30:00] actually bringing value to, w- with these tool sets from an operational standpoint, operational resiliency, OE, that kind of thing. But, you know, to get the attention, to get the executives to build that case, to get moving,you know, that, that's the, the perspective that they need.

Jim They need to know, this is a real business risk, guys, and we need to start addressing it before, before this happens because the... What's the mantra in cybersecurity? It's not a matter of if, it's a matter of when,

Craig But when. Yeah, and you don't wanna be trying to do this in the middle of an incident.

Craig That is the absolute worst time to try and figure it out. Your team is focused on other stuff. And, there are tools out there. I know that on our website, we have a, a budget tool, if you wanna call it that, where we have a, a work paper or a worksheet that just gives a, a talking points of some of the things that we just went through of where should you start, what are some things to think about, [00:31:00] to consider, that kind of helps build that case that whether that be the operational team or the IT team that's responsible for security to begin putting things on paper and escalating it up within the organization to build that case.

Craig You know, so this is not- You know, it's not rocket science unless maybe they're making rockets, and they could be rocket science, but-

Jim right. So be- before we wrap up, I want to throw one other thing that's out there, uh, that I, that I've had that kind of, uh, resonates on, on a few different sides. Uh, uh, and it's, it's a term called technology debt, right?

Jim And the IT guys understand technology debt, right? They go, "Okay, you can't let the debt overwhelm you because then you're in for a major overhaul," right? This is what they've learned over the decades. Oh, well, XP and then Windows 7. So they, they have these refresh cycles, right? And the life cycle's a lot different, but they're really focused on avoiding technology debt.

Jim Well, I like to [00:32:00] play that term onto the OT side and say, "Well, you have a lot of technology debt 'cause you're running equipment out there for 20 years." Now, the model's different because it's a major, major investment for a business to buy some of these machines, centers, and equipment, and plants. but you know, I would say to the executives and go, "Well, you- you've been living on technology debt because y- you already got a lot of the payment on it 'cause you put in equipment that had, And, and you, you retrieved the efficiencies out of that automation, but you never paid for the security when you brought it in," right? So, I mean, it's more of a conceptual, and you can put money to it, but if, if, folks out there got, uh, they have some sort of process, to, to account for technology debt, that's a, it's a, it's a great way to, to kind of communicate that, right?

Jim hey, that efficiency with this automation, that's where you make money, but you didn't do everything that you should [00:33:00] have done, right?

Craig Well, it's, it's kind of like my automobile. I bought a car. I've got 345,000 miles on it, and all I've done is tires, brakes, gas, and oil, and it was depreciated 100% 15 years ago.

Craig So it's been paid for over and over. You look at these OT machines that are 20, 30, 40 years old that are fully depreciated, they've values there, and they've not done anything with it except continue to use it

Jim Is, is your c- your hoopty, is that what you're referring to? does that even have seat belts in it anymore?

Craig No. No.

Jim No

Craig more.

Jim No.

Craig Mm-mm. I cut those out immediately.

Craig Well, thanks for everybody for w- for following along with us today.

Craig Again, this just gives you an opportunity to, to take the next steps to start the process. Budgeting is, is the beginning phases of getting the money to do it, so we all have to figure it out. so you guys have a great day, and we appreciate you following along.

Jim I'll just, uh, [00:34:00] reiterate, I've said it before, you gotta get started.

Jim One of the things with making a case, remember to talk to, talk to the executive at the executive level. make sure that they understand the impact, uh, the ownership. And, if you're a multi-site, think about carving one out and showing real quantifiable issues that you have at a facility. That is going to speak much stronger to an executives to build that business case when you have real examples in your actual plant that are risk, and you're not just talking abstractly about the possibility of it.

Jim You can say, "Here are some things going on right now. We need to fix those, and we need to find out whether they're in the rest of the organization." And that is a great way to build that case, right?

Craig It's always more powerful with your own data. 100%, yeah. Yeah,

Jim yeah. So I'll do the official wrap-up sign-off then.

Jim How about [00:35:00] that? So-

Craig All right, deal.

Jim All right. Well, thanks everybody for joining us on this episode of, uh, What Are We Talking About Today, right? Is that,the case for, building OT cybersecurity budget. thanks again, and look forward to, joining in our next episode. Intro/Outro: Thanks for tuning in to the Industrial Cybersecurity Insider. Intro/Outro: To stay up to date with our latest episodes, be sure to click the follow or subscribe button now. And if you found this podcast helpful or have a topic you'd like us to discuss, please leave us a review or let us know. Thanks again for listening. See you next time.