The Silver Tsunami: Manufacturing's Talent and Knowledge Retirement Crisis

Dino I think what I would say, though, is on the OT side of the House. We're not seeing a lot of that traction per se. Intro Welcome to the Industrial Cybersecurity Insider. In each episode, we dive into the world of industrial cybersecurity. Join us as we cover the latest trends, innovations, and practical insights as we talk with leaders and practitioners across the industry. Gear up and let's get into this week's episode. Craig Hi, I'm Craig Duckworth and I'm Dina Busalacchi. Are you sure you're Dino Busalacchi today? Dino Positive. Craig Okay, sometimes you change. I just want to make sure you didn't. You're not going to be somebody different today. So I think today, Dino, I'd like to talk about two things. But before we start, I don't know if you saw it. I know that one of the technology vendors we work with raised another Four hundred and thirty five million dollars yesterday, which put them at a six point one billion dollars valuation. they just announced in August that they're at three hundred million RR. So these vendors that we work with on a side note, are rapidly growing. This is becoming a quickly adopted industry, which is huge. So I just wanted to give a real quick shout out on that. you know, just from a, a size and scope and make sure everybody was aware of that. Dino that's great news. And I think it's showing that this industry is starting to move in a in a positive direction. I think what I would say though, is on the OT side of the House, we're not seeing a lot of that traction per se. Right. And we've talked about this many times before that companies that have invested in tools like Armis or Clarity, for example, and have had them for years, they're only picking up, you know, a subset of their assets and their manufacturing environment. They're really not getting what I like calling the last mile, you know? Um, which is where we live and breathe is an engineering organization. And, um, and we've had the back and forth on, you know, how do those IT executives and leaders start building bridges to their OT ecosystem supply chain? Craig Totally agree. Right. as we we talk about, you know, this process I really want to focus on the human element or the lack thereof. You know we've we've talked in the past about the silver tsunami. And I can see your hair is as white today as it ever is. So that's part of it. But again. Dino Young at heart. Craig That's what counts. Right. So but as the aging workforce, especially in manufacturing, which is higher than traditional industries, it's going to be important because there's going to be a very large loss of knowledge transfer as these retiring individuals start leaving the workforce. what's your thought on that? How can organizations begin trying to protect that now? And what does that look like? Where would you say the most dangerous place in the plant would be? Is it the retiring person? It's the person that has all that knowledge from working there fifty years that's now going to walk out the door? Dino No. And obviously that is a challenge. And I think most organizations recognize that. Right? I mean if they I gotta believe there are people team and their leadership team recognizes the demographic and the age of the folks they got working for them and those they're approaching retirement age and where their position within the organization, you know, what happens when those folks leave. And and we both know that the life cycle is very different for industrial control systems and manufacturing space compared to the IT space, right? Laptops around three to five years. Control systems around are measured in decades. And so there hasn't been a lot of capital investment on lifecycle replacement. You know, moving that needle forward where you're still dealing with very old technology, but yet it's been connected over the last two decades, last ten years Covid. we've seen this, mountain of remote access for a whole wide range of reasons, whether it be business related, support related people can't travel related, that have visibility and access into those environments. And what organizations haven't done is, shored up. What is that cybersecurity in that plant? What does it look like? Right. Meaning, you know, we always say think globally, act locally, right. It is more of a centralized organization in the way that they operate, the way they're put together versus ODT, which is very decentralized. Right. And so if you're looking for where is that odd in server that's out there? How are these VLANs connected? What kind of changes are made during different production cycles and line changeovers? You know that that activity at that plant level is how do you tap into that? Right. That's what's going to happen as these guys retire and leave is understanding, you know, the inner workings of these plants. Right. And the assets that are in right. And I'm one of those. Right? I mean, I've lived through, you know, all the way back to the early nineties and you think about, you know, how we started with mechanical systems that were air gapped to moving towards connecting them and then Y2K, you know, preparations and then living through the whole dot com thing and then going through the Covid connectivity. There's a lot of knowledge, you know, in these environments and bringing somebody in that's young you know, where I've seen young, you know, engineers or plant people go into a plant and walk up to an HMI. that's a panel view and treat it like their iPhone and trying to, you know, move the screen. So scoot around. It's like, what are you trying to do? It's like I'm trying to expand it and flip through. It doesn't. It's not how things older than you are, you know. Craig Yeah. And I, I get it and I see the same thing. But you know, it's I think it's going to be important as the industry is starting to tackle these, challenges. You know the younger. Workforce are all accustomed to their iPhones that expand and contrast and move and all that stuff where, you know, maybe there should be a I think of an apprenticeship or a co-op or something like that, where the young are starting to migrate in and their skill sets are different than that of some of the the exiting, retiring older generation. Dino Well, I think part of them need to come out of the industry per se, right? I mean, even if you go back to networking and I can go back as far as when they broke up, Ma Bell, which really started the foundational aspect of the internet becoming being used more commercially and all that talent come pouring out of, you know, Ma Bell at the time and all the technology. But those were folks that worked in the industry, and then organizations eventually were able to grow and hire talent to come and help and build enterprise networks. Right. And I think the cybersecurity on the plant floor is going to have to be the same. I mean, the question, who owns cybersecurity in the manufacturing plant? And I would say no one and everyone. Right. Craig It has to be treated like safety. It's got to be everyone's responsibility. and right now again I say this all the time. There's a lot of people with responsibility for that, security and almost no one with authority for that. Dino And the reason why they don't have authority is because they don't understand the inner workings of how that plant operates to produce the goods that generates revenue for the organization well enough to be able to work in there without being disruptive. Right. To be able to do the things they want to do in order to improve the cybersecurity posture shored up and at the same time, not slow the plant down, knock the plant down. Or, you know, how many times have we heard cybersecurity in the plant? It just gets in the way of getting things done right, especially when it's coming from somebody outside dictating to something they know zero about. On how this machine or these process centers work within this plant. You know, you have to speak their language, which means, you know, to me, it goes back to the OT ecosystem has to get better at this. They have to start driving this narrative because that's who these plants trust. It's who they work with. It's who they buy from. and do they look for support when things aren't going well? If my drives aren't running well, to keep my packaging line running most effectively, and a lot of these organizations don't have controls engineers on site anymore, they got operations people. But if they need somebody to help them program their PLCs and determine, you know, why aren't my, you know, uh, frequency drives working correctly? They're usually reaching out to some engineering firm to help them with that. Right. So that talent isn't even necessarily in the plan, let alone how am I going to provide security around that without being disruptive and be able to do things that are actionable to help me improve my cybersecurity posture? Craig It leads me to think that, you know, is the OT industry leaning toward more of an IT model of outsourcing and not so much having it all in-house, you know? Dino Yeah, I think you have a point there. Back to the resource issue, Do you know? How are you going to find this talent that knows how to do this? They're not just out there on the street waiting for you to call them. You're going. Craig To. Dino Have to grow them. And then how do you grow them when you really don't have a good strategy or plan in place, or your IT team is the one that's managing it, but they don't have an operational background, you know, the production background process background. Right. And so how do you how do you fix that. Right. And so your best bet if am I a CIO or a CISO and I'm and I have, you know, large or medium sized manufacturing, I'm tapping in to who my plants are using and relying on and supporting them and helping keeping these plants running to determine what kind of practice do you have? What kind of resources do you have? What kind of partnerships do you have in regards to my strategy around cyber security? Back to I have the responsibility. I'm working my way towards authority, but I got to get plugged into the people that are really helping drive that because the plants aren't necessarily driving it. They're just end users. Craig Right? Dino Yeah. Predominant there just end users, you know, the people that design and build the machines or it's like. It's like a car, you know, you buy the car, you're the operator of the car to do use it for however you see fit or a truck, but you're not the one that built it, right. You're not you're not the engineering team that built that vehicle to do what it needs to do. Right? And that's the people that it hasn't gotten their hands on yet to help them with the plan and strategy that they're trying to pursue. Craig Yeah, and I see that. And I think that that's definitely plays into it, but again, it's bigger than that. I think it's industry wide. It's how do you help articulate the real risk and measure with dollars and cents and equate that to organizational risk to get that buy in and to get that authority for making changes on the plant floor? A lot of times it's, seen as well. You know, you need fifty million dollars to do whatever you want to do or a million dollars. And and we see no return on investment. But to say, hey, if you spend a one hundred thousand dollars and we protect two million dollars worth of revenue by doing whatever this is by by securing this packaging line or reducing risk for this filler or whatever that task is. Sea level. Understand that number, that metric. If I spend one hundred thousand dollars to save two and a half million dollars, that's a no brainer. I'm going to say, here you go, run really quick. Is there any other ideas like that that you can give me to spend more money? Dino Yeah, well, and that depends on how good they are tracking their OE. Right. How, you know, their EMS systems that they might be using to be able to determine what that metric is, what an hour downtime cost me, and how much do I how much downtime do I take that's due to the ghost in the machine versus something that was planned or, you know, the machine just broke, you know, or there was a regularly scheduled maintenance. You know, we lost power. You know, those are identifiable. But what about the things that are unidentifiable that cause that? Right. That's human error. Changes to the control system somebody wasn't aware of. maybe pilfering around inside your network somewhere and being disrupted, those control systems to be able to test that. Back to your point, to say, look, you know, there's a black hole in the middle of my plant. I sunk ten million dollars into it last year. And I don't know why I can't I can't put a metric on why I lost several million dollars in production and an opportunity cost in that plant. Right. Craig Yeah, let's look at some of the other stats on the, aging workspace within manufacturing. A couple of things that I, I found interesting that, you know, eighty two percent of the labor force that left manufacturing for all reasons, were for retirement. Eighty two percent not turn over, not going to another job, simply retiring. That's alarming to me. To me, that should be a wake up call to how do we get younger talent, either from the education system, the schools, from trade schools into this area to start supplementing? Because if not, there's going to be a even larger talent shortage in there. There's got to be some time window to transfer that knowledge over. Dino I don't know if this is unique to the United States versus overseas. Right, right. maybe they're not having the same problem, but I will say is that it's very hard to get, um, the younger generation to go work in an industrial environment. That's kind of old, right? It doesn't have great technology, latest technology. Right. It does what it does. You know, I used to work in the beer industry. If you wanted to be the greatest networking guy, you know, to build global enterprise class networks, then go work for a company that does that. We make beer. Craig Yeah. Dino And so if you have that mindset, you know, from a manufacturing standpoint that we make widgets, you know, we're not in the technology business, then you know, you're not going to attract the talent that you're talking about. The only way to to to do that and be effective at it, even to protect your older systems, you're going to have to go outside and bring somebody in that does this as part of their practice. Right? Craig Yeah. Dino and some do. Right. They it has been they've done this for decades. Right. They go out and and find organizations to help supplement and or run complete applications or the infrastructure portions of the enterprise, whether it be maintenance, support, development, whatever it might be. And they've leveraged that. We haven't seen that in the manufacturing space, except for the engineering teams that are out there helping them with the machine centers that are being designed and built, maintained and support. Yeah, but they're not bringing their A-game when it comes to cybersecurity around those control systems. Right? Craig Right. Dino They're not doing that. And we know that because we're in this industry, we have these conversations and it's at all different levels, right. you know, until you get to the point where you have a manufacturer who's working with an integrator, an OEM, and if you don't have the right boxes checked for them, meaning that you have partnerships with the armistice and clarity's and Cisco's right around just using those as examples, you don't have a practice. Um, you're not implementing the types of technologies that help me improve my cybersecurity posture. I'm not buying from you. I got to go find somebody who does. I actually heard that from, uh, an OT cybersecurity guy from a very large organization basically there to that point, if you as an OEM who might have the coolest machine in the world, we really would like to have, but if it doesn't meet these specific requirements, because he was talking about a machine that they had bought just a year or two ago that came in with windows ten on it. Right? And it was like within six months the OS was going to expire. And I've seen this before. It's not the first time I've seen this. You know, they're like, are you crazy? It's like, yeah, those guys are still selling that stuff and their company is still buying it. Craig Yeah. Dino You know, and that's back to, responsibility and authority, you know, where somebody comes in with a hammer and says, let me review the technology that we're buying on this machine. You know, it's like buying a car today and, you know, it doesn't have certain safety, uh, precautions on it. You know, there's no seat belts, you know, no horn, no headlights, you know. Craig And an eight track tape player. Dino You know, we're only gonna drive it during the day. And, you know, we're driving at ten miles an hour or whatever. But my point is, is that you're not going to buy that vehicle. Right. And but we still have manufacturers that buy equipment that's out of date before it even lands in the plant. Craig And that's a fault, though, Dino, I think of the industry, these tools and technologies are designed to last twenty, thirty, forty years. If I'm making a pick up, a plastic blow molder or whatever it is, and I make this in. Italy and I'm the only one that makes it, and I want to change my processes once every ten years because I freeze the technology, I freeze the components, I freeze all the stuff, and I make stuff for ten years, and that's all. It's the exact same thing for ten years, the same product, everything. And then, like the last in year eight, I start trying to figure out what's my next evolution and then I migrate over, and then that I set all of that in stone, and I go from windows seven to windows eleven. But I forget all the stuff in the middle, because I'm not going to change my process, because I'm the only one that makes this thing and everybody has to use it, and I don't really care. Dino Yeah, well, that can and does happen. Right. Uh, I think it's less and less of that, you know, where somebody's got a chip on their shoulder that says, I don't care about your cyber security challenges and problems. You want my machine buy it? Yep. If not, I got five people standing behind you that will, you know, versus, you know, if you had an engineering team like we used to have back in the day, you go build your own damn machine. Craig Yep. Dino Right. You can do it. It can be done. Or you go find somebody and you can build it yourself if you got somebody. But you know that that's playing that card of, you know, my, my extruder that I make for, you know, plastic blow molders. To your point. I'm not. I'm not messing with it. Changing anything around the operating system, using the PLC that I'm using, or anything from a networking I'm still putting in a dumb layer two switch it and I'm still running windows seven, you know? Craig Yeah. Dino Um, all the goofy, crazy stuff we still see, um, you know. And so how do you move forward? You know, if you're not going to make capital investments, right, you know, in your manufacturing environment, you know, to get out of this mess. And a lot of it is back to the, uh, silver tsunami is a lot of those folks that have lived through this aren't signing up and stepping up to move the needle in this direction. It's the next generation's problem, right? Let them deal with it, you know, versus bulldoze the plant. Start all over. Greenfield, brownfield, whatever. We're going to start all over. And but you have to have capital investment to do that. Yeah. Right. Craig But it's easier to to take that old antiquated new equipment and say, you know what? I have to have this. I'm going to buy it. It is what it is. But your network can be micro segmented off. You can protect that asset from all the other traffic and still secure it in a way that's appropriate. If you have that knowledge internally or with a chassis or whatever, but you can't just ignore the fact that it's put on the plant day one and riddled with vulnerabilities, because that just isn't the answer. Dino Well, that's what you have to have a collaborative effort, right? Because, you know, we've witnessed it still happens today. A plant who is trying to follow some IT policy or or governance activity, for example, remote access. And if it becomes too cumbersome, too problematic, too bureaucratic to get in, they will skirt around that in a heartbeat, put in their own remote access, working with whoever they're trying to get in there and bypass it altogether. Right. Because that eighty thousand dollars an hour. Million dollars a day. Whatever it is, I'm not waiting for the people that are dragging their feet who don't care whether this vendor who can help me fix my drive problem can get access in the next couple of weeks. No, I need them in there now, you know. Craig Well, again, if if I'm in Italy and my choice is get on a plane, schedule it and get over there, That may be three or four days at your point, a million dollars a day or whatever that number is that doesn't work for the plant Here's your access right now. Come into my network. Do what you gotta do. Diagnose it, figure it out. I don't care what the consequences are to my security. Hygiene. Here you go. Open port. Come do what you want to do. Dino All right, well, then, that's the difference. Like I said earlier, centralized it decentralized ot. How does you get it to start acting more like decentralized centralised model, which means you have to be ingrained. It has to be a significant amount of collaboration relationship in there that's trusted and valuable, and you're accountable for that million dollar a day loss because of your inactions or your actions. Right? Because that's the way the plant people look at it. That's them. They get comped on that. That's how they get paid. That's how they get bonuses. Whatever. Being safe and being able to generate revenue the most effective, efficient way as possible. So how do you get it into that model and not sit in some ivory tower trying to dictate where they'll just shut you off and ignore you? they'll do the minimal. But when it really comes to control to the assets that you don't have your hands on it, that you don't manage or support, they're going to do what they need to do to be successful. Craig And we see that all the time from bringing in completely separate ISPs into the plant because they're told you don't get internet access, they just drop it in, They pull it up across the board. So. Dino And that's where I think it needs to broaden their partnership arrangement and try to find out who is operating and running in my plants. Right. Because one plant on the East Coast is going to have a different set of operators handling your plants on the West Coast, right from an ecosystem perspective. Right. And so you're going to have to to build bridges and relationships and partnerships and try to find out who these folks are that are working their plants, because they're the ones that can help you with your initiative. It's not going to be the plant guys because they don't they don't have the skill and they don't have the time. They don't have the resources. They don't have the budget per se. You're going to have to go to the folks that they really rely on to help them keep their plants running. the problem the plant bounces from tier one to tier two, tier three support after tier one, you know, you send out the mechanic or the electrician Attrition or some some guy, you know, that's running around with a toolbox and he goes, yeah, this is something else. And then it bounces up. Then you're into the I gotta go talk to the controls guy or get to the OEM guys. You know that that's the gap that that needs to be fixed right there. Right. And that's who it needs to start going. Who's working in my plants and programming this stuff and selling me this stuff and configuring it and helping me maintain it and determining what firmware is running on, what operating systems, on what software is running on it, all of these things. That's where it's got to go from centralized to decentralized to be successful in these manufacturing environments. Craig No, totally totally agreed. it makes sense. and hopefully organizations are starting to take advice and do that. we've beat that horse and we've preached that sermon nonstop for two years already. Yeah. And it's beginning to get adoption, but not really. Dino Yeah. I mean, if you're talking to the CIOs and CISOs and you're having this dialogue where where what are they thinking, right? What are they really thinking? You know, from that context, you know, how are they trying to manage that, landscape to that extent? Because we work with the other side of the fence. We work with the OEMs and the system graders, not only our competitors and our colleagues and our peers, but that conversation is not being had to this day. Craig So some of them, I would say that message is being taken two ways. You got part of them that are saying, yeah, I hear you, but I'm not listening to you because my tools, technologies, I'm smarter than you. I can figure this out. And then you got some that are like, you know, I've not thought of it that way. That's interesting. And they really, honestly, truly want to learn and want to make a difference and really want to help the situation. Those are the ones that where we see successes versus that round peg, square hole mentality of, you know, I can do this with my own tools and they really can't. Dino No, it goes back to what I said earlier. Who's responsible for cybersecurity in the manufacturing plant? Everyone. And and I just we've been doing this long enough to know you know, we've witnessed it. we've seen these tools. You talked about armis and and their, growth. And we've seen their tool in action. We've seen their tool in the field for years. And every time we walk into a manufacturer, it's been using their stuff or their competitor stuff. They're seeing less than half the assets that that manufacturer has. So what's the point? You know, what's the point of the fact that you bought an OT tool that's that's seeing half your OT assets or a third, you know, and there's no actionable stuff coming out of it, you know, from the events and the alerts, how you organize and how you're prioritizing. how are you tackling the events that are being uncovered in your plant? Who owns it? Who's resolving it? You know, Craig But I don't know if that's a tool issue that's more of a, process issue. Yeah. Dino It's not it's not a tool issue. You're right. It's not a tool issue. Craig The tools can absolutely pick up the assets. But if it's just dropped in at a an IDF or corps backbone, you're only going to see nothing. Dino It's people in process. Craig Yeah. Totally agree. Dino It's not the technology. It's his people process. Craig But you're right, they're not they're not making the effort is what I would say. Dino Well, I would say they don't know how to make the effort right. Meaning that it's not a game that they know how to play because they don't play it every day. They play it in the enterprise. Correct. And they've been at it for a while, you know, chasing printers and servers and applications and laptops, networks. But then you got a whole nother set of assets within your environment that you don't touch, you don't work with every day. Craig And you're not familiar with and you don't understand the process behind them. Dino You weren't even behind the decision making process of what control systems it was bought back to your example with the machine out of Italy, right? Yep. I guarantee you it was a part of that conversation. That was some some plant team that went out there and reviewing, you know, gas cheese shaker can makers and going, yeah, these guys in Switzerland got the best one we've seen. Let's just buy that. And it shows up on windows XP, you know, and I'm plugging it into the network. Craig Yeah. Dino Running around is an IT executive saying get that off of my network is a non-starter. Craig Yeah. Dino You can say that all you want back to your responsibility and authority. But that machine stays. Because if that machine's not running, this plant's not running. And that's going to cost me a million dollars a day. Craig Again. It's a it's a revenue thing. It's, you know, my assets regardless of new, old, antiquated whatever make the revenue for the business. And without them there is no business. So how do you have that marriage? How does that look? As you know, you go back to the, you know, the topic of, you know, as these aging workforces are taking that knowledge away, how do how do they fix this and try and bring that in and, and resolve part of that issue? Dino Well, there's there's a lot of paths, right? There's AI, there's virtual, you know, the technology can solve a lot of those challenges that you're talking about. Craig The repetition that. Dino Requires investment right back to the capital spend. Right? I got to move from a twenty five year old piece of equipment where I got to do re control or put in a new piece of equipment that has more state of the art technology with cybersecurity built in, right? I mean, we talk about this, think about organizations that have bought a tool like Armis have had it for years. We're out there building packaging lines for them, making, building the panels, designing and building the panels. And they're not putting Armis technology down around that new packaging line. Craig They need to put. Dino It in. Craig Every single panel they replace or build, period. Dino Yeah. It's like you just you just forwent all your security protocols that you've been driving somewhere within the organization, and you're not putting it in this twenty million dollars packaging line that you're building that's going to have a dozen panels wrapped around it with a dozen, you know, twenty PLCs from start to finish of, you know, packaging and filling cans or bottles of your product. Yep. Right. And you got no visibility. You have no visibility into it whatsoever. And it's like, why? Right. You know, and it's not a matter of, if you get hit, it's a matter of when you get hit. Craig It's it's coming. Yep. It's absolutely coming. Well great conversation, Deano. I think that, you know, definitely something to retire. Dino I got the gray hair for it. Craig You've got probably twenty more years. And then you can. Sunset. Dino True. Craig All right. I'll give you eighteen. We'll let you go when we're done. How's that sound? Dino All right. Craig All right. Have a great day, buddy. Dino See you next time. Intro Thanks for tuning in to the Industrial Cybersecurity Insider. To stay up to date with our latest episodes, be sure to click the follow or subscribe button now. And if you found this podcast helpful or have a topic you'd like us to discuss, please leave us a review or let us know. Thanks again for listening. See you next time.