Trust But Verify: Why Every Air-Gap Claim Deserves Scrutiny

Dino [00:00:00] We find cradle point cellular modems in that machine center. We find third parties that show up with their own laptops that they allow into the plant to walk out there to plug into that machine, or it's got some VPN concentrator in it of some sort that's allowing VPN connectivity all the way through the organization's enterprise network down to that machine center, completely invisible IT,

Intro - Outro Welcome to the Industrial Cybersecurity Insider. In each episode, we dive into the world of industrial cybersecurity. Join us as we cover the latest trends, innovations, and practical insights as we talk with leaders and practitioners across the industry. Gear up, and let's get into this week's episode.

Dino Hi, I'm Dino Busalacchi, And with us today we have Jim Cook.

Jim Hi, I'm Jim Cook,and thanks for [00:01:00] joining us today, What are we talking about today, Dino? I love that lead-in that you go in like that. That's great.

Dino Uh, we're, we're, today we're gonna talk about this, uh, this myth of the gaps between industrial control systems, OT, and

Jim when I saw the, that we're talking about the myth today, thought maybe we'd be talking about Bigfoot or the Loch Ness Monster, but, uh- Mythical, right?

Jim No, uh, we're talking about the OT myth, right? I think that's, the OT air gap myth, right?

Dino We are,

Jim right?

Dino it's the, th- I think a lot of it is just the comm- lack of communications between those two groups, right? The fact that they're not intertwined with each other in regards to the day-to-day activities of machine operations, plant production, plant floor,manufacturing.

Dino And what IT is typically responsible for on their day-to-day [00:02:00] activity as far as taking care of infrastructure that's primarily concerned about business systems.

Jim Right. Well, I, I, it's a great example. I was out on the floor this week, and, uh, two different answers where you walked on the floor, One said, "Don't worry about that equipment. That equipment, not connected. It's air-gapped. Not connected." Talked to a guy around the corner, "No, all that stuff, that's connected," right? And even in the same facility, that communication isn't there, and that assumption of, "Oh, well, that's air-gapped," doesn't stand true, does it?

Dino No. it kind of boils down to responsibility, right? Who is responsible for that asset, that plant floor machine? If it's not running for whatever reason, who's gotta get it back up and running? And I will, I know IT doesn't have that job, right? And so how do they know how the OT people solve that [00:03:00] problem, right?

Dino And we know there's a, there's a myriad of ways that happens, right? We find cradle point cellular modems in that machine center. We find third parties that show up with their own laptops that they allow into the plant to walk out there to plug into that machine, or it's got some VPN concentrator in it of some sort that's allowing VPN connectivity all the way through the com- organization's enterprise network down to that machine center, completely invisible to, uh, IT, right?

Dino They don't know what they're going to, they don't know what they're doing, they don't know if they're doing upgrades, if they're changing anything, file transfer. They don't know if they're scooting around and looking at other things that, that shouldn't concern that third party that's looking at, at other machine centers in that environment just because the way the control systems network.

Dino It's not their concern, and we see that all the time, right? I mean, when you really get into the, the nuts and bolts of it when you're out on that plant floor, and you get all the liars in the same room, as I like calling it, and to your point of your meeting last week, [00:04:00] all of a sudden you realize that they're not on the same page.

Jim no. I had to d- introduce them to each other, and I think they had worked together for years.

Dino and I've seen that, too. I've witnessed that. I, I, I've, I've met IT directors at manufacturing environments that have been there f- managing that infrastructure for 10 years that don't even know what a PLC or an HMI are, you know?

Dino They don't know what those things do or what they, what they're all about, right? And so th- they would normally

Jim Yeah. and it stem, it stems from, the I- like you said, IT's not my job, OT, they're not thinking about it. They're just getting support. So nobody's asking the right questions, getting everybody in the room, introducing, "Hey, Steve, Bob, y- you guys have worked together for five years.

Jim Tell your version of what that machine is doing," right? And then suddenly that myth sort of just flutters away, right? holy cow, we didn't even ask that question. We didn't even think about that. Hey, I, I wanna talk about a couple of things 'cause we, we always hear this, right? 'Cause the, that's the not connected, right?

Jim "Oh, don't worry about that. We're air-gapped. We're not [00:05:00] connected," right? A couple of scenarios that, that I love to see, right? I- And one, one is, uh, "No, no, uh, we're not connected." Okay, t- you always ask the question, "Well, what... Well, how, how do you get remote support on that? Do you get remote?" "Well, yeah, if something breaks down, we gotta get remote support."

Jim "Well, how do they get in if it's not connected?" "Oh, they dial in," right? And we're like, well, all right. I mean, you and I got enough gray hair to remember the days of dial-in, and you actually had a dial-in modem, and it wasn't connected, and somebody dials in. But that's not the case, right? It's, you mentioned it before, cellular modems, right?

Jim And they might use the term dial-in, but hey, your machine is actually connected to the internet, uh, you know, where via this, this cellular modem. Boom, the myth disappears, right? what's another one? oh, another one I love, Dino, is,when those devices in there, you mentioned some, like VPN concentrators, maybe there's switches.

Jim some of those [00:06:00] have dual purpose, and they have, Wi-Fi capability in them. And the, you know, one of the great ones we've seen is, uh, yeah, it, we needed support, so we just hooked it up to the guest Wi-Fi, right? Right? The guest Wi-Fi. Well, uh, is that what it's for? No, but we needed support. Therefore, suddenly this machine is connected, and it was, it was there for years, uh, for all we know.

Jim Th- I mean, those are some, some great examples of that, right? We've got others that we run into all the time, and we get that answer of, uh, "It's air-gapped. Don't worry about that," right?

Dino yeah, and it's, you know, there's a cost associated, right? Downtime is very, very expensive. And that's why that remote support is really, really important, right?

Dino 'Cause, having a few hours of downtime can cost you tens of thousands or hundreds of thousands. You have a day or two of downtime, it could get up into the millions. and that's not a pain point that IT organizations feel, right? The plant does, right? And so that's why they, they cook up these, [00:07:00] Remote access, connectivity strategies into their environment.

Dino I've seen plant managers put in their own internet access. They didn't care what IT had to say, or the enterprise. It didn't make any difference to them. If I need support, I don't wanna go through all the rigmarole of trying to get somebody in here to fix this machine that's costing me 50 grand an hour.

Dino I need to get that thing back up and running, right? and IT can pound their chest all they want, and the plant manager, that's how he gets comp, right? Is how well that plant, operates. So he's getting things done, right? He's getting the stuff out the door. and so IT at some point, they just, I don't wanna say they give up, but they play in their sandbox.

Dino You know, whatever that, whatever their, uh, D mark is within that plant. And anything on the other side of that is not their problem, right? and so when you get into, into the business that we're in, you know, when it comes to cybersecurity, you know, the, the, we have to change this dynamic. And, and a lot of it is just getting these folks together and having a conversation, just like when you [00:08:00] introduced those two guys last week to one another.

Dino you know, "Joe, meet Sally. Sally, meet Joe. You know, let's, let's talk about what's going on in here, what's really going on in here," right? And, um, and start trying to d- determine how can we do a better job of securing and protecting this environment, right? What does this remote access look like? You know, how's it being handled?

Dino I mean, we were at a client a few weeks back, and the way that they handled it is they just had cable that they would plug and unplug when they wanted that OEM in, right? The cable's just dangling inside the panel, right? This isn't a rack for you IT folks. This is a machine center out on the plant floor where PLCs and HMIs and drives are at, and there's a dro- drop dangling in there that's coming from the IT network That when they need that third-party support, they just walk out there and plug it into the switch out there on that, on that floor, right?

Dino And then, but nobody can see what's going on. That third party gets in there, they do what they're doing, and nobody's the wiser. You hope the controls folks, who have no tools to monitor what's going on in there per [00:09:00] se, that alls they know is the filler that I had that wasn't working correctly, within an hour they had me back up and running.

Dino That's all I care about, right? And s- now, now the question is, well, did they unplug the cable or did they leave it in place, right? And nobody knows. You're just hoping that whoever plugged it in was smart enough to go back out there or remember, you know, maybe tied a string on his finger or something, say, "Hey, you need to go back and check that, that, that connection to make sure you pulled it off," right?

Jim Yeah. Ano- another variation that's scenario where we've seen, right? They plug it in, they plug it in the IT network, and IT network may have some sort of blocks on it, and they can't do it, so what do they do? They start plugging it into stuff and see if that works, right? And there's a, there's vending machine networks.

Jim Y- you mentioned even just, uh, plant managers bringing in their own i- internet connection, but, uh, th- you know, there's vending machine networks are everywhere, right? There's actually, uh, OT supply vending machine networks out there, and most of the anyone... Right, they're personal. I mean, great systems, great concept.[00:10:00]

Jim They bring in their own network. But if it doesn't work on the first network, they'll keep trying on that next network, right? And, and, and they'll just plug it in, just like you said, "'Cause I gotta get that machine backed up and running." and, and we've seen that, right? We've seen cables that go off to nowhere, and they say, "I don't know what that's plugged into."

Jim But, uh, those guys can get in, they can get the machine working.

Dino And then you have all these mergers and acquisitions that go on, too, right? So all of a sudden you have a manufacturer that had 10 plants, and now they got 15 or 18 plants that they really are, they're not really even sure what's in there.

Dino They just know what, what it makes. But they don't know, uh, anything about the control system infrastructure. They don't know anything about the network that's in there running inside of that plant. There's no drawings. There's no documentation. The people that built that stuff have left long years ago.

Dino and so now the question is, is how do you even support that, right? How do you even manage that environment in a, in a, in a consistent manner for safety, quality, and from a [00:11:00] security perspective, right? And if you can meet the first two, safety and quality, everybody seems to be happy with that, right? But when it comes to security in that environment, and I'm talking about digital security, cybersecurity, it's tough to find an owner within the plant that owns that.

Dino There's some, there's some executive and some team off in the ivory tower somewhere within the environment, within the organization who kinda sorta owns that. Kinda sorta But when it comes down to that local level, man, there's nobody that owns it. And that's a dynamic that has to change if you're, if you are trying to do a better job, and you're gonna have to get better if you want cybersecurity insurance.

Dino You're gonna have to get better if you're a publicly traded company and your company gets hacked. Now in the SEC regs, you gotta tell your shareholders that, you know, the people that buy stock in your company so that they know how good of a job you are at [00:12:00] protecting this, because we've seen brands take hits with cyber attacks, right?

Dino It costs tens of millions, hundreds of millions of dollars.

Jim And then the hurdles they gotta go through after that, right? for, to get cyber insurance even after that. y- you know, the, one of the things is then how do you know, right? So how do you know with all these things and scenarios, right, how do you find Bigfoot?

Jim How do you find Loch Ness right? These myths. Or how do you dispel the fact that Bigfoot doesn't or does exist or Loch Ness does, in these scenarios, right? Because one, one of the challenge, I'll put this challenge, and y- we touched on, but if you ask,if you go out and ask or if you do a survey, you send an email and say, "Hey, what's connected?

Jim What isn't?" You know, one of the things that we find, we'll run into the, the guys on the floor that are reticent that on purpose they're gonna tell you it's air-gapped. Why? Because if I tell you it's connected, then your IT guys are gonna come in [00:13:00] here and disconnect it, and that's not, you know, my issue is to keep it running, not cybersecurity.

Jim So how do you figure it out when it, you know, it's difficult to get that answer and to get everybody in the same room, Dana?

Dino they definitely will, will try to be evasive when that question comes up. When you have people that know what they're looking for and why they're there, right?

Dino They're not talking about your system integrators that are out there just trying to help you with your control system, to be able to make it run more effectively and do predictive, uh, maintenance on it and things of that nature, giving you some, some level of support, but somebody who's actually looking at the bigger picture of how that control system network fits into that overall plant and how it fits into the enterprise and how it may or may not be connected to the internet, right?

Dino And, um, and so the key in my mind is, you know, how do you educate those folks, right? How do you assign responsibility that as a CISO, you know, what is your job [00:14:00] when it comes to the plant floor? Where do you stop? Do you gonna go all the way down to the Windows 7 machine sitting out there on the plant floor?

Dino Because I, most of those guys, they don't wanna have anything to do with that damn box, right? Forget that. Keep, disconnect it. That's what they would tell you to do. Yeah, but it's running my packaging line. That's how y'all get paid. As long as that packaging line's putting liquid in a can or a bottle or making, chemicals or meds or whatever it might be doing, they're not gonna disconnect.

Dino and the recontrol effort around that could cost millions of dollars, right? And so you're gonna, you're gonna try to say, "Well, we'll just put in zero trust and call it a day." Well then, it's not gonna work very well, and then we can talk about the reasons why zero trust has its challenges in that space.

Dino Again, remote support being one of them, maintenance activities being another one. You know, when they're running around the plant trying to fix stuff, you know, during a planned downtime, scheduled maintenance window, and all of a sudden they can't get to all the process areas, cells, zones, lines because [00:15:00] somebody's locked them out, implementing, you know, ACLs and/or firewall rules around these zero trust strategies.

Dino And all's you're doing is slowing down my maintenance window, 'cause I only wanted to be down for two days and now I'm down for four days.

Jim you know, one of the things that I think is effective in here, 'cause those, those are just tons of challenges to get to the truth, right? Um, y- what we're finding is very valuable is to hire the big foot- hunters, right?

Jim To hire the guys that know where to look to ask those questions, that aren't afraid of it, and that's why we're seeing some success, 'cause just sometimes it's good to get an outsider coming down. And if it's not the CISO who's, w- who doesn't think it's part of their, their scope, and, uh, the OT guys don't think it's part of their scope, we can come in and help facilitate that, and that's why it works so well.

Jim you know, I, I like doing the simple caveman approach sometimes, okay? Is that connected? Well, then how do you do this? How do you do that? If so, can we take a look? Let's [00:16:00] open it up and show that, and we can kind of be that investigator to get to the truth of whether Bigfoot exists, right? And we know where to look, and we know where those, the, those, uh, you know, white lies are to protect production.

Jim And we're not gonna stop disruption. We run into it all the time, right? You know, we've got clients, and we're helping them come up with mitigation so that you're not immediately gonna disconnect it and impact disruption. But i- if you're just gonna ignore it and pretend somebody that, well, they sent an email and said nothing's connected or, well, you know, we were told it's air gapped, uh, you gotta go, how do you know?

Jim Well, how do you know? Have we gone through that investigation, right? and gotten down in there with them to say, "Hey, how is it really happening?" And it's sort of that unbiased third-party look to, to kind of referee. I think we've even talked about refereeing. I don't know if refereeing marital counselors here is the right analogy, but a [00:17:00] little bit of that by saying, "Okay, we've got some issues on both sides.

Jim Let's first start and really define what the situation is here," right?

Dino Yeah. I, I mean- One, one of the things we recognize is we're starting to see the, the landscape, the ecosystem of OT suppliers are starting to build out practices around OT cybersecurity, right? They got a long way to go. Tr- they do.

Dino You know, compared to IT, who's been at it for quite a while, right? And I think if you're a CISO or a CIO, you should take some comfort in knowing that's beginning. But at the same time, back to Jim's point, you have to start looking for those organizations that are doing this type of work with- within your facilities, right?

Dino Who does your company buy machines from? And some, some are very, very specific on who they buy from, and some of them buy equipment from all over the world, right? Just depending on the vertical that you're in, and you got a wide range of equipment [00:18:00] coming in from Italy and Germany and South America, you know, or are you doing your own engineering, working with s- integrators within your, your country, per se.

Dino And the influence that needs to be exerted upon those groups to determine how to, to see what they're doing to get better, to provide cybersecurity technologies within the machine centers that you're buying, right? and that's, that's kind of missing in this, this debate, right? We're not seeing that happening.

Dino We are seeing the practices being built within these organizations, within these automation technology suppliers, if you will, again, that ecosystem of OEMs and system integrators, and even the Rockwells and the Siemens and the Honeywells and the GEs and Schneiders, all of them have developed pr- practices.

Dino You as a CISO or CI- CIO should be investing some time and energy into those companies and who it is you're buying from Right? Who are you buying your packaging lines from, right? Who's building those for you? You're not building them yourself. You're buying those from somebody. You don't [00:19:00] build your own car, you go buy a car, right?

Dino And so who are those folks, and what are you doing to improve that relationship with them if you're the one that's responsible for cybersecurity on that plant floor?

Jim Yeah, and, and, and even with that, that, that gets tapped into the supply chain, right? Like CISOs are, are thinking supply chain from, you know, from a, a digital aspect, right?

Jim So where do I get the hardware, and where do I get this, and what, what component is it using, and what cloud am I dependent on? Well, this gets to supply chain of real supply chain, and I shouldn't say real, of a physical supply chain, right? Where do these machines come from? And then guess what? How are they getting remote support?

Jim How are they connecting them? Because then suddenly there's two and three layers, uh, between them and the vendor. And g- y- you, you should be applying some of those concepts to the, the new machines coming in the door, and you should be pressuring, uh, one, any new purchases for those guys to have an [00:20:00] answer for that, and two, your own internal organization, and start asking those questions.

Jim Because those machines, th- that air gap, is it really an air gap? No, it's most likely not, and there are ways around... Even if it's not connected to your network, there are ways around it that's connected to a network, and that should be a concern.

Dino Again, how do you close that gap, right?

Dino We're talking, it started off, what is the gap? Everybody thinks, a lot of people think that their systems are air gapped, or they've got some, some really good stringent tools in the middle, intrusion prevention systems, firewalls, that are helping them with their separation between those, or at least control the flow of data through there.

Dino But it's at that one point, right? You've got thousands of points on your plant floor, tens of thousands of points within your plant floor, depending on how big it is. How are you controlling that access? You can't just control it at one point somewhere to demark in the plan and say, "Hey, I've, I've got it figured out.

Dino I'm, I've got this firewall," even though it's got a [00:21:00] lot of holes in it because of all the different industrial protocols and applications I got running on the plant floor. I have to open these ports up for these things to flow freely, right? File transfer. Do you need file transfer on your plant floor, right?

Dino Do you need Telnet sessions on your plant floor? Are the... What, what ports are open down there that shouldn't be open, right? And if I, and if you're gonna only talk to one particular machine, my filler, what are you doing in utilities? Why do they have access to utilities if Miller is supposed to be working on the filler?

Dino And so all of those questions, those are the questions that we never hear IT asking, right? And OTs, I don't wanna say they're not smart enough. They... Th- again, they're production people, operations people. They're, they're j- I just need to keep the plant running, right? I'm not sitting here trying to chew, to, to chew this thing down into little bite-sized pieces to make my job more difficult in their mind, right?

Dino Security to them just gets in the way of getting things done, right? And so you have to have that go-between between those two groups. And, and [00:22:00] to be honest, you, you won't have a practice big enough to deal with it. If you've got 30, 40, 50, 100, 200 plants in your fleet, you don't have enough people right now to do this job.

Dino You flat do not have it, right? I don't care what you say, right? It... And if, if you wanna build that practice, you're talking about years Or you're gonna start working with organizations that are doing this today

Jim 'Cause how, how many of all the plants that we've been through in all the years that we've walked in and somebody on that facility is, charged with this?

Jim Right? With this role and, and finding the answer and finding the, the myths that are out there. None, right? we haven't. We've had some that have some interest. We, we- actually, what, what we get mostly is, "Hey, can you help us, uh, separate from the IT network? 'Cause those guys are causing us problems."

Jim Which probably means that they've already started the process and plugging it in other places. but yeah, I mean, it's a production, about a production. Production's about efficiency and quality and [00:23:00] safety and getting it out the door, and they're, they're... We haven't walked into a place that has somebody there saying, "Hey, I w- really wanna clean this up and I wanna answer these questions," right?

Jim They, they just don't exist, and that's, that's the, that's a huge challenge, right? and you know what-

Dino And do, do you, and do you have the right tools in the plant? do you have the x-ray machine? Do you have the stethoscope? Do you have the MRI within your plant floor to give you actual data of what's going on inside the body of that plant, right?

Dino And that's what's missing, right? And, and, and that's what we specialize in, is those, those systems that provide that level of visibility to determine what the ailments are within your plant. Sometimes we're not even fixing cybersecurity issues as much as we're fixing process integrity issues. Just screw-ups.

Dino Things that are poorly configured. Things that are, that are not handling traffic properly, right? Default configurations, human error. You know, IT scanning the network. All these other, you know, disruptions that are going [00:24:00] unnoticed because you don't have an x-ray machine down there on your plant floor. You don't have that stethoscope sitting down there listening to that heartbeat changing and skipping potentially, right?

Dino And, the plant knows when the, when it skips a beat because they watch their filler just tick up and all of a sudden stop running, and now you got a big mess that's gonna take me two hours to clean up before I get that thing back up and running again. And they don't know what shut it down all the time You know?

Jim so we've talked about a lot, and now comes our time for a little bit of wrap-up. And, you know, I'll start. I mean, we're, we're talking about this myth exists in most organizations. I won't say all, but most organizations have a challenge to identify, uh, you know, whether, uh, Bigfoot is real, right?

Jim Whether the air gap is, and h- how is this thing connected, and how are they making those answers? and then h- h- how do you find out, Uh, my, uh, approach is, I mean, we are dealing with cats and dogs here, as we've talked about before, right? I mean, and [00:25:00] that, that's what we've got, and you've gotta ask the questions the right way.

Jim You've gotta get out on the floor and understand what they're doing and how things actually work. don't trust, yeah,don't trust the answers that you're gonna get through email or little forms or position statements. You gotta get out there, um, because there's always things that, that we discover, that they discover when you have those conversations.

Jim When you get the cats and dogs talking to each other, uh, you find out that, uh, you know, maybe some things are going on that they don't know how to go on. So, you know, my recommendation is, y- you know, that, that, yeah, air gap's a myth. you need to understand within your organization that it, it is a myth.

Jim Where is it at? Who's the responsible party, and how, how do you wanna address it? And h- how is it addressed as an organization? And it's the things that we run into all the time. It's the things where we can really bring that value to the table [00:26:00] because, it, it's, it's opening up the panels. It's having the conversation.

Jim It's, it's asking the right questions in the right format, getting all the people in the right room. But, you know, that's, that's kind of, you know, my action item, for everyone listening and, and trying to understand, you know, whether or not, well, we've been told it's air

Jim gapped, uh, but I guess we've never checked. We've never... You always like to say trust but verify, right? And this is a good way to verify. So with that, I'll hand it over to you and let you do your wrap-up, Dean.

Dino What, what I would say is a snapshot in time is not good enough anymore. for something that you think that you went through in the last quarter, last year, or two years ago, it's changed, right?

Dino And so what you thought you might have saw then is not the same today. Machines come and go in your plants all the time, again, depending on the size and scope of your facility. Not only do the machines change as far as life cycle replacement types of activity but also the configurations of those machines, the activities of those [00:27:00] machines.

Dino you need to stay diligent in the s- the, from the standpoint of really understanding how that plant floor operates, right? From a digital perspective. and the only way to do that is to have people that, that are looking at it holistically from, yeah, I understand the IT piece, I understand the network, I understand the f- the firewalls, I understand, you know, the certain security policies and procedures and risks, but then I also need somebody to tell me how that plant operates on a daily basis, weekly basis, 'cause things change, right?

Dino You know, one day we're making this product, second day we're gonna make that product. We're gonna make a line changeover. I'm gonna bring this machine in, take that one out, and I'm gonna reconnect it. And you don't know what the machine that's been sitting out, what it's coming in with, 'cause you don't know if anybody's touched it, right?

Dino And so the question becomes is how do you stay diligent in accessing the data in that environment, right? And, and that's the hard part in my view. If people are not doing that, that's where you need to start looking [00:28:00] at, do I have enough people in my organization to do this? The answer is no, you don't.

Dino You have to, the people, there has to be a few people at the plant level That's responsible for a lot of this. It's not somebody sitting in an ivory tower a country away or states away who's gonna manage that plant floor at that level for you. It's not happening. It's just not. otherwise the plant manager wouldn't be in the plant.

Dino The plant manager would be in the same spot, and that's not how you operate. The plant manager is at the facility. The GMs are at the facility, and there's a reason for that.

Jim Yeah, that's an ac- excellent point. You know, you want, you want to trust but verify, but then you gotta have that continuous m- monitoring in place, right?

Dino So you're building a capability out there because it, it sure is a lot easier to deal with as the change comes as opposed to trying to unwind, decades and, and, and some sort of history and changes of what's going on. It becomes, uh, you know, changing the tires on a, on a moving car. Um, but if you can get [00:29:00] those, uh, ongoing capabilities built into your organization with tools and, assign roles, responsibility, and resources, uh, you're gonna be in a better position moving forward, Yeah. It's a day-to-day, almost shift-to-shift kind of role.

Jim You said shift to shift, right? With an S?

Dino Shift. Yeah, from shifts. If you run multiple shifts in your plants, you know, first shift might do something that second shift does, and third shift might have a different role than all of them, right?

Jim I just heard you use other words before, but shift is the word you're using now.

Jim Shifts. Okay. All right. With that, uh, appreciate everyone for joining us on this episode, and, uh, look forward to you joining us on whatever we might be talking about next, right, Dino?

Dino Yep.

Jim Have a good one. Thanks. Thanks, everybody.

Intro - Outro Thanks for tuning in to the Industrial Cybersecurity Insider. To stay up to date with our latest episodes, be sure to click the follow or subscribe button now.

Intro - Outro And if you found this podcast helpful or have a topic you'd like us to [00:30:00] discuss, please leave us a review or let us know. Thanks again for listening. See you next time.