Two Major Cybersecurity Shifts the Industry Isn't Prepared For with Simon Chassar

Simon [00:00:00] that asset visibility of what's connected and communicating across your OT and cyber systems environment, is becoming commoditized. It is becoming like the base standard minimum requirement.

Simon and ly that area is the fat bit in the middle, I'd say because. The challenge is that the problem is so big in terms of the vulnerabilities that are being identified from these physical assets and the task of remediating them, Intro/Outro: Welcome to the Industrial Cybersecurity Insider. In each episode, we dive into the world of industrial cybersecurity. Join us as we cover the latest trends, innovations, and practical insights as we talk with leaders and practitioners across. The industry gear up and let's get into this week's episode.

Dino Hi, I'm Dina Bussi, and [00:01:00] today I have with me Simon Chas, a colleague and a friend who I've known for probably almost 10 years now, thinking all the way back to my Clarity Rockwell days back in the beginning. Welcome to the show, Simon.

Simon Thanks, Dino. I really appreciate the invite. Thank you.

Dino Yeah. Yeah, I know.

Dino We, we just met, two weeks ago down in Miami at S four and caught up some, and,I guess to start off, maybe give it the audience a just a brief description and bio of what you've been doing from now back into the last several years.

Simon Yeah. I mean, I, I think keeping the focus on sort of CNI and ot.

Simon I mean, I go back, I was the chief Revenue Officer and executive vice president of NTT globally for cybersecurity. And I saw this sort of emerging trend and requirement to deal with OT and iot cybersecurity through my organization and through my services and technology that we were bringing to market.

Simon And therefore I made a move into the vendor space and that was with Clarity and I became the Chief Revenue Officer of Clarity when they were, [00:02:00] relatively small, about 18 million a r and about 200 customers or something, single site manufacturing and CNI. And I took them through a journey to, over 125 million in three years, about a thousand customers.

Simon I think that's personally involved in about a thousand, a hundred of those, sorry. And, we went to about 56 countries. So that was a great journey. And in the last couple of years I've been an investor in, OT iot and AI Cybersecurity, companies. I've been an advisor for, many organizations that are, I suppose, innovators in the.

Simon OT or cyber physical systems, cybersecurity space. And I've been an advisor for multiple private equity organizations on ot, cybersecurity and VCs as well as raising funds for some of these cybersecurity data. So yeah, it's been a pretty bit of a ride. and yeah, it was good to catch up at S four and give you a bit of a view of what I've been doing.

Dino Yeah. Well you were a great mentor for us and I'm, and many other partners, I'm sure. 'cause you had a lot to do with building the partner community for [00:03:00] clarity. Also at your time at Claire. Right. So what would you like to cover today? I mean, you have your fingers in a lot of different things in this particular space, so you have a wealth of knowledge and information that, would probably be very beneficial to our, listening audience.

Simon Yeah. Okay. I mean, I think I'm. As I said, I'm an advisor of multiple companies and they're all very closely aligned, but in slightly different niche spaces. And whether that's, traditional sort of OT IDS organizations or ot, so companies through the distributed energy to analytics, physics, OT organizations do renewable, you name it.

Simon So I think, one thing I would comment is. I'm seeing that generally there's a couple of fundamental shifts that are occurring, around CNI and ot. and I won't talk about the regulation and the geopolitical threats and those sort of things because that's, that is all, ramping up significantly.

Simon But I'll just take around the [00:04:00] sort of OT tech space, ot, cyber tech space. I'm seeing this sort of two polarized shifts and there's this shift to the right and there's this shift to the left. And if you think about what has traditionally been going on where, the first generation ot, cyber tech companies, the nas, the cla, the drag.

Simon The world plus the former, companies like security matters and energy and cyber that were acquired by Tenable and Microsoft, et cetera. that asset visibility of what's connected and communicating across your OT and cyber systems environment, is becoming commoditized. It is becoming like the base standard minimum requirement.

Simon and ly that area is the fat bit in the middle, I'd say because. The challenge is that the problem is so big in terms of the vulnerabilities that are being identified from these physical assets and the task of remediating them, that it is unable to be done with the fact of, plan factory [00:05:00] shutdowns, even some process manufacturing facilities can't even be shut down, to try and address that sort of, connected underbelly of the vulnerability.

Simon So everyone's sort of making this shift out to what I call the right and the left. And I'm seeing the shift to the right being that, okay, we've gotta move to more of a threat led, data-driven landscape view of our environment. So that move to more of a soc perimeter protection, that sort of, services Overwatch piece.

Simon enabling us to put that perimeter correction, protection around the environment. And the reason why is that they just, they need to be able to then sort of protect what's coming in the environment, and that's then also driven into policies and segmentations that then are coming off the back of that.

Simon I'm also seeing that there's this sort of shift further, right? Which is if I need to get a single source of my industrial code lifecycle management, my factory in a box so that I can actually do backup and disaster recovery across all of my automation project [00:06:00] files and automation systems. So when I do get hit, I can recover.

Simon So I'm seeing those two shifts. And in terms of the ot, the service piece that big pain point. I wanna move from my first line of defense as the, the OT plant operator to the first line of defense is my soc in the three lines of defense model, where traditionally it's been very hard because of low fidelity data quality, high false positive alerts, blowing up the sims and blowing up the soc.

Simon there's also this emergence of, okay, how do I look at second generation sort of ot? Asset visibility technologies to eliminate, I'd say the false positives and drive a higher fidelity of that asset. So that's that shift, right, that I'm seeing occurring. And there's some really great organizations which are, picking up on that, in the market.

Simon The shift left piece is, okay, how do I think about secure by design, from the beginning around my manufacturing facility or my CNI, and how do I think about the [00:07:00] things like the SBO and other activities within the components that are within that environment? As well as how do I use sort of a tax simulation or how do I look at sort of OT TTPs to really help me prioritize around what areas do I need to focus on and really put my efforts behind a security strategy around business continuity.

Simon Versus the ones which maybe become, afterthoughts, less of a business continuity risk for the enterprise or the organization or nation state. And so those are the big two things that I'm seeing really happen, and that's driving some really interesting innovative tech that is growing fast and some innovative services organizations which are growing fast.

Simon So that's what I would like to mention.

Dino Let's talk about services for a second. one of the things that I've witnessed, over the last 10 years, especially a lot of clients that have invested and bought some of these OT IDS platforms, is they do it from a self-performing standpoint, right?

Dino Trying to do it themselves. and I've seen this [00:08:00] tech turn into shelfware. Right. Because however it entered into the environment,the client never got the visibility that they were really chasing. Right. And I've seen the numbers are pretty staggering, right? Companies that have had a tool like Clarity for years and maybe seen 30, 40% of their assets on their plant floor and not knowing how to get to the rest because they self perform versus.

Dino Maybe looking for organizations in the partner community that specialize in, in, in this arena that works across a wide spectrum of manufacturers, whether it be food and bev, chemical, oil and gas, automotive, mining, et cetera. how have you We're not seeing a change in that. to my point that I bring up a lot is I don't see the IT leadership in a lot of these companies trying to reach into the, System integrators and OEMs, they're the primary driver of attack that they have in their plants, at least from a support standpoint. 'cause a lot of manufacturers don't even have controls engineered, right. They rely on [00:09:00] third parties to do that. And so the self-performing, activity I find is not being very fruitful for organizations trying to drive this themselves.

Dino I don't know if you see that differently or have you seen that as a success? When you talk about ITO OT convergence, which we've been talking about, as long as you and I have known each other. it, it just hasn't gelled. is like it should be, and I think a lot of it is because they're not branching out and trying to find out who are the best in class, organizations out there to help them and maybe not try to self perform as much as them, as many of them try to do, but maybe you see it differently.

Simon I mean, I'll give my opinion.

Simon The stark differences between somebody who is and has the skills of understanding an operational, automation environment. And those that understand cybersecurity, theory and law practice is that, one is a vocational, sort of pursuit in your life and one is [00:10:00] a academic pursuit in your life.

Simon So in essence, somebody likes sort of plugging things in, building things, and the other person likes to sort of, apply the theory and the applications of, practice through academia to solving a problem or a challenge. And there isn't enough. Skills. Skills that are in the operational automation environment that understand the dynamics of cybersecurity or digital safety within the environment and how to apply that because cybersecurity is moving so fast and so quickly that they still need to keep the plant operating and that at the end of the day they, they've gotta sort of deal with what's in front of them now.

Simon So. You are right that actually the skills in the market, they, we haven't done enough to boost the skills and the personnel that are out there to be able to be available for some of these bigger, what I say, needs that we have to do to protect this sort of critical infrastructure of, Western Hemisphere in a way. and the challenge is if they mostly live within boutique organizations, boutique service partners because they are, [00:11:00] homegrown come outta university and they've gone through the sort of, the practice and they've been working, from a young age, building plants, and building and dealing with pumps and sensors and making conveyor belts work and goodness.

Simon And they may have been diversified into cybersecurity, but they're still living in the, in their sort of very local remit. And there's not, therefore there's a lot of good skills in boutique partners and providers. And there's also a limit within the larger, bigger organizations in terms of some of this scales, of these global environments because, you pick someone like you knows or something.

Simon They've got like 400 size or something, this, it's just massive across the globe. And there's such a disproportionate,disproportionate variety of skills and expertise globally and in different partners and providers that it's just been a challenge. And I even, I know, I mean, I've been hiring some resources and skills [00:12:00] for some of the companies that I'm representing and working with.

Simon And they command in 30 to 40% more in OT cybersecurity than they do in IT cybersecurity because there's just such a shortage of them and you're looking for a particular capability that is unique to sometimes each organization. you, yeah, you'll get the same automation vendors. Popping across different companies, but the design and the sub cell architecture and the way in which they deploy, purge you or not purge you or, it's just totally different in terms of some of the scar environments.

Dino Yeah, because I believe that the OT ecosystem, as I call it, has to get better at this. Right. And providing, Digital safety, cybersecurity strategies built in. I mean, they're gonna do it with ai. I mean, it's coming today, it's like they're leapfrogging over their security, apparatus to go after the AI piece.

Dino and then it's like, well, you're gonna have to come back and layer that in at some point. why not do it at the beginning? Like, I would say if [00:13:00] you're a big, clarity shop and you've been using clarity for years and you're getting ready to put in a new packaging line, you would think that you want to design in your cybersecurity technology and the sensors, if you will, at that control layer during that new packaging line build out.

Dino Right? Instead of trying to do a retroactively, which is costly, more expensive.

Simon Well, that's what I mean. That whole secure by design shift left everyone's now the green fields. I built it from the beginning.

Dino Yeah, and I don't think AI is gonna drive that, potentially. Right? I mean, there's some really cool things going on out there in that space.

Dino and it's getting to the edge, right? The last mile, as I call it. And,and the technologies that are going out there, they're not islands anymore. They're not just local networks, as people still like to call them. It is connected to something, even if it's somebody going out there with their laptop and plugging into that local network, into that control system.

Dino That, that's still a connection. you don't know what's on that laptop. You don't know if it's got a cellular modem on it. You don't know if it's got wifi on it. It's got Bluetooth on it. What else is it connected to [00:14:00] while it's in that environment? What's it bringing into your environment? I mean, if we go into 10 plants, eight of them will let us take our own laptops and go plug it into their plant.

Dino Right? To support 'em, to get 'em up and running, get the startup going, or whatever downtime they took because, some new features and functionality wanted to be added. they we're. Going in, remote access is still, the wild west. on average, Simon, we'll find four to seven different remote access technologies being used in a single plant.

Dino And if you've got 30 plants in your fleet, well then do the multiplier on that, right? And a lot of times it is not even aware of what that OEM put in that machine center for remote access.

Simon I mean, look, this. There's happening, I mean, I'm involved personally in a UK company and we're about to, launch our own new software, which is, integrating, I suppose OT asset sensor information with it, threat feeds and and also with AI [00:15:00] that is driving an AI sort of L three SOC analyst capability trained on.

Simon IT and ot, TPS to detect and help isolate, or provide playbook for isolation and containment and remediation For OT specifically, that's like separate, but also the compliance requirements and generating auto compliance. And that's gonna be launched in the next month or so. But as I'm seeing others move towards that space, and if I look at.

Simon The way in which we think that AI is gonna change things. I mean, I was speaking literally with a global steam,production company. they're deploying, co-pilot everywhere. And, the problem they've got is that it's suddenly started to look at unstructured data and.

Simon Telemetry feeds and other things which are coming from outside the corporate network into it. And it's uncovered things like, passwords, plain text, passwords, unencrypted, no cryptography or any encryption on it at all, and they're just, again, we have a massive problem.

Simon This AI is quickly [00:16:00] identified. Things that we didn't even know about by looking at our unstructured data and everything else, and now it's going into a public AI system. So now we've gotta sort of put some controls and governance around what can be shared with the public AI because we haven't dealt with the risks at the edge.

Simon I'm working with a company that she's really pushing the boundaries on, physical AI and data notarization, and they are effectively driving a blockchain based encryption for, data feeds in from unmanaged and off-network devices to inside the corporate network so that you can provide immutable zero trust of the data that's coming inside.

Simon You can almost, I.

Simon And that's gonna really disrupt the PKI and ca or certificate authority type, business landscape because. just authenticating a connected device to your corporate network is no longer any good. you have to go way beyond that [00:17:00] because you've gotta, protect the data from manipulation, data poisoning.

Simon Most of the first generation sort of edit tools aren't really looking at the data poisoning manipulation side of the house anymore. That, they're sort of using broadcast and multicast and union cast. Approaches and passive listening and, or flow based analysis and this is gonna really create a, a challenge.

Simon Where can you trust what your AI model is telling you around? What is your production volume units and your supply chain connected? Order requirements, et cetera. If somebody manipulates it or poisons it, or even like you say someone brings in a, piece of a USB driver or laptop and it completely corrupts the data feeds in that then, if we rely on AI for all automation of rule sets and even supply chain, we start to create a global just in time manufacturing economic challenge by having it all connected.

Simon A lot of stuff [00:18:00] said there, but you know. I,

Dino the funding I is mysterious to me in a lot of cases where there's not a lot of, focus on funding for an OT technology, cybersecurity, maybe ai, but especially on the cybersecurity front, most of that budget's always tied up with the IT organization.

Dino from my view, it to the extent of I know the resources constraints that are out there. I mean, trying to find people that have the background that went on. One, wanna work in an industrial environment, right? I mean, you can think globally, but you still gotta act locally, right? So you can come up with a grandiose plan and strategy on what you want to do, but to be able to execute it, you're gonna need help.

Dino and those that, that wanted to try to do this, like I said earlier, self-perform. It's almost a non-starter. You're only gonna get so far. Right? and so the funding do you see a shift in investing budget? Into this space because, when I think of private equity specifically, they're not spending money on capital to replace equipment.

Dino They just run it till it [00:19:00] breaks, and just, barely keep these plants running, and they'll steal parts from other plants that they're shutting down to domino into another plant. And I just don't see the funding model like you would see in it. It doesn't have that same, momentum or motion.

Simon I, I would say that I'm on the board of about three companies and, I do see that cybersecurity is, and our adherence to regulation, but also protecting the organization and even the wider portfolio companies environments. So like from the private equity point of view, and, if they have multiple portfolio companies that are within it, and I'm in one of those.

Simon protecting the overall organization. It is a boardroom topic and it does have time on the board meeting. So that is focused on, I think that, there's definitely with regulation tailwinds that are really getting quite crispy now, I'd say really sort of quite spiky. That is driving effectively boards to consider and allocate more funds [00:20:00] towards physical systems, cyber security strategies and solutions.

Simon It's still not enough in my view. I think there still needs to be more done, because if you think about, all the budget that goes into it, cyber security. In essence, like PII data now on the market is like $10 each. if you're the, black market resell, that stuff, PCI is at about $20.

Simon I think PMI data is about a hundred dollars. if you think about that in the context of just, I don't know, 20,000 users getting the data stolen from some database, it's a couple of hundred thousand dollars of reinsurance that they need to do with some, credit check company.

Simon That's about it. No lack of impact. They get hit on their production facility, they're down for two or three hours. That's like 5 million out the window output done. It's a completely different risk, model. So I, they, I can see that boards do have to make that shift and they need to sort of deprioritize.

Simon The challenge that exists is that there is this budget in it [00:21:00] where, 70% of it is already prespen every year. Just on renewals of existing stuff and the cycles needed to move away from that and or to change to a different strategy is just so much,mandates of effort for CIOs and CISOs that it is just not really addressed.

Simon And only 30% of that budget is really broken up on, dealing with new threats and new landscape risks. Innovation, investments to look at what do they need to do ahead of the curve for future potential risks? and that's it. they don't really have this ability to go, right, I need a brand new pot of money over here because I've gotta go protect the business and operational resilience, and I need to go build what is effective with my IT cybersecurity strategy, but it's separate on an OT side.

Simon They're not doing that

Dino right, and that it gets back to what I said earlier about the OT ecosystem has to drive this, right? They have to start carving out their budget for this and finding those organizations to assist them with that. [00:22:00] Because if it could do it, they'd be doing it right. They would. and the answer to that is, is they're not, I mean, they're doing some, but it's not enough, right?

Dino There's a lot of blind spots on that plant floor that it just does not have the, the responsibility or the accountability to deal with the control systems. Per se. Right? And so that's where I think the OT ecosystem has to really step up and start driving this to the board. 'cause they report up differently, the OT side and it typically report different paths all the way up to the top of the organization.

Dino They're just not putting together their own plan and strategy. And I think a lot of it has to come. From the industry that they typically rely on to buy this equipment from, to get the support to deal with the technology that comes in from these OEMs and system integrators to start recognizing what they're dealing with.

Dino And I, and maybe AI will be the thing that, that changes, that, narrative potentially. I don't know.

Simon I mean, I've definitely seen the sort of accountability. [00:23:00] Is being aggregated around the CSO for both IT and OT now. I mean, I think that is, with the regulation changes that have been going on, it's definitely the but stops or the buck stops with that individual, I think it's still being a huge orchestration game across multiple resources on different sides of the house.

Simon So on the operations. Supply chains, side of the house, there's still a different other resources that need to be coordinated from the CISO and the IT cybersecurity and network and so on to bring together the outcome. So there's a lot of coordination that goes on there. but

Dino depends of the responsibility to that point.

Dino That's landing on the CSOs desk. Is, why aren't they looking to find out who are the top four or five integrators or OEMs that are working and operating in their plants today? What are you doing? Who are your partners? What kind of practice do you have? What kind of resources do you have? What do you know about my specific challenges from a cybersecurity perspective and about my [00:24:00] business?

Dino Right? Which is a lot. Right. A lot. But I don't see that, that being connection. I don't see that CISO picking up the phone and calling their top integrators. 'cause I would know because we're one of 'em, right? I mean, we're one of the largest food and beverage system integrators in the country in North America.

Dino Right. And we're not getting those phone calls from that IT leadership asking for help,

Simon because I think a lot of it's still coming from the top down advisors. So if you think about the traditional sort of accounting advisors or digital transformation advisors that are coming in from the IT side, a lot of those are driving the narrative down the organization.

Simon And that sometimes dictates who's selected for projects. Whether they have the skills or capability to deliver or not is another question. But that's where you're seeing that coming down because it's such a top level topic at the board. That's how it's coming into the organization versus a ground up.

Simon This is what I need, local skills solve the problem. I've got this relationship here that bring them in. So that's maybe what you're seeing as a difference. [00:25:00] I think I do see, I do think I see some risks in the future ahead. Risks and positives. I mean, it depends how you wanna look at it and what lens you're looking at it at.

Simon But with, I think some of the exits that have occurred, like the amis, exit to ServiceNow with the Nazomi exit that occurred, and the sort of new funding around raises that have been going on with some of the others that are out there. You are definitely starting to see that. some of the bigger players are going right now, OT is a mainstream thing I need to buy in and acquire.

Simon And there's a lot of acquisition tool that is going on from some of the traditional, I'd say it, cybersecurity networks. Cybersecurity organizations looking at how do they make their move, but also at the same point. You've got people like the Rockwell and you've got the Schneider and the Siemens, the automation vendors also going, well, okay, how do I make my move in?

Simon Because Honeywell made their move in as well. how do I then protect my space in this environment? So there's definitely gonna be a [00:26:00] lot of, I think, acquisitions and roll up occurring over the next 12 to 18 months on, I would probably say the second generation, because some of the first generation guys are pretty expensive now, so they'll be sort of.

Simon The bigger players, but you'll then get some of the slightly, risk averse smaller players thinking, well, I wanna make a strategic shift, so I'm gonna buy some of the smaller new tech. And then the bigger first generation with the big customer bases are gonna go to some of the bigger guys. And that's gonna be good for the industry, but it also means it gets wrapped up as a another with another, mainstream cyber security vendor.

Dino So you mentioned SOX earlier. so how do you see the OT SOC development going out there? specifically around OT sox, right? I mean, we don't have one. we would probably leverage a supplier that does that. And one of our,

Simon I could make an introduction for you, Dino. I've got a, I've got an excellent one for you.

Dino Well, it's key because a lot [00:27:00] of clients are asking for it, right? I mean, we do have clients that are asking for. SOC support. we can pro, we provide 24 by 7, 365 support managed services, but eyes on glass, we don't have, and those are expensive to build, right? And it's a huge investment. And so, what does that environment shaping up as?

Dino Right? And I'd love to follow up on that conversation in regards to. You're, whoever you're talking about. because we want to have that conversation with them. I mean, we actually, we just turned down a job because we didn't have the soc

Simon so, um.Some private equity firms. as part of that, they're all sort of talking about this is the next direction. This is about nine to 12 months ago. I then had an opportunity to go into a, uk security cleared, sort of ex government intelligence, sort of founded tech company, UK sovereign, sort of organization that does it stock.

Simon And we've evolved. [00:28:00] The capability to be ot. And so we've moved over towards ot and since then, it has been, an amazing journey with, public sector, what you'd call federal and critical national infrastructure organizations in the uk. They're looking for that ot. So that shift to my first line of defense is the, as the ot, as the so provider versus my, federated, distributed, It's been amazing and I think that the only. I say is people need to understand it slightly differently. You need to have the full data visibility before you start looking at whether you've got a mod bus fuzzy attack. You need to understand what the IT threats are, so you do the IT environment, because there's a lot of traverse in that goes on from IT to ot, which can create impacts as well.

Simon You've gotta create real sort of anomaly, indicators of compromise so you can see some of those living off the land, sort of adjustments that might be going on. And it's about bringing tech together, making it work harmoniously. [00:29:00] And there's only so much you can do around, dev on that without using ai.

Simon You need to use AI in that sort of strategy to be able to give you that full use. I see it as a big growth trajectory. I'm seeing it personally with this organization that I'm involved in, and I'm seeing more and more what I'd say traditional sis MSPs asking for a backout ot soc provider because they can't build it themselves.

Simon They are getting asked for it and they can see it as a separate track to their own it SOC and almost, non-competitive. And they can see it as from an operating playbook perspective. They can have the IT soc with a swivel chair with the OT SOC as the third party who specializes in it and did in the co the coverage that they need for the clients.

Simon And if you've got the right ad, active directory structure. Store systems and playbooks, you can bring in the OT partner operators to be part of that remediation activity. When you do find something like a mob bus fuzzy attack or whatever it may [00:30:00] be,

Dino that, that, that's a conversation I'd like to carry on further at some point.

Dino is there anything that you'd like to cover that we didn't cover in our discussion today?

Simon I mean, not really. I think that from my side, it's been, great speaking with you. I totally respect your view and opinion in the market, so I love to learn from you as well around what's going on, especially in the States.

Simon and from my side,I'm touching all sort of areas of a lot of emerging tech around IOT and ot. So, feel free to invite me back whenever you want and I'll give you my view. So no, it's been great. Thanks, Dina.

Dino Yep. Thanks

Simon Simon. Intro/Outro: Thanks for tuning in to the Industrial Cybersecurity Insider to stay up to date with our latest episodes. Intro/Outro: Be sure to click the follow or subscribe button now, and if you found this podcast helpful or have a topic you'd like us to discuss, please leave us a review or let us know. Thanks again for listening. See you next [00:31:00] time.