What Every CISO Gets Wrong About OT Security

[00:00:00] Craig: CIOs are not equipped to be. Plant managers, they don't own the assets. It goes back to what we've said a hundred times over who owns the assets. If something happens, who's that frontline defender that's gonna be there? The first responder, as you mentioned, that's gonna be there to resolve the issue, whatever that is, Hi, I'm Craig Duckworth,

[00:00:55] Dino: Bus,

[00:00:57] Craig: and today let's talk about, I don't know, what do you wanna talk about, Dino? I.

[00:01:02] Dino: I think. I think a very popular conversation a lot of our listeners like talking about or listening about is OTIT convergence. I guess the real question is what does that really mean in the OT realm of manufacturing and industrial environments?

[00:01:18] Craig: I think it could be anything. I've heard ITOT convergence. I've heard ITOT collision. I've heard. digital 4.0, 5.0, industry, whatever you wanna call it. There's a hundred different names for it. I think they, at the end of the day, it kind of goes back to who owns the asset.

[00:01:37] Craig: What are you trying to get from the, is data you're trying to get? Is it. Support you're trying to get from the IT teams. What are you trying to achieve and what's the best way to do that within your organization?

[00:01:52] Dino: Basic, fundamental question is, is OT considered an IT shadow group? Right.

[00:02:00] Dino: I'm trying to get rid of all your shadow IT groups that you have within your organization. Right.

[00:02:05] Dino: But when it comes to ot, I'm a firm believer that it stands alone what they to do what they do, right.

[00:02:13] Dino: Data driving physical outcomes is not the same as data driving data outcomes in the IT world. And all the work that I witness that's being done in manufacturing environments, all the development work, a lot of that infrastructure is all managed predominantly by the OT teams.

[00:02:33] Craig: Well, I would go one further and say the underlying principles are different, meaning OT beats to the safety drum and it beats to the data privacy or the data security drum, but not from a safety aspect.

[00:02:55] Dino: Right. Well, An OT response is about controlling chaos without triggering a catastrophe. You know, your first responder is the operator.

[00:03:10] Dino: When there's an event, it's not some IT group trying to squash what's going on. You gotta get those machines in that product into a safe state, right? And it as organized of a shutdown as you can get it.

[00:03:22] Dino: , Without losing product, without destroying equipment, without hurting anybody, without some hazardous environmental release, whatever. Those are your first responders when there's an event within a, , manufacturing environment. And so again, I get back to that fundamental question. Do organizations believe OT is a shadow IT group?

[00:03:44] Dino: The answer in my view is no. But I'm open to listening to what others have to say because I recognize who's doing this development work for these applications. Who's implementing them, who's supporting them? And it's not it, right? It's these engineering groups, it's these system integrators and your OEMs and the operations staff at the manufacturing level.

[00:04:06] Dino: So. The challenge is, is how do you get ITOT convergence, right? It doesn't mean that they can't work together for budgeting and resources, you know, to try to meet needs, but I was just an event recently and it was a vendor summit at a client, and the room was, predominantly everybody. There were the sis and OEMs that were providing machine centers and applications in a manufacturing environment. , and in our particular case, you know, being a system integrator, having a, cybersecurity practice was intriguing to those other system integrators who don't have that type of practice within an organization, meaning that they're not looking at what they're doing through a cybersecurity lens.

[00:04:50] Dino: Applications and systems that are developing for the client. This is where I think it can be very beneficial in influencing that discussion. Right. You have to work hand in hand and very closely with those sis and OEMs and the internal manufacturing teams to be able to drive that governance. Right? Set policy.

[00:05:08] Dino: In terms of technologies, I mean, how often do we hear, you know, that some manufacturer on the IT side has went out and picked an OT cybersecurity tool and nobody from the OT side is even participating. And the result in that is you don't get OT , participating at all. Where's the value and the benefit to the organization when you have that huge disconnect, right?

[00:05:28] Dino: You're not getting your it OT convergence in that particular case. , because the only way you can demonstrate if you're getting closer to that convergence model is there's an ongoing dialogue back and forth between all of these responsible parties in how to improve and harden that cyber security posture with those machine centers within that plant.

[00:05:49] Dino: It is working hand in hand with those system integrators participating and vice versa,

[00:05:54] Craig: And part of that disconnect, you know, I was at a conference last week as well and it was there were a dozen vendors there. But what was obviously missing was the support mechanism. Meaning the support network from an OT side. The vendors there, they have software, they've got technologies, they've got product.

[00:06:16] Craig: You Organizations there that are looking to source that, that are deploying or trying to deploy that across their fleet, and they're trying to do it all themselves. They should be leaning on that network, that infrastructure from the systems integrators, from the partners, from those trusted advisors that know their infrastructure and their environment well to do that.

[00:06:39] Craig: But what was really missing and. And part of this was, it was looking at it from a. We can support the infrastructure only and not the applications. And some of the organizations, they were looking for more than that. Some of 'em didn't want any of that. They were like, we want to see as much firewall.

[00:07:02] Craig: We want two firewalls on the north side and two firewalls on the south side, and we want an IDMZ with a gun pointed at each of you guys type scenario. And just to try and protect themselves because they didn't, there was no trust there because of the inherent. Issues in the past, however long ago that was.

[00:07:19] Dino: Well, again, it gets back to what I, how we started this conversation. Is OT a shadow I And so knowing that, how do you get aligned and transparent and collaborative between those two groups? Right. Which would mean the IT organization would have to, , take a larger role.

[00:07:38] Dino: In the operations of these manufacturing facilities, and I'm talking about on a day-to-day basis, right on the activity that goes on inside these facilities, because fairly large manufacturing facilities always have some amount of activity going on, whether it's lifecycle replacement, maybe an expansion, maybe new product, you know, big maintenance windows that are going on, you know, line changeovers, things of that nature, , startups, et cetera.

[00:08:01] Dino: And they're not inherently involved in that. and those activities in those, functions. So, that's the only way you can really change this dynamic. And I don't know if many CISOs or CIOs are gonna sign up with the staffing and the resources that they need, the limited budget they probably have.

[00:08:16] Dino: To go out and find the qualified people that they need to have to go and work within those industrial environments. You know, the good news is, is there are organizations out there who do that today, who have the DNA of the OP world, right, who have automation and controls as part of their manufacturing mindset.

[00:08:35] Dino: And so you really need to start leveraging those organizations to help you, you know, weave the cyber landscape in this industrial world.

[00:08:44] Craig: the CIOs are not equipped to be. Plant managers, they don't own the assets. It goes back to what we've said a hundred times over who owns the assets. If something happens, who's that frontline defender that's gonna be there? The first responder, as you mentioned, that's gonna be there to resolve the issue, whatever that is, and you know, Yep. But you know, and you look at your instant response, or if any, somebody looks at an instant response for an organization who's on that team, who from the OT boots on the ground in the plant operator, is practicing that instant response with the IT leaders, with the OT leaders that's gonna get the phone call that says, Hey.

[00:09:39] Craig: Everything's going south. What do we do? eyes on the machine. What's happening locally? they've gotta be part of that response.

[00:09:49] Dino: You have to get the folks that are most intimately knowledgeable of those applications and systems,

[00:09:55] Dino: those are the folks that have to be at the tip of the spear when you are either implementing and executing cybersecurity. Projects and or dealing with an Incident of some sort in that realm.

[00:10:06] Dino: Right? And until you fix that, you're never gonna get this done. Right? Right. You can do it right or you can do it again.

[00:10:13] Dino: Right?

[00:10:14] Craig: Heard that a million times.

[00:10:15] Dino: and you would know, right? Because system integrators would be on the phone spending a lot of time talking to CISOs and CIOs and their teams about what's going on inside these manufacturing facilities to, again, to gain that knowledge, that inherent intimate knowledge of the work that these groups are doing.

[00:10:31] Dino: Not only the systems and the machines that they're bringing into these plants, but the ones that they're also maintaining and supporting for these plants,

[00:10:38] Craig: It's not an easy task. you don't just learn this overnight. This is, years or sometimes decades in the making and understanding. And you know, one of the stats that I got I took away last week is, you know, a big percentage, and I don't know exact number, but a very large percentage of the workforce is retiring and moving on in the next five years or so, and the.

[00:11:02] Craig: Concern is, is there going to be enough knowledge to replace that and how do you adjust?

[00:11:10] Dino: Now that's where they're relying on ai, right? is one of those tools, virtual, you know, reality, there's a lot of technologies you could deploy that to be able to, , educate a new workforce. It can be done. You know, the question is, are manufacturers willing to, put forth, you know, that type of investment to do that, So it's either that or you gotta work within the, framework of what you have and what you have today. Is you have people who at the plant have inherent knowledge of, those machines and their ecosystem of support partners that help them when the plant themselves can't resolve a particular issue, then they go to their OEM or to the SI who develop and built and maybe maintains and supports that equipment that's their go-to, right?

[00:11:57] Dino: Their phone isn't to pick up it necessarily to find out why my filler's not running properly on, my packaging line. Right.

[00:12:04] Dino: it's OTs job to figure that out and there are connections with the relationships with the vendors that they have to support that. So, you know, for it, most of all of this stuff is just blind spots for them,

[00:12:14] Craig: and.

[00:12:15] Craig: all the plants are different. as much consistency as there is. Each plant is gonna be different. It's gonna be unique, the processes are gonna be different. there is no exact duplicate or replica as much as. If organizations would like to say there is.

[00:12:29] Dino: you, so you know, getting back to of this OT not being a shadow IT group, then how do we get OT in a position to be funded properly? Not only just funded, but also to have some governance and strategy around how to improve their cybersecurity posture and the demands that they need to be placing on their, partners who are bringing systems into their, plants.

[00:12:53] Craig: Again, that goes back to secure by design from an OEM manufacturer. Perspective and then working with legal procurement for a secure by demand for those that are choosing not to support the secure by design and trying to. Back to the safety in the seat belts in a vehicle, you know, pick a date, standardize and say this is the date.

[00:13:19] Craig: Going forward, these systems have to be in place and eventually everything becomes compliant within a matter of timing.

[00:13:28] Dino: certain individuals, especially within the IT ranks, who picked an OT cybersecurity tool, aren't concerned about east west traffic. Well, just 'cause you're not, doesn't mean that, that those that are responsible for those machine centers aren't concerned about that east west traffic.

[00:13:43] Dino: So that being said, how do I get that metadata in an actionable, format for me to be able to take action? Right? Getting it in a way to get it up and feed it to me in, in an organized fashion where it's, optimized, it's prioritized, it's localized, and I can actually set a plan to build around this real data.

[00:14:02] Dino: and right now that that's just not happening, especially when it's being done in a vacuum by a group that's kind, I call it cloak and dagger, meaning that whoever put the tool in is just keeping it close to the not sharing,

[00:14:14] Craig: Well, again, you've got. the disparity between security ops, you talk about cloak and dagger there. Everything is tightlipped. Everything is, you know, just me. You can't see that it's not for you. That type mentality where I think if, there were issues or incidents or. Things happen.

[00:14:34] Craig: If there was a think of an ISAC community sharing event that could, you know, help and protect all the entire ecosystem, I think it would be beneficial.

[00:14:44] Dino: One of the things that I learned last week, and it is very common, is the whole conversation around oe, right? Overall equipment effectiveness. How well are you able to, make the goods that you make with the assets that you have, right? Quality, availability, and performance, and. If you're doing this right, you're gonna be able to get and determine how you might be able to get a few more positive OE percentage points if you can find some of the things that are causing unplanned, unscheduled downtime within your environment that are being caused by these external groups, Things that you can't quite always put your finger on. The reason again, I always like, these are the fillers. An example, why did my filler slower stop? You know, and by the time the organization resets the equipment and cleans up the mess and gets approval to start running again four hours later, and you know, 50 to a hundred grand an hour in loss, they just wanna get back up and running.

[00:15:33] Dino: But what caused the downtime and can't visibly see it, then they just keep moving on. Right? But it'd be nice to sit there and go, Hey, the reason why the filler quit working was because Craig got in there and made a PLC change.

[00:15:46] Dino: OT specific, saw it, did it and, their change was disruptive? Or was it, it scanning the network at the wrong time, hitting my servers and, , being disruptive to the hmis and maybe to the PLCs and that caused the problem.

[00:15:59] Dino: Again, go back to OEE and these tools and these technologies with the right people, you know, reviewing that data can help improve that. I mean, some of the projects that these plants going on, like the one I was at last week, half the projects are all around OEE. Right? How can I improve my operational effectiveness with that equipment?

[00:16:18] Dino: and they're doing all kinds of, you know, control systems, juujitsu, right? And data collection in order to do that, right? Sitting there is giving you realtime information on impact to the environment. it not only just as a cybersecurity, , footprint that's in there, but also as a, , industrial automation control system, integrity technology. for those of you out there, again, I don't think OT is an IT shadow group, so that's my 2 cents.

[00:16:48] Craig: And I would agree with you. And I think that if organizations look at it and really understood the function of what they're doing, they would see that it's a, real team that's doing different function than it, it's, so I think if it very consistent, very uniform. OT is different.

[00:17:08] Craig: OT is not always the same. It's a physical outcome versus a, a digital outcome. There's things that, you know, look at outcomes in measured, in human life, measured in other tasks that are not just data privacy and it, it means something. It hits home differently when bad things happen and people don't get to go home to their loved ones.

[00:17:32] Dino: If you're a CIO or ciso, I would encourage you to find out who your key OEMs and system integrators are within your organization. You need to build a bridge to those groups to find out what they're doing in order to improve cybersecurity within the systems and the machines that they're designing and building and supporting for your manufacturing facilities, right?

[00:17:55] Dino: You need to start, you need to start down that path. If you're not willing to do that, then they're, the OT is going to end up at some point just resolving around what they've always done, just working within their OT ecosystem.

[00:18:08] Craig: I would say even take that further and pick up the phone and go down to the plant. Schedule a time to walk through the manufacturing environment of your organization with someone on the OT team and look and see and help understand what some of their issues and concerns are and how jointly. You can work together to solve them.

[00:18:35] Craig: Again, it's that collaboration that wins every time, we just don't see it often enough.

[00:18:40] Dino: We're not, I don't hardly see it at all I mean, we're a system integrator

[00:18:44] Dino: I don't get calls from CISOs and CIOs.

[00:18:48] Craig: We should.

[00:18:49] Dino: I get calls from plant people

[00:18:52] Dino: and integrators.

[00:18:54] Craig: Yeah.

[00:18:55] Dino: here's what I will say is we are starting to see OT specific roles being set up.

[00:19:03] Dino: Somebody's being tasked with ot, cybersecurity lead or group, right?

[00:19:10] Craig: I'm seeing more of that, which tells me that there at least is some knowledge transfer or some advancements toward a collaboration.

[00:19:18] Dino: Right.

[00:19:19] Dino: And the funding of those, resources varies. Right? And who's paying for 'em? Is the manufacturer paying for it, the operations side plan side, or is it being paid by it?

[00:19:29] Craig: Organizations, you're out there listening today. Take the next steps. Reach out to a system integrator like us. Reach out to a partner that you have. Reach out to a vendor you're working with. Try and determine how you can collaboratively. Bring the IT and OT together so you don't have these shadow IT or shadow OT groups that are trying to figure this out in silos.

[00:19:57] Craig: This is not gonna get fixed in a silo. You know it, it's not whether the budget needs moved over. You carve out some of the budget and say, here it is. You can use it for this. You support 'em in whatever ways that you can. it's gotta be a collaborative effort.

[00:20:11] Dino: All right.

[00:20:12] Craig: Perfect. Thanks Dino. Great conversation.