The A-Z of Industrial Cybersecurity for OT Environments with Industry Expert Bryson Bort

[00:00:00] Bryson: The greatest actors on the planet are employees when you get in their way. Just like if you're a parent, children, when you get in their way, right? They're going to find a way around.

[00:00:07] Bryson: that segmentation is now going to give you natural choke points for overwatch. So this is where you can now install the monitoring capabilities to ensure that you have that visibility, not just from the assets themselves, but now the behavior around the assets, which, of course, is the one place an attacker has to get from point A to point B.

[00:00:26] Bryson: Again, I can't act what I can't touch. Now you can get them because on the wire. Every attacker goes to a one and zero like everything else. They just try to hide in the noise of the protocols you're using, but there's no way for them to actually hide from you.

[00:01:09] Craig: Hi, welcome. Today, we have the extinguished honor of having Bryson Bort, the founder and CEO of Scythe with us, as well as the founder of Grimm and the co founder of ICS Village. Welcome, Bryson. Give us a little bit of background about yourself. Tell us some information and let's see where we go.

[00:01:30] Bryson: Sure. I was a former army officer. I got hurt during the war and discharged as a captain. I went, took the first job that I could get because I'd never been, in the civilian world. So I was like, I was scared. I didn't know what to do. Ended up working for a British aerospace and defense manufacturer.

[00:01:45] Bryson: And then I got recruited, into the intelligence community because some of the activities I did, attracted the government's notice. That's actually where the nickname Grim comes from. And so when I got out in 2013 to create that offensive cybersecurity consultancy, I named it Grim because that sounded really cool.

[00:02:00] Bryson: Bryson's consultancy sounded a little douchey. And the mistakes that led from there to today are, Target in 2016 came to me, and I love the story of Target because if you realize how young cyber security is, I think it puts a lots of things in repose. First, firewalls were not commonly in place until 2000.

[00:02:19] Bryson: So around that time, commercially, we didn't separate your network from my network. And then that was it. So network segmentation through a firewall and A. V. We're good for cyber security, right? Well, no, then we have the target breach and the significance of the target breach is it's the first time organizational leadership said, Hey, that's what you nerds have been talking about.

[00:02:39] Bryson: And we can't just keep accepting risk. Here's the blank check. Solve the problem. And so where I come in on this story with them is they built a world class security organization. They built a red team, but a red team needs custom tools to be able to find the edge of the rainbow of an expensive cyber security investment because whether you spend a lot or a little, you can still get hacked.

[00:03:02] Bryson: So it just gets harder to start to find those edges. And as a result of that, I came up with a modular malware framework, which I co developed with them for 2 years. And then in 2018, with the help of Ron Gula, who created Tenable, and Dmitri Alperovitch, who created CrowdStrike, I launched Scythe out into the world.

[00:03:21] Bryson: Along the way, always had a lot of interest in industrial control systems, which actually started with Car hacking. So we were some of the first car hackers at grim, well before the wired article came out in 2015, we'd been doing it for a couple of years. And, I joined forces with a great friend named Tom Van Norman, and so that's where the 501C3 nonprofit, the ICS Village, comes from.

[00:03:44] Bryson: And you can find us at DEF CON, RSA, our own policy conference, which is currently called Hack the Capital. We're changing the name this year, that happens in Washington, D. C. we support other events as we're invited throughout the world.

[00:03:57] Craig: Perfect. Well, I have to say I love the unicorn. got to know the history behind that. I got to know.

[00:04:03] Bryson: So, the unicorn goes back to a grim. We would do annual T shirt contest for Defcon and. One year I proposed the idea of a cartoon Grim Reaper riding a unicorn because I thought the juxtaposition of cute and grim was really funny and this design blew up.

[00:04:23] Bryson: Everybody wanted it. So it was about that time that I was looking at spinning out conducting a VC raise for Scythe and I'm sitting and I'm thinking, well, the grim logo was really successful. But how do I make the scythe logo successful? It's a piece of wood and metal. It's boring. People are into these unicorns. And so the scythe logo was born.

[00:04:45] Craig: Okay. I like

[00:04:47] Bryson: then, of course, as the CEO and spokesperson of the public face, I, of course, have to match the logo and continue to push the brand.

[00:04:55] Craig: Perfect. Very, very fitting. See, I was thinking unicorn, three or four startups, all a billion dollars. That was, where my mind went, but what you did with it. That's, great.

[00:05:07] Bryson: Frank, there's a lot of subtle humor throughout the branding and the logo. I call it the Disney villain philosophy. The adults start to see that there's something deeper and there's a joke and the kids just think it's cute

[00:05:19] Craig: Kind of like Spongebob.

[00:05:20] Bryson: like SpongeBob or, Rocky and Bullwinkle for really going back to the, the real.

[00:05:26] Craig: Real cartoons. Yeah. So, help me understand, how did you get started? , what would you say drew you in to the OT space that really is what we're talking about today, the industrial control space and how organizations are adapting? I know you talked about Target. Everybody's familiar with Target breach.

[00:05:44] Craig: would you say that's the beginning or was there something else that really brought you to us? Yeah.

[00:05:48] Bryson: as a kid, I was one of those kids that tore everything apart and had my parents yell at me. They're like, you're going to break the computer. no, I can put it back together again. We're gonna be fine. But my dad would still come in and, back in the MS DOS and early Windows days.

[00:06:01] Bryson: your 386 would just break for whatever reason anyway, and he inevitably like, Bryson, you did that. I'm like, no, dad, dad, I promise wasn't me. Here's the deal. I can fix that. But I

[00:06:11] Craig: That was Bill Gates and his friends.

[00:06:12] Bryson: Yeah, and I took robotics development class in middle school. so I was always getting into the mix of the hardware and the software side of that, which I think really speaks more to industrial control systems.

[00:06:25] Bryson: But honestly, it was like I was saying earlier, it was car hacking. So, a good friend and a principal who still works at Grimm, a guy named Matt Carpenter, introduced me into that side as we built out that practice at Grimm. Along that way, I helped stand up the Car Hacking Village at DEF CON.

[00:06:42] Bryson: And then I was then playing into the ICS village, which had started, I think, in 2014 with a select group of folks who just really started with the passion in the garage but it struggled. I think it's really important to recognize that until colonial pipeline in 2021, nobody cared about industrial control systems.

[00:07:00] Bryson: I mean, broader population didn't care. So there wasn't just like the target example. There wasn't that aha moment that this is something that needs funding and attention and the investment in it when you start looking at from the B. C. perspective, because that's what creates the market for solutions.

[00:07:16] Bryson: that's in 2015, Tom and I joined forces and In 17, we turned it into an official 501 C 3. For any of you who think that starting a nonprofit, is something you're interested in, you need a lawyer and it takes about a year to work through the IRS and the state systems just to get the corporate designation to be able to do all that stuff.

[00:07:38] Bryson: And then that's only the beginning of your pain. So I have plenty of stories down that, but that's my path that got me in on it. And then from there, I enjoy teaching. So I teach different aspects of operations technology, through my work as faculty at IMs. I meet and work with probably about 40 asset owners a year.

[00:07:56] Bryson: And then, of course, Scythe, we have our own clientele where we've been collaborating. And this is the big thing. I don't like academic speak. I'll throw somebody under the bus. I won't name though, where they did this LinkedIn post and they were going on about how patch management was critical to industrial control systems.

[00:08:13] Bryson: And I was like, no, I mean, vulnerability management, patch management. Is important hygiene is important, but you can't tell me that should be the top focus because it's not available for the most part. These systems are built for a long life cycle. A lot of these systems can't be patched. I believe it was a drago's report 2023 that noted only 4 percent of the average industrial control system field devices could even be patched.

[00:08:38] Bryson: So don't like the academic, the ivory tower, the empty heads that talk about the stuff and haven't actually. Put the PP on, PPE on, haven't put the PPE on, gone down into the trenches and actually worked the problems. So that's one of the things I enjoy between IANs at the high level with the consulting and then with Scythe, the work that we do with helping conduct, converge risk assessments because the most common threat factor in the OT is IT.

[00:09:08] Bryson: That large squishy footprint, that's entire job is beyond the internet and have employees shop on Amazon instead of doing work.

[00:09:15] Craig: we see that, I would say probably what we do is majority, because the industry is still, fairly new on the OT side. It is very much, It is very much informational. It's helping organizations understand what's available. What are your options? There's no silver bullet. This is back to defense in depth.

[00:09:39] Craig: There needs to be multi layers. There needs to be different approaches. And I agree 1000 percent with you. This is not just patch and forget it because it may cost you 500, 000 To patch a micro segment something and there may be a ten thousand dollar Alternative way to achieve the same thing or better but organizations don't know it's available Don't know how to get to it and don't understand the mechanics of the way that it works so that itot bridge that you mentioned and that Convergence or digital transformation or whatever?

[00:10:15] Craig: Buzzword it is is important to help Back to educating the end users the asset owners on what this really means

[00:10:26] Bryson: Yeah, I mean, step one, an air gap is not an air gap is not an air gap. Your OT environment is never completely air gapped. I can't tell you how many times I have folks who like, well, you don't know how nuclear works. I'm like, Oh, yeah. Have you ever seen a cell phone modem installed in a crane that you didn't know was there?

[00:10:44] Bryson: I have. It happens. And the reality is, even if everything is air gapped, Air gapped from, we don't have it logically connected via network. That doesn't mean you can't have rogue RF, which can happen to multiple levels and it doesn't mean you still don't sneak or net something in. Nothing is ever fully air gapped because it needs to be touched at some point.

[00:11:03] Bryson: The second part. And I love this part, this lesson, because all too often we have a lot of I. T. vendors and folks looking down on O. T. as like, Oh, welcome to the cyber security game. Now that you're playing catch up and they're condescending and. I actually learned something to take back to the practice, because fundamentally, we were talking about vulnerability management.

[00:11:25] Bryson: It basically patch or accept in an it's mostly accept or mitigate. And there really is a partnership approach, which depends on architecture to be able to do that. Hence, segmentation, micro segmentation are great examples because you can't hack what you can't touch. So if the vulnerable isn't easy to get to, then I have mitigated the vulnerability and that's part of what my tool does is being able to prove that that can do that.

[00:11:51] Bryson: That's what site does.

[00:11:52] Bryson: So in summary, I see 2 major things that everybody in the industry is in there. A lot of other words, and I'm going to give credit out to sands for their top 5 controls that everyone should be looking at. But fundamentally, I see 2 core cyber security strategies established visibility.

[00:12:09] Bryson: What do I got? when I say, what do I got? Automation engineers, the plant engineers, the control system engineers, they know what they got, right? There's a spreadsheet. There's a list. There's a asset center in Rockwell. You pick your thing. They know what they have there. The problem is, it's not a consolidated list from what we're used to with the CMDB at the IT level. And that has all sorts of value with Negotiations licensing and then, of course, effective management and then to the 2nd state. know what you got now, you can build a defensible architecture and the key part of a defensible architecture is take the purdue model. Not as religion. Anything. Any model, right?

[00:12:50] Bryson: Is has flaws. If you make it a religion, you're going to catch yourself on the flaws just because you adhered to something for an unnecessary reason to take the Purdue model more as a good idea of a reference architecture on thinking through levels, segmentation and conduits for how you're going to talk to those segments, and that's the defensible architecture.

[00:13:11] Bryson: I'm establishing the proper segments. That do not break process workflows. I'm going to say that again that do not break process workflows. The greatest actors on the planet are employees when you get in their way. Just like if you're a parent, children, when you get in their way, right? They're going to find a way around.

[00:13:26] Bryson: that segmentation is now going to give you natural choke points for overwatch. So this is where you can now install the monitoring capabilities to ensure that you have that visibility, not just from the assets themselves, but now the behavior around the assets, which, of course, is the one place an attacker has to get from point A to point B.

[00:13:44] Bryson: Again, I can't act what I can't touch. Now you can get them because on the wire. Every attacker goes to a one and zero like everything else. They just try to hide in the noise of the protocols you're using, but there's no way for them to actually hide from you.

[00:13:58] Craig: and I would say that over the let's call it evolution of the ot controls engineers the plant process team they become very very adept in understanding how to use Multiple NICs to create lower levels to protect themselves from their internal brethrens on the northern side of the 3. 5 firewall.

[00:14:21] Craig: they are accustomed to hiding, theoretically, those lower level networks. But, you're right, there needs to be a defined way to better protect them from NICs. Internal and external threats, because we see the same thing you do. We see probably 70 percent of the threats that are coming through are internal, where someone just doesn't realize the implications of the actions they're doing, trying to help, but really causing more harm.

[00:14:51] Bryson: Yeah, and on that note, on hygiene, software disabling something does not make it Unavailable.

[00:15:00] Craig: No, it does

[00:15:00] Bryson: I can get root access on a device, I can turn on, say, a nick that you thought you had software disabled or a wireless capability and every corporate environment now has some guest Wi Fi, which is typically very easy to get on.

[00:15:14] Craig: Yeah.

[00:15:15] Bryson: I now have established my command and control ingress and egress.

[00:15:19] Craig: So what are you seeing today as you're out in the field through either, Real live engagements through the organization or through training and teaching as far as let's call it the iot convergence the beginning of the digital transformation as organizations are trying to work better together, which they should be doing to achieve a common goal.

[00:15:42] Craig: are you seeing great success or eh, we still got some work to do?

[00:15:47] Bryson: So, first of all, once you get here, there's no going back,

[00:15:50] Bryson: right? Just like cloud has taken over it through its economic utility. We're starting to see the same thing in OT. I can remember being asked this question a few years ago. I was like cloud in the OT environment. No way. It's already there.

[00:16:02] Craig: coming. It's, yeah.

[00:16:03] Bryson: it's not even already coming.

[00:16:04] Bryson: It's already there. Folks are happy to push. They're historians to the cloud. It's an easy way to share and conduct analytics in a safe manner. I've already seen, SAS HMIs.

[00:16:16] Craig: really?

[00:16:17] Bryson: I mean, it's here, and it's one of those things. Once you cross the Rubicon, you never go back. And why do we cross the Rubicon?

[00:16:23] Bryson: Because it's convenient. It's cheap. It's easy, right? There's all these advantages that come out of it. The overall purpose of digital convergence Is convenience and efficiency. That's what we're doing, right? I get better ideas on maintenance. I get a quicker way to be able to push updates and manage those devices, right?

[00:16:41] Bryson: There's operational efficiencies that are being achieved from this. The 2nd part, as is always going to be the case throughout humankind function 1st. Security second and we in security then have to play catch up because the business needs and wants these things. And for any of you who work in manufacturing, you know how the margins work.

[00:16:59] Bryson: You've got to be continuing to find those efficiencies in your production. So that's why we're here and why we're going there. And we're not going back. The most common mistake that I see again, what I was saying up front, It people not understanding what it's like on that side of the fence. You may work at the same company.

[00:17:16] Bryson: You are two different cultures, and if you get in their way, they may physically threaten you. Right? Get off my floor, Take your khakis and go over there, or I will forcibly put you over there, right? I am where we make money. You are not where we make money. You are a cost center to help me do what I'm doing and I don't need your attitude.

[00:17:34] Bryson: So this is how I work it in our risk assessments. Again, going back to the most common access factor, being it. Invite the O. T. Folks into a purple team exercise where they can see that in the I. T. Environment by themselves. So for those who aren't familiar with the purple team, you've all graduated kindergarten.

[00:17:49] Bryson: Red team plus blue team is purple. Yay, gold stars and stickers for everybody. But what the process does is it is a milestone driven collaborative process. So for those of you who have ever done a pen test, a risk assessment, a red team, any of those things, you're used to some really probably pretty good hackers doing something, throwing a report at your head and then disappearing in a cloud of smoke, but giving you more work.

[00:18:14] Bryson: and usually the report's not well written and you're like, well, what do I do with this? Purple teaming solves that. So what we do is we have transparency because we collaborate on the scope and what we're trying to do. We're going to test. These devices, this network, this domain, this sub process, whatever that is.

[00:18:31] Bryson: And we want to generate this signal. So we're going to emulate this particular adversaries procedures. And this is the order we're going to do them. And then this is what we expect will happen. And then you do it together. And so when we do it, and this is really cool for a lot of folks, because this is the first time really seeing other than a Hollywood movie, actually a hacker procedure looks like.

[00:18:52] Bryson: What is a threat really doing? They're like, Oh, that's why, and that's it. And so you're getting this education and this awareness naturally from the process. And then you fix as you go and you repeat the step to go, all right, do we now block this procedure if that's what we're trying to do? Do we now detect this procedure the way we're trying to do and you walk through that?

[00:19:10] Bryson: And then the outcome is a team education, foster relationships and of course, a more defensible architecture from what you tested there. So the folks can now get that confidence in you, the process and the tooling that's driving that signal. And then you start walking it toward them. And my favorite crossover point is a jump host or a bastion because that's a typically Windows Linux box.

[00:19:36] Bryson: It's not critical and you've now started the baby step into their space.

[00:19:40] Craig: And that makes sense. I can see that, organizations, from an IT perspective, they like the pen test philosophy from an OT side. Everybody's like, no, no, no, no, no, no, no.

[00:19:50] Bryson: You're going to break something. No

[00:19:52] Craig: So, but yeah, from an organization standpoint, on the OT side, it's always a bad thing. It's never good to do pen testing on the OT space.

[00:19:59] Bryson: No, it's not that it's bad to do pen testing, right? Again, this is the trusted relationship. So back to that question, trust is the biggest gap that I see. You need to go and win them over, not go over and tell them. You need to go and ask what their priorities are and try to figure out how do I ride that priority to getting something that provides security as a side effect to me making your life easier.

[00:20:22] Bryson: So, my favorite starting point, remote access. Thanks.

[00:20:25] Craig: okay.

[00:20:26] Bryson: already typically because it's contractually mandated have all of these third party vendors coming in either remotely or physically into their systems. They don't care how that happens, right? I don't need to dictate this particular VPN.

[00:20:40] Bryson: I just want it to be easy and a lot of them probably have some approaches that are not easy. I've seen some ways that are so anachronistic because that's how the vendor in Europe work. They would set it up 24 hours in advance just to make sure the damn thing works by tomorrow. That's how brittle some of these things are.

[00:20:57] Bryson: This is a perfect example where it, who's providing it on that side can provide it on this side. So I am not coming in and dictating security to you, but we are gaining security because I'm providing a service and we need to emphasize that I am providing you a service, which means I need to provide you a good service.

[00:21:14] Bryson: I provide you a bad service, we're back to square one, possibly negatively having lost trust. But if I provide you a good service. We've now controlled the connections coming in, going back to monitoring a defensible architecture. I've now gained free monitoring on all of those connections that you don't care about and is invisible to you.

[00:21:31] Bryson: We all win. Going to OT to build that relationship and bringing something that they want and doing it well, that's how you start.

[00:21:41] Craig: So speaking of start where should Organizations be spending their money today for organizations that are stepping back and saying, okay The board said here's a check go fix this

[00:21:53] Bryson: Mm hmm.

[00:21:53] Craig: Where do they start? What makes the most sense?

[00:21:57] Bryson: Every company every asset owner that I've seen is in one of two phases. I am working on visibility. I'm working on architecture and it's not monolithic. You can gain some amount of visibility to then some amount of architecture, particularly places that have global sites. It might be, some sites furthermore others.

[00:22:15] Bryson: If you're lucky and you have homogenous sites, then that happens. I've never seen that. Usually it's all through acquisition and you have 500 different configurations all over the place, plus an archaic routing and switching infrastructure that can't even handle more. So you can't do tap and span ports.

[00:22:30] Bryson: So everybody's in 1 of those 2 phases, and I think that's the key to recognize, because I think half of what I try to do in teaching is provide the therapy that you're not alone. The existential angst you feel you're here with friends who all feel it too. So you're in 1 of these 2 parts. Then second, going back to my comment earlier about how to build trust.

[00:22:48] Bryson: Okay, so the board's bought off on this. Go and meet the operational executives. And when I say meet with them, listen, I had a consultant call with, I. T. Architectural group and. They were like, well, yeah, we met with the senior vice president, and she didn't seem that interested. And I was like, well, you met with her.

[00:23:06] Bryson: Did you ask her what her priorities were? They all blinked at me and they're like, oh, we didn't think about that. your job with going to an executive is to make their lives easier, particularly the revenue producing executive that controls all of North American revenue and its production.

[00:23:20] Bryson: Maybe, asking what she's interested in will get her attention and her support as opposed to just being like, Well, ma'am, we're here to make security happen for you And then from there, individual sites, plant managers are demigods. They run their fiefdom with P& L and safety and you're coming in there.

[00:23:40] Bryson: You're going to have to win them over the same way. So the remote access, like I said, is the most common, easiest way that I've seen to gain that win win across. those are my recommendations. You can be either in that visibility or, architecture and then ask, ask, ask. So now you can tie what you're trying to do.

[00:23:57] Bryson: again, don't force it. don't try to pound something in that doesn't fit instead. All right. You want that? Well, that's not what I was thinking about. So what do I need to do to gain some security benefit from providing you something towards your goals?

[00:24:10] Craig: Yeah, we've seen many times where Organizations the IT side will procure a tool or a technology And then we'll ask all the questions. Everybody's on board. We're ready to go. We're gonna start Next tuesday be at the plant and you walk in the door and a plant manager says what are you guys doing?

[00:24:28] Craig: Well, we're here to do this project. Whatever it is. He's like, oh, no. No, he said I shut down In six months i'm closed for one week. I've got four weeks worth of stuff to do You go see my boss who's the ceo or the c o o and if they prioritize whatever it is You want me to do and put it in my list? I'm happy to if not, you got to go away,

[00:24:50] Bryson: And yeah, don't surprise them. And so another area that you can find that is disaster recovery and business continuity planning that is fundamental to how that plant manager thinks and the good news or bad news is based on how you think about it. So, back in 2020, then director of the cybersecurity infrastructure security agency, SysA, Chris Krebs and I gave a talk at RSA and we predicted the coming scourge of ransomware.

[00:25:16] Bryson: So ransomware had been around, but it hadn't really hit the, apex. Unfortunately, we saw that dovetailed with, COVID, and hence going back to 2021. And my point is, never waste an emergency. That can be an opportunity. And so ransomware is now a kitchen word.

[00:25:33] Bryson: Your grandma knows what ransomware is now. Grandma doesn't know how ransomware works any more than the 500 times. She asks you how to work her phone. Grandma's how you turn it on. It was off. But guess what? That's the same level that your business executives work at. Good news. Bad news. They know what ransomware is.

[00:25:54] Bryson: They know ransomware is a threat, they do care about business continuity planning and disaster recovery. They have budget for it. They have attention for it. So that's another area that you can try to work and tie to. And that's now the advantages you have in the greater state. Like I was saying, but the village, we were doing it for years because there was no great crisis.

[00:26:14] Bryson: So nobody cared when you hit in a hydrocarbon based economy. When you hit folks, not being able to get gas, then the average citizen suddenly cares.

[00:26:22] Craig: Absolutely when people are putting Gasoline in trash bags in the trunk of their car because they don't think they'll get it anymore next time Well, first off the fact that the gasoline didn't immediately You Instantly dissolve the black plastic trash bag is still beyond me, but maybe it didn't I'm not sure

[00:26:40] Bryson: I think that's more credit to the plastic bag, frankly, and part of why, please use paper bags and recycle because this stuff does not leave the environment. There's a great Craig story and note that the gas didn't disintegrate the bag.

[00:26:53] Craig: I know it's crazy. So as we look forward What do you see? Shaping the industry. Are there key indicators, key technologies or areas where the industry is going to drive? And I'll preface it with this. I saw something just published in the last couple of days.

[00:27:11] Craig: They're secure by. Demand. Let's call it that. It was secured by the design with the emphasis on procurement instilling upon organizations. You must now do this before we will buy from you, which gets back to a secure by demand mentality. So something of that nature, is there something else?

[00:27:28] Craig: where do you see us going?

[00:27:30] Bryson: Again, since we're all in visibility and architecture toward better architecture, in the next five years, I'm hoping that the majority of asset owners, have built a defensible architecture because. Let's be frank. It takes years, years, years, this isn't a 6 month project. This isn't a 12 month project.

[00:27:47] Bryson: This is years. And the bigger you are, the longer it takes. Something I don't talk about very often because it takes away from my elite hacker cred, but that British aerospace and defense company. I built from scratch with the team around the world that I also had to build from scratch. The only fully functional configuration management database I've seen anywhere.

[00:28:05] Bryson: And it took us four years to get 70 percent deployed before I left. Four years to just do an IT CMDB. I wasn't even pulling OT assets in. that was four years. And I had a team of 12.

[00:28:16] Craig: yeah, if you do the math, and I'm an organization with a hundred plants or a hundred and fifty plants in my facility, and they're all different and they're spread around the globe on seven different continents, that math equates to a great big number with a lot of zeros after it.

[00:28:34] Bryson: By site by site,

[00:28:37] Craig: Wow

[00:28:38] Bryson: you have to do each site individually. If you could figure out how to do more one at a time, then God bless you. You've, cracked some executive code there to make that happen, but. I'm skeptical. So it is years. So that's my hope is that we continue down this path of that defensible architecture.

[00:28:55] Bryson: And then what's after that? I don't know. Now we're into a grab bag of fun things.

[00:28:58] Craig: that's always exciting though as new things come on if I go back to your story i'm gonna guess you probably don't drive a tesla, which is a computer on wheels probably a Early 50s or 60s car that has zero electronics in it. That's manual shift. That's a hundred percent manual in nature

[00:29:17] Bryson: Actually, I drive a British racing green Jaguar with cognac Windsor leather. It is that Beautiful color combination

[00:29:26] Craig: Okay, beautiful. So it has some technology in it.

[00:29:31] Bryson: going back to car hacking. The technology that by regulation shifted. Everything was tire pressure monitoring system. T. P. M. S. In 2006 to frequencies guaranteed access in combined with the fact that. Can bus is just like we try to segment processes and ask owner environment.

[00:29:50] Bryson: Our environment, you had generally 3 can buses and of course, what's the most important part in your car as a driver and a consumer. Infotainment system, so something running again, the folks are going to laugh, right? Something that's a couple of generations old windows or Linux. Is now my central brain to being the thing that keeps the three important can buses, including the priority one, segmented from each other.

[00:30:15] Bryson: Well, you do the math.

[00:30:16] Craig: Yeah, not pretty. So as we look to wrap up, is there one piece of advice for organizations that are listening today that are starting the journey, maybe they're beginning the journey, they're on it. Is there one thing that you could say, If I could go back or I recommend you do what might it be?

[00:30:35] Bryson: the most common fallacy I see across everything is everybody wants to complete some project. And, after 234 years of putting this in, then they want to do the risk assessment. Think about that. What if you got something wrong? Why not catch it earlier? Right? We all know this from manufacturing the earlier I catch something in quality control, the less the price of the defect.

[00:30:58] Bryson: Well, it's the same thing for security issue, which is the same thing as a defect. So try to bring in risk assessments in partial components. Again, this is where purple teaming is really valuable. So bring that process into as part of your deployment to check your progress as you go and adjust because you're going to save yourself a lot of time, a lot of money.

[00:31:20] Bryson: And a whole lot of emotional pain, with that being the scaffolding to test to your design to deployment as opposed to afterward.

[00:31:28] Craig: reminds me a lot of like a minimum viable. Objection so that you start with what is it are we on the right path and then you scrape and you start over and You modify and you adjust and then because you're right You don't want to get four years down the road roll out all of your plants And realize that there's a critical flaw and you got to start all over that is a bad day for somebody

[00:31:50] Bryson: And yet that is the most common wisdom that everybody is executing.

[00:31:54] Craig: Well Bryson great conversation. Thank you very much for joining us today. I appreciate it Super wisdom keep doing the work that you're doing keep educating teaching all of the different ways you're doing it Thank you. Thank you. Thank you so much. I appreciate it.

[00:32:10] Bryson: Thank you for having me on the show.