When the Plant Can't Stop: Securing Systems That Never Sleep

[00:00:00] Ian: you can access something remotely, a bad guy can access it remotely. So you have an increase, what we call attack surface at the same time. So you have digitalization coming in and you're seeing an increase in the frequency. and potency of attacks. So you now you have those two converging and then you have, as you mentioned, TSA and other areas, government coming in and saying, okay, we, we need to regulate some of this. 'cause we need to start figuring out how do we start managing this across a societal level.

[00:00:30] Ian:

[00:00:59] Craig: Hi, welcome. My name is CrAIg Duckworth, and today I have the honored guest of Ian Branson, the Vice President of Global Industrial Cybersecurity at Black and Veatch. Ian, welcome to the show. Can you give the listeners a little bit of background about yourself?

[00:01:15] Ian: Sure. First of all, thank you very much for having me here.

[00:01:17] Ian: very important platform and concepts that we're gonna be talking through today. I am the, , vice President of Global Industrial Cybersecurity here at Black and Veatch. I've been with Black and Veatch about a year and a half. it's a relatively new practice that they've, set up here. Black and Veatch as a company has been around about 110 years, it focuses on building critical infrastructure, , both on from the design build and running of critical infrastructure and focusing on sustAInable growth. , They brought me in about a year and a half ago because they wanted to start an industrial cybersecurity practice to complement all the different types of, work that they're doing. they have been doing industrial cybersecurity for about 20 years already. They just had been doing it in We've been doing it in areas such as, , our industrial control systems. We've been doing our consulting group. We have been doing it in our, , government space, but they wanted last year to bring it together because there was a significant. Client need out there to saying, look, there's a safety considerations on critical infrastructure and we really need to put together the full set of services and value to bring to our clients throughout their lifecycle.

[00:02:33] Ian: So that's why they went out and, asked me to join. Previously I was at Siemens Energy, helping them build their industrial cybersecurity program, and I was also at. w, orking in the maritime industry, helping organizations there, doing the same thing. So this is, I've been doing this for a while. , So it's a natural fit.

[00:02:51] Ian: When they, they asked me.

[00:02:53] Craig: Okay. No, great. I appreciate the background. That's, I think that'll bring a lot of value to the listeners. , We've got a ton of the, of the same. Kind of crossover, but I guess I would say the differences are in some of the power distribution, power generation, water delivery that, most of us consider critical infrastructure that, you know, that we use every day in our lives.

[00:03:16] Craig: around the house, you know, we all kind of take it for granted. I do, I get up in the morning, my water is fresh, and my air conditioning is cool and I don't think anything of it, but there could be a time That, that may not be the situation. So it's, important. And I would say give us a little background about kind of what you guys are seeing in maybe the power or the water areas on how you're leveraging cyber and what.

[00:03:44] Craig: Maybe some initiatives that are through TSA or through the various programs that are helping your organization and us as an industry secure the critical infrastructure for the country that we're in.

[00:03:58] Ian: Sure. First of. all your Point is exactly right. When you look at what we do or what critical infrastructure is about, it's about what we do every day, right? It's about how we live and work and advance our lives. It's all those underpinnings that, hey, it takes energy to get to my house, to, do the things that I just assume that are there. But that's all across society and it's, underpins everything from economy, , to just quality of life, to everything that we do as a society. And so we take that very seriously when we're trying to protect it. And so when we're asked, Hey, how do we protect it?

[00:04:36] Ian: What's going on? What's changed in this environment? And why has it become so critically important? It's because you have a convergence. Of what's happening in the market right now. You have a lot of, of this critical infrastructure, particularly on the OT or on the industrial side that's being connected in ways that had never even thought of a few years ago of being connected. So all of a sudden you've got. t he equipment and machines and everything that is running those operations are under critical infrastructure, being part of digitalization, being part of remote access, being part of ai, being part of all this next wave. Of innovation that's going to make our lives a lot easier and make these things much more efficient. But it also makes them much more exposed because let's say take remote, if you can access something remotely, a bad guy can access it remotely. So you have an increase, what we call attack surface at the same time. So you have digitalization coming in and you're seeing an increase in the frequency. and potency of attacks. So you now you have those two converging and then you have, as you mentioned, TSA and other areas, government coming in and saying, okay, we, we need to regulate some of this. 'cause we need to start figuring out how do we start managing this across a societal level. So you have NERC CIP on power side, but you also have international things like, NIS or NIS

[00:06:03] Ian: 2 you have in water or in Oil and gas, you have TSA in water, you have a WEAs. You have different areas that are coming in to scrambling it. That convergence of those three areas. You know, when you're talking about the attack surface digitalization and regulatory environments, it's pushing cybersecurity into a top level.

[00:06:22] Ian: Usually it's a top three priority for most , board of directors. , Particularly when you're talking about power, water. if you're talking about any of the critical infrastructures that we use every day.

[00:06:33] Craig: you're a hundred percent spot on. and we see the same, convergences across the. Industrial, you know, whether we're heavy in food and bev, , pharma life sciences in that area. And it's the same thing. We'll walk onto a plant floor that's maybe got, you know, 30, 40-year-old equipment that has been around since before the internet even really started.

[00:06:56] Craig: it was manufactured with, without security in mind. It's been converted from. s ome other protocol over to an ethernet base. So now it's, as you're connecting it to the enterprise, because you know the business leaders, the executives are looking for metrics, KPIs to help drive that efficiency.

[00:07:17] Craig: It's the same thing I drive by, a power. Distribution on the way to work. And I look at it, I'm like, it's been there since I was a kid. That stuff has been there a long time. But you know, now as the grid is becoming more, fragile, we're adding additional, Which constraints on it were, you know, you mentioned ai.

[00:07:37] Craig: every time I turn on the news, a new data center that's gobbling up megawatts or gigawatts of power is being added to the infrastructure and how that plays onto everything that's already there. It just makes it, I would think more fragile. So what you're doing is all more important.

[00:07:58] Ian: Well, yeah, and I appreciate that. And that is exactly the focus we're looking at. I mean, you have legacy systems combined with a lot more demand if you're talking about, , the grid, right? Lot of different kinds of demand coming in. AI is, and data centers is a big area, but you also have electric vehicles and other types of electric services going on. Things are, you know, we're not getting less connected. On this planet, we're getting more connected. And all that takes power. And that makes it not only amount of power that you need, but is the surge times and when you need it and how you need it. So all these different factors are coming in, which then feeds, Hey, I need more digitalization so I can do it more efficiently so I can get the most out of it.

[00:08:42] Ian: So I can get everything in order. A total. g rid orchestration of every parts of these working together so we can get the most outta this well, when you start putting that in, whether they be smart meters in some areas, or anything else that you're doing to do these improvements,

[00:08:59] Ian: you have a cybersecurity. You're becoming more dependent on digitalization and more exposed to cybersecurity risk.

[00:09:05] Craig: No, you're right. let's take a look at, NERC CIP and kind of some of the, guidelines that they're providing organizations. like here in St. Louis, we've got Ameren, Missouri, Ameren is our power provider, I guess. So they're gonna fall within a, a NERC CIP guideline. I think probably for, you know, I think they're high, medium, and low.

[00:09:25] Craig: So they're gonna be whatever. They fall on that scale. So help, the listeners that may not be familiar with what NERC CIP is and that regulatory body and kind of how that helps structure and guide the protection, if you wanna call it that. Cyber resilience within the infrastructure that, you guys are helping to secure.

[00:09:46] Ian: Sure. And when you speak about NERC CIP, NERC CIP itself it's a much larger category about how all operations run. There's a specific part of that, which is called NERC CIP. That is on the, critical infrastructure protection, it goes into cybersecurity, itself,

[00:10:03] Ian: and has those outlines.

[00:10:04] Ian: It's been around again for about 20, 25 years. Our teams actually helped on the first NERC , Discussions about what those regulations are, and basically it said, Hey, listen, we gotta start getting our arms around this. And it's been evolving ever since then. And like most regulations is trying to identify and say, here's the minimum stuff that you need to get done to start putting inside your, your systems and networks to, put these protections in place. Like all. c ompliance It's meant to do a very broad group. , There's a big difference between being compliant and being secure. , I can't emphasize that enough. You can be fully compliant but still not hit the full security levels that you need. but that doesn't mean. The government shouldn't put in some of these regulations and trying to say, Hey, what we do, NERC CIP has been increasing ever since its beginnings of what you need to do.

[00:11:00] Ian: And there's recent ones, NERC CIP, CIP 15 that just came out, in June that was. Gaining it now to its next level, so you can see it getting more and more stringent trying to keep up with that threat environment. It's never gonna catch the threat environment. Threats go much more quickly than government, and there's a difference between, again, being compliant and being secure. But it does give justifications for many, many organizations Say, we have to start investing this. We're required to.

[00:11:28] Craig: Well, yeah, the organizations can no longer. Keep their head in the sand. They have to do something. And, a real quick story. We worked with a client, this has been probably six years ago. They were in, there was a municipality. They were a water and light organization. And we did a project with them where we, we leveraged an intrusion detection software.

[00:11:54] Craig: We went in, we put it in, we turned it on. Their eyes got the size of saucers. They're like. Oh my goodness. We can't have that. Turned it off, unplugged it, set it in the corner, and let the license expire because of the requirements of NERC to fix what you know is wrong. And they're like, well, we can't know all this is wrong because we can't fix all this stuff.

[00:12:23] Craig: So I get where we're going, but I'm like, is that the right answer or was that an anomaly?

[00:12:30] Ian: Now. So

[00:12:31] Ian: look, at the end of the day, we're speaking with our clients, right? we say the risk is a risk, okay? It's there. You can turn off all the stuff you want, you can deny it. You cannot do stuff that it's there. And if you don't acknowledge it, you are by. defacto you're accepting it. Okay? And when you have regulatory environments and say, okay, you have to do X, Y, Z, okay? Again, at certain level, but we know that the risks say, well, you should probably doing these other set of things to be fully secure. That distance, that space between compliance. And when you're talking about full security, that's what we call residual risk.

[00:13:11] Ian: That's the risk that you're not addressing, but it's still out there and it still can affect safety and it can affect uptime. And when we say safety, we mean site safety. We mean environmental safety, we mean public safety. And oh, by the way, since your critical infrastructure, it means national security and economic stability. It's still there. It is what it is, and so what you need to do is identify it and then manage to it however you can to do it, but turning it off or going away, that's not the answer because it doesn't go away. Now our clients, again, a lot of them when we're sitting across industry are paying attention to this and what can they do? You raised a really great point. Now what? A lot of them, I've been in this game a while now, and at the beginning they were saying, you're making up cybersecurity to sell me stuff. And I'm like, okay, I don't know what else I can do. Again, a little bit of denial. I haven't heard that. in quite a while now it's the, we acknowledge it.

[00:14:09] Ian: This is a risk. I dunno what to do about it. Right? What else? How much is enough? What do we know now? There are guidelines, there's ways, there's a discipline approach. There's only a set of certain amount of control that you need to cover. It's not an infinite amount, and it all depends on if you're talking about NERC CIP or you're talking about a NIST standard or IEC 6, 2, 4, 4, 3. All these different standards organized in differently, but it's still the same universe of stuff that you need to pay attention to, to make sure that you're managing the risks to the appropriate level for your threat environment.

[00:14:42] Craig: It Sounds like from your experience over the last couple years that the industry is, let's call it maturing, that they are beginning to accept that there is the risk there. It's not going to go away, and they need to begin taking actions to, to begin mitigating what they can within their control.

[00:15:04] Craig: There's obviously, you know, we hear organizations say, I wanna see a hundred percent visibility. I'm like. You sure you want a hundred percent. Do you know what that's gonna cost you in time, effort, ability, or, you know, where's that sweet spot? Maybe it's 85, maybe it's 90, maybe it's 70. I don't know. You know, it depends on the organization, what makes the most sense?

[00:15:28] Craig: And as the industry is maturing and beginning to get that acceptance, it sounds like you are seeing that shift to more.

[00:15:37] Craig: resilience

[00:15:39] Ian: it's all moving, right? This is all an emerging area. Bad guys are. Figuring out how to get in. Good guys are figuring out how to protect it. Digitalization is expanding what we call the attack surface way they can get in, what they can do, dependency. So it's all this moving game, but it has matured in this, it has worked out in the sense where people are now no longer saying, again, it's undeniable. The risk is there. They just don't know exactly where the risks are and what to do about it. But when you go through these discipline approaches, as you're saying, they're going down that journey to do it. NERC CIP gives some of those guidelines. There's other standards that are out there that can give you some frameworks. Get your arms around it basically so you know what to do. And then to risk prioritize because the reality of the situation as you had brought up before, you can't do everything all at once. And maybe you don't need a thousand percent on every single control all the way up. Pin the needle because your threat environment may not require it or, the risk base of what you do and the realities of what you can do don't fit it. You mention things like the legacy systems. There's just certain things that you might not be able to do because you don't have everything. It's not a perfect world in this. You're dealing in the realities of operations and budgets and logistics and everything else that you have to deal with.

[00:17:01] Craig: are you guys seeing. Let, let's call it certain players, whether that be the very large utilities, and to me in my mind, AMD's big, that like multi-state, they're, , maybe they are or maybe they're not. I don't know for sure, but you know, I'm familiar with them.

[00:17:14] Craig: But are you seeing larger, more innovative leaning and forward thinking utilities do more and are there certain. Techniques or frameworks or guidances that they're doing that might be applicable for a CISO of a small regional, let's call it a co-op or something that's not as large. It doesn't have billions of dollars and thousands of acres of solar farms and all the other stuff that comes along with a, a multi-state utility.

[00:17:44] Ian: Well, I will say you got it right, I've been asked, Hey, is there an industry that's just killing it and doing great and running out? I said they're individual. c. ompanies there are individual organizations that are doing very well and other ones that are lagging. And it's, because this is all emerging.

[00:17:59] Ian: So some are going faster, some are going low. And so some are really great examples. Maybe they have suffered attacks, they're taking it more seriously. Maybe they just have a different risk profile. Who knows? Right? But they have different reasons. And so there's at different levels, at different times. Larger organizations obviously have. More at their disposal, but they also have more exposure and they have other complexities that others do not. But when you talk about some of the best practices or some of the ways that people are getting their arms around it, there are a few. One is obviously acknowledging it and know that you have to understand it. The other one is what we've talked about already, which is there's a difference between being compliant and being secure. If I'm just trying to check the box, and I'm not trying to understand that this is a safety and uptime issue. Okay, then I may not getting outta the gates correctly right now.

[00:18:50] Ian: Once I'm there, I need to have their frameworks as I mentioned, IEC 6 2, 4 4, 3 is an international standard and NIST a standard other. There are ways to start getting, in course NERC CIP is a regulation, but fits within those standards so you can get your arms about what we should do. And then the other, another best practice is risk prioritizing.

[00:19:09] Ian: As you go along, what you need to do first, next to start bringing down that risk. 'cause at the end of the day, this is a risk game and you're trying to manage that. And the last thing is they're starting earlier. They're starting from the building of new construction. So green field or much more common major modifications and upgrades.

[00:19:27] Ian: Why? I've been doing it for two reasons. One is that it is much better and cheaper to build it in than to bolt it off. The earlier you start and the more you design it is a financial reality. So if you're that smaller mid-size one, look for those opportunities when you're doing that there, because over its lifetime, that is way cheaper to go do things like segmentations of a network on an ongoing. o peration is factors larger than when you could do it. And when you build it in, it's also makes it more seamless. Meaning it fits together. It's designed to work that way. That gives you the foundation of all these new kinds of attacks. you're basically trying to defend against the unknown. What's gonna change next? What's gonna be here tomorrow? Well. The way you do that is you have to build a stronger foundation. So the ones who are really cluing in and getting it are moving that starting point from my Brownfield G, what do I do now to protect what I have to also include? Not that you ignored those, you do everything, but also include the things from the beginning.

[00:20:29] Ian: Build it in better than bolted on. So these are some of the key areas that people are, doing as we're seeing as best practices that are out there right now.

[00:20:38] Craig: Okay. Yeah. And that, that's something that, picked up on, as you kind of walked through that we're seeing the same thing from a Greenfield is, trying to help them and build that analogy of, look at automobiles and seat belts, you know, the automobile makers, they didn't want seat belts.

[00:20:54] Craig: The industry, the insurance industry got tired of paying for. p eople in accidents, and they're like, we gotta find a way to make this safer, and how do we protect the organizations? So it does make sense and it's, obviously a lot cheaper if you're building a, a factory or a facility or whatever it is to incorporate from the design.

[00:21:18] Craig: Phase security as you are developing, building, implementing, then coming back and saying, well, I've already got a hundred panels in and where am I gonna squeeze this little sensor and I'm gonna have to redesign all this stuff. And it's already been in there for five years and it's not really gonna fit anymore.

[00:21:38] Craig: So it totally makes sense. I like that approach.

[00:21:41] Ian: Well, and to use your, seatbelt analogy, it's one I actually use with clients when I say look. Seat belts are important, right? They save lives to safety feature. it's required. Now, it's just, you gotta have it Now, do you want that seat belt C oming from the factory and built in with a car, or do you wanna do it aftermarket?

[00:21:59] Ian: And by the way, when you do it aftermarket, you can't stop the car. Car has to keep going. Operations do not stop for anything. And so now you're trying to put that seatbelt in while you're driving. Which one's easier?

[00:22:11] Ian: Which one's cheaper? Which one's better? Right? And so when you put it in those kinds of analogies, they're like,

[00:22:16] Ian: got it right?

[00:22:17] Ian: It's the total cost of what we're doing, or It's designed for it. And so. Just the way it goes these days. But the, best companies are starting to figure that one out. And it's just a reality because you have ai, you've got, digitalization, you have all these things that are making this faster, the attack zone, more powerful, more potent.

[00:22:38] Ian: And so that's. Forcing you to have that foundation built more correctly. If you have a bad foundation and you're going into the unknown, that's not a great formula. So why don't we bring it earlier and build it in correctly.

[00:22:50] Craig: I did a podcast earlier this week and we talked a little bit about AI and I, I would call it the dual sided sword. You know, AI is helping us automate some of the processes. They're helping us remediate quicker, getting a faster meantime to resolution. They are providing guidance for some of the.

[00:23:11] Craig: I guess false alarms if you wanna look at it. But they're also giving a roadmap where, you know, you can go on Google and say, write me a code for malicious script. And AI will almost do that for the adversaries. it's helping us look at it from a. p rioritization with the team to make sure that the teams can focus on what's important and not all of the, the noise, let's call it, but it's also giving the adversaries a heads up and a easy way in, because now as you know, the certs are published and the CVEs are published.

[00:23:50] Craig: Everybody knows what they are in advance and how to exploit them based on what the recommended fixes are from the manufacturers.

[00:23:58] Ian: we call it AI versus ai, it's adversaries are gonna be using AI to scan your networks or to amplify. What they can do or to create novel ways of getting in that we as humans, can't see you on the other side, can do the counter. And if you're not in the game and they're weaponized with ai, good luck.

[00:24:16] Ian: But you're also now responsible in operations to protect the AI. That not, not just how you're using it in your cyber organization, but how your whole organization is using it. And you're even responsible for figuring out how, what we call AI in the wild, how all your partners and people you don't know who's using this right now and how you're dependent upon it. So this AI game has these concentric circles of responsibility and complexity, and the reality is you're in the game whether you want it or not, you're in that game.

[00:24:46] Craig: Yep. So let me ask you this, as you guys focus, I would say predominantly within the critical infrastructure, whether that is, you know, power distribution, water that is public facilities, whatever, are the CSOs, the board is the message or the thought different than that of private?

[00:25:10] Craig: Or are they taking steps differently with, let's call it public? Money versus private money, or is it kind of the same? Obviously the end game is the same. How do you protect that versus this is the same, but is the approach the same? Or how should CISOs or CEOs be looking at it if they are managing or operating public versus private?

[00:25:34] Ian: Well, I mean, again, on one dimension, the risk is a risk,

[00:25:38] Ian: right? And so you have to manage it and how you go do that. And when you come down to cybersecurity, it comes down to visibility and control. Can you see what's happening? Can you do something about it? And there's the simple questions you have to answer.

[00:25:50] Ian: Like, Do I know what I need to protect? Asset inventory. Do I know where my holes are? Vulnerability management. Can I see what's happening? Right. Monitoring, can I get 'em out? Right? Response, recovery, and there's other dimensions like that, training and other

[00:26:04] Ian: types of things, but you're answering those still.

[00:26:06] Ian: The, the fundamental questions of the fundamental questions. Now, the business realities behind that and the routes you take, that might be different, right? If I'm a public utility and I, there's a rate. Considerations or there's grants or there's other things and there's other ways I get to that same goal than if I'm in a private sector or if I'm doing something else.

[00:26:25] Ian: So everyone's reality is a little bit different. Quite frankly. Every site is different.

[00:26:30] Ian: , So the equation, even though it's very consistent on what the end goal is and what the risk is, how you get that and how you manage that gets tailored to each, honestly, each organization.

[00:26:41] Craig: Of the, let's call it breaches. They are what they are. within the critical structure, I would say the two most famous ones that everybody heard about or, or is aware of that, you know, you've got the colonial pipeline up the gas up and down the east coast, and then you have. I would say probably the oldsmar water in Florida from ones that were really brought forefront to the attention of the public.

[00:27:08] Craig: And you look at, you mentioned earlier, safety, those two, you know, I was watching on the news and, my mouth was just hanging on the floor. When people were pumping gasoline in the trash bags in their trunk because they didn't think they were gonna get gas. It reminded me of the seventies when, the oil shortage and people couldn't get it.

[00:27:27] Craig: And then, you know, I hear about Oldsmar and the controller was sitting there and watching his mouth move, and the, chemical dilution was getting adjusted. I'm like, it's almost fear. In the public of, is my water safe to drink? it's really important and I look at it of how do organizations ensure that I, as a citizen have safety at mind?

[00:27:56] Ian: Right. Well, I would say pretty much every organization safety is a top priority period.

[00:28:01] Ian: Okay. I haven't gone across an organization in critical office that said, ah, we don't care about safety. However, connecting it to cybersecurity is always that that's what you need to linked together. 'cause they're thinking a lot about IT side, data, , my HR data being compromised and which is a thing, you have to pay attention to that. But compared to the risk of loss of life or environmental or in the case of colonial pipeline, economic stability, you can see what happens.

[00:28:29] Ian: That's a hugely different game on risk. They just need to link it more in their minds to cyber is a way that can cause that when they get to that, that's when you start being able to take a lot more proactive action. , You mentioned, colonial Pipeline, Colonial Pipeline was a seminal event. In industrial cybersecurity and in critical infrastructure because it was a warning bell to all the good guys that say, Hey, you better do something. But it was also a dinner bell to all the bad guys who said, Hey, wait a second.

[00:28:59] Ian: You can do what now

[00:29:01] Ian: and what you saw after that, including Oldsmar, but o other areas, you have an increase in tax, okay, on critical infrastructure and cybersecurity kits and regulations. And all of a sudden this activity started really bouncing up pretty highly there. , Because it, started triggering those kinds of, discussions on all sides.

[00:29:20] Ian: And then again, you add in digitalization, you add in everything else. And now you are where we are now, which is, is an emerging area. , A bit of a chaotic area, but an important area to address.

[00:29:31] Craig: Perfect. great conversation. A couple things as we wrap up, as you look at the industry as a whole, kind of where you guys are, where we've come in, your senior years and your tenure and where we still need to go. What advice would you give CISOs of organizations that you guys deal with that still are trying to figure this journey out?

[00:29:57] Craig: Where can they start? What are some, pieces of information that, that you could give them that will maybe help guide them?

[00:30:05] Ian: Sure. First of all, as I said before, it's. It's great to see so many more people taking this seriously

[00:30:12] Ian: and saying, what do we do? , What now? And so a lot of them are, as you're describing, are they, okay, so what now what do, how do I get my arms around this? And as things get complex, I. I tend to simplify, and I had mentioned some earlier start answering the basic questions. Do you know what you need to protect? Do you know where your holes are? Can you see someone inside? if someone gets in, can you get them out? How trained are your people? Hardened and trained are your people around that? And then there's other areas that will naturally flow out, you know, supply chain risk and other types of areas. But you start with those basics, getting your basics in there, and start regarding this as a safety issue. Not just a data issue or anything else. And so when you start regarding it as safety, and when you start answering these core questions, you'll do things like starting it earlier when your build process

[00:31:02] Ian: saying these things start becoming more obvious to you going, if we're worried about safety and uptime, how do I trace this back into the different ways I need to prioritize. So build risk registers. Figure out your prioritizations of where you need to go. Take the next step. Go and speak with experts. Most CISOs and most companies, this is all emerging areas. Find the people who have been there, done that, understand and can help guide you along that way. Because as I mentioned before, the risk is the risk, but how you manage it, that's gonna be something that's gonna be very tailored to your situation. You need to know that there are experts and resources out there that can help you along the way, and you need to certainly be able to rely upon them.

[00:31:48] Craig: Yeah, no, that's great advice. we'll say the same thing. Find a partner, find somebody that works in your environment that you're comfortable with that knows what you're doing, how you're managing, and. and leverage them. they're the subject matter experts in, doing this, you know, there's no reason with all the resources available today from the vendor community to the systems integrator community to the EPC community, they're all working for the same end goal.

[00:32:15] Craig: Reach out and, tap somebody and say, Hey, you know, you're doing all this stuff for our organization today. Can you help us with this piece as well? it's important. There's resources are there, so you're spot on. no reason to take the journey by yourself.

[00:32:29] Ian: Right it's about safety and uptime. How do you get there?

[00:32:32] Craig: Yep. Perfect. Great conversation. Thank you so much for your time today. I really appreciate it. Keep listening, keep downloading, and thanks for your time today.