Keys to Bridging the Industrial Cybersecurity IT/OT Gap

[00:00:00] Dino: the only way you can act local is you got to work with those folks that are in those plans every day, all day.

[00:00:05] Dino: They're the ones that are in the best spot in the best position to describe how this place is set up and how it works and what's in place and who's there to help them.

[00:00:14] Dino: When does this vendor come in? When does that vendor come in? How does that machine work? What are we doing this month in regards to our maintenance schedules and down times that we're working on? They're the ones that are closest to that activity to be able to implement and execute some of this, this work to help improve that cybersecurity posture.

[00:00:30] Dino: And again, like I said. If you're not going to supply the OT organizations with the tools they need, they're going to bring their own stuff in.

[00:01:07] Dino: I'm Dino Boussalaki.

[00:01:09] Craig: And I'm Craig Duckworth. And today we're going to be talking about a subject that's really important to all of us practitioners. When we go into the field, Dino, I want to talk about our ability to get data from industrial tools that are We can use for projects that we're working on that we're doing that the client should be providing us for an overall Project health of their environment.

[00:01:40] Craig: Does that make sense?

[00:01:41] Dino: Yeah, gets back to the true spirit of I T O T convergence, Something that we hear a lot about,

[00:01:49] Dino: and the question is, could it really be in practice, and when we say be in practice, Are the tools that are being chosen for assisting with cybersecurity in the OT environment, one, what role does OT play in the decision making process and gaining access to the information that those tools are collecting within that industrial environment?

[00:02:11] Dino: For a couple of different reasons. One is really to try to true up that asset inventory. Are you really getting the visibility that you should be getting Because it's perception of what that collection looks like. And what perception of what that looks like. It doesn't match up. the reason why.

[00:02:28] Dino: We recognize this is a disconnect is because an organization like ours design group is working in your manufacturing environments, We build plants. We implement machine centers. We do control system work. We build the infrastructure in that arena. And a lot of times we find clients have purchased OT cyber security tool.

[00:02:50] Dino: And yet, none of the information that those tools are collecting is being presented to the folks that are out there working on your plant floor, working around these, control systems.

[00:03:01] Craig: well So if I take a step back from that and I play devil's advocate, I think I know the answer who is Keeping that data. Where is the data going? And why? Why are we as? recipients Of that work or Practitioners being tasked to deliver a project in the environment. Why is it not being provided to us?

[00:03:23] Craig: What are we seeing that's keeping that from us?

[00:03:28] Dino: Well, there's probably a few different reasons why that's happening. One is, my guess is IT still has a fair amount of unfamiliarity of exactly what's going on inside that plant and what those assets are and where they are. That's one. Two, IT probably doesn't really know, outside of threat hunting, which is probably all they're really thinking about is threat hunting, is, What are the vulnerability and risk of which there's a lot of them, right?

[00:03:53] Dino: When you get OTS has been on the plant floor for decades and they recognize you can't just patch things, but they're not really putting together a plan on how to improve because if they were, they would not only be working with plant teams, but also the ecosystem and of partners, OEMs, system integrators, third parties that are also working in their plants, right?

[00:04:16] Dino: That should be back to your statement. The recipients. Of this information again, 85 percent of the data that's being collected by these O. T. I. D. S. Platforms is for the O. T. People to take action on. And so if we're in there putting designing and implementing a new packaging line for you, then we should have access to playbooks that you developed reporting that you develop a fair understanding of your current cyber security posture that you have.

[00:04:44] Dino: and what's prioritizing? What are you prioritizing in there? So that it's a collaborative relationship between the IT team, who's probably chosen this tool, and the OT teams that are out there actually putting their hands on these control systems. And that's, the disconnect.

[00:04:58] Dino: Again, getting back to IT OT convergence. Are you really doing it in the, spirit, in the truest sense of the whole reason why picked an OT IDS platform? if OT didn't participate in it, did any Level in that decision making process, then they're probably not going to work with you, or at least not.

[00:05:14] Dino: Well, and we see that, right? I mean, we've got partners that sell these technologies that are working with very large clients, and we are also working in there on those clients in their manufacturing environment, and they're not able to deliver their technology further and deeper and wider into these industrial environments

[00:05:29] Dino: because they Can't get past the OT teams because they're not working with them.

[00:05:34] Craig: yep. And I can see, when I think of the projects that we do on a daily basis, and I think of the clients that we work with, the benefit to us as a control systems integration team, as an AEC organization, how that data. Would benefit us and the client to provide that to us on a project.

[00:05:54] Craig: It's going to make the project go smoother. It's going to provide relevant information around the environment that we're going into to make sure that we can safely and, and efficiently put the equipment in. So there's a lot of reasons that I think that it makes sense for that collaboration spirit that you're talking about.

[00:06:15] Craig: To bring that data to the partner that's helping you on that project.

[00:06:20] Dino: Well, and to be quite frank, if they're not sharing and they're not supporting, or let's say they haven't chosen a tool, they don't even have anything, which, you know, there's a lot of clients that haven't done anything, we're bringing our own, set of tools. so we can be successful.

[00:06:32] Dino: Now, which is the next step in this journey is that the industrial ecosystem, these OT, collaborators, which is your OEMs and your system integrators and your local process engineering teams, plant teams, they're just going to go down their own path.

[00:06:48] Craig: Yeah, they are.

[00:06:48] Dino: Be successful, right? Because they know that they we all understand that we have to improve our cyber security posture.

[00:06:54] Dino: We have to get better from an O. T. perspective and providing cyber ready, cyber safe technologies within these environments. And so if I team is going to stay at the periphery. And not engaged, then we will go on the journey without them.

[00:07:10] Craig: Well,

[00:07:10] Dino: you'll end up with multiple tools in your environment, potentially, IT will pick a tool, OT is going to pick a tool, this plant is going to pick that tool, that plant is going to pick that tool, you know, that OEM is going to come in with this, that SI is going to come in with this, and then you end up with a splattering of different technologies, like we've seen with remote access, right, we've seen that with remote access in these environments, where there's no standardization, and so the teams bring whatever they need to the table to be successful.

[00:07:33] Dino: Cool.

[00:07:33] Dino: And so the question for CIOs and CISOs is how are you going to change this perspective? How are you going to get your organization more in tune and ingrained and what's going on with your plants? And more importantly, who are the plants working with?

[00:07:49] Craig: well, part of it. and again, my view on this is there's a disconnect there. You have a CISO or a CIO or someone that's maybe the responsible for that, but they really don't have the expertise or the. Skill sets to manage that, or they're not familiar with the plant environment or the industrial control area, or the tools and technology that they are leveraging may not be the right tools and technologies that are OT centric for that environment to give us or give someone that data. You know, maybe they just don't know.

[00:08:26] Dino: Well, the question is, it's still oil and water, Between IT and OT. You know, you're still in that mindset. And we see that, right? I mean, we see organizations that they don't play well together. And there's resource constraints. You know, the I. T. team, quite frankly, doesn't have enough people. if you've got 2030 50 100 plants in your fleet, you know, to be able to have an organization broad enough to be able to really understand that all of your plants are not the same.

[00:08:54] Dino: They're not set up the same. They got different automation technologies. Their network infrastructure, is set up a various, , Various ways, with no intended strategy. And we know this because one of the things we go looking for when we first engage is showing your documentation. Show me your high level network design.

[00:09:11] Dino: Show me your network design. Show me the architecture. And you know that that stuff is if they either don't have it or what they have is is wrong. You know, and so we're marking a lot of it off.

[00:09:22] Craig: for

[00:09:22] Dino: there's a lot of unknowns, And I think the IT just, they just don't want to fight that battle because you'd have to have people living and breathing and working that plan on a pretty regular, consistent basis, What do we say? You got to think global, but you

[00:09:35] Dino: got to act local, right? And the only way you can act local is you got to work with those folks that are in those plans every day, all day. Making that place run who are in the best. They're the ones that are in the best spot in the best position to describe how this place is set up and how it works and what's in place and who's there to help them.

[00:09:55] Dino: When does this vendor come in? When does that vendor come in? How does that machine work? What are we doing this month in regards to our maintenance schedules and down times that we're working on? They're the ones that are closest to that activity to be able to implement and execute some of this, this work to help improve that cybersecurity posture.

[00:10:11] Dino: And again, like I said. If you're not going to supply the OT organizations with the tools they need, they're going to bring their own stuff in. And we're doing it now, right? This is not, hyperbole. This is real,

[00:10:22] Dino: right? We're going in there with our own stuff, and even for clients who have a tool, and we're talking to the OT guys, it's like, oh, you've got Armus in here.

[00:10:30] Dino: You're an Armus shop. We know that. Okay, great. I'm looking for this report. Let me see your dashboard. Let me see your asset inventory. You know, I want to know what the vulnerabilities are in here. I'm trying to find this. Peace out about your network. And it's I don't know. I don't have it enough, whatever.

[00:10:46] Dino: And it's like, why is that, you know, and so I blame the vendors sell this their partners and or the vendors who sell this to an IT organization because they're not helping them, with that transition. All the way into the environment, Oh,

[00:11:00] Dino: And, so then you have groups like ours who are in there who are starting to get smarter and who are starting to ask these questions.

[00:11:06] Dino: And if we're talking to the wall, right?

[00:11:10] Dino: Nothing's coming back. We're just talking to the wall. Then we're going to go do what we need to do to be successful.

[00:11:15] Craig: Yeah. So when a systems integrator or a firm like ours goes into that environment, they know there's a tool there. How would, are there certain steps, certain questions that we could ask? how do you think. The most successful path, let's call it a path, to get that data, sharing that cooperation between the two different teams, what's the best avenue to begin having those conversations.

[00:11:43] Craig: Have you seen something work better than something else? I can, we can tell you what doesn't work and that's what we run into every day is when we're holding it close to our chest, we're not sharing. We're not giving it out. that's the cloak and dagger. is really we're past that the ecosystem needs to grow up mature needs to start figuring this out But are there things that make sense?

[00:12:05] Dino: but you know, ideally, because we're working locally, right, is, you know, when you're asking the plant, who is the owner, And they might just say, well, it is. Well, who and it who specifically

[00:12:16] Dino: is responsible? Who's calling the shots? Who could they go to? And sometimes. They're not even sure, per se, mean, I always welcome the opportunity for those I.

[00:12:26] Dino: T. teams to get close enough to the activity that's going on the plant, you know, and start asking questions and learning, which is what most of them are doing. Right? I mean,

[00:12:34] Dino: if I'm talking to an I. T. person, and, you know, I started talking about each of my appeal season and the next words out of their mouth is what are those things?

[00:12:43] Dino: Well, then, you know, if you're starting,

[00:12:45] Craig: you're in a wrong

[00:12:45] Dino: you wrote, They don't even know, right? And so there's a whole new learning curve for that, right? And again, you got one or two people. You got 50 plants in your fleet. That's not going to cut it the I. T. Model. from, services, managed services, PMOs, I see that becoming more prevalent in the OT space because it's very difficult to develop a practice, to be able to manage this, cause it's all net new, there's a tremendous amount of data that's going to come flying up out of that plant floor when you put these tools in place, they get overwhelmed very quickly, you know, the whole alert fatigue so they just give up.

[00:13:19] Dino: because they doesn't know how to organize these challenges, They just don't. what's the priority? What's the life cycle of these assets? Where are they at on the capital plan to be replaced? You know, when's your next expansion project? Your brownfield, your greenfield, your, Your downtime windows, who are the vendors that you're working with?

[00:13:36] Dino: What are they doing for you? If you talk to them about making cyber ready machines, if those discussions aren't being had, then you need to insert an organization that knows how to do this into the mix to help that,

[00:13:47] Craig: Yeah. And those, those are all questions that, a good partner can help lead for internally within the organization. those are valid. Those are concerns. Those are ways to help begin getting better.

[00:14:00] Dino: you know, and you have to do your homework, right? You just can't assume that the system integrator that you're working with to have to be a clarity partner. It's like, well, what have you done and where? I mean, there's one thing to stand in the system up. That's not difficult, standing these things up, It's really, what happens after that? What's going on after that? You know, you've sold them this stuff, and you've got it running in the plant, and they're seeing a third of the assets. What's next? if you're a client talking to a partner who's, saying, Hey, I can do OT cybersecurity for you.

[00:14:30] Dino: Oh, yeah. Great. Where have you done it? who the reference is? Can I go talk to that client? You know, especially if they're not in a competitive nature, where that conversation can be had. Because, you know, you and I both know that we have clients who are willing to be spokespeople. To other clients, you

[00:14:46] Dino: know, as long as there's no conflict, they're perfectly fine with having that conversation.

[00:14:50] Dino: clients, you need to consider that. So when you're working with a partner, who's says they're in the cyber security space. Good, even if it's on the I. T side, if you're working with an I. T versus Yeah, we sell clarity. We sell artists. We do drag us. You know, we do Cisco. Great. Where have you done it?

[00:15:04] Dino: And what have you done? And who is that client? And can I talk to him?

[00:15:07] Craig: Yeah, well, it's again, that's important. No different than when they're trying to vet a systems integrator for a controls project or an AEC firm to build a building or, in our personal lives, we go to buy a car. You and I both know that everyone's going to research that car. There's. Things that they like about a particular model, Chevy, Ford, Dodge, Jeep, Mercedes, depends on the price range.

[00:15:33] Craig: They're looking for certain things. They're doing research. Organizations have to do the same. They got to research and understand what they're doing.

[00:15:41] Dino: Well, and to take the car analogy a little further, there's one thing. are you the buyer and the driver of the car? Or are you the guys that can actually build the car? And these engineering groups can build the car. We can build the car.

[00:15:54] Craig: right?

[00:15:55] Dino: Right? there's a difference between selling the vehicle and building the vehicle.

[00:15:58] Craig: Oh, huge difference.

[00:16:01] Dino: organization, you need to work with engineering companies who can build a car. they're the ones who know what it takes to build that car, what's going into that car. They know the technology in that car, they know how it's being designed and programmed and configured, and the networks that are in it.

[00:16:15] Dino: It's not the person who's buying the car. It's the people building the car.

[00:16:19] Craig: But

[00:16:19] Dino: And that's what, again, back to that IT OT convergence, that's what's missing, Some people, you know, you got to get past that godlike mentality that some of these IT organizations have that think they're the smartest cats in the room.

[00:16:30] Dino: And it's like, well, that's fine over there in the data center. Let's go talk about your plant floor and what's going on there,

[00:16:35] Craig: Well again a great way To identify that up front when organizations are trying to figure this path out and navigate this journey is a tabletop exercise one of the very first things that we recommend is let's do a tabletop exercise with the c suite to understand Alignment to understand who is going to own this back to your question Who owns this who has responsibility and Authority to implement it, walk the plant floor with those individuals and open a panel with the plant manager or the controls engineer and say, okay, these are the assets that we want to talk about. These PLCs, these drives, this HMI, these. IOs and help them understand this is not about the PCs and about the laptops in the IT environment.

[00:17:34] Craig: We are talking specifically about industrial control networks and assets that are out here on the floor and how they are connected to the enterprise and the value of the data that comes up. organizations like design group, we have that ability to provide those insights. You talk about it's not real hard to install the tools technology and it's not.

[00:18:01] Craig: But when you sit down and prioritize risk and you begin looking at vulnerability management tools and you start putting together programs to begin assessing and mitigating that risk, it's important to understand that process.

[00:18:20] Dino: There's understanding, but more importantly, who's that owner going to be most comfortable with and having that conversation with,

[00:18:27] Craig: I think we know the answer to that.

[00:18:29] Dino: who's credible, who's accountable, and who is the plant manager and his or her staff that's out there helping them run that plant day in and day out.

[00:18:38] Dino: Who are they going to feel most more comfortable with when they're in there talking about their control systems? And it's not necessarily, Really going to be some I. T. person that shows up maybe once a year or every other year and just touches pieces of the network. And maybe there's been some bad experiences because things that I have done, like with firewalls or pushing patches or making configuration changes or doing denial of service attacks while they're doing, port scans and things that net scans and that type of activity that's been disruptive. And pin testing, things that they've witnessed that the plants like, why am I going to let you come down here and try to help me with something? Because every time you show up, you just create headaches for me.

[00:19:18] Craig: Yeah,

[00:19:18] Dino: And so I,

[00:19:19] Craig: gets delayed. My project costs twice as much money

[00:19:23] Dino: you know, I lost my production for 30 minutes or a day or 2 or whatever, a couple of hours.

[00:19:28] Dino: And so, and that gets back to that oil and water and that collision as we call it versus convergence. So that being said, they need to start working with the folks that are most. Credible to them, again, people who can build a car, the people who are building their cars and their plants are the ones that they need to really lean on to help them on this journey,

[00:19:48] Craig: yeah,

[00:19:48] Dino: right?

[00:19:49] Craig: Spot on.

[00:19:50] Dino: And as a C suite, if you're listening to this, you're going to have to get past what IT is telling you, because they're only telling you half the story.

[00:19:59] Craig: there's three sides to every story There's my side, there's your side, and somewhere woven intricately in the middle is the truth. That has pieces

[00:20:10] Dino: right.

[00:20:11] Craig: yeah, pieces of both sides. But at the end of the day, it's not one side, there's not a silver bullet. it's, how do you get to, The truth.

[00:20:20] Craig: How do you

[00:20:21] Dino: one of the legs of the stool, in my opinion, right? It's a three legged stool, and you're missing one of the key components. You're missing one of the legs, and that is the input and an activity that's being performed by those groups of people who designed to build those machines.

[00:20:36] Dino: And who maintain and support those and the people who operate them,

[00:20:40] Craig: again, if you're not a magician, you shouldn't try to balance a two legged stool. It's not beneficial. It's difficult to do.

[00:20:49] Dino: see that, right? I

[00:20:49] Dino: mean, we see that I'm in time and again, I place some of the responsibility on the shoulders of these firms who are selling this technology and selling it to the see. So, and calling it today, in the meantime, we're in the same plant, the same client working in many of their plants, and they got this cool tool and it's not being shared,

[00:21:10] Craig: And no one's using.

[00:21:11] Craig: Yeah. No, a 1000 percent agreed. If you're looking at this holistically from an organization. Then you need to start treating it holistically and enterprise does not mean only your I. T. and non revenue producing assets. It is the enterprise. That means everything. The entire organization and until clients organization see.

[00:21:41] Craig: So those begin treating it that way. There's always going to be the divide.

[00:21:45] Dino: You know, and They have to close that gap, and where does that begin? I mean, and there has to be some forced, collaboration

[00:21:53] Craig: Yeah, that does.

[00:21:54] Dino: on multiple sides, To put these people together, as I used to say back in the day, you know, get all the liars in the same room. And, get past the finger pointing game and let's really try to move this ball.

[00:22:04] Dino: and we can sit and say that because the work that we do, we're the ones that are in your plans.

[00:22:09] Dino: And we're touching the control systems. And if you're not talking to us, then you're missing the boat.

[00:22:14] Craig: Yeah, for sure. You can't just install it and walk away from it. that's no longer good enough. So great discussion, Dino. hopefully that's a hot topic that everybody takes to heart can go back to their organization and say, how are we doing this? Are we sharing this data with our systems integrators with our OEMs that are looking that we're looking to better our operations?

[00:22:36] Craig: And if the answer is no, You got to take a step back and say, why not? They're there to help, help you. Let them have access to the data. Show them what your environment is. Show them what they can do to help make you more successful. Everybody wins every time.

[00:22:53] Dino: And if I T O T convergence is something that you believe in, in something that you think that you're doing, then you should have a list of every manufacturer. OEM system integrator who's in there messing with your control systems to be on your

[00:23:10] Craig: Speed dial.

[00:23:11] Dino: And they should be part of the discussion when you're talking about cyber security.

[00:23:15] Dino: What are they? What are you doing? Here's what we expect you to be doing. Here's our plan. Here's our roadmap. You know, here's our security framework if those conversations aren't being had With those organizations and you don't have a comprehensive list of who those people are then you are not practicing itot convergence

[00:23:33] Craig: Totally agree. Beautiful. Well, for anybody that's got questions, you can reach out to us. Follow us on our podcast. Feel free to drop us a line. We're here to help in any way that we can. You guys have a great day. Thanks Dino for a fantastic conversation.

[00:23:48] Dino: Be safe, have a great holiday.