AI, Global Trends, and More: A Glimpse into the Future of OT Cybersecurity with Claroty

[00:00:00] Danielle: It's completely fine to outsource what you can't manage. What I tell companies is do not outsource what you don't understand. So if you know, during an incident that X, Y, and Z needs to happen for remediation with your crown jewels, with your critical assets, with your critical networks, with your critical processes, if you're not doing the due diligence to understand exactly what that remediation might look like, given an ongoing incident, then don't outsource that before you've really, really done it.

[00:00:25] Danielle: Orchestrated who needs to know what, who to call when, and that's all part of an instant response playbook, but typically we only see those written for I. T. So we really do need to extend that analysis to O. T. And then run your backup plans and test your backups, right? So we've seen that outsourced as well.

[00:00:41] Danielle: And we've seen where, you know, we have a backup. It's kept here. We don't know the last configuration the last day. We haven't validated what's in that do some of that due diligence before you have a major incident.

[00:01:21] Dino: Hi, my name is Dino Boussalaki, and today we have with us DJ Jablonski from SESA. So welcome to the show today. can you give us a little bit of background on what CISA is up to these days and what their focus is on in the coming year?

[00:01:40] Danielle: Absolutely. of course, I'm sure all of you have have looked at the recent NSM 22, the national security memorandum that did come out. So I've only been at CISA for about five months, coming most recently from the private sector from a vendor that did continuous monitoring for intrusion detection, essentially, and vulnerability management within industrial control systems.

[00:01:59] Danielle: I came at a unique time, NSM, which kind of re solidified CISA's role as national coordinator. And what that really means internally is as we've grown as an agency, of course, I can't speak for CISA. the entire agency. Having been so new is that we are really kind of reorganizing and recalculating how we serve asset owners across critical infrastructure.

[00:02:18] Danielle: Where for the last several years, we've focused heavily on assisting our partners across government and our interagency partners, looking at kind of F CEB, right? So critical agencies within the government and helping them understand their assets, and how that they can improve their security. So there's a ton of different programs.

[00:02:33] Danielle: All over the place, looking at everything from secure by design. Of course, across the it industry, we have a secure by demand working group. That's actually producing its own set of guidance for OT and secure by demand. In that sense is a little bit more procurement language oriented. So we have a lot of different programs driving and underway.

[00:02:50] Danielle: And then of course, out of the NSM role, we have the national risk management coordination in NRMC. And they are working on kind of reevaluating SEC sector specific reviews and management plans. So again, the NRMC and that's in coordination with partners across industry. So it's a ton of different work streams that are out there.

[00:03:09] Danielle: again, just recapturing our role as the sector risk coordinating councils, come together and, and being able to. Kind of focus our priorities because at the end of the day, we can't be a managed service provider for all 16 critical infrastructure sectors and every asset owner within those sectors.

[00:03:26] Danielle: But we have to be able to categorize and capture where to start and where to have the best, results.

[00:03:32] Dino: as you were transitioning from the private sector into working with CISA, are you seeing a lot of the same challenges that manufacturers are having as far as, going after specifically OT cybersecurity, right? I mean, it's really trying to figure out what is going on within your control system environment?

[00:03:50] Dino: I still like to call it surveillance, from a visibility perspective with some of the tools from the private sector that you and I both know in this space. Are you starting to see any shifts and changes as far as growth? And clients saying, I really need to get better at this, and they're actually doing something because I see the numbers that, 60 some odd percent you would hear from Gardner and from the OT cybersecurity software vendors, the companies that are still in that unaware to aware phase, and then 30 percent have done something, but, the size and scale of the organization, maybe they got it in one or two facilities, but they got 100 facilities, and then got 10 percent that maybe be up and running.

[00:04:28] Dino: And actually moving in a direction with a strategy.

[00:04:32] Danielle: So we've seen a couple of different things when I was in private sector, of course. Some of the customers that we were able to talk to were a little bit more mature in terms of their security policies and procedures for OT. If they were looking at some of the tools in that space and they had done some due diligence, right?

[00:04:46] Danielle: So they weren't completely in the dark about what assets they needed to protect. coming into CISA, I have seen a much brighter, broader range of that maturity curve. people starting from scratch, people not even knowing what they don't know. And then there's also at the same time, this quote unquote, shiny object problem that I like to refer to.

[00:05:02] Danielle: And, That is, every headline that says, well, we have to focus on hard coded passwords. No, we need to focus on this new APT threat actor. No, we need to focus on this integrator,VPN that, that might exist. And so people's heads are kind of on swivels. And when I was out of government, I used to say, if our shields are up, then get our heads off a swivel.

[00:05:20] Danielle: And so what that really looks like, which is very different from the same word in the private sector is enablement. So enablement is enabling people to use tools, enabling folks with within government. Right. Use cases is helping them to actually, look at the recommendations from different types of assessments that they might do with us or with a third part, another third party, or with a with even a private sector assessment and say, how do I prioritize these recommendations?

[00:05:44] Danielle: How do I understand my assets? Understand my forensic capacity today? Understand how to deploy controls correctly rather than just saying. Yes, I have an IR plan. I don't know how to test it. And it sits on a shelf and it doesn't talk about OT understanding how to actually do vulnerability management, not just how to list vulnerabilities in my environment from an assessment, right?

[00:06:02] Danielle: So that enablement is the biggest kind of sea change that I've seen. And it's much broader in terms of sophistication. It's not just focusing on visibility. It's focusing on all sorts of different controls that are out there, but at the same time, we all have a responsibility to help folks, avoid the shiny object problem and really start to prioritize.

[00:06:19] Danielle: And that's going to be individual, right? Asset owner to asset owner, sector to sector, and that's all about building relationships, which is what CISA really excels at.

[00:06:27] Dino: The key thing that you said, participation, this ITOT, convergence that we've heard a lot about. my experience, I still see a gap between those two groups. So when you're talking about, the activity that you're seeing in the field, you see it flowing through to IT.

[00:06:42] Dino: And the reason why I bring that up, you know, us as a system integrator, as an OEM, I mean, we build plants. we build machine centers. We're not always on the receiving end. I would say almost never on the receiving end from the client with specs and or requirements. to say, here's some of the things you need to do to help us improve our cybersecurity posture.

[00:07:01] Dino: At the same time, it's blind spots for us, right? Going into a plant, we have, maintenance and support activities. We got project startups going on in these plants. And my question to the engineering teams is, are you getting any information? If you got a client that has an OT cybersecurity platform within their environment, we should be receiving information from them.

[00:07:23] Dino: So back to the question, OT and IT, are you seeing that getting any better between these groups?

[00:07:31] Danielle: So from like an interoperability standpoint, we're seeing a little bit of of improvement on if somebody is looking towards visibility, they're not not bringing in their OT managers. They have their SCADA folks at the table, but primarily we still see IT folks tasked with kind of taking over and capturing OT.

[00:07:46] Danielle: They might have the resources to hire somebody under them to do that. They might not. Typically, their starting point is trying to extend some type of I. T. Security controls to the O. T. Networks. we all know that that has its limitations. The second factor typically, looks like a SIM tool, right? That grabs data from an O.

[00:08:05] Danielle: T. Network that they can try to analyze and look at some of the events. And things like that. And then they quickly realized that maybe their logs aren't up to date, or maybe they don't have a good understanding of their asset inventory. And so they have to circle back and start from scratch. so yes and no on the interoperability piece.

[00:08:18] Danielle: We're seeing a lot of tools out there to help with this. but from a management perspective, the Relationships that asset owners have with their vendors and suppliers are the kind of first touch point for security as well. So if that vendor, whether they're going through an integrator or not, has a best in class suite of security provisions that they offer, then maybe they'll utilize those.

[00:08:39] Danielle: If their integrator has a preferred managed service provider, then they'll take kind of notes from there. But there's really no granular way to say, Okay. Let's make sure that security is built into this process by design, and that's where some of the secure by demand work in OT that my colleague Matthew Rogers is leading is really emphasizing procurement language so that security doesn't become bolt on forever.

[00:08:59] Danielle: you classic kind of. Phrase is that they don't have money to replace systems. I talked to O. T. Organizations all the time that are in the middle of three to five to 8 million projects to replace technologies, and they're still not considering the security implications or networking and configuration implications of those massive investments.

[00:09:19] Danielle: So They might be midway through projects and still asking, how do we start the security journey? And so it's, it's kind of too late if you've already sunk those costs, but I think it's a misnomer to say that there's no money. It's that we're prioritizing, good things that, that organizations need and still bolting security on after the fact, whereas integrators, vendors, CISA partnerships, we all have a role to play in making sure that it's more by design.

[00:09:43] Dino: Yeah, I still like I said, we come in after the fact actually sometimes because the asset inventory that being requested isn't getting deep enough into the environment, even though they have a tool and, and at some point the it folks have to rely on somebody who's very comfortable with working in that plant floor to help.

[00:10:01] Danielle: And it's that that requirement of asset inventory, which is going to give you the vulnerability information that they're they're seeking. even before an inventory, some things I'm seeing that just aren't shared or aren't prioritized or things like asking for baseline configurations, asking for threat models from actual vendors because they do provide these two customers. They don't publish them on the Internet, thankfully, but they're provisioned.

[00:10:21] Danielle: And if you don't know what to ask for them, or if you don't know who's responsible in your organization to request them, then they just simply don't get requested. And so I'm hoping to kind of engage with this this ecosystem on things like, Hey, do you have configuration best practices for your site acceptance tests?

[00:10:36] Danielle: Can we start to streamline and share that rather than some of the threat modeling to really enable folks to do this by default? Things like that.

[00:10:44] Dino: and again, you have to be able to bring your OT ecosystem, as I call it, to the table, as you're unfolding in these capital projects to do this lifecycle replacement, these expansion, greenfield, brownfields, whatever they might be to get them on board to look for how we can improve that cybersecurity posture on those machine centers that we're we're designing and implementing for these clients.

[00:11:05] Danielle: And the last thing I will say on some other best practices I've seen across the IT OT divide, tabletops. I've seen in the last two years more inclusion of the OT and SCADA managers in tabletops, even if they are not mid management or up. having a voice and a role at the table, and that's absolutely critical for understanding not only the cyber incidents and scenarios, but the rest of the physical incidents and scenarios that actually could happen from a cyber touch point or access point.

[00:11:30] Danielle: So that's I've seen a great increase in that really positive.

[00:11:33] Dino: Yeah, excellent point on the tabletop. You're right about that. how does,CISA anticipate and or prioritize the ICS risk levels as a nation that you're seeing not only just here but in global, actually, especially in the geopolitical environments that we're seeing today unfold? Do

[00:11:52] Danielle: Absolutely. of course, right now it's election season, and that's definitely top of mind election infrastructure. And then we have some of the high level kind of innovative. touch points that we're looking at, like a I and post quantum encryption.those things are not as, Advanced, of course, across O.

[00:12:06] Danielle: T. So I mentioned the N. R. M. C. Earlier. the National Risk Management Center. They have a bunch of great tools and analysts and researchers there that look to prioritize significant risks to the nation, and then within each sector. And so it depends on the sector that we're the actual sector risk management agency for so only eight of the 16.

[00:12:25] Danielle: but we work with partners and interagency groups to basically identify and prioritize those. Prioritize those risks. So we actually share that analysis with industry partners across both the SCC and the GCC organizations that are self organized right by industry, but work in partnership with different touch points here at CISA.

[00:12:40] Danielle: now to be completely frank, there is no national asset inventory of critical cyber physical systems, their current configuration status updates, firmware, et cetera, right? That's not possible. that would also be kind of a risk factor if that did exist.but there are a lot of great programs and data data analytics that we utilize here, that help us focus on regional, entities of interest and concern.

[00:13:02] Danielle: we have another, program called the administrative subpoena process where we can help folks identify things connected to the Internet, identify whether or not those are control systems at these entities and notify them to get those off the Internet. So that kind of, remote access. Component where things are connected to the Internet and then potentially don't have any authentication or credential, access that they need for for remoting into those.

[00:13:23] Danielle: That's one way we do it, but within the sectors management groups, they have their own priorities, scenarios and mitigation strategies that they're iterating on actually right now. So they're in the middle of that process.

[00:13:36] Dino: you find that you're getting a lot of,participation where folks are coming to you guys? I mean, are you guys like swamped or do you think you've got capacity to deal with, the, I know the amount of work that's out there. So kind of give us an idea of not only the range of services that you guys provide, but then, how many clients are, receptive to it and actually knocking on your door.

[00:13:56] Danielle: So I have yet to be anyone here who's bored. I will say that. I know that when I first got here, actually, one of the first things I did, because I am a remote employee, even though I'm in headquarters, I'm still in Texas. I actually reached out to all the regions and their cybersecurity advisors and just said, Hey, what are you working on?

[00:14:12] Danielle: When does ICS come up? Do you have a background? Does anyone on your team have a background on ICS? So what do you struggle with? And of course, they're getting requests all the time for different services and assessments and trying to capture that data. and they're also doing a lot of Events where they kind of, just kind of showcase what we have to offer, how people can track things over time, because we use the term baseline a lot, but that kind of means something different in every program and every assessment.

[00:14:35] Danielle: So what is a true baseline look like? And how do we iterate on that to kind of enhance our goals and things like that? So I know the regions are there. Are doing their best. they're, they've also grown in the last couple of years. If you talk to any region, they've gone from like X amount of employees to 20, 30, 40, focusing on different things.

[00:14:50] Danielle: And every region is different, right? So some regions have a huge groundswell of critical manufacturing, critical manufacturing tends to have more resources. other ones have kind of a different makeup of what sectors are prioritized there, depending on their water resources or,their energy grid in large cities and things like that.

[00:15:06] Danielle: being able to prioritize and work. Closely depends on the makeup of the region, who, who they have there. And then back to headquarters, we've got tons of programs, that are typically first come first serve. Some of them are a little bit more strategic. It just depends on, on the service or the assessment.

[00:15:20] Danielle: but yeah, nobody is bored. That's, that's definitely the case. And looking back at that word enablement, how do we do things that are not just one off, how do we make sure we're building relationships where we can say two, three, four years down the line, we've seen enhancements, we've seen the capacity grow.

[00:15:35] Danielle: To help enable asset owners to do things, on their own, because of course, we see requests versus that to be a managed service provider and to provide services. And we're happy to do that. But again, we can't, be the MSSP for every organization out there. So it's a, it's a give and take.

[00:15:49] Dino: Right. And usually when you get to that point after you guys have done an assessment or done some work, and when the client wants to do the next step, you guys really don't point them in a direction. It's you need to go find that ecosystem of partners to help you with these activities that we've either uncovered or found best practices, initiatives that they should be pursuing, right?

[00:16:11] Dino: It's here's where you are, here's where you need to be,they're going to have to go out there and do your due diligence. find somebody to work with to help you guys out.

[00:16:19] Danielle: Yeah, it really depends on the program. So we have Sci Hi, the Cyber Hygiene Assessment, and from there we can point people to different resources and things that they can adopt or develop internally to enable their own capacity. but things like incident response. So one of the number one kind of requests from the government as a service is an incident response capacity.

[00:16:36] Danielle: We do have an incident response capacity, which is within Threat Hunt. We have a central email where you can send emails. any type of information, too. And then we'll get with the regions, we'll get with threat hunt, we'll get with our vulnerability management folks and see who can help, where, when and why, we'll also use some of our CTI, strengths across different parts of the organization, to say, here's what we know about this threat.

[00:16:54] Danielle: Here's what we know about kind of the response. Here's the capacity that we have. So we do have an IR capacity, but at the same time, we see organizations who want an IR, Service and don't have the forensics, right? They don't have the logs. They don't have the capacity. it kind of hamstrings any type of response.

[00:17:10] Danielle: And so we need both. We obviously need the government to maintain some type of response capacity, but we also need to enable organizations to do that themselves. Same with red teaming, right? We've got some advanced hunt work that we do, but we can't do advanced hunts and every single organization across the country, right?

[00:17:24] Danielle: So it just becomes a little Where can we teach and where can we assist?

[00:17:29] Dino: Yeah, it's a great point. You just made me think of something in a conversation I had with Chris a few weeks back. He mentioned something that caught my ear, these fusion centers, right? And, and I was looking for an opportunity to maybe go meet with them. And I learned that the CISO at our firm actually has a relationship with them.

[00:17:47] Dino: Can, do you think there's some value in organizations like ours and meeting with the folks that run these fusion centers? I'm just kind of curious on your thoughts on that.

[00:17:56] Danielle: Yeah, I don't want to speak for the fusion centers, of course, because I'm sure they're also not bored and are very busy. but I think I've seen a lot of coordination with threatened health sharing, a lot of interagency work with the fusion centers so they can bring in the FBI. They can bring in other, Parts of system that do like ransomware notification.

[00:18:11] Danielle: They could probably bring in some of the folks that do the administrative subpoena analysis and look and say, with our region, we've done X, Y, and Z. Here's kind of the typical bad practices. We've seen since I just put out a new resource on bad practices out there. So fusion centers could could.

[00:18:24] Danielle: Potentially execute a lot of like lessons learned and local, camaraderie on how do we avoid, bad practices? How do we enable good practices? Who do we work with across the region? Can we bring in some of our fema counterparts, right? So fusion centers are obviously excellent. I just don't know what their resource capacity looks like, but they do help us with, Threat Intel sharing.

[00:18:42] Danielle: So they, they, they host some calls and some sharing, which is a hot topic right now, of course. And we want to partner with as many people as we can, and do more of that regional work and swell that capacity, right? Because we can't do everything from headquarters.

[00:18:55] Dino: Yeah, I just, part of what I'm trying to understand is our role, because we have critical infrastructure clients, right? And if we uncover something in, within one of these environments, and we know it's, an attack, what should we do, right, per se? Obviously, we're going to communicate with the client, what steps they take, or should we be directing them to CISA, to the Fusion Center?

[00:19:17] Dino: I'm just, trying to understand our role in that particular case.

[00:19:20] Danielle: Yeah, there's always the who do you call question. I think everyone, defaults to the FBI because they, they have local,partnerships there as well. But CISA is, is always, like I said, we have that central management and we triage everything that comes through there. we're always willing, ready, and able to be a partner.

[00:19:33] Danielle: And then of course there'll be some reporting contingencies coming out of CERCIA, which I am not an expert in. but,there'll be some contingencies there of, of who must report and why, I don't know what enforcement is going to look like there either. if you want us to see an expert, we can definitely find one for you.

[00:19:46] Danielle: But the earlier you report, the better, the more information you share, the better. There's some, liability protections out there that are offered as well. but if you have a retainer and you know that you're. Third party that is on your retainer knows your organization and knows your infrastructure.

[00:20:00] Danielle: By all means, right? Call your partners, call your call your retainers if they have the capacity to, come in and limit the exposure to eradicate exposure, eradicate, you know what's happening. But if you don't have those partners, we'll find some resources depending on the region or what we have available.

[00:20:16] Dino: for some firms because we do manage services for them because they don't have an OT cyber security practice per se. And so they're looking for our organization to help them manage the tools that we have in there and do the research and, and help them prioritize their activities around vulnerabilities and giving them best practices on things that they should be doing.

[00:20:36] Dino: And at the same time, our firm has the ability to go in there. And, deploy those missing patches, do those network configurations, reduce that, that, attack surface for them too, because we, we are a control systems integration firm. I

[00:20:49] Danielle: That's a big open question, right? What does remediation look like? So we can give you a vulnerability assessment. how do you go about remediating that, in a ransomware scenario? How do you go about, extraction? These are the things that companies really need to think about regardless of who they hire to help them.

[00:21:03] Danielle: And one thing I said recently is it's completely Fine to outsource what you can't manage what I tell companies is do not outsource what you don't understand. So if you know during an incident that X, Y and Z needs to happen for remediation with your crown jewels, with your critical assets, with your critical networks, with your critical processes.

[00:21:22] Danielle: if you're not doing the due diligence to understand exactly what that remediation might look like, given an ongoing incident, then don't outsource that before you've really, really orchestrated who needs to know what, who to call when. And that's all part of an incident response. playbook. But typically we only see those written for I.

[00:21:38] Danielle: T. so we really do need to extend that analysis toe T and then run your backup plans and test your backups, right? So we've seen that outsourced as well. And we've seen where, we have a backup. It's kept here. We don't know the last configuration. The last day we haven't, validated what's in that do some of that due diligence before you have a major incident.

[00:21:58] Dino: would say that's probably maybe one and a half and ten clients that are at that level, understanding and knowledge compared to what we normally find out there. Shifting gears a little bit and knowing a little bit about the director's background, Jen Easterly, AI. So what is, what is CISA?

[00:22:17] Dino: Recognizing and seeing and dealing from the A. I. Perspective and out there

[00:22:23] Dino: is

[00:22:23] Danielle: so it's not my focus, of course, but in the office of the technical director, we do have some folks that focus on A. I. it's the focus I've seen in the last five months again. Admittedly, very new has been that it's one of those both force and threat multipliers. So those are kind of D. O. D. Terms. We look at risks, but a force multiplier is obviously something that maximizes your force and impact and then a threat multiplier.

[00:22:46] Danielle: Maximizes potential vulnerabilities. And so it is dual use, right? These are some of the buzzwords around it. but you know, it also we have to really break down what we mean by I. And so that's kind of the work that I've seen across all of these multifunctional different groups is are we talking about large language models?

[00:23:02] Danielle: Are we talking about statistics and machine learning? Are we talking about active remediation in tool sets out there? From cybersecurity, are we talking about automated attack patterns, right? And being able to script,copy and paste type type spraying, targeted attacks, things like that.

[00:23:17] Danielle: I don't love AI as a blanket term. A lot of the times when I see it in the cybersecurity solution space, it is statistics and machine learning, which is something we can grasp, when it gets to be like, larger than life takeover. I think we're, we're definitely, We're taking a very,reasonable approach to what we put out there.

[00:23:32] Danielle: We actually have an AI for OT paper coming out that is not Hollywood scenarios of grandeur, but really, these are the questions to ask yourself if you're considering the use of anything automated within an operational technology environment. Here's what to consider. Here are the questions to ask, and it really kind of comes back to procurement language, right?

[00:23:50] Danielle: What to focus on when you're buying a technology. What to focus on in terms of liability, we still see people struggle with the shared responsibility model from cloud service providers. So what does that look like now when we're talking about AI capacity? so again, a lot of really smart people working on AI across this.

[00:24:05] Danielle: I'm not one of them. but I think that the approach we're taking is definitely trying to grasp what do we mean when we're talking about these technologies? Is it a function of dual use? Is it a force multiplier or threat multiplier in that context? And then how do we do more diligence in the design procurement and deployment of these solutions or capabilities to enable security as a feature rather than kind of, catching ourselves on the back foot and saying, we didn't ask any of the right questions.

[00:24:32] Dino: Are you starting to see any specific attacks per se on control systems? I mean, normally we always hear the story is it came in through I. T. Made its way down to the industrial control system, primarily being windows based systems that are that are controlling those control systems. Are you starting to see To see anything more specific where you're seeing the PLCs starting to fall into the mix of, of, of an attack vector?

[00:24:57] Danielle: So this is a non AI question, or do you mean from an automated attack?

[00:25:00] Dino: The automated attack going after the, the, the PLCs specifically. Right. Stuck snap light per se. Right.

[00:25:08] Danielle: not from an automated perspective from like We've seen sophisticated malware look for specific components or, register different, capabilities, applications, programs within a network. that's not necessarily like an AI enabled use case, but no, writ large, we're not seeing a ton of automated, hunting or, or attack patterns.

[00:25:26] Danielle: And that is because these technologies are not ubiquitous. And so that's actually a good thing. So people have moved away from the quote unquote security by obscurity, reality. And I think that's a good thing to move away from because obscurity is not going to, prevent worst case scenarios.

[00:25:40] Danielle: but the fact that you see an average of 12 or more different types of vendor technologies within an environment is actually a good thing, right? Because you're not going to be able to target all of those technologies with Your level of access or your level of, your attack. So no, we haven't seen widespread automated.

[00:25:57] Danielle: and actually there was a paper put out a couple of years ago on conficker. And the fact that we still see conficker across a bunch of ICS enabled agents. And we, we know that organizations want to find the end controller, the Stuxnet, the like really sophisticated and targeted malware that's been there.

[00:26:13] Danielle: And it's been highly tailored for their environment. But if they don't have the structure and again, the enablement and the capacity that I've talked about to find some of those more low level,pesky, pesky things like conflict that's been around since 2008, then they're probably not setting themselves up to, to locate or, or alert to those tailored attacks unless something happens physically in their environment.

[00:26:33] Danielle: And that's kind of a. A scary reality to be in. So there's a ton of different tools and controls in that gap, but I remind people that you're not going to find in Controller or SuxNet if you're not looking for things like Configure, right? So we have to do the basics and build those blocks to be able to understand some of the.

[00:26:50] Danielle: The physical ramifications like it should be a last notification when something is changing in your pressure and your valve in your production line, right?

[00:26:59] Dino: any final thoughts? anything that we didn't cover that you'd like to cover?

[00:27:04] Danielle: talked about the CPGs before. I think we started recording and people kind of ask, what are these? What are these good for? what I like to remind folks is that again, we use this word baseline. But again, if you don't know where you're at, you don't know where you're going. And if you, you can't know where you're going without knowing where you're at.

[00:27:17] Danielle: And so the thing I love about the CPGs is if you don't download the PDF, but you look at the, Excel spread, if you jump into that, it's actually more malleable. So you can scope it down based on price. You can scope it down based on if you want to align to the CSF, you can scope it down based on,the difficulty of the actual control itself.

[00:27:34] Danielle: And so there's a lot of ways to slice and dice the CPG that I don't see people embracing when they're kind of doing their assessments and reviews. And so I would encourage people to go in with a strategy and say, well, we want to select controls that are gonna have the highest impact, or we want to select controls that we can afford, or we want to select controls that are in line with the detect function, because that's the next one on our roadmap, according to the CSF, that malleability is, is huge across that.

[00:27:58] Danielle: And then the last thing that I, I know it's. talked about all the time, but workforce development back to not outsourcing what you, you can't manage, but not outsourcing what you don't understand, we need to invest in people across this space. like I mentioned, it's a good thing that there's not a lot of automated capacity across OT systems and the, there's not a lot of ubiquitous systems out there, which means you can't obviously target every water utility in the nation and their specific HMI, because they don't all use the HMI.

[00:28:24] Danielle: And you don't have access to all of them at once, right? So there's like larger than life scenarios where we're just like spraying down full sectors. that's not realistic. But what is realistic is that personnel are your number one investment. And I know tools are, sexy and cool. And they're enabling a lot of machine learning and, AI and things like that.

[00:28:43] Danielle: But we really have to invest in people in this space. And this is doing that work right now as well to develop our workforce on OT. And I encourage organizations to find a way to also find those that expertise because it's too much for one person to handle it. And we've seen that in our engagements and with our partners, both private sector and government.

[00:29:00] Danielle: but yeah, definitely invest in your people across the space. And there's a lot of work we've done with the nice framework, with other organizations to say, here are the competencies. Here's what to look for. And here's what you can train, right? Here's what you can learn.

[00:29:12] Dino: Yeah, a good point on the resources, especially because I'm at that age, that the peak 65, right? The baby boomers that are retiring in the millions between now and 27. It's like what 20 million people, and for every two that are leaving, you might get one and change back in. So you're right.

[00:29:30] Dino: Even for our organization with the growth that we're seeing that it's challenging finding the people that we need. That's no doubt. So

[00:29:37] Danielle: And people ask, do you train cyber folks in engineering or do you train engineers into cyber and it's both you train people that are willing to learn. That's the answer, right? It's cross pollinating. It's it's both always.

[00:29:49] Dino: Yeah, trying to get them on the plant floor is always can be a challenge, but it's just because of the nature of the beast out there. Well, DJ, it was good seeing you. Thanks. Thanks for taking the time to talk with us today and good luck.

[00:30:04] Danielle: Thank you very much. I'm sure we'll meet again and good luck to you and your teams.

[00:30:07] Dino: Yep. Thank you.