OT Cybersecurity Insights with Lauren Blocker, Rockwell Automation

[00:00:00] Lauren: cybersecurity insurance is similar to car insurance All it's going to do is, if you crash your car, it's going to help you cover some of your bills. Cybersecurity insurance is the exact same thing. If you suffer from a cyber event, your cyber underwriter may cover some of the losses that you've had.

[00:00:54] Dino: Hi, my name is Dino Boussalaki, and today we have Lauren Blocker with us from Rockwell Automation. Welcome, Lauren.

[00:01:02] Lauren: Thanks, Dino. Great to be here.

[00:01:04] Dino: I want to kind of begin with , your journey into cybersecurity, specifically industrial cybersecurity working from Rockwell. So can you kind of give us a little bio and background on, Lauren's path to

[00:01:17] Lauren: Sure. Absolutely. Happy to do that. So, I really started my career in telecommunications back in the 90s, if you can believe it. So, the world was a very different place back then. And the real goal in the 90s and early 2000s was how do we help connect, right? How do we help organizations see through their digital transformation journey?

[00:01:38] Lauren: A real critical piece of that is the plumbing. How do we connect? How do we make it efficient for organizations to connect their, sites, their users to the applications and data that was moving from on prem primarily to data centers or cloud? So the first. 15 plus years of my career were really spent helping organizations leverage that really critical foundation to making their digital transformation come true.

[00:02:10] Lauren: And you think back to the 1990s in the early 2000s, the notion of digital transformation was really focused on. Very different industry types than when we think about it today from an industrial point of view, so that was, retail and finance and healthcare hospitality and logistics. They were kind of more mature in that sense, because those were the real drivers for business.

[00:02:36] Lauren: I remember, back in there again, early 2000s folks thinking about what is omni channel retail look like and how do we build an infrastructure to support. That type of connection to consumers, to users, to internal folks, to vendors. And that was really the mission statement of a lot of the work that I did.

[00:02:59] Lauren: I worked with IT leaders and practitioners to help them build out efficiently these types of infrastructures to support that digital So fast forward to about 10 years ago, the notion of now we're connected. What risk does that pose to the business from a cybersecurity perspective? And I think we maybe 10 to 15 years ago, we're thinking if you weren't, a targeted type of company or industry type, then you were good.

[00:03:31] Lauren: You didn't really have to worry about it, but that really started to change or kind of the Stuxnet. Events started to occur and become front page news, and then organizations started to get the idea that, oh, maybe this could happen to us too, but what would the risk to the business be if that were and so particularly in health care, there started to be a focus on how do we have this connected environment and ecosystem, but try to do it securely.

[00:04:00] Lauren: Back then we started seeing some of the first major ransomware events in the health care space. So there was a higher demand, I guess, in that health care space to really start talking about cyber security and best practices and things of that nature. Regulations also kind of started to pick up in those early 2000s again, really based on industry type.

[00:04:23] Lauren: Are you a power gen? Do you run a nuclear power facility? Do you deliver product to the, the D. O. D. and their compliance requirements? filter down to you. Those types of organizations were really, kind of leaning in and ahead of the game. when we look back on it now from, 2024's vantage point.

[00:04:43] Lauren: So I took a step into a very boutique managed cyber security organization and kind of started to have the opportunity to learn about what These different industry types and these different leaders, CISO, CIOs and IT practitioners in particular, what they valued from a cybersecurity perspective, I have an opportunity to really reflect on, what was the next wave of digital transformation?

[00:05:11] Lauren: Where was that coming from? And it became very clear to me that the next iteration of digital transformation was happening, kind of right now in manufacturing and that that posed a really huge opportunity to help those organizations mature quicker, gain awareness and start to develop and execute against programs that are industry standard based.

[00:05:37] Lauren: To help them solve those problems that kind of their predecessors and other industries may have faced previously. So, that's what brought me to worthwhile a little over 5 years ago.

[00:05:48] Dino: Right, yeah, no, it's been an incredible journey, and I'm a, I've been going to Rockwell Automation Fair for over 20 years, so for me, going back, it's like kind of, it's like almost like a high school reunion.question is, how do you counter, Those, I'm sure you hear that. I mean, we hear it in our business, those organizations that say, well, nobody's really targeting my control systems, when you start talking about cyber security on the OT plant floor, which is how is Rockwell handling those types of,debates, if you will, from organizations that say, man, nobody's really going after my control systems.

[00:06:20] Lauren: Well, I would point to kind of front page news and perhaps the target. Isn't control system, but if you think about who the adversaries are, right? These are these highly funded, sometimes nation state type organizations, very sophisticated. They're not necessarily performing highly targeted, events only, they're oftentimes really going after the low hanging fruit.

[00:06:47] Lauren: And there can be a whole host of, objectives that these, organizations are trying to accomplish by performing these activities and, is it, do we want to see what's going on? Do we want to, try and steal IP? Do we want to cause a disruption? in another nation state in preparation for some type of, other event later on, or do we want to break things?

[00:07:12] Lauren: Right? So we've seen where those types of activities take place again, highly funded, very sophisticated adversary, many adversary groups, that are performing these activities again to do a whole host of different things. And so whether the question is, am I being targeted or not is probably not the best question to start asking when you're beginning to take on an O.

[00:07:39] Lauren: T. centric type of cyber journey to ask is if a cyber event were to happen. What that

[00:07:48] Dino: Yeah, kind of like one of the things I like kind of talking to what I'll say to the executives. Are you executing the same amount of due diligence to secure and protect your industrial environment as you do the enterprise? Right? I mean, that's kind of what we're really challenged with there. And speaking to that, how is how's Rockwell?

[00:08:08] Dino: Handling, trying to get more into being an industrial automation technology firm, getting to that I. T. Leadership when me when I worked at Rockwell, I was kind of a little bit of a challenge for a lot of the account teams is getting past the plant manager or even getting past just the local plant engineering and operations team.

[00:08:28] Dino: So is Rockwell starting to build into building relationships? And finding an opportunity to get in front of that I. T. Leadership, the C. I. O. The C. So, the I. T. The security teams per se

[00:08:43] Lauren: you're, you're spot on. This is not the type of program that at a particular individual site or plant manager or maintenance manager role could. Really, effect in order to build out the awareness, the funding model, the adoption, the type of holistic view of O. T. cybersecurity. We really do need to have a different set of personas in the room than historically has called on.

[00:09:12] Lauren: And so you'll see if you listen to any keynotes or, follow any of our executive leaders on linkedin or elsewhere. You'll see there's a very concerted effort to really elevate the conversation, not just in our cyber security business and our software and digital transformation business as well. We've had some.

[00:09:31] Lauren: Very strategic acquisitions over the last, 5 to 8 years that help bring in more value around services, consulting solutions that augments. The traditional Rockwell component and core business. So your question specifically is, how is Rockwell getting after and making these introductions and making an impact at a higher level?

[00:09:59] Lauren: You don't see that our executive leadership team and all of us are really tasked with getting those kind of top to top discussions happening so that we can begin to build out the differentiators and and show value in a different way.

[00:10:14] Dino: and following on along those lines. obviously, we're a Rockwell Platinum partner.

[00:10:20] Lauren: Thank you.

[00:10:20] Dino: How are we doing from an OT ecosystem, right? The OEMs, the system integrators, the Rockwell partners. Are we getting better? mean, is Rockwell seeing, us advancing and maturing, in this OT cybersecurity journey?

[00:10:36] Dino: In your view, in Rockwell's view, generally speaking, and, what are your thoughts on that?

[00:10:40] Lauren: Well, that's a loaded question. Do you know? I think there's much like we can't paint with a single brush. The experience and maturity of the cyber journey of every single 1 of 12 customers. We also really can't say, broad strokes. Everybody's doing back. Right? what I have seen in the almost 6 years that I've been with Rockwell is there's more focus.

[00:11:04] Lauren: There's more awareness. the S. I. and distributor type of community is starting to place greater focus on individuals with network infrastructure, cyber security type of credentials that can help elevate the conversation towards. here's what the standards are. Here's what you should be doing.

[00:11:27] Lauren: And again, the organizations, they vary greatly, right? You've got smaller ones, larger ones, integrators, different focus areas. But I would say that those ecosystem is responding to the need that all of our customers have jointly, which is. It's we're not doing everything that we need to be doing to to protect, and prevent the worst thing from happening.

[00:11:52] Dino: But, and I believe we need to get better, right? I've been, if you, our podcast over the last year and a half now, I pushed that a lot, right? To the extent where, I talk about cyber ready machines.if we're building a plant, which we're capable of doing, obviously building, control systems, packaging systems, whatever type of machine center is the,client is, is, is requiring we're an OEM is building, what are your thoughts around building cyber ready machines, right?

[00:12:21] Dino: So you got a client that's using a cyber security platform, whatever strike that might be, where we would actually start developing and implementing. Those cyber security technologies into our machine centers. What do you think about that cyber ready preparedness, sensor ready panels are just being cyber ready in machines that are going in, being proactive versus reactive.

[00:12:47] Lauren: Yeah, so, your business better than I do. I'm not a machine builder. I've never worked for a machine builder. We usually come in. In my role after the machines are built, or when they're being stood up and the keys are being handed over and the organization says now what? So I think the idea of, is there 1.

[00:13:08] Lauren: 1 thing that an organization can do when you want to develop a holistic standards based. Globally consistent program that's a bit of a tall order, right? There's no, there's no easy button. There's no, magic eraser to correct all of the, issues that are inherent in these legacy systems. The idea of.

[00:13:34] Lauren: Building from a security, centric position is always a great place to start, but then the question is, what do we do about all of this legacy equipment that's elsewhere in our fleet elsewhere in our state having 1 machine or line that's, up to standards, but 99 others that aren't. Doesn't necessarily move the needle in a holistic way that an organization would need to, and that's really where we can come in to help kind of coach and create awareness around what is good look like and what is the appropriate level of risk that an individual company, their leadership, their, shareholders, their executive board, what's an acceptable level of risk for them, and how do we build a holistic system across their fleet?

[00:14:22] Lauren: Thank you. That gets them there over time.

[00:14:25] Dino: Yeah, you're going down a good path. how often do you see clients that have actually come to start to develop? Being a road map, right? A framework, a security framework. Are you starting to see organizations really starting to build out a security framework? I mean, regulatory groups that have regulation requirements, obviously, have to do it, being asked to do it, but are generally speaking, Are you starting to see companies really begin building out a security framework and, and, and who are all the players may be involved in that, right?

[00:14:58] Dino: For the group, right? It can't be to your point earlier. It can't just be the plant manager, right? so it has to be a consortium, which I think includes the partners also that are the OEMs and the system integrators, the third parties. Are you starting to see more frameworks being developed? Yep. With their client base.

[00:15:18] Lauren: So here's what I typically see the CISO, the InfoSec leadership within an organization has developed a framework is adhering to governance and policies and is, checking and balancing against those. Reference documents that they've developed over time, either internally or with the help of a third party, perhaps one of the consulting organizations that's out there doing all that work.

[00:15:49] Lauren: And so, from an enterprise IT side of the house, that's fairly mature. So, if you speak to a CISO and you say, how's your cybersecurity posture? They're going to be thinking about. That plan that they put together in whatever 2000 and whenever it was and the internet process, they're following with secure their data and their, laptops and servers and rules and how they've tested their incident response plan. And so on the challenges. There's a whole set of connected assets. That many see, so don't even think about when they're asked about their cyber security, but it may not be,explicitly in their view and that's all the connected assets.

[00:16:37] Lauren: And they're manufacturing facilities, that's their safety systems and their production and their, feel fees and their switches that are running all of that stuff and creating data and maybe pushing that data to a place where it lives. but there's a. A lot of visibility to, that huge set of connected assets and everything that they're doing in thinking about what's my what's my cyber security plan.

[00:17:04] Lauren: What does it look like right? So on the 1, the tail of 2 cities, right? You've got the really mature iterative standards based. We've got the on the enterprise it with that set of assets. But a whole lot of not much for the assets and maybe not even a visibility to the fact that is in their purview or shouldn't. when I start to get these, calls and emails from. folks within an organization saying, oh, no, there's just this executive mandate that came down and I'm responsible for now to. What's so key? Literally, what is? And so we have this great opportunity to, be that trusted advisor and start the education process around, what do you have?

[00:17:55] Lauren: And if you want to see the steam come out of a CISO's ears, start talking to them about. What's typical from a life cycle perspective from a perspective from a, just very informal way of connecting and making things work. That's a great opportunity for them to go. Okay. Well, I didn't know.

[00:18:16] Lauren: And now I know. And what do we do about it?

[00:18:20] Dino: what would a CIO or CISO say if you found a Windows 7 machine on their network, right? And then their first

[00:18:25] Dino: response, well, they would say, get it off, right? Right? Get it off. And it's on your plant floor, that's a little bit more difficult, right?

[00:18:32] Dino: so let me pivot to one of the things that we're seeing, and I need a perspective on this would be really good cyber security insurance, right? Because, we've witnessed clients that can't get it. Right, or they've got some new requirements coming at him, let's talk about MFA for a 2nd for other control systems.

[00:18:50] Dino: Right. So what is Rockwell seeing, from the cyber security insurance industry and what kind of, we've talked about regulatory things driving that. Are you starting to see the cyber security insurance start trying to change behavior and improve activity on that front

[00:19:07] Lauren: I feel like cybersecurity insurance is similar to car insurance All it's going to do is, if you crash your car, it's going to help you cover some of your bills. Cybersecurity insurance is the exact same thing. If you suffer from a cyber event, your cyber underwriter may cover some of the losses that you've had.

[00:19:36] Dino: for remediation and mitigation, but not business as rock? Yes,

[00:19:40] Lauren: doesn't call business disruption. It's not going to cover, the, the brand impact that you can have, or the other flow downs that you can have based on where you are on your individual customer supply chain, whatever that looks like. The idea here is much like with a compliance requirement, don't don't teach to the test, right?

[00:20:02] Lauren: you don't want to just do the bare minimum to get coverage. You don't want to do just the bare minimum and check, check those boxes to achieve compliance because if you do just that, you're never going to be secure. You're never going to build out that iterative road map to compliance. Consistent improvement and cyber maturity if you focus more on the, I want to be secure and want to mitigate those impacts.

[00:20:32] Lauren: If when should they happen and you focus on it from securing being the goal, then you will check those boxes, whether it's from compliance or a potential cyber insurance underwriter, you will overachieve those and more importantly, you'll bring business value to shareholders, executives, the board. And everybody who depends for their livelihood on the business running, and staying in business.

[00:21:03] Dino: So what do you see as some of the dynamics that are out there that are shaping industrial cyber security today? when you look across the portfolio of technologies, what I think I heard a stat a month or so ago that there's 5000 cyber security technologies out there, right? What do you really see in leading the charge and not specific vendor or anything like that?

[00:21:24] Dino: But, what's really shaping this industry for us? in your from your purview,

[00:21:29] Lauren: So, yeah, there's a couple of things that come to mind when you ask that question. Do you know, I think about it from a, who's going after, this kind of white space, right? This, this problem looking for solutions. And you've absolutely seen over the last 5 years or so organizations that historically are focused on the enterprise space.

[00:21:52] Lauren: Be they, vendors or support providers or consultants, or, even some of the big 4 really trying to pivot their capabilities and people and, support.to focus on the needs of the industrial controls environments, right? It's, it's not necessarily, you can't just necessarily drop an it tool or an it skilled, person into an OT environment and have the kind of outcome that you would need to have.

[00:22:26] Lauren: So, so there's kind of that, right? There's. You can name all the names that you can think of where you've got boxes with blinky lights on them and name brands on them. All those organizations are trying to pivot a little bit to be more industrial control centric again with mixed kind of results. Then you'll see organizations like Redwell and our ecosystem, including your company, trying to leverage OT expertise and gain insights and leadership and solutions that are specifically OT oriented and starting to talk the IT talk a little bit more.

[00:23:09] Lauren: again, not everybody's. Following that, certainly is, and I know many other organizations are starting to make those types of investments and bring in strategic partners have. Well, ourselves, we've had some strategic acquisitions over the last 5 years to help build out our leadership, our expertise, our capabilities,our global footprint to help meet customers where they are and have solutions for them at kind of every step along the way. I think another thing that, that we're starting to hear a lot more is organizations trying to align internally with what the standards should be. So we hear a lot about the cyber security framework in the U. S. I. E. C. 62443 from a global perspective. For our friends in Europe, the notion around this too, and what they need to kind of get behind to all be speaking from the same sheet of music, if you will, so that the organization internally is aligned.

[00:24:12] Lauren: And once that happens, the light bulbs start lighting up pretty quick around.the awareness piece, where are we? Where are we out of compliance? Where are we out of governance with what our organization feels is appropriate? And then once that awareness is gained, if you've got the right leaders in the room who are engaged and focused on improvement, then the, it becomes a whole lot easier to let's, let's solve this together.

[00:24:47] Dino: you touched on something earlier. You talked about resources, right? Key thing to how we're definitely short on resources with the skill sets that we're talking about, right? That kind of have that end of the cyber security technology. I. T. Background the same time, understanding, process and control systems.

[00:25:05] Dino: How is Rockwell tackling the resource shortage out there, number one, and number two, are you starting to see the universities, start bringing cybersecurity from an industrial perspective into their programs from an academic perspective? Are you starting to see any of that?

[00:25:22] Lauren: So let's start with what Rockwell is doing. we have a hundred plus year heritage of expertise in the space, right? That's, that's our, that's our, in our DNA. So, our training programs are everything that we do with employees is all about helping those folks who come in with engineering degrees from some of the best universities or externally and have those skill sets to get really nitty gritty with the needs of OT and our portfolio of core competencies. Take some of those folks who have the interest. And cross train them in cyber security and networks and infrastructure and that sort of professional services organization that we have pivot them into more of a customer facing role that's focused on OT cyber security. So that is a continued work in progress.

[00:26:23] Lauren: You may know from your time at Ruffle, what a huge investment we like to make in our employees. Right from from the ground up and continuing on. You have that desire to be curious and continuously learn. Well, is a really great place to be

[00:26:38] Dino: Class A firm, not a doubt.

[00:26:41] Lauren: So, from a university perspective, there's a lot of cybersecurity programs that are out there.

[00:26:49] Lauren: My oldest son graduated with a master's degree in. Computer science, he is now a software engineer. Is he doing anything in OT? I mean, not specifically. He worked for a, a tantrum. so he has his hands on multiple different things. but to say that. Organization, there are universities have or building out,a huge program around O.

[00:27:17] Lauren: T. centric cyber security. I personally have not seen that. So, to me, it feels like we take folks that have the aptitude, the curiosity and the base level knowledge and augment with various different types of certifications and hands on.

[00:27:34] Dino: Yeah, I, even myself, I've witnessed, I hired two chemical engineers from great schools just in the last few years, and even though they went to school to be chemists. Their interest shifted into cyber security around industrial, and the nice thing about the kids, I call them because I can't, I'm old enough.they go into engineering programs, part of their engineering program before they graduate is they got to do internships, right? So they have, at least they have a little bit of a background on what these environments look like, right? And working in an industrial environment, I think that's a plus, right?

[00:28:08] Dino: So, so Lauren, the question in regards to IT leadership, the executives, how do you think that they perceive Rockwell in this space, knowing that they're primarily just working in what they would think is just their plant floor systems,

[00:28:22] Lauren: a great question and it does come up quite often. So, if I team leaders for info sec leaders are familiar with Rockwell at all. Oftentimes they're not. They think of the normal manufacturers that they do business with their switch providers, their cloud providers, their software providers. Maybe some of their consulting partners, their firewall vendors. When they think of Rockwell, if they know who we are, they think of us as a PLC provider and a PLC provider only. And one of not, maybe the primary one in their business, but by no means the only vendor that provides manufacturing automation in their space. Many times we'll start this conversation and a CISO will say, I only, why would I come to you for a holistic solution when all you're going to do is look at Rockwell and tell me to buy more Rockwell. So, we have absolutely a response to that and that is obsolescence risk, vulnerability, cyber risk cannot only be focused on 1 manufacturer in your estate. very much. It needs to take into consideration your local content, of course, but everything else that exists in your environment. If you want your program to be holistic and to adhere to those types of standards nationally.

[00:29:50] Dino: you're agnostic, right? if it's Siemens in there, Emerson in there, GE, Schneider, it doesn't really matter.from a Rockwell perspective, when you're talking about the cyber security journey and how you holistically using your term, go after how you're going to improve your cyber security posture and your manufacturing plant floor.

[00:30:07] Dino: so as we wrap up, what key advice would you offer to anybody who's listening to our podcast on how to start this journey? And then the last thing I would say is, is there anything that you would like to add that I didn't ask you that you would like to convey to our audience?

[00:30:25] Lauren: Yeah, thanks Dino. I would say it's tough to boil the ocean, right? Once you break out of that awareness phase and start digging into the reality of what exists from an inherent vulnerability perspective from a. Obsolescence risk perspective, right from, a gap between what it thinks is happening and what may actually be happening on the show for once we start digging into that lean in, keep digging into that.

[00:30:57] Lauren: And if you need support, if you need a partner, there are, we exist. We're out here. We can help get to. Over that kind of scary hump of the bad report part, if you will, of all the things that are wrong and help get to a place where we know that the activities that are happening after getting that bad report part are building a foundation for a standards based. Program that can help you keep getting after it year after year after year, because the fact of the matter is there's no finish line and cyber security. You're never done. You can move the levers and you can get that low hanging fruit, but next week, next month, there's another vulnerability that didn't exist today.

[00:31:44] Lauren: And so there needs to be that kind of focus attention funding and support. For that long term program, right? It's something new and we're trying to do more with less. Everybody is, but this is a critical, critical piece to the success of. Not just these individual organizations, but in many cases, the American way of life,

[00:32:04] Dino: right. Well, thank you, Lauren. Thanks for your time today. Appreciate it.

[00:32:08] Lauren: you know, the pleasure

[00:32:10] Dino: Yes, thank you.