Stuxnet to Colonial Pipeline What Have We Learned & What’s on the Horizon?

[00:00:00] Mike: Security is a continual process because the attackers are out there, they're always out there, they're always evolving, they're always improving, and we need to do the same thing.

[00:00:12] Mike: So a lot of these OT environments, like I always think like a power plant. You go in, they're like, well, we're NERC compliant, so we're all good. , No, that's not how it works. There's probably about 5 million different ways, right? To break into a nip compliant environment and have some type of, , negative impact to that plant.

[00:01:03] Dino: Hi, this is Dino Bus and today we have a special guest and his name is Mike Holcomb. Hi Mike. How you doing?

[00:01:10] Mike: Good, Dino, how are you?

[00:01:12] Dino: I'm great. , I think I'd like to kind of kick these things off is kind tell us a little bit about yourself and your, journey into the whole realm of cybersecurity and specifically OT cybersecurity.

[00:01:23] Mike: Sure, yeah, I'll try to, keep it short, but lemme say Thanks for the invite , , , , I grew up, , with , my best friend who was kind of the traditional hacker kitty. And so he would like.

[00:01:33] Mike: So you could copy them illegally, , he would write cheat codes for games so you could get unlimited gold or guns or lives. and I just was always fascinated with that. I was a good kid and I would never do anything bad. I. But I would watch. And so yeah, I kept watching as, he evolved in what he was working on and, , movies, like war Games had come out I really kind of fell in love with that, that movie.

[00:02:00] Mike: And it kind of just. Continued to take me down that path of not only computers, but the idea of how we can use computers for hacking, right? Whether for good or for bad, and everything in, in between. So that just always stuck with me through my career. So. So it started in, IT roles in high school.

[00:02:19] Mike: , Took a, I detour through, , movie theater, best job. Still ever had, worked in a bowling alley, actually did some electrical work, , as well as some, computer stuff there. , And then, , went to China for a couple years, came back to San Diego and then it was, , off to the races in the IT world.

[00:02:37] Mike: , so it was pretty much doing it. Then starting to work in security and showing, and actually wrote, so I was working for a computer training company, , doing all the networking stuff and actually wrote a, cybersecurity course before we called it cybersecurity. And, just seeing you at the time where not a lot of environments in the, in the business world understood they needed cybersecurity.

[00:03:00] Mike: And that's kind of the point we were at in the OT world as well, you know, especially, you know, four or five years ago. We've come a long way since Colonial pipeline, but, and I guess I'm jumping ahead a little bit, so, but I was always this, you know, IT cybersecurity nerd and got into OT when Stuxnet was announced in 2010.

[00:03:24] Mike: I was just fascinated with this really advanced piece of malware that not only got into this plant environment in Iran where they had the centrifuges that enriched the uranium gas, so they would eventually make nukes, but that the malware would get in. It would physically break down those centrifuges.

[00:03:48] Mike: So using physics to break down these real machines in the actual real world, which I was absolutely fascinated with. And then what really hooked me was at the same time, they made it look to the operators as if nothing was going on. If you're sitting in the control room back in the tans and Iran that you're looking at, all the lights and everything looks good, even though behind the scenes the machines are breaking down, they're wondering what the heck is going on.

[00:04:13] Mike: that was really the big hook for me. And so just getting into this question of, well, how does this work like in a power plant or water treatment? Because I had friends in power and water and start asking them and they didn't know and some kind of got a little angry 'cause they weren't doing anything about it.

[00:04:31] Mike: Right? They didn't even think of it as being a thing. And , thankfully after about a year, I got my job at floor. Didn't have a clue as to what Flore did. , I just knew that, , had to get away from my last boss. , Yeah. Did not like him for many reasons. Had to get away, got a call. Ended up working at Flora, and then found out we're one of the world's, you know.

[00:04:53] Mike: Giant engineering companies and we build the largest control system environments that are out there. And so I just got really extremely lucky. And so I've kind of migrated from doing, you know, it, at the floor into the, the OT world. And I, I get to learn from some of the best engineers in the world and they've really, , accepted me into that.

[00:05:18] Mike: So, you know, a big part of what I do now is, you know, take that information kind of from my background in it and then also in OT now and working with all these great people and a lot of the great people in the community and, and then putting that content out on LinkedIn and, and YouTube to help other people that are interested in OT, cyber to , you know, follow that, path.

[00:05:39] Dino: It's an interesting path, that's for sure. Right. My path is not too dissimilar to yours and you know, almost four decades of working in, Technology and 35 of it in the manufacturing arena and around the world. Like you, I didn't live in China for a couple years, but I did work over there. , and I recognized, you know, from moving from what happened in, Iran to being able to create such a sophisticated malware to targeted those control systems in the manner in which they did, and then spoofed the HMI, so that the operators couldn't tell there was anything going bad. Whoever the nation states there were to develop that stuff had to turn around and figure out a way to defend against that stuff. Which brings us to where we are today, right , And so knowing that, having that IT background and, and being involved in the industrial arena on the OT side, what do you think are some of the biggest challenges that we're facing to really get this.

[00:06:34] Dino: Moving into the next level really to kind of catch up where it has had two plus decades, you know, running it, cybersecurity technologies and building practices and resources and budgets and awareness. What's going on, on the plant floor, on the OT side, in your mind?

[00:06:52] Mike: it's slowly making its way over to ot, but in the OT world, still very much to me, like how the IT world was before the. Breach, you know, before Target, there still wasn't a lot of awareness, especially among executives, right? Corporate leadership, that they needed to do something about cybersecurity.

[00:07:12] Mike: Even the military had very little, you know, in the way of cybersecurity before the target breach, which is really scary, right. To, to think of. And, the target breach really changed that, thankfully. For us, you know, taking the silver lining into context that the colonial breach that happened, or the colonial pipeline breach that happened in May of 2021, where we had the longest, , gasoline pipeline in the United States go down for 10 days because of ransomware.

[00:07:43] Mike: That had very much the same impact as Target, right? Where the world saw that. And if you lived on the east coast, right, you would go to the gas station and there wasn't gas. Now you could go around the corner and another gas station had gas, but there was a super long line and they might run out before you got to the front and you had to go through that for like a week and a half or so.

[00:08:03] Mike: So there's a real world impact that everybody saw and they started to realize maybe we should start to take this seriously. So the IT world has changed dramatically since 2020.

[00:08:17] Dino: you know, to me, one of what I see as one of the biggest challenges, Mike, it's the asset ownership, right? I mean, when you think about technology, generally speaking, in a company, it owns that, right? Unquestionably, they have a role and a responsibility around those business systems and the infrastructure, which those things operate on, and the users that use them.

[00:08:36] Dino: When you make that shift to the plant floor, to those industrial control system, , assets, they don't own those. they don't pick 'em, they don't design 'em. I come from that world, you know, if I'm putting in a $20 million packaging line as part of my, or the firm that I work for, for a client, I don't have it in the room.

[00:08:55] Dino: Not that I, we don't invite 'em, the client doesn't bring them to the table to participate. In the design and architecture of what this 25 million piece of equipment is gonna do. You know, as far as the computers that are being picked, the operating systems we're using, how we're gonna configure, how we're gonna set 'em up, the networks in which those things are running on the firm order that the PLCs are using, the choice of the PLCs that you're using.

[00:09:17] Dino: You know, and at the same time, I'm not getting any, any direction from the CSO or the CIO that says, Hey, we have an OT cybersecurity strategy, Mr. OEM or system integrator, and here's the guidance and the roadmap that we wanna put in front of you as you're designing and building these, machine centers for us. that's the thing that's not jelling in my view. I don't know if you see it differently, but you know, I work on the other side of the house. I don't work in the, it ranks. we deal with them, you know, Lou Ray's probably heard this a hundred times, but, and, and so is our audience, you know, I want 'em on the field.

[00:09:49] Dino: I need em in the huddle. I just don't know if they can be the quarterback, if that makes sense.

[00:09:53] Mike: It does. and you do see that a.

[00:09:55] Mike: Environment, but you kind of see all different variations, in different organizations. And so you are right. A lot of it is, you know, is somebody taking ownership for cybersecurity, for ot, just even an OT in general and sometimes. You can have that, but it's very, very rare. And then of course you get into the question of is, is it OT doing that?

[00:10:21] Mike: Is it it doing that? or maybe it's shared responsibility. And then it gets into the question of are they working together or, are they butting heads or maybe they're just not communicating it at all.

[00:10:33] Dino: you're right about that. 'cause I will tell you that when you have those two groups working well together, where they're aligned and they're collaborative and they're transparent, then it's a beautiful thing. Going through one of these types of exercises, you know, but to your point, if they're thumping at each other and don't work with each other, or neither one of 'em has the resources within the organization really to deal with it effectively, then you're right.

[00:10:55] Dino: It's, it can be a heavy lift.

[00:10:56] Mike: For sure. And yeah, I've just seen too many teams that really are falling down because, and mostly just 'cause they're not talking whether they perceive the other team hates them or doesn't want to deal with them or work with them, , or they think they're not easy to work with, but for whatever reason, they're not talking and nothing's getting done.

[00:11:14] Dino: There's the environment, right? Not ' it's not uncommon. This happens a lot. we initiate a project, we usually, obviously gotta start the plant. You gotta think globally, but you gotta act locally and we'll come in and meet with it teams that have never been to the plant or maybe come to the plant once a year, every other year.

[00:11:31] Dino: And so they're, too far removed. You know what's really going on in there, and so in order to fix that, there has to be some continuity between those two groups. And it can't be a spot check periodic, or I don't want to go work in the plant because it's hot or it's dirty, or it's a danger.

[00:11:48] Dino: Or it stinks or whatever that's another challenge. Again, I guess that's more of a cultural or behavioral thing for some to want to get past that. Right.

[00:11:58] Mike: It's just a different world for them. Right. and I get that. But, if you're gonna work in an environment and, OTs attached, you know, if you have a plant, you need to, be exposed more than once a year is not gonna get it done, or less than once a year. Done

[00:12:14] Dino: what do you see coming around the corner? You know, that's gonna shape this in your views, you know, and is they are getting better. The awareness is out there, right? Technologies are maturing, you know, and getting better specifically on the OT side. what do you, what do you think else is coming, , you know, to, to help shape this industry?

[00:12:33] Mike: the two things and, kind of look at it, you know, from the good side and the bad side. I think as you mentioned on you. And there is more awareness, more organizations are doing, more owners and operators are realizing that they need to take cyber SE seriously. You, , on the other hand, you have more attackers out there realizing, oh, they have to take goatee cybersecurity more seriously too, right?

[00:13:02] Mike: The ransomware group operators, the hacktivists, the state adversaries, , they are. And the number of attacks just continued to ramp up since, Colonial Pipeline, and there's a lot coming down the pipe. Just looking at the, numbers right and the growth in attacks, and there are so many environments out there that, aren't prepared.

[00:13:23] Mike: Let alone over the last year or two, you know, two years ago, we were looking at kind of hints that you had state adversaries working with hacktivists and ransomware group operators, and now you fast forward to 2025 and now there's much stronger links and evidence to show that. So Rob Lee at, besides ICS this year, and his keynote was really, you know, promoting this idea and, and helping people understand that not only are we not prepared for what's coming, but it's gonna be worse than a lot of people are expecting because now you have state adversaries, which are typically right, they're low frequency, right?

[00:14:04] Mike: We don't see them that often pop up, but when they do, there's that high impact, right? They do very bad things. And, ransomware operators are kind of in the middle, but like with Right, they're all over the place. You see lots of incidents with them, but. it's very low impact, right?

[00:14:23] Mike: They don't have the technical skills or the tools. Well, now you're seeing them start to work together and, to align. And now you start having the knowledge and the skills and the tool sets of the state adversaries start to, you know, filter into the ransomware groups and. And into the hacktivist.

[00:14:44] Mike: And so now you set yourself up for this idea of now we have high frequency, high impact events and the world is not not ready for that. ' cause we have so many OT environments out there that they don't have somebody for OT cybersecurity, let alone it, cybersecurity, right? Let alone maybe even it at all.

[00:15:05] Mike: They're a small shop and they have to bring a consultant in, which they probably could barely afford when they do that.

[00:15:11] Dino: Well, Gardner came out with a report at the end of last year that said, in the next two years or so, 25% of the cybersecurity professionals are gonna leave the field altogether. That was a Gardner Post. And to your point on the OT side, you know, it's rare to find folks that have a, background both from an industrial perspective and from a technology networking and, cybersecurity perspective. really to shore this stuff up. , You know, because, when you talk about Colonial Pipeline and some of the other, , incidents that have hit, , manufacturers. What I always find amazing is when these events have, even the CrowdStrike event that happened, , last year, was impactful to the plant floor because it seems like people just, just ignore the fact that there's a tremendous amount of Windows operating systems out there.

[00:15:55] Dino: Running those control systems, it's like, and so they automatically think it, they think the business systems, but the plant floor is being impacted, right? The hmis, for example, are running on Windows operating systems and some of 'em very old, you know, we still find Windows seven and XP out there

[00:16:11] Dino: and, and when being supported anymore, just because the lifecycle is different with these OT assets compared to the IT assets.

[00:16:18] Dino: And you're talking about decades versus, you know, a few years, several years, , and so it bleeds over versus a very targeted control system attack like the stuck stack one that you mentioned, or the red Triton and being another one where those were targeted at control systems. and I'm gonna ask you your opinion on this and I, think this is gonna really change the dynamic of it, being able to target those control systems.

[00:16:41] Dino: And I think that's gonna be AI and I think that's going to, teach these bad actors on how to go after those control systems.

[00:16:51] Mike: Interesting to see how it plays out. But you do think right at a high level that it makes sense that if the attackers are using the gen ai, not only to learn how to like help them break into the OT network, but also then to be able to gather the information that they need to reverse engineer the process in that plant.

[00:17:19] Mike: At that point, then they actually have the information within maybe three months, maybe six months, or a lot faster using Gen AI to be able to essentially, again, decipher or reverse engineer how that process works. And at that point, once they have that, information, that's where they can impact the process.

[00:17:39] Mike: And whether that's, I'm gonna shut down the plant and I'm gonna do it nicely and securely. Probably not the route that an attacker would take or they're gonna make something go, and that's, I think, the biggest, concern.

[00:17:53] Dino: right. You know, going after control systems put you on a different playing field on how you'll be viewed, , compared to just hacking into somebody to try to extract money out of 'em or steal their IP versus doing something that's gonna make something go boom or do an environmental release of some sort of hazardous materials or to hurt or kill people.

[00:18:13] Dino: that puts you in a whole different playing field. You know, where that now you might have, you know, like the US government really wanting to hunt you down compared to, okay, they stole, they asked for $5 million from Company X and they paid the ransom and, and there's a lot of companies that just pay it.

[00:18:30] Dino: I was at a client last month, they just wrote a check. Paid for it to get the keys back. They were down for a week. They took the week of downtime and then just wrote a check to get back up and run it and it, versus trying to fight through it, which we've seen some clients do, like, , Clorox, that cost them hundreds of millions of dollars and tried to fight their way through it.

[00:18:49] Dino: and it took them over a year and sometimes longer than that to try to, get things. Back to normal, and they're not even sure if they're normal still, but it just varies depending on who's doing what and who you are and who you're attacking, right? I mean, it just makes difference on who the target is.

[00:19:07] Mike: it's absolutely true. So it's, it'll be interesting. , I do find it fascinating. That's another thing that Rob Lee touched on in his keynote at besides ICS this year was you just this idea that with full typhoon, right, being in all these critical infrastructure environments. And usually when we think Chinese and the Chinese are in the environment, oh, they're stealing proprietary information, right?

[00:19:30] Mike: They're gonna sit there and they're just gonna watch over time, but they're not gonna do anything. In this case, they were Vol, typhoon, or Vol site, which is the OT group within Vol Typhoon. They were getting into OT environments and critical infrastructure, and they were. Taking screenshot of, they were stealing GIS data.

[00:19:48] Mike: They were pulling data from historians. They were taking everything you would need to reverse engineer the, process of that. And of

[00:19:59] Dino: Crazy to think about that, that we have the tools and technology to be able to demonstrate and show to you that that's happening today. We can see those communication flows, we can, we can see where that data's flowing, you know, in and out of that environment and what signatures are sitting in there to be able to do that kind of stuff.

[00:20:18] Dino: it's a little mind boggling when, you know, because the IT folks, they can't see it. Down at that level within the control system space, per se. , Even with their tools, maybe they're catching some of it, you know, but they're fighting, they got like a fire hose pointed at them all the whole time with things that are constantly, you know, people trying to crack and hack and hit 'em constantly.

[00:20:37] Dino: Right. But on the plant floor side, they're just, think those things are still air gapped. They, they think that those machines are not connected to the network, you know, and Covid kicked that door wide open for remote access for support, right? And, you know, we find on average four to seven different remote access technologies in a single site, right? You got plants in your fleet, you just multiply it out of all the different types of remote access methods that are being used, , for third parties and, and their own external people, internal people, to gain access into that environment to support it.

[00:21:10] Mike: Yeah, no, it's very true. Yeah. you just start touching on, yeah, there's, there's a lot of challenges, right? That a lot of environments, right? some are looking at those risks, right? They are looking at the environment, they're looking for those remote access tools, and unfortunately, a lot of those environments aren't.

[00:21:26] Mike: going back to Rob, but you know, he, you know, he was talking, you know, this year about, you know, less than 5% of OT environments are performing network security monitoring. they're not even looking, right? So how are you going to know if you're compromised, if you're not even looking and even shoot five, 5%?

[00:21:45] Mike: I'm like, probably half of those are not doing a very good job. So, so it's probably more like two and a half percent that are actually monitoring their networks for Why So, we see a lot of bad stuff and we see a lot of bad stuff and that's only with monitoring, you know, so let's say, okay, 5% of, of the OT.

[00:22:04] Dino: In my experience, and I've been doing this for years, if I go into 10 plants, two of them, I'm gonna find malware. Just nature of the beast happens, but every single one of them, Mike will have rogue assets. Every single one of them will have an asset or two or three sitting in there that neither side knew anything about or how it got in, why it was there, or what it was doing every single time.

[00:22:28] Mike: someone brings their own personal laptop in, right. Let alone the, contractor, right. Coming in to fix something or do maintenance. Right. Or I've seen, I've even gone into clean areas and a plan and someone's got a smartphone plugged in, you know, with a USB cable and like in the clean room.

[00:22:44] Mike: I mean, like what? You know, it's just.

[00:22:48] Dino: and we have the technology to see that, you know, I, I've seen that myself. I've seen a cell phone in the control room that's being charged, popping up on my ot IDS platform. There's my Combs iPhone, I can see it, you know, and it's got wifi and it's got, it's got cellular on, it's got Bluetooth on it, and it's connected to my control system network. So, yeah. Well, one of the questions I always like to ask in, , IT executives when the opportunity presents itself is, are you executing the same amount of due diligence to secure and protect your industrial environment as you do the enterprise? and I can tell pretty quick whether they're doing that or not, but you know, and I, a lot of it folks, they don't wanna have anything to do with that back to the, you know, the, head button going on because they don't have any influence over it.

[00:23:32] Dino: Right. Back to that conversation and how do we change that, that model, or as I always, I've been, you know, subscribing to that the OT ecosystem has to get better at this. The people who design and build these plants. And these control systems and these machine centers and infrastructure which they reside on, have to start coming to the table with strategies and ideas for the client.

[00:23:56] Mike: They need to learn how to. You know, that's something that the people in, in it have been doing for decades, right? And it just isn't something that folks in OT have traditionally done. It's just like, and if you're not doing that, and if you're not stepping up to the table, and if you're not bringing those suggestions, if you're not.

[00:24:15] Mike: Coming and doing your pitch and even asking for budget, right? If you're not asking for these things, you're not gonna get the help that you need, unfortunately. So, a big learning curve. Think a lot of leadership in the OT world needs, has to take on unfortunately.

[00:24:32] Dino: Well, and, to the CFOs, you know, you have to demonstrate to them that there's value. This. Right. And I have to see the benefit and the value and, and, and it takes a certain skillset to be able to do that in my view. You know, to understand the process, understand the operations of what these, plants do, those machines do, and then talk about disruption.

[00:24:52] Dino: You know, I used to work for very large adult beverage manufacturer based outta St. Louis. You can probably guess who that is. And if we had one packaging line, not putting beer in a bottle or a can that was 80 grand an hour of loss. This is gone. there's no time capsule to get in, to go back to, to make up for that.

[00:25:09] Dino: I'm paying salaries. I'm, I'm wasting consuming, , natural resources. I'm sewer and beer. I've got trucks waiting. You know, I'm paying taxes and free. it's just loss. All right. You lose the entire packaging environment. Now you're talking about a half a million dollars an hour in downtime. You know, and so is it relevant?

[00:25:27] Dino: Yes. The question is, is you know, are you really measuring your unplanned on scheduled downtime because process integrity comes hand in hand with the cybersecurity tool sets and solutions and operations, the way that these things operate. Right? I can tell if it is scanning the network, take pin testing, for example, right?

[00:25:49] Dino: If somebody's pen testing my plant while I'm running, that's very disruptive, right? And then they learn. It's like, well, that knocks me offline, so let's not do that. Let's do it during off hours or during downtime and maintenance windows. Well, that's great, but now the machines that you want to test to find out vulnerabilities, well they're offline and so you can't see it.

[00:26:09] Dino: So what good is that, right? I. And so you have to have these conversations with folks and bring 'em up to, again, think globally, but you gotta act locally.

[00:26:16] Mike: Yeah, exactly. Yeah. And kind goes back to you have to work together and you have to communicate If you're not

[00:26:25] Mike: road.

[00:26:29] Dino: what is the one or two piece of advice that you would like to give our listeners as they're going through their OT cybersecurity journey? what would Mike say to them?

[00:26:41] Mike: My big thing is always just never stop improving and that, you know, that's for whether you're just trying to get into the industry and, and learn more about OT cyber. keep at it and, keep learning every, day and start, you know, trying to get hands-on experience with labs and maybe some onsite visits and build from there.

[00:27:00] Mike: Right. Always, improve, I think for, for folks that already work in the industry, that always keep improving. I, I see unfortunately, too much in, in ot and you see this a little bit in it as well, but a lot of OT environments that, that I've seen is they do have somebody come in and help them to do maybe a risk assessment, a maturity assessment.

[00:27:21] Mike: They have their list of things that they're gonna fix to reduce risk over the next, you know, 12 to 16 months. And then, you know, they, they get to the end and, and they got their list done and they're done. No, that's, that's not how it works, right? Security is a continual process because the attackers are out there, they're always out there, they're always evolving, they're always improving, and we need to do the same thing.

[00:27:48] Mike: So a lot of these OT environments, like I always think like a power plant. You go in, they're like, well, we're NERC compliant, so we're all good. , No, that's not how it works. There's probably about 5 million different ways, right? To break into a nip compliant environment and have some type of, , negative impact to that plant.

[00:28:10] Mike: You know, so we always, always need to be improving, you know, based off of our, our resources. I realize not everybody has massive budgets, you know? , But. We always have to improve at least with the resources that we can.

[00:28:25] Dino: Right. Well, and to the budget again, if you go back to unplanned, unscheduled downtime, what is that costing you? Right. So whatever metric you use, KPI determine how well you run. You know, and you take most discreet manufacturers, they operate in the fifties and sixties percent. You know, just a few percentage points of improvements is millions of dollars.

[00:28:48] Dino: Right to the bottom line. And so there's definitely always room for improvement. I agree with you a hundred percent. You know, you gotta do something to demonstrate that you're getting better, is what I usually say. But to your point, you know, it never stops. You gotta, you gotta prove that you're getting better, right?

[00:29:03] Dino: You have to have a measurement. Can't manage what you're not measuring. Set your baseline and keep ticking away into your, it's never gonna stop. Right. And it's, it's a continuous process. You know, you have to stay on it. And, that's where this it, TOT convergence game it needs a shot in the arm.

[00:29:19] Dino: somehow, some way that, piece of, that relationship between IT and, and OT really needs to change that dynamic. It can't be viewed as, you're gonna overrun my budget. I'm not gonna make my startup when I planned on it. you delay it. And that's why a lot of those OT guys will always push back against it because they've, they've lived some of the, , unpleasantries of implementing. , It technologies in their environment that are being put down on, whether it's firewalls, the network, EDR, you know, just managing through application manage the infrastructure in which those OT applications are running on. And so there's a frustration level that somehow groups need to really gel together if they're gonna do it,

[00:30:01] Mike: Yeah, for sure. It goes back, yeah, that earlier conversation. it's a people problem unfortunately, at the end of the day and people just don't always, , work well together for whatever reasons. Yeah, my girlfriend's a therapist. We talk about it from time to time and yeah. But it, sounds like there, I always think of it, you know, in terms of, a lot of her clients is, yeah.

[00:30:22] Mike: She does count couples counseling. Right. And you have,

[00:30:25] Mike: couple, right. That if they're at each other's throats or again, they're not communicating, nothing's getting done. and I've seen that unfortunately in, too many en environments now, have I seen bad environments, where IT and OT start to communicate and start to work together, and they do improve over time.

[00:30:42] Mike: Yeah, I have, and that's a beautiful thing. but I, I also know there's a lot of environments out there that they're still either fighting or not talking to each other either.

[00:30:50] Dino: I think there's a little bit of a scale problem too when you talk about when you do have those groups that are working together where they've assigned it and OT people to work on this common challenge, but then you got 50 plants in your fleet. Right. and all of a sudden, you know, those couple people that you chose to do this, they're not gonna be able to get this done in this decade.

[00:31:10] Dino: Right? I mean, so you either have to expand your resource pool, you know, and there's a lot, . Third parties out there that can assist with that, that's why it is, is leaned on managed services for so many years, you know, to to bolster, you know, infrastructure support, application maintenance, you know, working on an ERP development, whatever the case may be, because you need those skills at the right time in order to increase your ability to get this effort done.

[00:31:40] Dino: and I think the same is true when it comes to this particular challenge, is you're gonna have to start relying on others. That's why I say the OT ecosystem has to bring their A game to the table, , and assist with that, right? Because that's who the OT people tend to trust. I. That they view them as being credible because they build these things, they maintain them and they support them.

[00:32:00] Dino: Right. if you buy a new gm, you don't take it, you know, to Joe's Garage. You take it back to the, certified, you know, dealership that works on GMs right at the, fixture vehicle. it's kind of the same concept. But anyway. Well, with that, I think we'll call it a wrap. It was nice talking to you today.

[00:32:19] Dino: Thanks, Mike.