How to Secure OT Environments Without Disruptions with Dan Cartmill, TXOne Networks

[00:00:00] Dan: Begin doing that scanning, finding out more about the assets so you can move from that general to the specialized, but the important part is you have to start taking action.

[00:00:09] Dan: You have to take that first step and you don't need to know your entire risk profile to do that. You can put in assumptions and put in some generalized controls. and get really positive effects from that and then move into the specialized protection. And whilst you're doing it, your overall risk will be much lower. Hi, my name is Dino Busalachi and today I have with me Dan Cartmill from TX1. Welcome.

[00:01:06] Dan: Thanks, Dino. Good to be here.

[00:01:08] Dino: Yeah, so you can see I got my TX1 hat on. Thanks for sending that. No, I've actually had, been working with TX1 for the last, two years. So, why don't you tell us a little bit about your role at TX1?

[00:01:20] Dan: Yeah, sure. So about two years is how long I've been at TX1. So at the moment, so I look after product marketing. So I work very closely with the product groups in developing how do we best describe our products so our customers. and the market can understand if it is a good fit for them. I also look after our analyst relations, practice as well.

[00:01:43] Dan: So I spend a lot of time with the industry analysts, which is, with another interesting role, for sure. that's what I look after at TX1.

[00:01:51] Dino: So what brought you into the cybersecurity realm? that begin?

[00:01:57] Dan: Yeah, so it's, been quite a journey. So I've been doing, information security, cyber security for about 17 years now. so I started back in Australia. You can hear from the accent. So I was, in the Australian Navy, the Royal Australian Navy for about eight years and, started in communications and information systems.

[00:02:16] Dan: back then that covered a lot of things like physical security, information security, cyber security. communication security, all of the more traditional senses of security, if you will, and, During that time, the Australian Navy was still going through a lot of its modernization and, a part of that came up when it started using IP based messaging.

[00:02:36] Dan: So, before then it was not using IP based messaging and, we're working on 75 board. Communication channels and whatnot. It's a unique experience in itself. But as I started moving there, the realization came that, hold on, we'll need to look at the more cyber security part of this. so that led me to, working as a security analyst in the Navy.

[00:02:58] Dan: So, so I changed into that specialty and worked at SOC for for all of the Australian Defense Force, which was a very interesting role. So I did that for a while, did that for a couple of years. then when I left the Navy, I, uh, started working as a security analyst, before moving to, consulting.

[00:03:15] Dan: So then I worked with a whole bunch of different federal government agencies still in Australia, helping them design. IAM systems, different network topologies and the network security side of things, before I then moved to the vendor side. that was the big shift. It definitely is a big shift moving from the practitioner side into the vendor side.

[00:03:36] Dan: as I did that, I was working in sales engineering and I got the opportunity to come over to America. that was a great experience about five years ago is kind of when this happened and was about in the space of two or three months actually decided, you know what I'm going to move over to the States.

[00:03:52] Dan: I've been offered a job product manager for the tipping point product at Trend Micro. A, uh, network security IPS tool, was doing that for a couple years as a product manager. That was very interesting working on that, side of it. And then I moved into product marketing. So that's how I met TX one.

[00:04:09] Dan: So TX one used to be owned by Trend Micro. And, the part of product marketing that I was leading the network security part had TX one as a part of it. So I started working more and more with them. As developing their messaging and their marketing understanding the problems that they were facing versus The problems that I've previously seen the things that I already kind of knew about had a good experience in and seeing hold on. These are pretty different. This is new. This is interesting. This is something that a lot of cases hasn't haven't seen that before and really, really interest me. So then the two companies split.

[00:04:45] Dan: So takes one spun out his own company and I was good friends with the product manager and the CEO Terence and The opportunity came up to move over to TX1 and I took it and it's been great. It's been very interesting. The problem space is just so different always interesting.

[00:05:02] Dan: And think That's probably one of the hardest parts is because it's so different, it's very hard to understand. So a lot of folks need help understanding what is this actual problem that I'm facing, and do the approaches that I already know work, or do I have to consider something different?

[00:05:18] Dan: And being able to help explain that, as this is like still an emerging area of security, I think that's just a really fun opportunity, and that's what keeps me interested, what keeps me coming to work each day. Mm,

[00:05:29] Dino: Yeah. So I'm guessing the light bulb kind of went off when you were in the Navy, right? And you have these, what we call connected physical systems, So the ships in the Australian Navy, obviously you have normal comms and, data coming in for a wide range of other reasons, what I would call maybe like enterprise level, Communication, email, administrative stuff, but on a ship where you have weapons systems and you have, propulsion, control systems driving those ships that's probably where you saw. The industrial control piece, like a plant floor manufacturing environment, right? so this is the challenge, And in our industry is, we have, witnessed. I'd like to hear your, take on it as you started connecting those dots between cybersecurity from the traditional enterprise business system. Components that we've been at for 20 plus years. And all of a sudden you see this shift. It's like, need to be concerned about these connected physical systems.

[00:06:23] Dino: that rely on data to drive them, and how do we secure and protect that, right? And to me, that's the challenge, And, the ownership of those assets is different than, what IT would normally be responsible in controlling. So what kind of challenges are you seeing, for TX1 in bridging that divide between these very different groups,

[00:06:45] Dan: Yeah. Ownership. that's, so core to the problem space as it exists in all of it really, it all comes down to ownership in both understanding who is the owner, but also making sure that they're at the table when decisions are being made. so you can't have. A different group making a whole bunch of different decisions.

[00:07:03] Dan: So let's say let's throw an example out there. Say have the I. T. Security team. They suddenly have a mandate to. Put cyber security in the OT environment, in this new, production environment. So they make all the decisions themselves, uh, they don't consult, get any input from. They blow into the manufacturing floor and say, Here we go, we got to go and deploy all of this stuff just to be rebuffed and told, Take a hike because you didn't consider anything that we need to manage here.

[00:07:30] Dan: Priorities were different, the objectives were different. I've seen it happen a lot of times.

[00:07:35] Dino: Right, process and production and safety, safety is job one, right on the plant floor. So sometimes it kind of missed that they can be, and their practices and the technologies, quite frankly, that they use are very disruptive in an industrial environment, you

[00:07:50] Dan: Yeah, that's absolutely the case. a while back as I was thinking about this problem, a good analogy struck me on, how to describe in a lot of cases, and it's not being done in malicious way. It's, kind of just how we go about, Approaching problems. if we consider it security, so it has its approach to doing I see it security things, right?

[00:08:12] Dan: So inside the data center inside the on premise corporate environment kind of know how to do that. Yeah, there's changes and developments. For the most part, there's a pretty well defined approach to take. Then along came cloud computing and now the IT security teams were responsible for securing these cloud environments.

[00:08:29] Dan: So they were the Wild West initially, and then bad things started happening. And now requirements existed that they had to be secured. So the IT security teams were able, for the most part, to take their knowledge and their approach, their experience and apply it to the new domain of cloud security. And how do we approach this to provide the security for it?

[00:08:50] Dan: Microsoft Mechanics Of course, there were changes that have been required and new technologies that come out, all of that kind of jazz. But for the most part, that skill set, that experience could transfer. So now enter the space is OT security and the same things trying to be done where it's okay. Well, this works for IT, but also works for cloud.

[00:09:11] Dan: As I now approach this new security problem, I'm going to take same mindset, the things that I know, the approaches that I know, and apply them into this new domain. The issue is that without understanding the restrictions and limitations, you don't realize until it's too late or hopefully someone stops you that, as you mentioned, What you do is going to be very disruptive.

[00:09:34] Dan: You can't take a stop things and then fix it later. If it goes wrong, you have to adapt any approach that you take to identify priorities and respect the priorities of that operation. So it is a it's a mindset change that's needed for a lot of teams to say, okay, I have this wide domain knowledge.

[00:09:58] Dan: But it may not be directly applicable, and I should wait, I should work closely with these other teams. Collaboration is so important to understand why and then go forward.

[00:10:11] Dino: yeah, I like the cloud analogy because even the client that was wanting to leverage the cloud still had to rely on multiple external. Resources to help them, right? The cloud vendor, the security that that vendor is using and or third parties and the technologies that you're deploying and buying, whether it be Palo Alto or Cisco or Juniper or CrowdStrike, what have you, it was a culmination of organizations to help with that, right?

[00:10:41] Dino: It wasn't just the client, pick company A to Who wants to leverage the cloud and say, I got this all figured out. I'm going to start leveraging cloud. they had to rely on those third parties to help them. And I see that as a little bit of a gap on the OT side. Because there's not a, I hate the term here, who's, truth is actually real.

[00:11:01] Dino: In this discussion. And how do you make that happen with. OEMs, SIs, plant operations teams, engineering teams, IT, InfoSec network, plant management, risk, all these different groups that you got to bring to the table to tackle this area that we're concerned about, which is that industrial control system environment.

[00:11:21] Dino: So, the cloud, that's a good one, right? So whatever playbook you had to use then to bring all these people to the table, you have to do the same thing. Again, if you really wanna get after your plant floor cybersecurity's, posture and strategy.

[00:11:35] Dan: Absolutely, and this is definitely even more broadly than this for OT security in general. I think by identifying that, that, hold on, maybe we have a playbook that we can reference here, how we went to cloud, how can we use that, but even just OT security versus I think we can learn as an industry, we can learn from the mistakes.

[00:11:56] Dan: Boy, were there some missteps in IT security, some things that didn't go well, some approaches that security organizations took that just really rubbed everyone the wrong way. Essentially the and, I hate when I read it, when I see it, that it's always the user's fault or the user's always wrong, or the user knows nothing or it's a user error.

[00:12:16] Dan: Well, it's because you never told them what to do in the first place, and then you yelled at 'em when they didn't do it

[00:12:21] Dino: You know, we see that a lot and it's the finger pointing game, right between IT and OT and OTs. it's got a little bad taste in their mouth because they've had disruption, they've had shut. Downs, not really sure what happened. It's claiming they didn't do anything. It wasn't on their end.

[00:12:35] Dino: Nobody knows what really happened or they do find out what happened. And it was it scanning the network at the wrong time, trying to do their due diligence, but not realizing that they were going to be very disruptive in their activities. So, because I will tell you as Long term, manufacturing guy and, working for a group the size of design group, the Barry Wendler teams, we got hundreds, hundreds of clients, do tens of millions, hundreds of millions of dollars worth of business every year.

[00:13:03] Dino: And I will tell you right now, nobody calls us up and says, Hey, we need to tell this project that you're working with us on. We need to sit down and have an OT cybersecurity strategy planning session. Think about that for a second, right? Never once has CIO or the engineering team came to us on a 25 million project, which we're doing for them, or even a new plant build out, 200 million plant build out.

[00:13:30] Dino: And nobody's sitting down to us and going, Hey, we need all these machines, all these systems, all these networks that you're bringing into this manufacturing environment and sat down and said, we need to talk about our cybersecurity plan. And

[00:13:42] Dino: that's, that's great. That's 2025. I know we're just into the start of the year with multiple meetings every week, planning, and nobody is coming to the table.

[00:13:53] Dino: Whereas I got a CISO or CIO pinging me up going on. I need for you to help me figure out how we're going to secure that plant floor.

[00:14:01] Dan: Yes, so it makes me, well, I wonder with that because absolutely agree that it should be, it should be strategic thinking and strategic thinking aligned with the life cycle of the actual plant is being installed at the different systems machinery is being installed. It needs to be aligned with the much longer life cycle of that.

[00:14:20] Dan: But I wonder, is that in part caused by it. Well, the IT security team, the CISO, the leadership of the security org, they're stuck fighting fires in their IT security. They still can't get ahead of that, let alone look at the strategic view of a new system that, in a lot of cases, the teams aren't working well together.

[00:14:39] Dan: So it just seems like, well, there's every reason not to do this. There's every excuse pops up as a reason why I didn't get to it today, and it ends up just slipping. And then they're stuck with a cleanup or come try to patch it later. Which ends up costing 10 times more affecting, the actual production, the security, the overall posture, the risk, all of that comes from ignoring the problem because when it comes back down to.

[00:15:03] Dan: The ownership and that collaboration between those teams

[00:15:07] Dino: Well, yeah, and also, companies like ours are competing, to, for this project, you know, to put a new packaging system in. And so they're cutting costs wherever they think they can in order to win that opportunity. And so if they can cut out, 100, 000 in OT cybersecurity licensing costs or, putting in a standardized and switching, Platform that can help move that metadata to the platforms that needs to get to their cutting costs to try to win the deal, And the client's not putting any, requirements on them and say, you will put cyber security X product in that panel. You will put cyber security, of this stripe on these, SCADA systems that you're building and designing for us. Those conversations don't be had. In fact, what we'll find in a lot of cases is, to your point, IT, in a virtual environment where you might have a hundred HMIs running on VMs versus standalone bare metal boxes out on that plant floor.

[00:16:04] Dino: IT will come in behind that project at some point and they'll install something uh, CrowdStrike. In that environment, not recognizing when AV and scanning fires off in that environment that all of a sudden now my HMI that's running my filler 2, 000 bottles a minute is quick communicating and the PLC doesn't see comms it'll comm fault or go safe and my filler stops working.

[00:16:28] Dino: And none of that stuff is being tracked. OT can't see the fact that that scan fired off, and nobody's sitting there going, have delayed communications between my PLCs my motor control centers, and those machines confaulted because there was no timely communications, or because there wasn't timely communications, they went safe. just like an AGV. An AGV, if it loses communications with the network, it'll quit running for safety reasons, And so, that's where you have that disconnect between IT and OT, where IT just said, hey, I'm putting requirement is EDR on these virtual machines. Why didn't you work with OEM that designed and built that before you did that to see what your disruption looks like when you fire off tools at whatever interval you fire them off at,

[00:17:16] Dan: so definitely see that building specialized O. T. tools. We only build the security products that takes one for industrial systems that are. Not well designed for IT environments. That is one of the biggest things that comes up in the actual product design parts is how do we make these technologies such that they don't impact normal operations of the products and the way that we look at it is so there might be a cyber security threat that exists.

[00:17:44] Dan: you have Perhaps a controller, a tool that you're putting in to try and mitigate that, to try and stop that from happening. At the same time, there is another class, if you will, of threats, the operational threats. Things that will stop that operation from running the way that it's expected to.

[00:18:02] Dan: At the end of the day, and certainly from the operations perspective, it doesn't matter which category it's in. If either of those things happen, and the operation is no longer running the way that it's expected to, That is a problem. That needs to be stopped. If a security tool, as you say, that ITADR tool causes some kind of interruption, some kind of outage from it going about its normal business trying to protect against a security threat, in reality, it turns out that security tool was actually an operational threat.

[00:18:31] Dan: It was a threat in and of itself. And, and calls those out. Right. And, that's a great point. the question is, is, and when you call those out, 'cause we see that right? Because of the, type of work that we do for the clients that we have that, that have gone down this path where we've moved into the OT cybersecurity range, having to negotiate with the InfoSec team, security team, networking team on what they're doing that's impactful to the plant floor.

[00:18:56] Dino: Because now we can see it, you know, we get these intrusion detection systems that were built for OT and they track and audit and log and show anomalies and different behaviors, good, bad, and indifferent in that environment. And then we're going back to, the IT team going, you need to take these machines.

[00:19:13] Dino: out of your list for you scanning them. If there's information you need out of this environment, tell us what it is that you need and we can get that to you. We can feed, integrations up to your CrowdStrike, up to your intrusion prevention systems, up to your SOC, up to your SIEM, so you can get relevant key data off the plant floor without tripping it up and knocking it down.

[00:19:34] Dan: right. so, I mean, extending that further, it's also a case of, is that same amount of information actually required? So, if we think about the difference between IT world and your OT floor, difference between those environments has been described by everyone in every which way. But in the most simple terms for this explanation, it's Deterministic the production environment is very deterministic.

[00:19:59] Dan: It's it. We know more about what it's going to do what it should be doing. It's much more unlikely that saying unexpected will have to be done. It's not your workstation where one day you work in an Excel. And the next second you need to open up your email client, or you need to then go listen to something on Spotify, listen to your latest podcast on Spotify, it's not happening on these kinds of machines.

[00:20:21] Dan: So we have more information about them, which means they can be locked down more. So they can be restricted more in what they're doing, https: otter. ai application, allow listing and whatnot that tried to work in it. It never worked. It never took off and everyone kind of went away from it because it was too hard to do effectively in dynamic worlds.

[00:20:38] Dan: Well, that works pretty well in a very deterministic environment. And with that. You need to track a lot less information because you don't need to try and identify if a threat is occurring if there is actually an attack happening right now from a thousand different signals about all the possible things that could be happening because most of those you just stop them before they started anyway you just need to monitor the individual processes the things that you expect and are they working the way you expect so it's a different approach to security as a whole.

[00:21:11] Dino: Yeah, And to your point, understanding that process, who's best suited to determine how that process should work, for that machine to operate, it's not going to be IT, you know, unless they really want to learn the process, this is where the CSOs and the CIOs, getting past their, what I call the line of demarcation.

[00:21:29] Dino: what we typically witness in 98 percent of the clients that we work with is IT stops at what we call the IDF, That's the last distribution switch under IT's domain and control that's within that plant before it drops off and starts connecting all these different machines that are down in the plant floor, per se.

[00:21:50] Dino: They stop pretty much at that switch. And then all of a sudden, now I've got a packaging line that's got five switches on it. And 10 HMIs and 20 PLCs that are all downstream connected in that environment. But that's not IT's domain of responsibility and control. It's stopped at that last switch they own.

[00:22:11] Dino: Anything after that, and so, key for the CISOs and the CIOs. How do you get past that? Because the guys that own that stuff down there, if they're not working with mature OT cybersecurity organizations that are aware, And I can say Design Group is one of them, Rockwell's another one, Siemens is another one, and they're partners.

[00:22:31] Dino: How do you change that relationship and that dynamic? Back to what I said earlier. Why are we being called the room? When it's when somebody wants to talk about cyber security manufacturing environment, when you think you bring in the people that have designed and built the machine centers that you have out there and the infrastructure in which they run on as part of the conversation.

[00:22:49] Dan: Absolutely. I mean, they should be, before anything's put to paper, it's all about meeting, opening that dialogue. And there's a lot of different ways look at that. So there's the obvious benefits, as you just described, of the technicals, of do we best achieve this. Another thing for CIOs and CISOs to consider, though, the eternal challenge of how do we prove to, the committees that we're spending money wisely, that we're actually having a positive effect on the organization.

[00:23:17] Dan: We're not just a cost center. The security isn't just a cost center. Well, the ability to do that inside of an operational environment, that data that you need to be able to provide that evidence has to be interpreted for you in almost every case because it's going to be in an even More foreign language than what it will be for some of these I.

[00:23:37] Dan: T. Systems. So if you've got that strong, close working relationship with operations colleagues, they're going to help you convince and show evidence and show the power and how your efforts and the efforts of security inside of the environment is providing you. Meaningful and material risk reduction is providing value, ensuring value.

[00:24:01] Dan: They'll help you describe that. So there's benefits beyond just the technical interlock across much more broadly in business. How do you describe value? How do you keep moving away from security being thought of as a cost center? Again, collaboration is key.

[00:24:17] Dino: Yeah, well, we use this term, you got to think globally you got to think that way, but you got to act locally because these manufacturing environments, even in the same under the same manufacturer, no 2 plants are the same. They're just not there. There are different areas of control systems.

[00:24:33] Dino: They might have different automation technologies, different processes. It even gets more difficult as you go across the globe. so if you're a global manufacturer, which we have running in the U. S. It isn't necessarily how EMEA works, or how Africa works, or how Asia works, right? And so you've got to act locally, because the people on site, the boots on the ground at that level, are the ones that are best suited with the information on how this plant operates, and what does it have in it.

[00:25:01] Dino: And what does it take to fix things, and to make the goods which they make, right? And understand what technologies Then placed in there, because we go into plants and even the local teams aren't really entirely sure how things are put together and how they should work from a technical standpoint. They don't know. They don't have the tools. They don't have the data and they don't have the expertise. Their job was just to make widgets all day every day. if they couldn't, Pinpoint a mechanical issues, motor that burned up or, gears that need to be replaced or belts or whatever, then they're not really sure why their, packaging system, but work, they just want to get it back up and running as quickly as they can.

[00:25:39] Dan: Absolute and that's what the business's objective is right it businesses objective isn't counting how many security instances did it have or did it not have it's how many widgets were made

[00:25:51] Dino: That's

[00:25:51] Dan: it doesn't matter the security part so that's measuring what matters it is so critically important there and I love that think globally act locally and that's certainly something the TX1 is working on with our TX1 SAGE1.

[00:26:05] Dan: governance platform that's being built out, is a very strong development happening there where it's attempting to provide that, that unified view. For that, that global visibility while still providing the local part. But this is and it's a very interesting marketing problem, actually, because if you think about to use the single pane of glass, which it's not looking to be that because that's not what's really needed.

[00:26:34] Dan: Because the individual sites, they still need to maintain their level of control. Sometimes they may just want that, and internally need that. Other times they may be regulated to have that. All the way down to individual devices being able to be overridden. So that ability to have that local control is essential in so many.

[00:26:56] Dan: Of these environments. So instead of just trying to abstract away and away and away from that and provide some centralized view happening countries over that that doesn't make the mark. It's looking at how can. We provide that global view in a way that makes sense. How can we surface that correct information?

[00:27:16] Dan: How can we help the governance and the policies be set in such a way that they can be effectively implemented within the confines, within the restrictions of the individual sites? Because as I said, they're all going to be different in how they're deployed, what's required of those deployments.

[00:27:33] Dan: But it's an interesting challenge and difficult to describe because it is and This is the IT versus IT, it is so different and we're used to how we've done this before, and it's a part of that, changing our approach, understanding what other ways can we approach this problem, that's one of the big things we're working on in 2025 is how can we help describe that to help folks understand that There are different ways and here's the reasons why.

[00:27:59] Dan: And why is that important to know that? How does approaching it in a different way or considering these different factors help you in your overall security posture at an organizational level? Because it's not just about the IT security or the IT risk profile, the OT risk profile, it's the organizational risk profile needs to be managed.

[00:28:19] Dan: How does it get effectively merged into that To allow us to not make the same mistakes of IT security as we begin OT security, as we continue OT security, how can we avoid those challenges of the past?

[00:28:32] Dino: Yeah, it's not part of its organization. I mean, because if you map out the organization between it and O. T. The first time and this is usually the case that they have the same manager is usually at the very top of the pyramid, usually at the CEO or president of the company, but before O. T. and I. T. have the same boss, that's not where you want to be. in this discussion, it might be right. There has to be a different way of doing this. And it can't also just be the CIO sitting there saying, I'm running the cybersecurity game plan for this organization and I'm doing anything about the plant floor because I use a line.

[00:29:06] Dino: It's kind of a little bit of poking the bear. It's when I'm talking to asking a CIO a question, it's like, are you executing the same amount of due diligence to secure, protect your industrial control system environment as you do the enterprise, and you should see the looks that you get when you say that to them, because I know the answer, because I'm already doing work for you in the plant.

[00:29:24] Dino: I know based on the tools you're using, the resources you have, the budget that you, what you're doing versus what I'm seeing on the plant floor, they're not aligned. So I know you're not doing that. So is it your problem or not? Is it somebody else's problem to solve? And if it is, then let's get those folks in the room and let's start having that conversation.

[00:29:43] Dino: You can facilitate it. Again, can't be the quarterback necessarily, maybe. But that's the conversation that needs to be had at that sweet C suite boardroom level, in my view.

[00:29:54] Dan: Absolutely agree. Get the right people in the room. Distribute some of that control. You don't need that vice grip on it. if you, you're the decision maker, make decisions, but you're not an expert at everything, nobody is. Get those right advisors in the room to help you make your best decisions.

[00:30:12] Dino: cloud analogy when that started, right? You had to get the best folks in the room to help with that decision making. And we're not seeing that necessarily on this industrial side of things from a cybersecurity perspective. We're just not to the level of where I can say that over 50 percent of manufacturers are moving in that direction, maybe 10 percent, 15 percent, you know, are starting to play a different role and game in this, but 80 plus percent of them still out there in the wilderness wandering around.

[00:30:41] Dan: yeah, and I think vendors play a part in that in terms of a disservice to that in a lot of ways where, uh, so sure, risk absolutely exists in these OT environments. There are threats to them, but there's no need to hype it up at every opportunity. And this new wild piece of Malware, this new vulnerability that exists that can only be executed with this wild chain of things occurring, if that's what's coming up in conversations, if that's what's leading the, this is why you should do security, that's not helping because that's not the problem.

[00:31:16] Dan: The problem is things like the basic hygiene master the basics first, but that's not sexy. So by muddying the waters with all of these, or you have to do these, 10 super advanced higher level. security activities. Otherwise, your plants are about to shut down. It's often not the case. And all that does is you ask for too much budget.

[00:31:42] Dan: Your goals are too lofty in what you're trying to do. You're trying to solve problems that Others in the team and from the operation side may say, how could this even possibly be a problem and they're very experienced risk professionals in the O. T. Side right there. They're not new to this game.

[00:31:57] Dan: It's just a different context of the game by getting away from that message and looking at what the actual problems are that need to be solved. what are the things that we can do now to make meaningful action? That is, I think, a good starting point as an industry for us. Mhm. I'd love for us to be able to just reset that and move away from the hype and look at what are the basic things that if we mastered this, it would get rid of a lot of the problems and then we can grow and advance, avoid the problems of IT, IT security and it's decades long journey of trying to get it right.

[00:32:31] Dan: We can learn from that. They did the same thing. We can learn from that.

[00:32:35] Dino: you know, part of some of the strategies that we're pursuing is that if we have clients that are our clients that we're doing the typical traditional OT activity, building machines, networks for them, control systems, et cetera, and then you have an I. T.

[00:32:51] Dino: Consultant or partner that's working really well with client's I. T. Organization. And we're both in the same manufacturer is working together with those partners, to try to bring the two together, right? Get those type of relationships form where they're selling collaboration and data center and, software to find networks are bringing in new firewall technologies to them.

[00:33:15] Dino: and they're manufacturing X and we're out there putting in packaging lines and doing support and maintenance and maybe some brownfield work or some life cycle replacement and the same client X. How do we get together to help bring these guys together? Right? That's part of the initiatives.

[00:33:31] Dino: And not only that, the partners, like TX1, you're working with the IT side, there's got to be a, there has to be a counterpart on that OT side. Somebody driving this, that's part of it, And, resources are short on the OT side, no doubt about it. I mean, they're short on the IT side, Look at all the cybersecurity jobs that are out there that companies are trying to fulfill. plant floor is no different. we got a lot of people retiring. and a lot of experiences walking out the door. And for every two that are leaving, only one's coming in. And not everybody wants to work in an industrial environment.

[00:34:01] Dino: for the obvious reason, dirty, dangerous. Dark, whatever, plant floor is not for everybody. a challenge where you're going to have to rely on your partners. In this particular case to get going, if you think you can do it yourself internally, you're going to be at it for a long time

[00:34:15] Dan: Oh, yeah. Yeah. Use all the resources available. Avail yourself of all of those resources, because yeah, you're not, doing this alone yourself in your own organization. You're not. Trying to take on everything. You're working with other organizations, other suppliers, vendors and whatnot. This is no different.

[00:34:34] Dan: It's the same situation that exists and if you don't take advantage of all of that additional brain power, I guess you'll miss things and unnecessarily in a lot of cases when and this is definitely one thing that I've noticed about IOT security in general, there's a lot of eagerness to help, a lot of eagerness to share information and talk through the challenges and whatnot.

[00:34:59] Dan: The problem is that the conversations that start that aren't happening as much as they should. But once they open up, once that dialogue is there, that conversation, that communication can be really good and really powerful and a lot of learning takes place and we end up with way better results an outcome of that.

[00:35:16] Dino: Yeah, maybe you think of something. One of the points that you made is the modeling, the IT world, if you got 50 sites and you need to deploy new firewall upgrades or whatever. There's a pretty good model for IAT to go, okay, 50 sites. I know how many resources it's going to take. I know how long it's going to take and how much it's going to cost.

[00:35:36] Dino: I can get this done in a year and it's going to cost 3 million, And then I'm going to pay, 500, 000 a year maintenance and support from there forward. They've got a pretty good model. On the LT side, there's not a good model because the environments are so different to go, what's this going to cost me?

[00:35:52] Dino: Well, if I go back, if I show you the punch list of things that I need to have regarding that manufacturing facility and I got to trust and I got to verify what you're telling me, because sometimes what people tell me is not necessarily what I find on the plant floor. So then we have to go spend this discovery time in the field, going and actually looking at that stuff to come up with, well, this particular plant is going to cost you a million dollars.

[00:36:15] Dino: And this plant over here is going to cost you 500 and that one's going to cost you 3 million, right? There's not a good model. Because there's not a lot of data to be able to determine what's it going to take to do this, because we see that with clients today, when it goes up to the board, it's like, yeah, we got some problems.

[00:36:31] Dino: We need to fix some stuff. Holy crap. We got to deal with that. What's this going to cost? It's like, well, you got 125 plants around the world,

[00:36:40] Dan: Yeah, a few dollars. Yeah, maybe, start a swear jar or something like that to start collecting some budget. But I mean, yeah, that's, the power of a partner. that is the power of a partner. So, as an individual organization, yeah, you might build a few plants a decade kind of a thing.

[00:36:54] Dan: You're you're not building one each week. Like design group, how many have you built? How much more experience and the background, the learnings, the lessons learnt that happened on the client before that you can bring into this next one here to help the next client along.

[00:37:11] Dan: That is such invaluable information, invaluable experience. and yeah, having those partners available to you, an amazing resource and I definitely recommend. Organizations look for, their strongest partner for their particular industry for their region as well as you mentioned, they're all different to help them make their best decisions.

[00:37:33] Dino: Yeah, it's definitely a journey, right? It's not a marathon. It's not a sprint. It's a marathon. and there's a lot of mergers and acquisitions, which is how a lot of these plants have grown. So they don't even know what they have, you know, that's, you know, it's like, how do you go out there and you bought a brand new plant and you've got 30 windows 7 machines out there running critical processes on your plant floor.

[00:37:52] Dino: I asked the CIO, what would you do with a Windows 7 machine? He or she would say, I would get it off my network. In fact, I would rip it off my network. And it's like, well, it's going to cost you 30 million to get rid of those, couple of dozen Windows 7 machines you have in this plant that you just

[00:38:06] Dan: An expensive machine. Yep.

[00:38:09] Dino: Yeah,

[00:38:12] Dan: And, I mean, with that, and again, mergers and acquisitions is a good one for it. but even so getting started. taking that first step and actually we look at this a lot I've been doing a lot of work on this recently in TX1's messaging is a lot of these legacy systems exist, the fact that it's legacy, it's not even a great way to describe it. They exist and that's fine. If they're still doing their job and the only thing that's wrong with them is the security thing. Well, it probably may not be the best business decision. To actually replace that right now, maybe the cost of replacing is too much.

[00:38:45] Dan: That's the legacy system, that's a whole different discussion, but the part with it is unless you have a just built yesterday plant, there's going to be something in there that has some kind of a vulnerability to something, has some kind of exposure. Instead of taking the approach of, before we do anything, Let's map out a hundred percent of what we've got.

[00:39:07] Dan: Let's find out every asset that we have. Let's find out every vulnerability on every asset we have. And then we'll take some action. It's safe to take the, to make the assumption that if my environment wasn't built yesterday, wasn't built today, there will be some kind of a vulnerability. Then start putting those preventative blocks in where it is safe to do so.

[00:39:31] Dan: ITOT borders, at the edges for remote access and what not. Put in those things and have it a generalised policy, sure. But that is going to cut down that attack surface so much. And then, alongside that, Begin doing that scanning, finding out more about the assets so you can move from that general to the specialized, but the important part is you have to start taking action.

[00:39:57] Dan: You have to take that first step and you don't need to know your entire risk profile to do that. You can put in assumptions and put in some generalized controls. and get really positive effects from that and then move into the specialized protection. And whilst you're doing it, your overall risk will be much lower.

[00:40:18] Dino: it's a journey and You just got to start. pick a plan after 2 or 3 and you got to begin the process. So you can figure out what kind of people do I need? What kind of partners do I need? What kind of technologies do I need to be working with? begin the process and don't try to let it do it in a vacuum.

[00:40:35] Dino: Because if you let them do it in a vacuum, you will fail.

[00:40:38] Dan: yes,

[00:40:38] Dino: Straight up fail. there's no question about it, you're gonna struggle, and you're gonna give up, they're gonna walk away, and the plant's not any safer than they were than when you started.

[00:40:48] Dan: exactly. But you spent a whole bunch of, resources in the process. Yeah, a hundred percent.

[00:40:53] Dino: Well, Dan, it was nice to meet you. I'm sure our paths will cross, in person at some point, at some event.

[00:41:00] Dan: hope so. This has been great. I know, I really appreciate it. Thanks for having me on.

[00:41:04] Dino: Happy New Year.

[00:41:05] Dan: You too.