You Think Your Plant Is Secure. Your Data Says Otherwise.

Shellie [00:00:00] we've gotta have honest conversation about where we are and where the risks are, or we're never gonna get to where we need to be.

Shellie And we can't think about today. when we build technology, we're building for something that way out. we wanna build for the future.

Intro - Outro Welcome to the Industrial Cybersecurity Insider. In each episode, we dive into the world of industrial cybersecurity. Join us as we cover the latest trends, innovations, and practical insights as we talk with leaders and practitioners across. The industry gear up, and let's get into this week's episode.

Craig Hi, I'm Craig Duckworth, and today I have the distinguished honor of presenting Shelly DeAngelo, who has an immense amount of wealth in [00:01:00] the IT space. Shelly, why don't you introduce yourself. Give us a little bit of background about what you've done and kind of kick us off.

Shellie Thank you for having me, Craig. I appreciate it.

Shellie I'm Shelly D'Angelo and I'm a CIO and Chief Enterprise Architect, and I've spent the last 15 plus years working in manufacturing and distribution. Companies across the gamut, aerospace and defense life, all the life sciences, tier one, automotive, just doing what most executives only wanna really do once, which is building and rebuilding the entire technology foundation of an enterprise from the ground up.

Shellie So I say my job is to come in and. Turn our chaos into cash. And that's it in a nutshell.

Craig Perfect. No, fantastic. and a lot of our listeners are in that same spot. They may be C-I-O-C-I-S-O, VP of IT that understand from a very high level and can. Provide that guidance, but not so much down in the bits and the [00:02:00] bites on the facility floor.

Craig So I think your perspective is gonna speak to a lot of our listeners. So I appreciate your time today and look forward to the conversation.

Shellie Thank you.

Craig So let's just kick it off and jump right in. So as you look at this emerging OT, IT convergence space. What would you say is probably one of the leading things that organizations need to consider as they are building, foundational, moving data from the plant into the enterprise to make a decision whether that be governs, that'd be a risk decision.

Craig how would you advise someone to make sure that they're doing this appropriately?

Shellie I think we have to first understand, our business and our data and, all of our assets because first for me, data governance is critical. It is what [00:03:00] helps drive and works in a symbiotic relationship with security, both information security and cybersecurity.

Shellie So when we are bringing data in, we need to understand what data we're bringing in, what are the drivers for our business that are gonna turn, an ROI, what's really making a difference. So it's understanding, what our business needs are, the key components and. Then understanding the differences in between those systems because how we store data and operational technologies.

Shellie So when we talk about that, like PLCs, HMI, SCADA systems, how we store, and what data we store and those types systems versus what we store. And, the ERPs, the, CRMs, HRAS, manufacturing execution systems, how we store data there and what we store is very different. So I think it's understanding and pulling this data into some centralized location, whatever, data lake, data warehouse, whatever [00:04:00] it may be, but understanding, pulling that the right data in and understanding what we need to report on.

Shellie But I think. Critically, we have to understand how the data's stored and just making sure that there's governance around it. For me, that's the most important thing because that's where I think things are lacking,in a big way. And that governance has a direct impact on how we report data, which means it's gonna impact financially the decisions that get made.

Craig I would agree with that. I, from a, an accounting background, I always hear garbage in, garbage out. So again, if the data is not accurate, either, whether that is you're leveraging AI to help train a model to make a better decision, or you're using AI for, efficiencies, again, if you're making the wrong decision based on the wrong data, that implication is huge.

Craig so it's. Both [00:05:00] sides of that, and we're seeing where I would say that we in the field are seeing most of these decisions driven from the top down. Are you seeing the same thing? What's your kind of, what's your thought on that?

Shellie I definitely think it comes top down, and I don't say that to be disrespectful because I have the uts respect for our entire C-Suite, but I think.

Shellie What happens at the end of the day, everybody's looking at revenue and how much, we can make and how quickly we can turn and the, it's, we've gotta change the mind shift. It is all about, or at least in my opinion, it's been about tools. What tools we're spending all these tools, but it's not working and that's the problem.

Shellie We're looking at it from a tools perspective and we have to get away from that. We've gotta look. Understand our business first, what our goals are as a business. And I'm not just talking about, hey, we're at 600 million today, we wanna be at [00:06:00] 1.2 tomorrow, in two years or whatever it is, or that we've gotta grow 30% year over year.

Shellie It's understanding who we are as a business, sets us apart from others. what we feel we can do to. Set ourselves apart, understanding the data that's most critical for us to protect and not just, and I would say more importantly, not looking at it from a compliance standpoint, but looking at it from a business standpoint, knowing what impact it's gonna have.

Shellie So all that understanding. Okay. Knowing that. If this data leaks out, it could cause a huge issue. who are my most, 10 most important customers that are my needle mover. That if I lose any one of them, it's going to, possibly cost. this company, its entire reputation. So once you've kind of figured those [00:07:00] things out, it's then looking at our assets, the assets that we have today, physical assets, intellectual assets, understanding, kind of what's under the hood today.

Shellie So before you go out and buy the first tool, understand what we have today and what we have to fix. because I have yet to go into any environment and see any environment that, you know has a strong grasp. On data governance and in comparison, security, cybersecurity. And has those, has all those things lined up.

Craig Yeah, no, you definitely touched on something that I think is important and most of our listeners will resonate with is, you got foundationally, you have to know what you have. There has to be visibility into that environment. You can't base it off of a 10-year-old spreadsheet that John, who worked here for 30 years, that retired last year, put together for everyone.

Craig what is a, what is a. True, accurate inventory. [00:08:00] What are those assets communicating with? What's the business impact of each of those asset or sales or zones or whatever that looks like, and how do you begin securing and protecting those different conduits within the organization? And then as that data reports up to a risk governance compliance.

Craig Committee or individual or however the structure is. Again, following that data is important, but you have to trust the data and it starts with, what do I have? You can't, all of that other stuff is irrelevant if you don't know what you have and how it works.

Shellie Correct. And I think it's, and it's governing the data and even down into what I'm gonna call data quality and data structure, because.

Shellie we all under, I say in, in the world of technology, we understand what we have to do to get data and pull data, from our tools, whether you're [00:09:00] running a SQL environment or whatever you're doing to pull the data out. But if you are storing data and you've got data structured in a system such that based on.

Shellie If we've used best practices and standard, kind of TOGAF principles, this is how it should be stored, A, B, and C. But if you're not consistent in how you put that data in, so, I hate to say it, but it's as simple as, data entry. And I think it's communicating amongst the teams.

Shellie I, and I think this is where it becomes very. A very important support mechanism to other teams, whether it be customer service and sales, or supply chain and logistics, regardless to understand you own this data that gets put in, but this is how, from a governance perspective, it needs to get [00:10:00] entered consistently every single time.

Shellie Because when data. Is not, when you have, when you've got bad quality of data or data not being entered in, then that too affects your reporting. So you're gonna end up either not getting data pulled that needs to get pulled, or you're gonna get things if the quality of the data entered has not been entered correctly.

Shellie So all these things, I think, impact what we're doing.

Craig yeah, and I would agree with that a hundred percent. it really has an effect if it's not structured and set up accurately. So as you look at from, just from a very high level, from board down through CEO and the C-level executives from a organization holistically, how would you say.

Craig The decision making process, if we wanna call it that has been so far, are [00:11:00] do you think that overall they're on the right path? Do you think that as we look at the way that. The processes have been in the past versus where we need to get to, to be at that next stage. are we 10% there? Are we 98% there, or have we even opened the door to walk in the room yet?

Shellie I think it's somewhere in between 10. And the last one you said, if you want my honest opinion.

Craig Yeah. no. And I think that the listeners want, that's, we wanna know where you're at.

Shellie I mean, I think that's the honest truth because what we think versus the reality is vastly different. It's different from the North Pole to the South Pole.

Shellie And I think it one, while we would like to think. That in much more highly regulated environments, things are exponentially better. I think the reality is, unfortunately that's just not the [00:12:00] case. It they are better, but there is still, there's still lacking. And I think there is just this, I think there's a fear there too with communicating openly and being transparent with CEOs.

Shellie they don't wanna communicate to the CEO and then if they do, the CEO doesn't wanna tell the board. There's like this fear there, but the problem is that's what's gotta stop. We've gotta, we've gotta have honest conversation about where we are and where the risks are, or we're never gonna get to where we need to be.

Shellie And the thing is you can't think, and you and I know this, we can't think about today. We're, when we build technology, we're building for something that way out. we wanna build for the future. And so before you can add on the wonderful tools that we've, we've been using, I know I've been using, artificial intelligence, robotic process automation, and MLS for, machine language for more than 20 [00:13:00] years.

Shellie I will say, I'm gonna call it hype around it, that's come out now and everybody wanting to use it. it's, for me, I see it kind of like. if you wanna relate it to other things in technology, think about when everything we used to do was on-prem. We had our own server rooms, or we had our own data centers on-prem and then, came offset data centers in cloud and it was the big hype, it was a big thing as if it was something so different.

Shellie And all it is it's still servers at the end of the day. It's not, it's just that we're, it's like renting space. I kind of, and I say if you wanna have it more simply think about it like. We used to have cars that, everything was on gas. And then, I don't know if you remember, we had this whole water for gas concept.

Shellie I know it just 'cause my father was an engineer and that you could build helix coals and, run a car, so they could use, more hydrogen water than did gas. And then, we moved into. Electric cars, and now we're continuing to grow on that. So if you [00:14:00] look at all the changes, there's always a big hype when things first come out.

Shellie But it's this technology that's come out it, a lot of it, it's not that it just came out, it's been out, it's just how it's being used. And so that's, I guess what I would say about ai. it's a great tool, but you can't just put it in. You have to look at the very foundation. And for me, I would say where that plays a far more key role is because not even taken into a, account quantum, computing.

Shellie If you look at AI today, just with the computing that we do today. Look at how fast from having just basic systems, automation or basic system processes that we used to, have to now trying to put in ai, you can see how quickly it scales and how quickly it can [00:15:00] scale bad data.

Craig Well, I would say not only bad data, but I look at AI and for all of the advancements and we do work with. Various hyperscalers, so we see firsthand as this. AI infrastructure is being built out, that are supporting open AI and clawed and all of the models that are there for all of us to use. I look at it from the opposite side of that.

Craig How quickly is AI supporting the bad actors to infiltrate into the environments that we, on the other hand, are trying to use AI to help us protect? So it's a double-edged sword and. I would say organizations should be optimistically cautious in how they implement it to make sure they're doing it correctly with the right governance and boundaries around it.

Craig One for garbage in garbage out [00:16:00] scenario. Do we have the right data making the decision. And two, how are we making sure that what we have isn't being used against us by someone that's trying to get into my environment? 'cause again, if the nefarious actors recognize all my protections are AI driven, well, I'm just gonna turn the model upside down.

Craig And now AI knows how to get into AI to get into your network. So it's a vicious little circle.

Shellie It is, it's a very vicious circle, and that's where I would say yes, you have, all of your information, security and cybersecurity, all those things come into play. So I am, information access management, privileged access management, and privileged information management, all those things come into place, policy as code, having CDNs doing all the things that you can.

Shellie But at the end of the day, I think. What could help, I'm not gonna say by end, it's an end all, be all is, making sure we have as much closed loop as possible. I think that's gonna be a critical player, [00:17:00] unfortunately, because of the fact that we are going to quantum computing. So much of encryption, as we know.

Shellie This whole true end of end-to-end encryption is not a hundred percent. I mean, there's certain bodies, government bodies that see everything and and I'm not saying that some of that's not necessary because we try to protect ourselves as a country, but, we've gotta find ways to do as much as we can today and as quickly as we can to protect before we start bringing in other tools to help automate things.

Shellie Then start gauging how we're going to do these things, in the next six months when quantum e even when the quantum, encryption comes out, especially as it regards things like artificial intelligence and all of our security practices.

Craig So let's shift focus just a little bit. If we were look at [00:18:00] organizational structure and trying to.

Craig For organizations that are beginning the journey. we got all the way on the far left of, holy crap, I don't know what I have, I gotta figure out my visibility to all the way on the far right of, I have a mature, rich organizational structure with governance, risk compliance, all the way down to tools, technologies, and people to manage all that from.

Craig 99 to zero. Basically, as organizations look at themselves internally and they're, let's say, a little farther left than they need to be, how do they begin the process, would you say? Let's look at a tool. To start giving you visibility, or would you say, let's start on the other end and you need to have a risk governance, compliance structure foundation that will govern all of those tools, technologies so that you understand the long journey [00:19:00] versus putting in something for a quick fix result.

Craig How kind of, how would that look for organizations that are trying to figure it out?

Shellie I think first. For me always is looking at what's underneath the roof, I mean, underneath the hood. So to, I think you have to understand that because if you don't even have a very solid understanding of what's in your environment, then for me all another tool does is bringing in risk.

Shellie So for me to take an appropriate governance risk, compliance view, you've gotta first spend time to understand what you truly have. Now that being said, certain environments are different than others. What I will say in the world of manufacturing, even sometimes those that are mature and have done a lot of work to assess that, and I would [00:20:00] say.

Shellie have a, I'm not gonna say perfect, but a good idea of what's underneath the hood. I think sometimes, there can be a combination of tools that are put in place that, when I say tools, things that we use in it to kind of scan our environment, to let us know what's truly in the environment.

Shellie Because there can be things that are in our environment that. Like, and the simplest way I can say it is shadow itt, but things that are unapproved,

Craig we see that all the time on the plant floor because at the end of the day, the manufacturing sites are tasked with get the job done, and sometimes the mentality is security gets in the way of production.

Craig So we will run into those shadow it. Environments because it's, how do I do this? And it flows back to that governance and [00:21:00] that risk and the organizational's philosophy and values of is it important or do I have someone at the top checking a box trying to fix the problem?

Shellie Well, I mean, for me, when you're using Shadow IT software that.

Shellie You've managed to connect up to your environment, but hasn't been vetted, hasn't been secured. One, you've just opened the door to the, for me, to the worldwide web. You've opened it up for everybody, so you might as well just go disconnect your firewalls. I mean, and I hate to be so countless sounding. Maybe that's the unfortunate reality of what we're doing and.

Shellie we need operational technology, but that's also very, a lot of that is very rudimentary technology, compared to some of the others. So securing that [00:22:00] technology behind door, behind closed doors is. Absolutely critical. And a lot of times we don't realize that because we, in manufacturing, PLCs are necessary.

Shellie HMI, SCADAs and even cameras. I mean, I've come from environments where we use cam. we use cameras on a production floor and you're training using artificial intelligence, those cameras to look at things to help, with your quality process so that you can produce faster. And all of those things are wonderful things.

Shellie But that's where understanding the environment and understanding how those types of equipment work at in their most simplistic form, because they are easy, they're easy prey for, bad actors.

Craig Yeah. So as you look at that foundational, let's call it that area, are there certain signs or certain things that.

Craig An organization could [00:23:00] say, aha, maybe this isn't working the way it should. Cracks in the foundation where somebody could say, maybe this is going awry.

Shellie I think if you have the right people, and I'm gonna say this and getting more to the human aspect of things, because a lot of people, will say, well, I've got a team of people.

Shellie I've got 200 people, and it's not about. The number of pe. I mean, certainly there's a balance in between number, but for me, I could run off, I could run a much leaner team if I have, I mean a far leaner team. But it's having the right team. You've got to have, absolutely gotta have the right people. And I think that's one where things are suffering today, because I think companies look a lot.

Shellie They're trying to make something match a checkbox. Well, do they have these things as if that fancy, the [00:24:00] fancy paper is gonna make, when most of that, whether it's education or certifications, is all theory based and there's, very little, two or three years of experience.

Shellie There's no real experience. That's where I say having the right people, seasoned people who have been doing this for so long who have seen, Who have seen situations, so many situations and can think out of the box and know how to act, when they see something. I think if you have the right people, those people will start seeing patterns.

Shellie There's always a pattern and. maybe you don't see it in the first 10 days or 15 days, but within, 30, 60, 90 days, if you really start looking at things, you will see a pattern. And I think if we focus on looking at the patterns in relationships between things, that we will have a whole different level of understanding.

Craig Yeah, I would say you're a hundred percent correct and especially from, back to [00:25:00] your, have the right team and we see this on a, I wouldn't say a daily basis, but we see this more so than not organizations that are trying to. Understand this on the plant there isn't that right team that's readily available.

Craig The skill sets are not always there. The resources are not always there. You can't find somebody that's got 30 years of OT security experience because it's not been around 30 years. Let's just, and it's funny 'cause you see a resume or a job posting. 10 year experience in OT cybersecurity. I'm like, good luck with that.

Craig But I, so I understand that piece of it. But as, as we try and always tell clients, pick a partner that you're comfortable with, a partner that you've worked with in the past that has the skillset you're looking for. There's no reason to go down this road by yourself. [00:26:00] We don't need to reinvent the wheel.

Craig The wheel's already there. We got four of 'em on the car. let's use what we have and let's make this simple and truly reach out to peers or reach out to someone that's in a non-competitive. Environment and say, Hey, how are you addressing this? How are you handling that? And try and lean on the industry that's here to help support you as you go down the road.

Craig it's not rocket science.

Shellie It's true. It's, that's true. I mean, and the thing is we've gotta do this now. I mean, there's no more time if businesses. Want to stop the bleeding and you wanna stop tech debt, then you've gotta understand technology can't be your afterthought. That has to be the leader of your business.

Shellie And so therefore, you've gotta understand what all that means, and it can't be siloed out. It is everything together. [00:27:00] You know your business applications, operational technology, you know your infrastructure, it's everything and it's cybersecurity, information security, data governance, and most importantly, people, it's having the right, not only team of people in it, but it understanding that it is your business partner.

Shellie We have to work with all other teams to understand their needs and you know how we can better serve them.

Craig that's been part of, let's call it the struggle in this it OT convergence is the frameworks that it uses and some somewhat of their approach is different than that of the ot.

Craig Mainly because I believe there's not an alignment from reporting structure within the organization. I report to it who's. Responsibility and first priority is data security. You report to ot, your first [00:28:00] responsibility is operations and production. They're contradictory to each other. I can't, and so there's been that battle.

Craig How do we frame them both in a way that the. That somebody steps back and says, okay, we're on the same team. We both work for the same organization. My goals and your goals are different, but together they are the same. How do we get that true interaction and achieve the holistic overall approach of governance risk?

Craig Compliance while getting the outcome that the business unit needs and the security that the it CSO need for the organization. That's where we've gotta get to.

Shellie It is, but I think we, it's our, I think, our job is to help people understand, a lot of people think, well it is not [00:29:00] really,bringing in money, but that's not true.

Shellie We actually do turn ROI and we help each. Through scale and through security and all the things that we provide. So I think our job is to get in and help people understand how doing these things will have a financial business outcome, and how doing it the right way will turn an ROI and will continue, to help us meet our ROI goals or exceed them.

Craig great conversation, Shelley. One. One final thought as we kind of wrap this up. If you could give some advice to listeners out there that are. In this journey, no matter kind of where they are in their space, have they just starting or they're kind of going through? If you could say, Hey, here's a nugget that you should really think about that might help you on this journey, what advice do you think would be valuable to the [00:30:00] listeners?

Craig What would you say that they should really kind of focus on maybe.

Shellie So I'll give you a kind of something I say, but I'm gonna tell you, I know at the beginning I told you and I was being kind of funny, but there's small seriousness to it. When I say turning chaos into cash, at the end of the day, the business has to make money.

Craig Yeah, abs, that's the goal that their value to the shareholders is a hundred percent, number one, whether it's public, private, they, if they don't make money, they're not in business. So, yeah,

Shellie absolutely. So at the end of the day, they have to make money, and if they're not making money, we don't have jobs, right?

Shellie So we care about, at least even our investment, being able to be secure in our job and have a job and put a roof over our head. So if we care about that. Then you need to care about, both the upstream and downstream impact that you have on that business and what you can do, not just in your typical day-to-day, but what can I do in the bigger scheme to help [00:31:00] with this?

Shellie 'cause it's, we've gotta stop this. While it's not my job, it's all of our jobs to do this and see this. So I would say. Think about, governance and speed. when governance is working well, it does not slow the business down. So that's what we have to understand. So we've gotta be able to do things that give leadership, confidence to move faster,to know that they are protected and that they can make decisions without second guessing the foundation and the data that they've been given.

Shellie So, that's. That's just my very humble advice, just thinking about things on a bigger perspective.

Craig No, I, it's great advice and it goes back to the one thing that you touched on earlier of, as organization, how do I correctly and accurately communicate the real risk up? Can't be afraid to tell the CEO what the true evaluation is.

Craig You can't be afraid as a CEO to tell the board what's our true position if, 'cause when that [00:32:00] happens, it leads to that false sense of security, which is a worse position than saying, look, our baby's ugly, let's fix it. you can't put lipstick on a pig and it's still not a pig. So you gotta be honest and move things in the right direction.

Craig So. Great conversation. Thank you very much for your wisdom. Hopefully the listeners got value out of this, so

Shellie thank you for having me. I greatly appreciate it. It's been great.

Craig You're welcome.

Intro - Outro Thanks for tuning in to the Industrial Cybersecurity Insider. To stay up to date with our latest episodes, be sure to click the follow or subscribe button now, and if you found this podcast helpful or have a topic you'd like us to discuss, please leave us a review or let us know.

Intro - Outro Thanks again for listening. See you next [00:33:00] time.