Your Most Critical Network May Be Your Least Protected

[00:00:00] Kevin: These attackers are not going out for ransomware anymore. They're going out to take businesses out. They're going out for espionage. And if they can get this data from these environments, they can now take it to a competitor and say, "Hey, your competitor's doing this. I could take their systems down for two weeks, a month, and give you an advantage right now.

[00:00:20] Intro - Outro: Welcome to the Industrial Cybersecurity Insider. In each episode, we dive into the world of industrial cybersecurity. Join us as we cover the latest trends, innovations, and practical insights as we talk with leaders and practitioners across the industry. Gear up and let's get into this week's episode.

[00:00:51] Dino: Hi, I'm Dino Busalacchi, and today I have with me Kevin Kumpf from CAASM. Welcome, Kevin.

[00:00:57] Kevin: Pleasure to be here, Dino.

[00:00:58] Dino: I see you got your uniform on.

[00:01:00] Kevin: not the vest, but the orange shirt and the hat, because,I understand OT just like you do, and, it resonates.

[00:01:07] Dino: Yeah. So what do we want to talk about today?

[00:01:10] Dino: we've- we've seen, w- we've seen what's been going on in the market just recently, as far as some of these attacks that are going on. They, they seem to become, becoming faster and, and, and more at a regular pace, damaging, high profile. but yet we s- we still don't see... It's again, going back to the industrial side, which is where we're seeing this stuff, we're not really seeing a lot of movement, in my view, on securing and protecting critical assets.

[00:01:38] Dino: And whether it be critical infrastructure, manufacturing, supermarket chains that have refrigeration systems.

[00:01:46] Kevin: Yeah, w- we're not, and that is because I think, when we look at the five pillars, and we're talking to some, mutual clients right now that are saying, "I need to go out, and I need to segment my network 'cause I'm worried about a prior attack that's just recently happened in the dairy industry."

[00:02:05] Kevin: And you look and you say, "Okay, w- how is this gonna move the needle for you?" And you look, and you say, "Well, wait a minute. That's a cost center." To micro-segment a network, it's a great project to start, but it has no endpoint overall because it, number one, you have to bring in resources, you have to do every single asset, every single environment.

[00:02:28] Kevin: There's Re-IPing potentially involved. There's changes to infrastructure, and that's a cost. But yet what's really the, the driver of where we're going today with these supermarket attacks and everything else is simple devices that are inside of these stores that were just changed, and their temperature caused millions of dollars in damage.

[00:02:51] Kevin: And yet, if somebody would've had a simple monitoring on a temperature probe, like we're doing with technology that we're partnering with you for, guess what? We could have prevented this. So while they're out here building these giant five-pillar projects to say, "Know your assets," and all these other things which you know don't come to full fruition, a simple screen with a monitor of somebody remote could have said, "Hey, there's something going on.

[00:03:18] Kevin: We need to stop this."

[00:03:19] Dino: we, we s- from an engineering perspective, I mean, we still have engineers designing infrastructure that's 20 years old, right? Because their belief is that, ... Let's take a DLR ring, for example, with a bunch of drives sitting on it, running power management systems.

[00:03:36] Dino: they, they still don't believe the visibility is required in that space because they don't think anybody has access to it. they believe that, right? and so, it's like, how are you gonna flip this narrative to determine... It's like, look, if you're gonna build it... And I'm seeing this in brand-spanking-new data centers going in today, right?

[00:03:55] Dino: Still using technology architectures that are decades old. To change that, that philosophy and that strategy, where you see, one, be providing overwatch over the work that you're doing while you're there to secure and protect just your own work while you're in the, the design, build, startup, commissioning phase of whatever i- industrial assets that you're putting in, be- because th- they're, they're just not doing it.

[00:04:23] Dino: It's like pushing a rope up a hill to add that in. And a lot of them are doing- w- would say, "Well, the reason why we don't wanna pursue that is because of the cost, and we're competing for this work, and my competitors aren't doing that, I don't wanna lose the job." Well, make it an option, you gotta to at some point get the right people in the room, to make these decisions because AI is going to change this.

[00:04:44] Dino: We're already starting to see that. The AI folks are starting to enter the fray on how they can help, either 'cause th- they know they can see the bad, what AI can do to control systems. Now the question is, is how can we use AI to improve and harden the cybersecurity posture of these assets?

[00:05:02] Kevin: Yeah, and, and it, let's be very honest about this.

[00:05:06] Kevin: Let's be brutally honest. Security doesn't sell. from encryption to we're gonna basically hide your credentials when they have the mindset that things are not leaving their environment already, but unfortunately we know they are. the hackers have figured out that AI and tools like that can drive it forward.

[00:05:25] Kevin: Now you need to do that monitoring and flipping around and say, "Great, not only does it provide you a level of security, but you're shifting the left of boom mentality where it's not reactive like the supermarket incident we just had. It's proactive, where if I monitor that, I can figure out when those systems need to be changed, when there's things going wrong that are PM maintenance type stuff, that I can then have tools that anybody can get in from anywhere safely and securely and do a job."

[00:05:58] Kevin: Because Dino, there's, there's less and less of me and you in this industry. You have it in your organization, which you have a handful of people coming in, but they don't have your experience of seeing things go boom or seeing things that what good looks like. And that knowledge is leaving, as we've known for years.

[00:06:19] Kevin: So unless you get the data straight from the devices and you can now show management business value, they're not gonna do it for security.

[00:06:28] Dino: Yeah. so I just, I just wanna read something, right? So pick your AI company, right? Has already found thousands of high-severity vulnerabilities, including some b- in every major operating system and web browser.

[00:06:43] Dino: Given the rate of AI progress, it will not be long before such capabilities proliferate, potentially beyond actors who are committed to deploying them safely. The fallout for economies, public safety, and national security could be severe. It's an urgent attempt to put these capabilities to work for defense purposes, right?

[00:07:04] Dino: 'Cause they already know it can do offense, right? Also, it's gonna, it's gonna be very easy, which we've seen, to, to u- leverage AI to be offensive. We can also use it from a defensive perspective. So the, the challenge is, is how do you get this OT ecosystem to recognize this? And don't think that your client's gonna figure it out, 'cause if they, if they were doing it, they'd be telling you what it is you need to be doing in order to safely bring in control system environments, SCADA systems, DCSs, take your pick, and what it is that they expect to be part of that security posture with that equipment.

[00:07:42] Kevin: so it's not the product vendors themselves. Kasm is not going to go out there and pull all these tools together, and, you use tools in, in your day-to-day that, when we're talking about this platform that we're gonna, unveil at Automation Fair, that's already here now, but we're gonna get it in front of the masses.

[00:08:00] Kevin: It's a collection of tools that when put together functionally help you be more secure, but also more operational efficient and give you that return on investment. And you bring up a good point about the AI. Many customers, in fact, just speaking last week, when I said, "How many of you know that your vendors are pulling data out of your environment with, with tools to put into AI where they say it helps improve your business, but they're now using that data to sell and to go to other customers, long-term?"

[00:08:33] Kevin: That's a repository. Hackers know if I wanna get to the data of 1,000 companies, I'm gonna go to one of the vendors. I'm not gonna hit 1,000 companies individually.

[00:08:43] Dino: which is, is- which is where most of the breaches come through, are third parties.

[00:08:47] Kevin: Exactly, and so I think there has to be that vendor trust.

[00:08:50] Kevin: The other part when you bring up the AI that is interesting is there, there are standards out there like 42001 about AI for, frameworks and for having an understanding of your coding and management and things. There, there's... just look all over the place. Just anybody out there that's listening to this, Google AI regulatory standards, and you will see that there are things out there, but the code is coming out so quickly that, today what you put out is gonna be changed tomorrow.

[00:09:23] Kevin: That doesn't work in OT. A- And this breach that happened at the supermarket chain, if you, if you, and I post on it, if you read about it and why it's so important right now is they said a lot of the old systems didn't have updated firmware. But new systems puttin' in also had the old firmware. Why is that?

[00:09:44] Kevin: So it's not just the customer that needs to protect themselves, it's the vendors that need to take initiative, and then you need the third parties like yourself that says, "We're gonna put in this Overwatch-type platform that understand when you're talking about your drives what this data really means."

[00:10:03] Kevin: And you need to actually start extracting, mining that data, and going to management and saying, "Here's process improvement." And that's what you're good at.

[00:10:11] Dino: Yeah, you take any electronics technology that's got firmware or software in it that's been sitting in a box on a shelf for a year or two, what's the first thing it wants to do when you turn it on and, and you connect to the network?

[00:10:22] Dino: It wants to update, right? w- in the controls world, they may do that at s- to s- at some point, but once they get into startup inside that manufacturing facility, that all stops. And to your point, you could be two, three, four, five revs behind in patch levels with brand-new piece of equipment you got coming up online right now inside your plant.

[00:10:43] Dino: And there's n- there's nothing for that OEM or that SI that's required of them to try to keep and stay current with that or have anything in their, their service contract. Most clients, if they don't even, if they don't have one, a managed services program that says, "I will come in here once or twice a year and move you forward," right?

[00:11:04] Kevin: No, there's not. And this is where... And this is not the homer pushing product person, but this is why I'm working with people like yourself and with Kasm, is because they need a platform for this. So Kasm is being billed as that secure front door that gives you that secure access. It gives you the ability to bring your other tools in.

[00:11:25] Kevin: But the thing that you just hit on that's so mostly, is so important is this is a platform now that allows you to do updating directly from it, and you can control that. So now a vendor can come in, they can have their update readily available for them, and now you can slowly, and at your own progress, update the systems you need to and have full auditability.

[00:11:49] Kevin: Right now in the vendor world, in OT, a vendor came in today, he updated something. The plant manager doesn't know what it was 'cause, hey, he's here every single day and I trust him. And now something like this happens and it's like if I was to go out to a supermarket chain today and say, "What firmware is in the devices in your refrigeration units, and are you next?"

[00:12:11] Kevin: None of them would know.

[00:12:13] Dino: No. Just like they would know the version of the software running on their switches inside their plant that are inconsistent across the board, right? It is, they... 'Cause they, depending on when they were deployed, at what time, if something failed, you put another one out there.

[00:12:27] Dino: it's like y- you're not removing the variables in your environment, right? If you're a big Cisco shop and you have Cisco from top to bottom inside your plant, which nobody does, 'cause the OEM put in, Phoenix Contact or Hirschmann's, and you got Stratix in there and you got Cisco at the core and at the distribution layer.

[00:12:44] Dino: So you got a hodgepodge of stuff, right? And they're all at different levels of operating systems and firmware. it- it's just inconsistent, right? and, and now what's interesting is that the AI companies are talking about being able to do this for you. Now, that's an interesting concept when you think about it, okay?

[00:13:02] Dino: If you wanna update what's going on in somebody's, enterprise and hit the workstations that are in there that are being used by the accounting teams and the people team and your management teams, that's one thing. But doing that on the plant floor to control systems just to randomly start pushing patches out, and updating, I- I don't see that happening, not, not in my lifetime anyway, per se.

[00:13:24] Dino: not without the human in the loop. 'cause you look at Rockwell and their SecurOT platform, I mean, that's one of the, the primary, fra- their framework is to being able to do that, right? and,we're just having... We're not seeing that at scale for somebody just gonna push out patches on 5,000 HMIs across 2,550 plants.

[00:13:48] Kevin: No, a- and there's a problem with that. AI- Cannot be trusted. And, and I don't mean that in a negative way saying AI isn't helpful. It is helpful to the world in many ways. It's also detrimental as you see these hackers that are able to immediately figure out what customer has what product, as we've seen with the S7 breach as an example, and say, "I know how to target this now.

[00:14:12] Kevin: I know what to look for." it makes the hacking quicker and more efficient. What it's not doing for us is it's not providing the context. So while an AI platform can say, "Hey, I can go out and find all these devices and patch it," they don't know what that device's current state is, what it's running, why it matters.

[00:14:31] Kevin: And if you patch one of them and it goes bad, you can't just say, "Well, back that out and start from scratch." And that's where the knowledge of your organization comes in. So this overwatch-type platform that you're putting together that's tying in the assets, the users, and the access, even down to the devices at a granular application level, you're now controlling people, process, and technology.

[00:14:55] Kevin: And so now that you have that control, now you can build a baseline. Now you can say, what does good look like? And we were talking earlier in the week about the IDS stuff, and people say, well, you quoted it and it says why does IDS matter? And the reason IDS matters now is because there are certain situations, let's take Modbus, where somebody should be able to do a Modbus read but not a write.

[00:15:22] Kevin: If you encrypt that traffic end to end, how are you ever gonna see that? A- and no other platform is gonna pick that up. And that's why, as, as one of the things that I'm working on in Kasm, I can bring up an SSH workspace, and you're right in that workspace with key logging and things, as opposed to on your laptop where you're connected in, and now you just come through and you go to the box and you do SU root, and you can go anywhere you want.

[00:15:49] Kevin: So I've given you a tool to get there, but it's trust. In this world now we're living in with AI and everything, it's trust but validate, and that's Overwatch and its core.

[00:16:01] Dino: Yeah. And you would, you would think that, the, the Overwatch would be something that a, that a client that's bringing in a, a, a, an integrator to work in their plant would expect that of them, right?

[00:16:13] Dino: Because I firmly believe, and I, and I've... There's people within our firm that still think the same way, that they gotta quit thinking this stuff is isolated, that it's air-gapped, there's no access, that data's irrelevant down there in that area, and, and at that IO level, and that's just not the case anymore.

[00:16:31] Dino: It's just not. we gotta quit designing systems and with that mindset. And the problem is, is we- it's still being done day in and day out.

[00:16:40] Kevin: Well, let's take an example of where you and I just walked through a facility, and I asked the individual there about, "Do you still use the paper disks for charting?"

[00:16:48] Kevin: Which you saw, the rotating 24 hours or 12 hours with, pen marks up and down. And they said they're going to an automated system now that's gonna happen.

[00:16:55] Dino: They're gonna go to digital.

[00:16:57] Kevin: Yep. And so now you look at that data and you say, "Who does that data matter to?" And the plant operators it matters to for things that they're doing on the floor, or maybe to the ERP or, or, management information systems of how to make process improvements.

[00:17:14] Kevin: But overall, it doesn't matter anything to the security people or to the management until you look at what's going on now about these attacks. And so the supermarket chain attack here is really interesting because, as I spoke about last week, and you and I talked to several companies experiencing this in the Fortune 10 level, they said, why does that really matter to us?"

[00:17:38] Kevin: These attackers are not going out for ransomware anymore. They're going out to take businesses out. They're going out for espionage. And if they can get this data from these environments, they can now take it to a competitor and say, "Hey, your competitor's doing this. I could take their systems down for two weeks, a month, and give you an advantage right now.

[00:17:59] Kevin: I could take their new release that they're talking about, that they're touting in the media, and crush that new vehicle right on the production line before it rolls off the plant floor and put them back six months." And now it's not about the ransomware of saying, "We're gonna extort it." They can sit behind the scenes, and now you look and you say, "There's other motivation behind this that's growing."

[00:18:23] Kevin: And that data is now important. And it's important in the other way, too, because if you look at what you do on a daily basis, Dino, somebody calls you up and says, "There's a problem on my system. Come out and fix it." The way many times they know that is the system stops working or the data they have right on the screen in front of them, suddenly says there's a problem.

[00:18:43] Kevin: If you can get that data back to a management platform where it's eyes on glass 24/7 like you are now offering, now you can say, "Hey, guess what? I'm noticing this deviation from baseline. I'm gonna dispatch somebody out there before it gets to the point of criticality." And now it's operational effectiveness and improvement meantime between failure that you're selling.

[00:19:05] Kevin: You're not selling security. You're not selling break fix. You're selling business process management.

[00:19:11] Dino: Well, and, and the challenge, for... And, and I still see it today, you got people over there tripping over, dollars to pick up nickels, right? Because, well, that, that, that's, that, platform, that technology is more expensive than the stuff I can get that's cheaper, wouldn't even know the difference between the two, and they don't.

[00:19:30] Dino: They don't e- they don't even understand the difference between one platform versus another platform because the other platform says they're a cybersecurity intrusion detection system. It's like, at to what level? Do you even know? I- you're, you're telling me about a product I haven't even seen at any of the trade shows and hasn't made its way to the Gartner Magic Quadrant report.

[00:19:49] Dino: You mentioned them a while ago. I never see it in the, at, at client side. Somebody even brings it up. But you wanna compare one tool to another tool just because it's cheaper. who are you even gonna find that knows how to put- You gonna go with the vendor and expect them to help you?

[00:20:04] Dino: Do you think your people are gonna figure it out? They won't.

[00:20:07] Kevin: No. A- and this is where, earlier t- this week I was talking with Gartner, and we were demonstrating to them what we were doing, not from a tech perspective. We spent two minutes on showing them a look at the product platform, the core that's, what you're building in your overwatch environment, for the monitoring and maintaining.

[00:20:26] Kevin: And they were more interested in about, "Hey, we figured out why the C matters, and how we can get operational efficiency out of it." Gartner doesn't have a quadrant for that in OT. They are all security products. And you look and you say asset management products, asset visibility, detection products. That's great.

[00:20:44] Kevin: They're up there, but we're still seeing people that, I talked to a woman at the show last week, and you were there, that said, "We went out and bought a platform that was in the cloud. We don't like that it's in the cloud. We don't like that we have to manage in each plant, but that's what we basically decided because we didn't think about our long-term goals.

[00:21:04] Kevin: We t- thought about short-term." OT's a long game.

[00:21:08] Dino: And CISOs are a short game, right? Average tenure of a CISO is 26 months, less than 3 years, right? So y- you got a dozen, 15, 20, 30, 40, 100 plants, and you're, and you think you're gonna be able to, to architect and g- and roll out a cybersecurity strategy and, and solution sets for those facilities in a very short period of time?

[00:21:30] Dino: you're, you're kidding yourself.

[00:21:33] Kevin: Yeah, and yet it's funny you mention that, Dino, because we've had the screens to show temperature collection out of the lab we've built now for, over a, months, almost a year, and it took us less than, what, half an hour to get it funding into Elasticsearch, a couple MQTT commands, some Modbus work.

[00:21:55] Kevin: The device already has it built in, and all I had to do was build a little widget on the screen that says show me temperature. The worst thing we have to do with it now is show where that temperature delta is, and that delta really comes from the manufacturer of, "Hey, what should this unit be operating at?"

[00:22:12] Kevin: You've already got that for your customers, and you're in the food and bev industry. You could now go to these customers and say, "I can drop this little unit on your network that has nothing on it but a outbound port that is secure to a platform that reads this data, this telemetry information, and now I can tell you when something's going on."

[00:22:33] Kevin: And look at how much it's costing this supermarket, vendor. All because nobody... And that's the vendor's initiative where they should have said, "Hey, you should have been monitoring this."

[00:22:45] Dino: and there may have been logs that were being posted somewhere, but nobody was paying attention to them, or you have to have somebody walk by and look at the little HMI screen that's got the temperature on it and note it, and look at the trends.

[00:22:56] Dino: I gotta believe that the capability was there and somebody wasn't even paying attention, or they truly were standalone systems that required somebody to be, tracking it in a manual mo- m- manual, mode of operation.

[00:23:10] Kevin: I looked at that and I sort of thought to myself, "If there was a way to get in and modify these, there was a way to get out."

[00:23:20] Kevin: And, and that's where it's like if you hit so many at the same time, and now you're hitting other vendors out there, or other, the supermarkets as they are, now the wave is going forward, you don't even know if you're next and who's responsible. And that's where you're coming in now is you're saying, we're gonna take that service over because, the, the, I think the final point we really have to make here is that, the reason you're going to these shows and meeting your customers in automation fairs, you're saying vendors that are just providing product aren't the solution out the door anymore.

[00:23:56] Kevin: The solution to basically get everything together is to have a service provider that knows all your systems, that works with things on your floor, that understands what good looks like, and can monitor them for you and give you the best business value of why you need to do this, as well as doing it securely.

[00:24:17] Dino: Yeah. in, in the system integration world, there's thousands and thousands of SIs out there. They're not all the same, right? They don't all have the same capabilities, the same partnerships, same types of practices. And so, I, I can pick a company that, that you and I know that's got several plants.

[00:24:35] Dino: It doesn't seem like a lot, but they have, they have over 24 SIs, and it's p- plus 250 people that need access remotely to those several plants.

[00:24:48] Kevin: And what individual in the organization knows all the comings and goings? Nobody.

[00:24:55] Dino: No. They really, really don't. it, it's just that it- it- at some point, as I've mentioned in many of these podcasts, the, the IT leadership, if they really, really wanna get involved in this, they're gonna have to make some new friends, and they're gonna have to find out who are the top OEMs and SIs working in our manufacturing facilities today to find out what their capabilities are to see if they can help me.

[00:25:17] Dino: and we're seeing it in the AI stuff. in, in these new AI factories that are being built, even them, they struggled early on and recognized that they didn't get the, get what they wanted because they thought the SIs and the OEMs were gonna get them there. It's, it's like the DLR rings I was talking about that somebody in...

[00:25:35] Dino: had d- designed and built, and they came back and said, "Well, we want visibility to that." And the engineering team was like, "Well, why do you need visibility to that stuff? Why is that important? Nobody has access to it." Which wasn't true, right? An assumption, but at the same time, they put something in brand spanking new, built it, with no visibility into it at all.

[00:25:55] Kevin: Yeah,and the last point I'll make about this is that there was a supermarket chain in, in the UK, I believe, early or late last year, that went out of business from a cyberattack.

[00:26:06] Dino: Look what happened to Jaguar, Land Rover last year.

[00:26:10] Kevin: so now if I look and I say, "What's the fallout from this?" Even if they had cyber insurance, it doesn't matter because the supermarket's gonna say, "Hey, we have a loss."

[00:26:22] Kevin: They're gonna turn around, cyber insurance is gonna say, "Great. Guess what? We're not covering this fully, if at all, because the vendor had basically outdated systems that you were still running." But then you turn to the vendor and go, "Well, you're putting in new systems with outdated firmware in them as well."

[00:26:40] Kevin: So now it comes back to the vendor. By the time that all cycles through the courts on however big this is going to be, that chain has lost a significant value in a market that is pennies on the dollar thin.

[00:26:53] Dino: Margins are very thin in that business.

[00:26:55] Kevin: can you survive that? And that's why ransomware doesn't matter, and that's why now it's like if you can do an espionage and you wanna take somebody out in this business world, you can see the dollar value on the other side.

[00:27:06] Dino: Yeah. And I, and I, and I think ex- I don't think, I know AI's gonna expedite that.

[00:27:11] Kevin: That we're seeing now with these attacks, yep.

[00:27:13] Dino: Exponentially. It's, it's coming. It's already happening. People don't even know it, especially, for what we learned at, at the, the conference last week, the bad actors that are living in the normal, right?

[00:27:24] Dino: That, that are living in between, the spikes and the trend, 'cause they don't wanna get caught. They just wanna sit in there, right? And then the question then was,h- how many points of change need to happen in a row before d- you get, you notice it, even though it didn't fall out of the normal, right?

[00:27:38] Dino: Living within the normal. But then how can you track to see if something's in there that shouldn't be in there, right? What was it, the seven or eight points of change, that, that happen repeatedly? if you see that, then that's an investigation point, right?

[00:27:52] Kevin: Well, the other point about this is that how do you know that employees that are let go, their job is replaced by AI and things, and these organizations aren't turning around and going, "Hey, guess what?

[00:28:03] Kevin: I can now go out and cause damage to you, your reputation, by using the tool that I helped build, that you said I'm no longer needed for, to now start attacking your customers instead of doing good"?

[00:28:17] Dino: Yep. It, it, it, to me, I mean, if we make it sound like there's no way to solve this, there is. It's just that you have to drag a certain group to the table and raise the expectations instead of just letting them do what they want. I'm gonna come in and put a packaging line in for you. It's gonna put- it's gonna fill 2,000 cans a minute, which is what you want, and, and we're gonna make it work, and then that's it, right?

[00:28:41] Dino: That's, that's the baseline, 2,000 cans a minute.

[00:28:44] Kevin: Yeah. and this is why, this is why we've been working together with others to build this platform for you because you have the customers, you have the knowledge. And this is why in November at Automation Fair, they'll be able to come out on the floor and touch it and feel it and grab a temperature probe and say, "Look, this is rising."

[00:29:05] Kevin: And you can see it right here no matter where you are And you could help prevent or mitigate this type of attack.

[00:29:12] Dino: Yeah. it's interesting you bring that up when you take, talk about these trade shows, and you go up to pick SI whatever that's got some machine center, some skid whatever, and it's like, "Well, what is your cybersecurity strategy for this stuff?"

[00:29:23] Dino: And it's either, "Well, the traffic's encrypted," or, "You don't have access to it." That's what they'll say. It's like, no, how would this fit into an overall... Or, or it's, that's the client's responsibility. Well, is anybody even asking the client what they're doing? how they're handling this?

[00:29:39] Dino: Because we work in this space all day, every day, and it's rare to find anybody that comes back and says, "Here's what we want, how we want to handle this. Here's our platform, here's our tool. Here's the things you need to do in this new machine center that you're building and designing these components to provide visibility down here.

[00:29:54] Dino: I need to get this baseline information, this metadata, up to my platform." and that never happens. It d- it does- doesn't happen.

[00:30:03] Kevin: A- and there's a reason it doesn't happen at the core, because it is a cost. And this is where now taking all that data that's sitting there, those paper disks that are now going digital and saying, "Hey, why are we saving all this data?

[00:30:17] Kevin: Is it for an audit? Is it to do a CYA for us? Or is it things that we should really now with the power of AI be number crunching and looking at and finding out how we can improve to give us a technological or business process or even product advantage?" And it's sitting right there.

[00:30:36] Dino: Well, there is a cost.

[00:30:38] Dino: Trying to come back and do it retroactively, it's definitely a cost. But if you're putting in a $10 million packaging line, adding 50 to 100 grand of tech and services into that is, is a rounding error, to be able... It, it's not a cost issue at that stage. It's not. Right? But the problem is, is you don't have people within your environment that can do this.

[00:31:04] Kevin: No, and that's where the service providers come in, and that's why one of the things that we've built into Kasm is an AI basically platform right in your boundary. Nothing leaves. You control it. There's no worry about your vendor getting your data and then somebody hacks your vendor and sells it to a competitor.

[00:31:21] Dino: reverse engine- to take your recipe, right? Your Coca-Cola. To, to your point, it's just data, right? But data in the right context, all of a sudden you're realizing how they, how they actually make that.

[00:31:33] Kevin: the pharmaceutical industry, we have a couple mutual friends that have told us flat out that if they can get into their plant and start looking at their control systems, their production line data and things, all this OT data that everybody finds insignificant in their world from the people we talk to, they could now remanufacture those drugs elsewhere.

[00:31:53] Dino: No, we've seen that with cars and trucks and planes overseas that look identical to the stuff that was owned by GM or by Boeing, you

[00:32:03] Kevin: And now you're spending money on lawsuits. You're basically, lawyering them to death, and yet you're losing revenue already, and what's your hope? That the court awards you all that money, that cease and desist?

[00:32:14] Kevin: It, it doesn't work. We have to be proactive

[00:32:19] Dino: we live another day to fight another battle

[00:32:22] Kevin: Yep. I guess, as I said, come see us at the show. Dino, everybody knows you online, so reach out to you if people know me and wanna reach out to me. But, last week was eye-opening 'cause we talked about all this stuff at the show.

[00:32:38] Kevin: People in my session nodded and smiled and said, "Exactly," but had no solution, and now we see an incident this week immediately after that says, "Oh, wow, we do need to monitor the idiot lights and the gauges."

[00:32:51] Dino: it was, the, the, the show we're talking about, right, it was a national. So for the audience, it was the, ICS, Industrial Control System, Cybersecurity Summit, right?

[00:32:59] Dino: It's been running for 25 years. This was their 25th year. There was probably 500 people at it. All the key vendors were there, right? All the, all of the vendors that, that, that provide this tech and this space were there. The Ciscos were there, the Clarotys were there, Nozomi was there, ServiceNow was there, Rockwell was there.

[00:33:19] Dino: they're there But 500 people. You go to s- you go to a, a, an RSA or a Black Hat, and there's tens of thousands, right? All- again, cybersecurity professionals, I'm assuming, what they work on is not this. So I bring that up just to show you the difference in the audience size. Even though manufacturing is key and critical, has tons of technology in it, but the resource pool that attend these events to gain knowledge of the tech that's there, that's coming out, what others are doing, listening to folks like Kevin who are speaking, CISOs that were speaking, 500 people versus 25, 30,000 that go to an RSA or a Black Hat, maybe more.

[00:34:06] Dino: A Cisco Live,

[00:34:08] Kevin: A- And how many were decision-makers that had budget? We met a bunch of them, but it's now, "I need your help." Great, let's formulate a plan so you can go to management and present this. And it's not a plan in any of them that say it's security. In fact, another vendor that was there was Salvador Technologies, a partner of yours for the backup stuff, and people were like, "You know what?

[00:34:30] Kevin: I should back these up." Well, of course, because if somebody gets in and plays Whac-A-Mole on your HMIs, PLCs, and other things, and you don't have backups like we do know they do not in many cases, Dino, guess what?

[00:34:44] Dino: Consistent. through a manufacturing organization, it's just... And even the same plant, it's not consistent.

[00:34:49] Dino: We'll see thumb drives hanging inside the panel on a hook. you got an engineering workstation, one engineering workstation that's got backups on it. it's, it's hit or miss. It's the wild, wild west. There's no consistent strategy on how to do it. it's crazy, as it may sound.

[00:35:06] Kevin: It is. I look forward to seeing you next week when you're up here to put this plan together. And as I said, this is something that at Automation Fair we're gonna have right on the floor that you can come up, look, touch, and feel, and a customer can have you manage it or drop it in an environment or...

[00:35:21] Kevin: and the funny thing is, it's multi-site, it's multi-tenant. It's everything the industry needs. It's all the tools IT already has, except now these are true OT tools to make it happen. And they've got the backing of your organization and you that knows how to drive this forward. You don't sell somebody a bus and say, "Just get in.

[00:35:42] Kevin: The steering wheel, the gas pedals, and everything else are the same." just 'cause it has four wheels, a steering wheel, and a gas pedal, and a brake doesn't mean you're driving a small mid-sized car. And that's the problem, is you need somebody that knows how to handle that vehicle, and the platform you're putting together is your knowledge, experience that knows what these customers need and how to extract value.

[00:36:04] Dino: No, y- you gotta get the C-suite. remember the, logistic company, global, large logistics company? The guy who's responsible for the OT infrastructure network was begging and trying to get the CISO out to one of the facilities just to tour it, to show him what he was up against, and he couldn't get him to do it.

[00:36:24] Dino: And this is the... And the CISO has r- reports up to the board, right? That's the path in. But he could not get that CISO, and he tried numerous times to come out to his facilities and say, "I need to show you what we're fighting up against." Wouldn't do it. So if you're that CISO who's not interested in the plant floor, then tell your board that, right?

[00:36:46] Dino: And tell your OT people to start figuring out how they're gonna get better at this, because IT's not gonna help them.

[00:36:52] Kevin: No, and you can't rely totally on your vendors, because in my slide presentation about why the C and AIC matters, I had six quotes from people in the industry that are higher-ups, and many of them are the chief strategists for OT security product companies.

[00:37:06] Kevin: And some of the comments were, why does somebody care how much water is flowing through a valve at a point in time? That's useless data." Not to a hacker that can use it in AI and say, "Tell me how I can change and destroy this plant by flowing, changing the water flow just in one valve." Tell me how I can change the mix to Coca-Cola or to any other product out there just with one change to the formula.

[00:37:34] Kevin: All it takes is one little system, Dino And so if we don't get it as vendors because we have people here that have never been in OT that are now in these roles, and the CISOs are leaving early, and the customers have their management is afraid to walk the plant floor 'cause of what they will see, it's gonna take vendors like yourself and us to turn around and put it in front of people and say, "We built it.

[00:37:57] Kevin: Come use it."

[00:37:58] Dino: Yeah. my view, there's too many armchair quarterbacks i- in a lot of these ranks, especially in the IT world,who sit from some perch thinking they can call the shots on what's happening on the plant floor, and, they don't. And, and so it's incumbent upon the OT ecosystem to get better at this.

[00:38:16] Kevin: Yep, and we need the IT people. I mean, that's 110% because you're seeing the tools like ServiceNow coming in, which are IT tools. We just need the people in IT and OT to come together and saying, "You know what? Come out of that office, come to the plant floor." And then when the people come from the plant floor to the offices on the carpeted side, to take what they're saying as important and critical.

[00:38:38] Dino: Yeah. Well, the other thing I learned last week is maybe we got the IT/OT convergence vernacular wrong, and we shouldn't call it IT and OT. We should just call it technology, right? 'Cause as soon as you say IT and OT, you're creating two camps. so you're already setting two groups. In a lot of cases, they're pitted against each other.

[00:38:55] Dino: And if you think even those organizations who believe that their IT and OT groups are working together, it's not consistent, and it's not throughout your entire fleet. And especially not with your integrators. I can tell you that for a fact because we m- we're, we don't have those conversations with either one of those groups about this stuff.

[00:39:14] Kevin: Nope, and now you look at, this hack that we're talking about that was the impetus for this session today. You go to the supermarkets. Where does that now lie? Who do you say is responsible for that? Some C-suite? D- Does the supermarket chain even have a CISO that understands the cooling systems and refrigeration?

[00:39:35] Dino: I can bet you they're out of a job today.

[00:39:37] Kevin: Yeah, but this... But is it their fault? Is it their fault because, you know-

[00:39:42] Dino: It's not, but that's who they blame. That's why you're back to the, the 26-month tenure window.

[00:39:49] Kevin: Yeah. A- and, they're more worried about, the hundred other things in the entity out there.

[00:39:54] Kevin: how do we compete against somebody else who provide different products and services, make uniqueness to our, in- in-house cafes, whatever it is, our ease of checkout, DoorDash delivery to make it easy? They're not thinking about the refrigeration system getting whacked. That's the least of their things.

[00:40:12] Kevin: Look, it runs. It has lights. I open the door, it's cold. The products stay cold. That's great, until they don't.

[00:40:19] Intro - Outro: Thanks for tuning in to the Industrial Cybersecurity Insider. To stay up to date with our latest episodes, be sure to click the follow or subscribe button now. And if you found this podcast helpful or have a topic you'd like us to discuss, please leave us a review or let us know.

[00:40:34] Intro - Outro: Thanks again for listening. See you next time.