Your Most Valuable & Underutilized Cybersecurity Asset

Dino [00:00:00] if you're not spending a significant amount of time working inside these manufacturing facilities, I'm not talking about states away or countries away, or your ivory tower, I'm talking about inside the four walls of that plant.

Dino That's how I can tell whether somebody really has a pretty good beat on what's going on and be able to solve these kinds of problems, versus somebody that's never been or goes once a year or every other year and they're there for a couple of days to work on some business system at the plant that is not the group that's going to solve this problem.

LuRae Welcome to the Industrial Cybersecurity Insider. In each episode, we dive into the world of industrial cybersecurity. Join us as we cover the latest trends, innovations, and practical insights as we talk with leaders. And practitioners across the industry. Gear up and let's get into this week's episode.[00:01:00]

LuRae Welcome to the show. My name is LaRay Lumpkin and I'm the producer of the Industrial Cybersecurity Insider podcast. And today, Dino Bussi is joining me to discuss why our ecosystem partners are our greatest cybersecurity asset and what companies can do to leverage those relationships. So Dino, welcome to the show.

Dino Thanks, Leroy.

LuRae So we're gonna start with a series of topics that you, I know have significant, experience with. when it comes to manufacturers, they're already spending money with system integrators, they've got technology partners. Why aren't they leveraging those relationships today?

Dino That's a great question. it's almost like it's just one opinion. Meaning that, you know, because we've had conversations with, you know, it, leadership around cybersecurity for their industrial environments, their OT environment, and some, I, their position is vague.

Dino Vague [00:02:00] enough that. They don't really have a really good understanding, or they don't believe or feel that those OT assets need to be a part of their cybersecurity strategy or their journey. And again, that's one opinion, right? And the conversation in a lot of cases never goes above and beyond that.

Dino Meaning that, well, why don't we ask that of the people that actually operate and run the plants, like a plant manager for example, or the engineering teams, to find out if they would feel the same of kind of being left out, or at least help them understand why cybersecurity for their control systems is important, right?

Dino So that they can actually start thinking for themselves and start figuring out how can I do a better job of securing and protecting these control systems in my environment? As we all know, years past, you know. security wasn't designed in to these machine centers, It just wasn't part of it.

Dino 'cause there was a, there's still a belief that these, these environments are, air gaped. that's just not the case anymore. And any IT leadership, [00:03:00] you know, that's recognizes that, just some based on the amount of data that they get up and off the plant floor and the remote access that they had to put in, like during the pandemic in order for people to support them because people couldn't travel right.

Dino In order to keep those manufacturing facilities up and running. So the key is, in my view, is trying to get to the know. And the question is do you believe that you should be executing and implementing the same cybersecurity strategies, you know, for the control system environment, the OT environment as you do the enterprise, right?

Dino Or your due diligence? and part of that due diligence would be. Tapping in to probably the greatest resource that you're unaware of. It's working in your plants on a pretty regular, consistent basis, helping maintain and support those machine centers for the your plants to be able to produce the goods that they produce.

Dino And that is your system integrators and your OEMs. Because a lot of manufacturers don't even have controls engineers. They hire that out. [00:04:00] and we know that because that's the business that we're in and that's the business I am in, right? Working for organizations like that and have for decades, and we don't have IT.

Dino Executives tapping into that, trying to find out who we are, what we are, what are our partners, what are our capabilities, what kind of practices do you have, what kinda resources do you have? To help them with their cybersecurity strategy. So either they don't have one for the plant floor or they don't want to own it.

Dino One of the two. There's probably a third, you know, option out there. But I don't see them doing that. and I work with, and, you know, my, My social circles in this space are pretty broad with the top partners, you know, the Cisco systems, the Rockwell automations, the Siemens,the clarities, the nas, the arm is the TX ones.

Dino Microsoft. I can go down the list. And the same challenge that we're talking about right now, they would say that is a challenge that itt OT convergence, as everybody [00:05:00] likes calling it, is not true convergence,

LuRae right? Absolutely. So if you're gonna help CISO, like, or a plant manager even take inventory like of their existing partners and figure out who to start.

LuRae The security conversations with first, like, what is the best practice to even get started with that?

Dino Well contact your plant leadership and find out who those people are, right? And try to get an idea of what they're working on. You know, and in a lot of cases, these system integrators have been working in your manufacturing facilities for decades.

Dino Still are, right? They're the ones who design the machines. They, program them. They maintain and support them. They help you with changeovers. They help you with maintenance. They help you with a whole expansions, lifecycle replacement, whatever the case may be. there, there's an engagement of system integrators working in your plans today.

Dino They all have varying degrees of capabilities and partnerships with regards to [00:06:00] technology. I would probably argue that if you look across the system integrator, you know, landscape, you're only gonna find a handful or a dozen that even have, practices related to cybersecurity for the industrial environment, So, you know, I remember a very distinct story some years ago. It's been over, I felt close to a decade ago when, WannaCry came out and I was working for a very large automation technology vendor here in the United States. And we were meeting with a client and to go talk to them about networks and security because the engineering team.

Dino Wanted to, they knew that they needed to do something different for the security and the segmentation of their network and their plants. And this was a dairy company. they were a big dairy company and meeting with the CIO, you know, and this is a client that did over $10 million worth of business with that automation technology vendor in the course of a year.

Dino I would challenge that any of your IT partners that you spend that much money [00:07:00] with them in a year, but you do spend a lot of money. Your plans do buying this technology and the services that come with it for your manufacturing facilities. But the response that I got back from that CIO, that we should have probably been like your second phone call to figuring out how we could help you with this event that you had going on, and they didn't know who we were.

Dino You know, the response I got back was duly noted. And my point is that, you know, you're missing out. on the resources that you need. If you truly are going after a, an OT cybersecurity strategy,that fits in with your enterprise plan and you're not tapping into probably the best resources available to you to do that because it's not your plant people, that's not their skill.

Dino That's not what they're there to do. Their job is to keep that plant up and running and generate revenue. That's their job. It's not to be cybersecurity expert. It's not to be control systems experts. It's not to be networking experts. [00:08:00] They're not that. You gotta go to the people who are designing and building and implementing that stuff.

LuRae if you've got the roster of, these are all of the technologies that you know, that you're able to identify, like, what does the first conversation look like? What does that sound like? If it's around cybersecurity, how do you broach that subject and get into what is important to be talking about?

Dino Yeah, asset inventory, right? The very first thing, do you have an accurate up-to-date asset inventory of all the things that are connected to your network? And not just in your enterprise world, but on your in, in your plans. And I would probably venture to say that most IT organizations probably have a pretty good grasp of what's connected to their network in their business systems.

Dino But not so much on their control systems. Not so much on the OT side, not inside those plants. They don't, so that's the first thing that you need to try to get your arms around, just to find out just the number of assets that I have. And then from there, what are the risks and vulnerabilities associated with those assets based on their firmware version, you [00:09:00] know, their lifecycle status, you know, the end of life and the support, you know, you know, so you can start at least getting a picture.

Dino What you got out there. And then from there you can start, you know, going after. So that's the reveal piece, right? That's revealing. Before you can go to protect, you gotta be able to reveal, you know, what you have, you know, what's connected, you know, when you get to step two, what is connected now that I've got my asset inventory, what's connected?

Dino What's talking to what, and understanding those communication flows. And are they, valid? Connections and communications per se, are they valid applications that should be in the environment services, right? Before you can get into, you know, into, detecting and responding, you know, your IR plan and all those other things, before you can start implementing a strategic plan forward, you gotta get to that reveal factor, you know, and that's step one, right?

Dino And so that's the first question. Are you doing that today? Can you show that, you know, if you came up to somebody, if you had an [00:10:00] audit that you had to pass or go through, would you be able to demonstrate that?

LuRae Well then I think that the other thing that it, that automatically makes me think of is remote access.

LuRae Because we kind of opened Pandora's Box with COVID and it, you know, now that warranties and you know, all of the things that come along with imp, implementing a new cybersecurity piece of equipment or just equipment, period. Like your warranty will be void if you don't allow remote access. So how do companies even get their arms around that?

Dino Well, and you gotta be able to detect that, right? You gotta be able to detect that's even happening. And then once that connection is allowed for remote access, what are they doing? Are you watching them? Are. Are you providing some type of audit on that? Do you have change control? You know, if somebody makes a control system change, can they just do it willy-nilly, you know, shoot from the hip?

Dino Or is there a process to get through to make that change? You know, and you're not gonna be able to do that without visibility, you know, and if you don't have the asset in an inventory to determine what its state is and what it's supposed to be doing, and what it's [00:11:00] supposed to be communicating with and what applications are supposed to be working with it, you know, those are all the things that you have to uncover in order to validate.

Dino what is a valid action versus something that's not valid? You know, I mean, when you look at these bad actors, I mean, they sit inside these, environments for close to 300 days. What is it? 280 to 300 days. They're sitting in there. So for almost a year, they're embedded in your environment, just watching and listening and moving around silently, and you don't even know they're there.

Dino Because you are not looking at that stuff in the same with the same lens that you're trying to look at in your, enterprise with the tools that you have and the resources that you have.

LuRae Yeah. And I'm wondering also, how often do you run into. Organizations where they'll say, precursory, oh yeah, we invested in cybersecurity.

LuRae We've, you know, we've checked the box for, and they basically covered themselves for the board and the C-suite, but really it's not been [00:12:00] operationalized. How do you address that?

Dino Well, it goes back to what I said earlier. That's one opinion, right? would the folks that are the true asset owners, so to speak, the people that operate the plants or run those plants, would they say the same thing?

Dino Would their opinion match that box checker who says, I'm in compliance, right? Because we know if you're not spending a significant amount of time working inside these manufacturing facilities, I'm not talking about states away or countries away, or your ivory tower, I'm talking about inside the four walls of that plant.

Dino That's how I can tell whether somebody really has a pretty good beat on what's going on and be able to solve these kinds of problems, versus somebody that's never been or goes once a year or every other year and they're there for a couple of days to work on some business system at the plant that is not the group that's going to solve this problem.

Dino Again, that's one opinion. Somebody, when I [00:13:00] hear that it person says, we don't need that. I don't need to have visibility to those PLCs and those drives and those hmis. Again, that's one opinion, So you have to flip the narrative, you know, because it get to that, get back to the no, okay, it, are you going to do this or not?

Dino Are you capable of doing it? Because if you're not, I have to go down a different path. Either way, even the client, the plant would still go to their trusted advisors. And who is that? It's the people they buy this stuff from. The people that help maintain and support it. That would be their natural pivot.

Dino They're not gonna get on the phone, and I don't see a plant manager or an operations team calling Cisco systems. For example, they're not gonna do that. We don't even know where to begin. They have to go through it to even get there, ideally. But if they called Rockwell or Siemens, that'd be a different conversation.

Dino Or if they went to their system integrator [00:14:00] that they've been working with for 20 years and spent tens of millions of dollars with who's working with 'em today? They could go talk to them,

LuRae right? Yeah. So what's really like at stake for a manufacturer? They've already invested, you know, money into equipment, but they're treating like the relationships, like it's just a transaction, like a vendor relationship instead of a partnership.

LuRae Like what's really at stake for them not having those relationships solidly in place?

Dino You mean with the system integrators per se? From an IT perspective, from an OT perspective, they have that, right? I mean, that's who they go to. And that plant is sideways or casters up and not running, and the plant can't quite figure it out themselves.

Dino They're gonna go to the people that designed and built and maintains and supports that equipment, right? That's gonna, that's who they're gonna get on the phone or get on site to help solve that problem. Is that it's problem? I don't think so. I don't think they would ever say that's their problem.

Dino Whatever. Took the plant down, right? [00:15:00] Even if it was malware, if there's malware in your control systems, is it's job to eradicate? Would they even know where to start? Because what I will tell you is they haven't run any exercises to figure out how to do that. They don't have the tools in there, right?

Dino Because we can tell whether they have the tools in there to do that type of discovery and research and investigation and provide that type of response and incident re, you know, recovery activities. We would know 'cause we'd be a part of it. We'd have to be a part of it. We already are a part of it.

Dino if that machine goes down and we're the second phone call that's made. You know, if the local guys can't fix it, they got their 800 number of who they need to call to get on the horn to help 'em out. You know, and so again, you know, what is the purpose of ITOT convergence? I hear it all the time.

Dino I,I'm not discounting it, but I just don't see it.

LuRae an action for anyone listening, like how do they start [00:16:00] tapping into the partners that they're already paying for and how can they start, Doing that.

Dino Yeah. Yeah. you need to find out who the contacts are at these organizations, these system integrators who are working in your plants and meet with them and bring 'em in and or go to them and sit down and tell me, you know, what you're doing for me on a, on an annual basis.

Dino What, again, what are your capabilities? Who are your partners? What kind of resources do you have? What kind of practices do you have, you know, to better understand their role. Because you might, you could leverage that. You really could, you know, I mean there's a lot of companies out there that try to self-perform and I've seen that not work very well.

Dino 'cause you just don't have the resources to do it or the experience to do it, or the maturity to be able to do it. You know? And even then, if you're a fairly large manufacturer, large meaning that you got, let's say 50 plants or 25 plants, well, you know how many people you would need in your organization to be able to do that.

Dino You know, I mean, you need at least one or two per side on average just to get this stuff in and start. [00:17:00] Start that discovery process. Now that I've got the discovery process, I'm starting to map out my vulnerabilities and risks to determine how I'm gonna prioritize this stuff and start localizing it and operationalizing it and make it actionable and start determining what areas are we gonna target.

Dino That all has to be done at the local level, you know, and so you think about the number of people that you need. it's pretty significant. You know, I mean, and you're not gonna pull it off with just a couple of people or one person. You know, I was just talking to an organization earlier this week, and I knew that they knew nothing about the OTIS types of cybersecurity platforms.

Dino I could just tell because they didn't recognize any of the technology firms I was talking about. And the next response was, well, that's, you know, that's 18 months to two years out before we, you know, and my, again, that's one person's opinion,

LuRae right?

Dino And why, and so you have to really ask yourself is that.

Dino Is that sufficient? And you know, it's not right, it's not as sufficient that it's one [00:18:00] person or one group's opinion. It has to come from across the business for the people that are truly responsible for plant operations.

LuRae Yeah, absolutely. Yeah, because the ownership, there's the group that pays for it.

LuRae And then there's the, okay, we need to put thisinto effect and leverage it. And as we've talked about in many different episodes, there are not enough people, as you just said a little bit ago, there just aren't enough people with existing teams. They're already spread thin and they need additional ancillary support.

LuRae People who know and have done this before, so they're not running blind, it doesn't really know. They're trying to do the right thing, but then the OT people are spread thin and not always empowered to and or even have access to the data that is coming through the machines.

Dino Yeah. they don't even have access to it.

Dino Even for those firms that have implemented something, you know, maybe seen a third of their assets or half of their [00:19:00] assets in their plant, there's still no actionable activities going not only to the plant teams. But again, back to the system integrators and OEMs who are operating and maintaining that equipment also.

Dino 'cause again, we would know, we'd be getting targets, right? We'd be getting metrics, we would be getting, things we might have to design into that next machine center that's coming in to make sure that you have visibility to all of that stuff. And there'd be a baseline on the firmware versions or the operating system level or the application.

Dino Versions to what you're gonna put in my plan, and this is how the network's gonna be set up. You know, we're gonna segment this piece of equipment, here's how we're gonna do that. And they would have it all mapped out and they just don't, you know, I not, and when I say they, I'm talking about 80 to 90% of 'em out there.

LuRae So what's your f final words of advice for anyone who's, you know, trying to make sure, okay, we, one, we don't want the operation to go down. We don't want anything to happen. or I'm in charge of this and we bought something and [00:20:00] I'm, I think it's okay. Like what would be your final like, words of advice to someone out there trying to make sense of all this,

Dino but how to get better?

Dino Let's do something to get better. the first thing I'd look at is, might think about doubling or tripling your cybersecurity budget, because in most cases, the, the IT cybersecurity budget, once the budget's been set, 70 plus percent of it's already spent, you know, the first day, right? And so there's never enough to go tackle 50 plants, 30 plants, 10 plants, whatever you got, to begin this journey.

Dino You know, into try to driving cybersecurity further and deeper into my environment. so ideally for me, I've always been interested, why aren't the IET executives probing, asking those questions to the system integrators and OEMs that are the primary deliverer of the equipment that you have, the technology that you have, the maintenance support of that is in [00:21:00] the hands of a third party.

Dino why don't you have your fingers into that? And I'd love to hear a response from a CIO or a CISO to that question, and part of me is sitting there going, they're like, I either I don't want any part of it, or I don't really have the responsibility. I can't control what they do.

LuRae in what you said made me think of like two things. One, every organization knows what an hour of downtime, a day of downtime, like what that cost is. So if you're looking to prove in the ROI of an investment in cybersecurity protection for your production, your revenue generating equipment and facilities, look at that.

LuRae And the second thing is cybersecurity insurance isn't gonna save you. It

Dino might help with remediation, but it's not gonna help you with your losses from business operations, that's for sure.

LuRae But if you take those two pieces and have to prove in the ROI, you know, by, okay, well if we get hit and we're down for a day or more there, you can [00:22:00] look out there the visible.

LuRae Cyber events that have happened and the loss, and we've touched on this before, like what happened to Jaguar, land Rover affected the GDP, the country. So it can have a huge effect

Dino yeah. Look what happened to Stryker just recently, right? and they happen every month. I It happen every day.

Dino We just, every month you want somebody makes the news, right? But a lot of it, it happens every single day. You know, a lot of smaller companies, private companies that don't have to,announce that they've had a breach, are just either paying the ransomware or they're just taking the hit and spending weeks or months, a year trying to get back on their feet depending on how bad the hit was, right?

Dino So and so it happens every day and, and somehow we gotta get past whoever believes that they're holding the cards to try to do this. are not making their way to where they need to be. So like the consulting organizations that, you know, somebody that the IT people rely on. So take your pick of some of these big consulting firms or [00:23:00] even the big IT var that are selling this technology to 'em.

Dino they are not helping with the the strategic direction and strategy on how to really drive this down into your plants, into that last mile, you know? So you either don't think the last mile's relevant or important. Again, that's one opinion, right? Back to that one opinion, or you really don't understand it.

Dino And if you don't understand it, then you just start talking to people who do right and get that second opinion or third opinion.

LuRae I thinkthe summary of this is know who your system integrators are, have relationships with those people. Don't just write the check and then forget until the, you know, renewal comes up.

LuRae Have relationships with them. Have conversations with them.

Dino Yeah, I mean, again, I, it'd be really good to hear, you know, from a CIO or a ciso from a ma large manufacturing company, many size really, why aren't you tapping in to one of the greatest [00:24:00] resources available to help you with this? Why are you ignoring that

LuRae time to take action now?

LuRae Don't wait until it's too late.

Dino It's not that they won't work with you, you know? and out. Every system integrator you're gonna have in your plant is gonna be at a certain maturity or sophistication level around this OT cybersecurity, right? But you might have one or two, and if you don't have 'em, then you need to find some that do.

Dino Again, at work in this space, you know, don't just go off to an IT bar that provisions, you know, cybersecurity equipment, that's, I've seen boxes stacked at the plant that never got implemented because they couldn't do it. It couldn't do it, and the plant didn't have time to do it, didn't know what it was for, and wasn't just gonna throw something on the network hoping that it wasn't gonna be disruptive to their operation.

Dino But they would work with somebody that they see every day who's working on their plant floor and putting technology on their network. They'll work with those guys.

LuRae So I think we always say, don't, you don't have to [00:25:00] go it alone. You don't have to do this by yourself. And if you don't have the expertise in house,

LuRae Reach out. Dino's available to have a conversation. So thank you so much, Dino.

Dino Thanks. See you next time.

LuRae Thanks for tuning in to the Industrial Cybersecurity Insider. To stay up to date with our latest episodes, be sure to click the follow or subscribe button now, and if you found this podcast helpful or have a topic you'd like us to discuss, please leave us a review or let us know.

LuRae Thanks again for listening. See you next time.