Your Organization Says It's 'Green' on Manufacturing Security: Here's Why That's Dangerous

Craig [00:00:00] when it comes to change, patching, updating, modernization, they're driving that narrative with the OEMs or the SIs.

Craig They're choosing that path normally without any IT interaction. they're not asking them, "What SCADA system should I use? What HMI should I buy? What switch should I put in this panel?" IT normally doesn't even know they're getting a new panel made. there is no IT collaboration in that aspect, and OT is owning that, so they should kind of own part of the rest of that to a degree. Intro/Outro: Welcome to the Industrial Cybersecurity Insider. In each episode, we dive into the world of industrial cybersecurity. Join us as we cover the latest trends, innovations, and practical insights as we talk with leaders and practitioners across the industry. Gear up, and let's get into this week's episode.[00:01:00]

Craig Craig Duckworth

Dino Hi, Craig. I'm Dino Busalacchi.

Craig uh, kind of go back to this whole who owns cybersecurity, and when it's owned jointly, who's responsible? So OT security is really everyone's responsibility, but who actually is on the hook when it doesn't go right, if something were to go wrong?

Dino Well, when it's everybody's responsibility, that means it's nobody's responsibility, right?

Craig Yep, good point. there's a lot of finger-pointing in that situation, you're right.

Dino And, it exists. I can't emphasize enough at the end of the day, it's the asset owner. I mean, when it really comes down to security, it belongs to the asset owner. and there's a clear [00:02:00] delineation between control systems and what I wanna call back office business IT systems, right?

Dino That includes the plant network, firewalls, switches, the applications, the infrastructure. Who owns the asset at the end of the day? And the things that IT owns, it is their responsibility, the OT side is doesn't belong to them. It just doesn't. And I can't emphasize enough that because of that, OT does pretty much everything within their power to keep IT from getting down to that control system level for, some type of administrative management cybersecurity role, right?

Dino Because of production, because of safety, things along that nature, right? Because you gotta remember the OT world makes money, that's your revenue. They generate revenue, and IT is an overhead and [00:03:00] expense. And the, it's oil and water. I just went through this again today. there's pushback from OT folks.

Dino you got an organization that's failed an audit 'cause they don't have asset inventory, right, to determine the risk and vulnerabilities associated with that. And the CISO, the global CISO who's owns that responsibility, right? To, to your original question, who owns OT cybersecurity? That CISO, I guess, is raising their hand.

Dino Maybe not as high as they would like, but regardless, they're raising their hand. But as soon as you get to the plant and you start trying to figure out or describe and define how to get that asset inventory within that control system layer- there's a wall

Craig Well, that goes back to the difference of responsibility versus authority.

Craig If the CISO has responsibility, then [00:04:00] he-- the CISO is gonna be the scapegoat, because in that example you just described, he doesn't have authority when he gets to the plant. He's being told, "Thank you, but no thank you." So again, back to how do you get past that problem?

Dino Well, it's by... You have to begin somewhere, right?

Dino So, so take the leverage. If IT is driving this narrative and has this responsibility, they have the capability of getting this technology into the plant, right? To the things that they own, right? and we know, we both know that a lot of that OT traffic comes up into the IT realm, right?

Dino Where it would get captured for the asset inventory. You may not get everything that you need, but at least you know the things that are coming up, as we call the north-south traffic, right? You're able to pick up a few things. where IT, I think sometimes falls short, and we've seen this before, we see this a lot actually, where IT has bought a [00:05:00] tool to do that.

Dino But we both know that they're capturing maybe 20, 30% of the assets in the plant and missing a big chunk of them, right? But being able to show that to the engineering teams, the OT teams, and show value and benefit of it, just from the little bit that you do have, right? Have that continuous, conversation with them of doing what you're doing, and then how can I expand this?

Dino Which is where our IT can struggle because- Firms like ours and even the OEMs, they're not bringing cybersecurity safeguarding measures into the projects that they're doing. We think that we-- they should. we're looking at how we can put language in our proposals to be able to, safeguard, the project that we're there to do, right?

Dino You got a $2 million project, to do this line modernization. You got some OEM equipment coming in. how do you ensure that there's no malware within the environment, within the scope of what you're working on, right? Not the [00:06:00] whole plant, but the things that, that you're responsible for and the egress and ingress points of data coming in and out of that process area, 'cause you know there's connectivity up and out and in.

Dino so it's coming in and it's going out. So are you-- do you have overwatch on that? are you monitoring those communications and that activity surrounding your project, to safeguard malware, malicious IPs, default passwords, rogue assets, things that can be disruptive to the environment or, can slow your project down and/or cause, like a breach potentially.

Dino and so that being said, the OT world has to get better at how they want to provide safeguarding, because if the client's doing it, if the client's really trying to do that, then they would be laying those requirements at our feet in the RFPs that come out saying, "Here's how we are gonna handle that there's no malware in the environment.

Dino Here's how we're gonna handle, known exploited vulnerabilities, per se, malicious IPs, rogue [00:07:00] assets." they would be defining that and making sure that we're following their guidelines, right? And they're not doing that, right? We-- In the hundreds of proposals that we do, in a quarter, none of that stuff is in there, right?

Dino So as a CISO, it's what I've always said in prior podcasts is, these CISOs should be tapping in to the integrators and the OEMs that are working in their plants every day, all day, providing technology to see how they might be able to assist them with their cybersecurity, strategy that they're pursuing, right?

Dino And that's not happening either

Craig It's not. and a lot of it, I think, goes back to the false sense of security where the CISO is being told one thing or being led to believe one thing, and he's not as familiar and comfortable with the OT side to go and ask his own questions and is relying on other people to give him information versus, 'Cause wh- when you look at it, IT [00:08:00] assumes that the OT teams can handle specific decisions, and they can as it relates to uptime, safety, processes. But if something were to happen and there were malware, let's say, got ra- started running rampant in the plant, the OT teams, their focus is gonna be on, "How do I keep these machines safe and my team safe?"

Craig Versus worried about propagating that malicious virus or whatever it happens to be, and it's a different thought. It's a different mentality, and it's not aligned.

Dino Yeah, it's not. on the risk and compliance side, right? if you're con- if you're in control of the metric, take the CISO, for example, and they put in a tool, an OTIDS platform, and are able to get something.

Dino They might, they would probably say, "I was able to meet my metric because I told you that I would collect OT asset information, and I got what I got." E- [00:09:00] even though you're missing 80% of the assets in the plant, but if you're controlling, if you're the one that's in control of the red, yellow, green, status, then you'll pay...

Dino You'll say, "Green. I did what I said I was gonna do." and they'll just ignore the other 70, 80% of the assets that they're not seeing or don't have visibility into because, one, they don't own the asset, two, they- they're gonna believe they did what they were tasked to do.

Craig Yeah, but for a devil's advocate, though, I'm the CISO.

Craig I'm gonna say, "Well, yeah, but 20%, if that's the number you say I have, is better than no percent, which I had yesterday before I turned this on."

Dino Get it. Yeah. Right. Right. So I'm green, right? I would say that I'm green and not red. Knowing that from a risk and compliance perspective, you just barely moved the needle.

Craig Right. I'm still missing 80% of my assets, so really that green is not quite as green as it should be.

Dino Right. and I've seen [00:10:00] organizations do that, right? IT, if you're controller of the, of metric determine the status of how, where you are from a project perspective, then you did what you said you were gonna do.

Dino 'cause there's nobody coming back that's gonna call you out on it and say, yeah, just like the folks that we worked with a year or so ago that's in, was in the fo- bev- beverage industry that was missing 135% of their, OT assets for a tool that they've had for years, right? And I'm sure that didn't sit well, right?

Dino When you think about risk and compliance, you're really trying to figure this out, then the only way you're ever gonna get there is you're gonna have to leverage either the OEMs and system integrators that are operating in your facilities today, or you're gonna have to really push through the OT guys to implement these visibility tools to get the asset information you want.

Dino and like, the pushback that, that I got f- from one guy, "Well, what's the pros and cons? I see more cons than I see pros because, you're providing things into an environment that I feel like I may already have." [00:11:00] But not even knowing the difference between whatever it is that they're doing compared to what a cybersecurity platform would look like that's collecting the fingerprinting of these OT assets, right?

Dino And,and not even... And that's just a cybersecurity conversation. It has nothing to do when you start talking about process integrity, about control system changes, assets coming and going out of the environment, remote access into the environment,online edits to your controllers, misconfigured devices, un- unforeseen unknown traffic that's flooding your network on your control side.

Dino You're missing out on all of that, right? Which helps you run better, right?

Craig two schools of thought on that. One, I'm the CISO, and I'm like, I meet with my OT teams, and they're telling me all the stuff that's fine, and I kinda know that it's really not. So do I wanna hear again how bad my environment really is from somebody else?

Craig And [00:12:00] truly, again, I think it takes it to a different level if I am the CISO, and I now have a report from a third-party independent verification that says, "Your baby's really ugly, and it's you got some significant problems that, that now as an organization I have a legal and a responsibility to do something with."

Craig Versus just checking a box and going back to, "Well, I'm better today than I was yesterday." But at the end of the day, is that better okay in standards? Or is it, again, are you, can you, do you need to pull your head out of the sand and look at this and say, "Okay, I know that my baby's ugly, and here are the first three steps I wanna take to, to try and do something in the next quarter, the next half, or the next fiscal year," whatever it is, and put together that plan to begin making advances.

Dino Yeah. Well, [00:13:00] again, If you're missing out on 80% of your assets and you're saying you're good today, how do you know there's nothing malicious in the environment?

Craig You have no idea.

Dino No.

Craig You, you

Dino don't know. And so again, it- you're working in, half measures here versus an overall plan and strategy.

Dino and personally, I believe the way to solve this, 'cause we've been looking at this seven ways to Sunday for years, and not just us as part of the design group or our prior, OT cybersecurity, but, my time at Rockwell, and in the channel with this,I know this problem pretty well.

Dino And what's missing is the OT ecosystem is not driving this narrative.

Craig There's no ownership- Yeah ... in OT, yeah.

Dino But from a, for system integrator perspective, why not put safeguarding measures in your proposals that are at least at a minimum asking those questions and determining what's client responsibilities and what's [00:14:00] clarifications and exclusions, right?

Dino In regards to safeguarding. I want overwatch on this project that's gonna go on for the next several months in your plant. here's the scope of it. There's a lot of technology. So I want overwatch. client has a tool, we need for you to provide overwatch on this, right? And we wanna be able to do that data.

Dino If you can't do that or won't do that for whatever reason, then we should have the option to be able to do it for ourselves. Right? To provide overwatch. To look for those, activities that could be disruptive in the environment. I don't wanna be accused of bringing malware into the plant if it was already in there, right?

Dino For example.

Craig Yeah. and that makes sense. I would agree with you that ecosystem needs to be driven by those asset owners on the OT side. It's because when it comes to change, patching, updating, [00:15:00] modernization, they're driving that narrative with the OEMs or the SIs.

Craig They're choosing that path normally without any IT interaction. they're not asking them, "What SCADA system should I use? What HMI should I buy? What switch should I put in this panel?" IT normally doesn't even know they're getting a new panel made. there is no IT collaboration in that aspect, and OT is owning that, so they should kind of own part of the rest of that to a degree. Marker

Dino Yeah. Well, it's like the folks I talked to today that still don't understand what these tools do, right? and they may even had a tool in there, and how it was deployed and who did it and what technology they used, maybe they got a bad taste in their mouth, right?

Dino Because they didn't really work with a group that knows what the heck they're doing. my point is that the client's OT organization, and many of them, are still very, that's probably not gonna sound good, but they're just not very mature. [00:16:00]

Craig But this is all new though, Dino, so that's not a, it's not a bad, it's not a bad thing.

Dino it's been around for over a decade, right? And it's gaining momentum. I mean, these companies are growing. They're billion-dollar-a-year software companies that are focused purely on OT cybersecurity, right? And they're fanning out, they're getting bought by bigger companies.

Dino They got money being infused by big consulting companies. It's like, was it Dragos with the Accenture infusion of cash and their role, whatever that's gonna be. They bought Phosphorus, Dragos did. You got Armis was,acquired by, ServiceNow, right? We've seen Microsoft do it. We've seen Cisco do it.

Dino And so to say that this is not a thing, is somebody that's truly not paying attention. you're living under a rock. if you think that my job is to make sure that this line runs day in and day out for whatever productions, and that's all that matters- the only way you're gonna f- see,value and benefit from a, an OT cybersecurity tool is for it to come in with somebody with the chops [00:17:00] who've implemented it hundreds of places for various reasons to show you the value and benefit of what this tool can provide to you for multiple reasons.

Dino Not just the cybersecurity piece, but also the operational and process integrity piece that it brings, right? and recognizing that the way that you're doing it may not be the best way, right? and your risk and compliance, y- I mean, you can change a lot in improving your cybersecurity posture if you got people pulling in the same direction.

Dino And right now, I just do- we just don't typically see it, and that's, that includes all three, IT, OT, and the OT supplier, the OT ecosystem that's involved.

Craig Yeah. They're, they all need to be working together. They all need to be on the same page, so that in the event something does happen, it removes the finger-pointing that often takes place in that situation, But if you go back and you look at, let's call it the fire [00:18:00] drills, the incident response fire drills, does each of the teams, IT, OT, know what to do, who to communicate, how to proceed in the event something takes place? is that being practiced, if you wanna call it that, at minimum annually, ultimately, every six months so that everybody knows what to do.

Craig It's, in today's environment with AI, the nefarious actors are taking advantage of vulnerabilities quicker than they can be remediated and fixed from the vendors, from the SIs, from the end users, and it's not a matter of if, but it's a matter of when, and there's gotta be plays in place.

Dino Right. Well, and again, the thought, they, the OT guys already know they're way behind from a patching perspective, right? They know that there's no way that they could ever patch themselves out of the predicament that they're in. [00:19:00] Now, nobody's expecting them to do that. But that being said, it doesn't mean that you can't map the communication flows within your control system environment to determine what traffic is warranted in this space versus what is not, so you can put that mic segmentation in place.

Dino For those machines that you can't patch, there are other technologies that you can put in there to prevent e- exploitation of vulnerabilities like virtual patching, right? we talked about that. So there are paths and avenues to help solve that, "I can't patch at will," like IT can, right? IT patches at will for the most part, generally speaking.

Dino Plant does not. So you have to take on dif- different techniques. So this is not a technology problem, this is a people problem. it is. And I, and there's a trust issue between IT and OT. it, it just, you always hear it, it's there, it doesn't go away. And again, there's a very clear delineation on asset ownership In this, in the space between IT and OT.

Dino there's no question about that. Who owns that [00:20:00] PLC? Who owns those drives? Who owns that HMI? Who owns the network those control systems are sitting on, right? 'Cause there's us- there's two. There's always two. There's, sometimes there can be three, but there's the plant network that IT's got, and then there's the OT network which the control systems run on.

Dino And using PLCs as a firewall, the OT people thinks that they're still air gapped and isolated because of that.

Craig But again, that, that's a false sense of security. When you've got the ability to get down to those lower level networks, again, it goes back to that mentality of we've designed this so you can't, but technology is allowing it to happen.

Dino Well, you can even track it, right? At least on the plant network, if something's going on and you've got the right tools in place, at least you can follow the activity, right? But once you get to the control system, it, it's all gone 'cause they're not doing that. They're not monitoring. that was the term that [00:21:00] they used, monitoring my network.

Dino to them, they view that as you're putting additional resources in my environment that can be disruptive and it's being managed by somebody else besides me.

Craig I get it. Back to that inherent tr- distrust of I will be 100% in control of my network so that I know what happens and no one else can do anything else in it.

Dino That's right. Yeah, 'cause if you put something in their environment and they have an outage of some sort, it can be completely unrelated to what you put in that environment, the first thing they're gonna do is take whatever you put in them. They're gonna take it out.

Craig Yep. No, without doubt. We see that all the time.

Craig Yeah. Yep. Yeah.

Dino Well, until next time.

Craig I think that's a great start. Hopefully organizations can kinda get an idea of how to better determine what that ownership needs to look like. So we're here to help. Feel free to [00:22:00] give us a call. We appreciate everybody listening and watching. Have a great day. Intro/Outro: Thanks for tuning in to the Industrial Cybersecurity Insider. To stay up to date with our latest episodes, be sure to click the follow or subscribe button now. And if you found this podcast helpful or have a topic you'd like us to discuss, please leave us a review or let us know. Thanks again for listening. Intro/Outro: See you next time.