Your OT Cybersecurity Strategy Is Failing: Here's Why

Craig [00:00:00] anyone that's got. Industrial assets needs to figure out how do they begin securing protecting and managing those industrial assets in a safe, secure manner. Intro/Outro: Welcome to the Industrial Cybersecurity Insider. In each episode, we dive into the world of industrial cybersecurity. Join us as we cover the latest trends, innovations, and practical insights as we talk with leaders and practitioners across. The industry gear up and let's get into this week's episode.

Craig Hi, I'm Craig Duckworth.

Dino And I'm Dino Busak.

Craig And so what have you been doing lately, Dino? 'cause I haven't seen you, it seems like forever.

Dino Any year started and, you know, budgets have, opened up and clients are coming at us with all kinds of requirements in regards to helping with my cybersecurity and my manufacturing [00:01:00] facilities.

Craig I'm the same way. My head's been swimming after the first of the year, and it's, it's trying to get my feet back underneath me and, and get moving. Started with some of the, the new initiatives we've got going. what's on your mind today? What are you thinking?

Dino there's a lot of things on my mind.

Dino but one of the things I, I think we could talk about is one of the shifts we're starting to see in regards to, managed services, in regards to cybersecurity, specifically around some of the, Ot, IDS, software companies that have, have built service programs outta necessity in order to service their clients who are taking their tech.

Dino And, because of just, there wasn't a lot of resources, experience, and skills out there. And this stuff is fairly new, even though it's been around for a decade now. some of these firms, Is them wanting to move away from that stick to being software companies and trying to find service organizations that can, take on the responsibility of managing and maintaining these O-T-I-D-S platforms, for manufacturers and, and assistance with the clients.

Craig [00:02:00] Well, you know, and I, I look at that and, and we've seen this, we've talked about this in the past. Organizations, resellers were signing up to resell these software companies. They were backing up to the door of a manufacturing site. They were dumping it off, washing their hands and saying, have a great day.

Craig See you later. And they're turning into shelfware. Organizations are now the software manufacturers are starting to see the, let's call it churn, the lack of recurring with renewal rates, and they're trying to figure out that model of how do we ensure that there's what we call local adoption localization.

Craig Operationalizing this technology, so that the client gets value out of the technology.

Dino Value in help. Right. I mean, I think the s are still mounting in regards to risk regulations, the board, the geopolitical [00:03:00] environment they're, up against out there and, with ai, you know, coming at 'em like a freight train, how are we gonna deal with this, right? How am I gonna find the people? How am I gonna build these practices? How am I gonna provide, you know, measurable services that are showing not only that, it's, you know, helping me with my operational efficiencies, but also protecting my manufacturing and operations.

Craig Right. No, totally, totally get it.

Dino You know, and then being able to, you know, determine how well it can assist in that. Right. You know, and I, you always hear me, it has a role right on the field in the huddle. Just can't really be the quarterback in, in owning this because at the end of the day, they don't own the assets.

Dino On the plant floor, because the responsibilities and priorities are much different in that space. So, you know, if you talk about pen testing, right? We hear a lot about pen testing, the red teams, how do I create an offensive situation, that being disruptive to my plant floor, right? And so does that mean that you're gonna, you know, build digital twins?

Dino Very [00:04:00] expensive. you can't really do this type of work in a manufacturing environment that's running without being disruptive. You know, you can't, I mean, we've witnessed what a pen test can do to a manufacturing facility when you're running in the middle of the day running full out, right? And so you have to take a different tactic, which is, well, we'll do it while the plant is down.

Dino Well, good, is that right? All the systems are offline or not, are not powered up. And you know, your pen testing to me is just a waste of time.

Craig Yeah. Well, and in the OT environment, it's, it's more about what does that lateral movement look like? What is the opportunity, once someone is in that environment, what can they access, what can they get to, what can they do when they're there?

Craig It's not, 'cause you look at it holistically, most of. OT side, it's kind of protected a little bit below the IT firewalls, if you wanna call it that. There's still paths down there, but they've got some insulation to them, so it's a matter of how do they [00:05:00] maneuver when they get there as the concern in my opinion.

Dino Yeah, well, it's back to the controller, right? I mean, we still see a lot of clients got stuff that's 20, 30 plus years old. They're still using older, network infrastructure technologies like device net, control net, pro feed bus, et cetera. And there's not a lot of organizations that could even deal with that.

Dino Even the companies, the Rockwells and the Siemens of the world, you know, they're resources of dealing with this. This ancient technology, they don't even have the skill sets anymore. Their recommendation when you have that stuff is to get it out and replace it. Right. And anything coming in new is smarter.

Dino It's more complex. It's, it's more connected. and using, you know, more of an enterprise approach from a network component specifically. you know, I, I've been working with a, a beverage company over the last couple weeks and their plant network is still a very large. Layer two flat network, meaning that when somebody remotes in from the outside, they get access to everything.

Dino You know, there's no way to control where they're going, what they're doing while they're in there. Right. They just, they provide a pipe for 'em, [00:06:00] let 'em in, off they go. You know? And that still exists today, right? Pretty prevalent. and those are areas where it is just, to them it's, like a fish outta water, you know, for them.

Craig Well, it, again, it goes back to the under underlying fundamentals. It does not own nor support those assets, and they struggle with a lot of the functionality around them because of that.

Dino let's be honest, some of those assets are older than the resources they've hired to be their cybersecurity professional.

Craig Well, there is that.

Dino So it's a challenge. I mean, it just, it really, really is. And, to the point getting back to why these cybersecurity. Technology companies are starting to look for partners that are, are more, plant floor focused. For example, the, you know, who can actually patch my control systems.

Dino Right. Either the client can do it, they can't. 'cause most of 'em don't have controls. Engineers, they hire that out, right? And so they're either relying on the OM or the system [00:07:00] integrator. And then the question is even the, are any of those guys still in business? You know, 'cause you've had that equipment out there for, you know, two decades or whatever.

Dino and so now you gotta find organizations that actually can do that work. Who actually can work with their tools. IED cybersecurity platforms have a practice in place and can put together a program for a client to go and execute, patching just of their control systems.

Craig Well, patching is, is a big topic these days.

Craig You know, as you look at how do I effectively and safely patch within the OT environment, whether that's a Windows patch running a HMI, whether that is whatever it might be, what's the method that I do that? And then you have to look at all of the. Ancillary devices associated with what you're looking to patch and is it compatible with the version that you're going to.

Craig So there's a lot of, it's not as easy and clean as it is on the IT side where somebody hits a button and it just sends it out to everything.

Dino and when you think of the supply chain, you know, it's, it's, [00:08:00] you have this, you know, the materials for example, from a supply chain perspective that, you could be doing the best job in the world of, of securing and protecting your plant.

Dino But the organizations are providing you raw materials or other goods and services. If they're not doing something and they have disruption, that that domino effect is gonna impact you, which gets me back to. You know, one of the themes that had been through several of our podcasts is how do you get those IT leadership folks involved with the key suppliers in these plants to determine their strengths and weaknesses around cybersecurity, their partnerships, their practices, their capabilities, you know, to be able to assist that IT organization with driving a cybersecurity strategy within their, company.

Craig Well, know, you look at the supply chain and, and you really are only as strong as the weakest link in that chain. And it reminds me of kind of what the DOD and the, federal government put together. I don't know, 10 plus years ago, they finally gave teeth to, which is the CMMC certification [00:09:00] for anything supplying the entire supply chain within the manufacturer of the DOD.

Craig they basically just stopped allowing the primes to provide any contracts down if they weren't certified. You know, they didn't have another way to fix it.

Dino Yeah. Well and even if they drive through and set up the governance and the policies, it doesn't mean that it'd being applied.

Dino Right. I was talking to a pharmaceutical company just this morning and you know, we started this conversation a year ago and you know, obviously our firm is doing work. For companies like this, and we're still not seeing the, targets that are being generated by the cybersecurity team being, being pushed down into the plant, down to the system integrators who are in there, you know, designing and deploying, supporting commissioning, and starting up these control systems.

Dino And that's part of the supply chain in my view. You know, that's another piece of the supply chain.

Craig and it's unfortunate, organizations spend a lot of time, energy, effort, money to implement these policies, guidelines, and they expect it to [00:10:00] make its way down to where it's important below that control layer.

Craig And a lot of times the effort is not there and it takes a lot longer than it should. So it's, very slow to react. It's like turning a battleship on the earth ocean versus a speedboat.

Dino Yeah. Well, and even the consulting organizations, which is another part of that money that they've spent, to get, you know, a strategy and a report on what they should be doing, but you're not executing.

Dino Right, and that consulting company that, that you hired to, to tell you where you, what you need to be doing aren't in a position to execute either, otherwise again, they would be dragging in these partners that are in there, working in these plants all day, every day, you know, finding out what their capabilities are and what they're doing.

Craig Yeah, well they're, they're good at, at governance. They're good at compliance, not so much from a delivery in, let's call it boots on the ground, and being that last mile in, making sure that it's [00:11:00] operational.

Dino The last smile is the hardest thing to get to in these plants without a doubt. It is, you know, again, because of the lifecycle, you know, spanning decades and, lack of documentation, the uncertainty of how this stuff is put together, how it works, what's communicating in that environment, what that infrastructure looks like, what can you even do at that aged, out, equipment and software and operating systems, you know, and applications that they have in that environment.

Dino you know, you gotta think about the, the whole. Environment, right? You just, you can't eat the elephant in one bite, but you should be able to get, at least at a minimum, start with an asset inventory to determine what your risk and vulnerabilities are and what you have in your house. And from there you can start focusing on end of life into support assets, determine how to develop your capital plan to go after that stuff.

Dino You know, microsegmentation back to my conversation with the beverage company that's got a very large flat layer two network, you know, with the controls layer, putting in technologies that are actually monitoring what's going on in that space and reporting back, you know, to the things that, the metrics that, that you should be concerned [00:12:00] about.

Dino and start, treat it like it is a marathon. It's not a sprint, right? You gotta start somewhere. And, those companies that are cutting their budgets back in this space for whatever reason, you know, to recognizing I don't have the people. To be able to do this. I don't know who the partners that I should be working with.

Dino Back to the conversation of finding out who your system integrators are that are working in your plants to figure out what their capabilities are, you know, and, you gotta get all the liars in the same room at some point in time. And, you know, a lot of that includes the plant people and, and they're left out.

Dino A lot of those in those conversations too, you know, the local teams.

Craig Well, it's a mind shift. it changes the narrative. You look at the OT. Ecosystem and the, the mind shift, the, method down here has always been very reactive and break fix. Methods. So you change that from, you know, what you mentioned a while ago is lifecycle replacement.

Craig In that space, these IDs that give you [00:13:00] full asset inventory with make model, serial, end of life end of support, now you can begin building that capital budget for next year or next quarter or whatever your time when it looks like, and you can have a. forward looking mentality that says, okay, in fiscal year 28, we've got 175 PLCs that are, pick a brand that are end of life in a support that we need to consider replacing with something else, or at minimum.

Craig Putting controls around, how do we make sure that they are the most secure in our environment? 'cause there is nothing else we can do besides monitor them at that point. And how do you begin putting a plan together to do that?

Dino Yeah. Well, and part of it, you know, it's, it's that coin operated mindset of.

Dino Some of these organizations that are just, that want to just sell technology, right? And we recognize that sometimes these, sales cycles can be long and for this particular, area of cybersecurity and industrial environment [00:14:00] versus somebody who's just focused on a quarter, right? They're only gonna spend time and energy on the things that they can close in that quarter versus trying to, to farm and work and understand what needs to be done in order really to deploy a solution, you know, in a consistent manner to get the depth and visibility of that last mile in order to really start rounding out your cybersecurity posture within these environments.

Dino And I think that's a, you know, I don't wanna be a hypocrite, you know, obviously we're in the business to provide services and make money as a company. But at the same time, I don't look at it as I'm only concerned about this quarter in a quick hit sales cycles, just so I can, make the deal and move on, I know it's, a long-term play in order to do this.

Dino Right.

Craig Yeah. You know, you're starting to be looked at as a strategic advisor at a partnership to that organization when you're looking at multiple years worth of value creation for that organization. Not a quick sale and walk away, But again, it's changing that mindset and [00:15:00] bringing more value to the organization.

Dino Yeah. And you know, the other thing we're starting to witness too, I know you mentioned just a few minutes ago talking about shelfware. Well, now we have organizations that have had these tools out there for a number of years, 3, 4, 5, 6 years. And they're, and they recognize that the first one they went with wasn't the best choice.

Dino Right. And so now they're, they're recalibrating and thinking, well, now I need to go look at another tool. You know? And then there are those that I think picked a really good tool just to implement it or manage it properly, to waste time and energy, go and look at another tool. Right, which is not necessarily the best course of action either.

Dino So yeah, generally speaking this, we're starting to see a shift of people changing from one to the other. We've seen the mergers and acquisitions right here, just recently, two big ones with niomi just in the past few months, you know, moving to a, a very large, really IT organization, well, except for Mitsubishi with OMI, is more of an automation company versus ServiceNow, which is it picking up all of this.

Dino Right. obviously Dragos and Clarity are still out there, [00:16:00] independent, you know, working and, We are starting to see flips in technologies because the company just wasn't seeing the value or the benefit of the tool that they bought.

Craig Well, and, and you look at, you know, that clarity just took another $150 million in the last week, 10 days, whatever it was.

Craig So, as these organizations continue to evolve, continue to refine their product, end users. That felt they had the best technology five years ago, six years ago, based on architecture and whatever. You wanna look at promises made by whoever are realizing maybe there are better, more suited technologies available for what that end user is trying to solve.

Craig For and what they need to do and other newer technologies that are, let's call 'em, smaller startups are coming on scene that are starting to make a splash a name for themselves that are doing it different. Leveraging that AI for some of those minimal task to help [00:17:00] automate the process to be more efficient.

Dino Yeah. Well, in the automation vendors, Rockwell, Siemens, Emerson, they provide services. and they have the technology, they have, at least the partnerships per se, you know, are starting to drive and change that narrative as we're describing the fact that this OT ecosystem has to get better at this, right.

Dino The question is, is those large automation technology companies can't deal with everybody, all the clients they're working with the Fortune fifties, maybe the fortune one hundreds, but anything after that, you're on your own And you may have Siemens of Rockwell in your plant. That doesn't necessarily mean that they're sitting there because one, you, you probably couldn't afford 'em to come in and be your, you know, your overall managed consulting, execution, deployment, managed services group, you know, very expensive to bring them in.

Dino So now you have to start shifting your thinking about, well, who can I actually go and talk to about this? But they also have to be well suited to work in the manufacturing space versus somebody who's used to working in the back office. Well

Craig and I would [00:18:00] say, every manufacturing site that I've been in, I know that you have, there's no one automation vendor exclusively in that facility.

Craig There'll be many that we run across, and it's gonna be difficult to get an O-E-M-I-E Rockwell or Siemens or Snyder that is. A manufacturing technology company to go in and support all of the manufacturer make and models, not just their own versus a systems integrator that is accustomed to working with a mix and myriad of everything that's there, no matter what it is, because the facility just says, make this stuff work.

Dino Right. 'cause they're agnostic. Right. That's, they were, they were built that way to work with the various, auto technologies out there for manufacturing.

Craig Oh yeah, for sure. But again, it, it leads to a lot of other stuff that we see on the plant floor from a, I'm gonna do whatever it takes to make my plant.

Craig Operate, whether that's pulling in internet from an ISP, whether that is creating a [00:19:00] shadow OT or IT network to put Chromebooks on a separate VLAN or a separate internet pull, whatever it takes to get the job done and skirt or. Avert or disregard some of the security policies that are in place because they're so restrictive?

Dino going back to the shadow it ot, I don't view OT as being a shadow IT group. I just don't. Right, because it is, is not, is not engaged at that control scada DCS layer within these manufacturing plants. They're just not, you know, I've been doing this for decades and I, I haven't witnessed it yet.

Dino You know, the closest it gets is portions of the network, MES applications, VMs, you know, some firewalls. That's the EDR, you know, is the gist of what they're really trying to drive. And even on the EDR [00:20:00] front, we don't even put EDR in the HMIS that we put, that we design and build for the clients because we know that, managing and administering that technology within that control system environment can be very disruptive.

Dino Operations. we just see it after the fact where it talking about shadow, where it is becoming the shadow group, in my opinion, to that. Right.

Craig There is in my opinion, if you look at the EDR, what's the true R down in the OT space? There's not a remediate, there's a maybe respond. I don't, I don't know, but there's, it's minimal because really, what does that mean when you're dealing with controls?

Dino Right? Well, it's if you have an event, your first responder is who?

Craig It's a controls engineer.

Dino The operators. That's right. It's the operators. It, it's somebody needs to get that equipment to a safe state, get product into a, a safe place, you know, to, to keep from losing product, damaging equipment, environmental, you know, disbursement.

Craig Physical eyes on the [00:21:00] operations. What, what is taking place? Was this a change that needed based off of temperature, time, speed, something that they're trying to correct fix or something is just really awry,

Dino right? So, you know, so COOs, executives in the engineering ranks, manufacturing operations teams, you really gotta step up your game, right?

Dino You know? and, and not defer, right? Just assume that your IT organization's covering the basis you really have to dig in, and start figuring out how you can best survive, from a cybersecurity perspective and AI perspective within your ecosystem of the technologies that you are procuring and implementing and using to make the goods and services that your manufacturers make.

Craig Well, and, for those that are out there that haven't done anything, that don't have a vulnerability management visibility tool or any of those in place, the time of doing nothing is [00:22:00] gone. that was 2025. That ship has sailed. 45 days ago almost. It is time to get with the program and start evaluating, looking at discovering, doing bakeoff, reviewing the technology and finding what works for you and start making a change.

Dino Right. And, and go to events and conferences that, that speak exclusively to this stuff. Like,

Craig oh, we got one coming up.

Dino That's right. That's four. It's in Miami in a couple weeks. Right. I mean, and, and this is not a new event, Dale Peterson's been doing this for 25 years or more. I think he's been running S four and he's got, they got a good following.

Dino They got, a lot of assets owners that show up. You've got the consulting companies, you've got the engineering and integrators that are at this event. You need to start finding events. Like S four, if you're a CIO or a CISO or an IT executive, instead of just going to RSA and Black Hat and you know, whatever Cisco's doing, you know, go to Rockwell Automation Fair, go to S four, go [00:23:00] to Manufac sec, go to Hanover, Messi, right?

Dino go to these manufacturing, conferences and events and see what the hell heck they're doing.

Craig anyone that's got. Industrial assets needs to figure out how do they begin securing, protecting, and managing those industrial assets in a safe, secure manner. And these conferences are gonna give you the basis for where to start looking to make that decision.

Dino Well, you can see what your peers are doing, your competitors are doing, your colleagues, you know what they're doing. You know, so you don't, you know, you're not looking at it through just one lens. Go, go. You need to get multiple lenses, you know, to. And, and meet the folks that are being tasked with the same thing you may be being tasked with.

Craig Right. No, totally agree. And, and this is for, for those that missed this year's S four coming up in two weeks on Miami Beach, next year's going back to Tampa. So I think Dale found a little bit larger venue that's gonna hold more people so he can get more people involved from the industry. [00:24:00] Again, it's a phenomenal opportunity for anyone in the industrial space to evaluate new technologies.

Craig This is a, a cutting edge. Conference for industrial asset owners and technologies.

Dino Yeah, you gotta keep learning, you gotta keep asking questions, you still gotta keep gaining knowledge. You gotta find out, who are the, the shakers and movers in this space that you can work with.

Dino Your vendors will tell you if you did start enough that you're, you know, if you, you're talking to, to Cisco or Clarity or you know, RMS, if you're profiling the type of partner you're looking for. Those folks can help you find those groups because again, they're trying to get out of the services business, right?

Dino They don't want to be in that business. They wanna be software tech companies. They don't wanna be hardware group guys. They don't want to be services organization. They want their partner community to pick that up.

Craig Well, again, you, look at organizations like Design Group and the versatility that we have across the automation [00:25:00] industry and the various.

Craig Makes models, manufacturers that we can work on support the tools that we have, the ability to bring in and help manage from an operations. It's very vast where if you are pick clarity or pick arm or pick whatever that is, then you're trying to train an entire team and the number of. People that you have to have is astronomical.

Craig at design, we've got 1600 pros, and there's a vast experience level across all of that industry. It's not just one. You can't, that's not an overnight gathering of talent.

Dino That's right. and, and chances are pretty good if you're in the food and bev industry, we're already working in your manufacturing plants, highly likely.

Dino Same thing with life sciences, pharmaceuticals. You know, you, you can go down the list of some of the big verticals that we operate in, but you need, to find out who, they are. Going back to that conversations from the IT [00:26:00] perspective, who are they working with? You know, who can I talk to?

Craig my message to that would be, don't go down the path alone.

Craig Talk to your systems integrator. Talk to your ecosystem. Talk to a peer that's, that you feel is non-competitive in nature. And ask them what are they doing? How are they addressing it? Board members across. All verticals are having these conversations. They're expecting the C level down to begin addressing this if they have not already started.

Craig it's coming. Find yourself a partner, somebody that you trust that is in the space, that has a practice. Lean on them for guidance. If you wanna build your own practice in the next. 24, 36, 48 months. That's great. Leverage that trusted partner until you can stand on your own two feet and be confident and comfortable in what you're doing.

Dino Yeah, and if your model's outsourcing on the IT side, probably should consider this same thing on your OT side when it comes to cybersecurity. So whatever [00:27:00] reasons why you decided to outsource, you know, a lot of your IT technologies and services and support, you need to think about the same thing on the OT side because the OT side's already doing it.

Dino When it comes to controls engineers, most organizations do not have controls engineers. They don't. They got some mechanical people, they got some. Got folks out there that can do break fix stuff, and their job is to fight fires most of the day and keep those plants running. They're not visionaries that are sitting there at the top of the trees looking across the horizon to try to, trying to decide which direction to go.

Craig Yeah, no, it's a a hundred percent, a hundred percent correct. we're seeing in the news almost daily, the number of. Attacks because they're either ai, augmented driven, supported, are continuing to go up. they're targeting manufacturing across the different verticals.

Craig It's not going away. This problem that we have is not going away. It's gotta be addressed and. Organizations have to start owning this. And there's no other way. You can't sugarcoat it anymore. [00:28:00] it's time for the truth.

Dino and from a manufacturing perspective, you know, trying to find resources is difficult.

Dino Right. A lot of folks are retiring out. You know, you've got that, silver tsunamis I like calling it, but, there are the peak 65, but we all know that for every two jobs that are leaving, maybe one's coming back, you know, and this is where we, you know, you need to make the plea, you know. Women diversity coming into man, think of manufacturing.

Dino You know

Craig anybody? yeah. Anybody we could just clone you and make you work another 55 years. How's that sound?

Dino Yeah. They just, we gotta have folks that want to work in this space, but you gotta make it so that it's, it's something they want to do. gotta be attractive, it's gotta be safe. it has to be fulfilling.

Dino You know, there's a lot of other attributes to, get folks to want to come into the manufacturing space. It's just, it, we, you got our work cut out for us on that front.

Craig Yeah, we do. Great conversation. Dino. it's good to catch up with you as always. Feel free, you guys, if you're looking for [00:29:00] help, you need some guidance, reach out to us, we've follow us.

Craig Send one of us an email, give us a phone call. Whatever you need, we're, we're here to help support you. Again, this is, we're all in this together. Intro/Outro: Thanks for tuning in to the Industrial Cybersecurity Insider. To stay up to date with our latest episodes, be sure to click the follow or subscribe button now, and if you found this podcast helpful or have a topic you'd like us to discuss. Intro/Outro: Please leave us a review or let us know. Thanks again for listening. See you next time.