Zero Trust in OT: A Look Back at Lessons Across IT and OT

[00:00:00] LuRae: Welcome to the Special Zero Trust in OT Environments. Rewind episode where we explore why IT security frameworks don't simply transfer to the plant floor. How legacy systems create unique hurdles and practical alternatives for securing industrial equipment.

[00:00:43] Dino: I mean if you look at, as we like to call the IT OT convergence, IT OT collision is because in the past it has implemented some level of security. Within the environment that's been disruptive to the plant floor.

[00:00:58] Dino: So for example, remote access is a good one, right? I have a machine center that has failed on my plant floor. I can't get somebody on site for three or four days, so I'm gonna give them remote access, right? In order to get the plant back up and running. And if you have policies and procedures in a place that it takes a week to get somebody onboarded, to get 'em in.

[00:01:17] Dino: Number one, or the remote access isn't working and I don't have anybody available to me on the IT side to make, to set it up, get whatever is required, and now all of a sudden I'm experiencing a day or a half a day or a weekend of downtime is costing me hundreds of thousands of not millions of dollars a day.

[00:01:35] Dino: So because of these types of events, what is OT said to it? Take that crap out of the way, or I'm gonna put in my own pipe and ignore you entirely because I can't afford this. Right. I don't think it's

[00:01:48] Jim: what is, yeah. I don't think it's what they're going to say. It's what they say right now. Right, right. And, and we find it even without zero trust, maybe we afford trust, Or three trust, I mean, without zero trust and that, that gets to something that we see. I, wrote down coordination. And I'll get to coordination in a minute, but it's the capability, the, IT organizations and their change management, which are great, wonderful things, they don't align with it.

[00:02:11] Jim: So if you're taking zero trust and you suddenly go, okay, we're putting in zero trust, but I need a change right now. Well, how's that handled on the IT side? I mean, we go through it, right? Like you said, we go through it and go, wow, you gotta be set up as a vendor and then you fill out some paperwork and then it's gotta go into this guy's queue and that guy's queue who's paying for it's, who's

[00:02:35] Dino: paying for this?

[00:02:36] Dino: Cost units

[00:02:37] Jim: is writing the check for this. and that's usually one use case here, right? Which is just, I need somebody now. And that's just one use case. Imagine. And the other use case that can be thought of as, okay, well now I put zero trust in and I'm pushing out these rules, Which are great. I took my baseline and I'm pushing these rules out, that maybe they haven't logged in in six months. Right. So maybe a maintenance window

[00:03:02] Dino: they haven't witnessed that's popping up maintenance. Yeah.

[00:03:04] Jim: right. That's the thing. You get a maintenance window and a guy's coming in on one panel and he is, he is working and has to fix the interlock on another.

[00:03:10] Jim: Well, your baseline doesn't include that suddenly their maintenance window is extended because they can't get the machine up or they can't get the work done. And meanwhile that. Tickets, sitting somewhere involved in there. So, guess not to get on the, it, it's, it just needs to recognize that, right?

[00:03:28] Jim: And go, well, what is my capability? Does my capability meet the needs that production needs? If I'm gonna roll something out. Like zero trust, right? Do I have that capability? Do I have that knowledge? Can I support those things? It's not just turn it on and let it run and then if something happens, it's a week window to troubleshoot.

[00:03:49] Jim: don't have a week, These guys are out there running around, they got an hour, they're trying to get it back up and running. while the zero trust, don't get me wrong, is great. it's a great strategy and a target to keep moving forward to.

[00:04:02] Jim: there's just all these implications inside of, supporting that in an OT environment that have to be thought through.

[00:04:09] Dino: and if you don't do it in a timely manner, in a collaborative manner where everybody agrees to it, you will find these OT environments finding alternative methods, right?

[00:04:20] Dino: And pathways to get work done in their environment. They just do, you know, and the question you really have to ask yourself is who shadows who? Is it incumbent upon the OT people to learn and do what it does every day and how they operate their practice? Or is it more incumbent for it to learn what OT does every day and how they run that plan?

[00:04:38] Dino: right. I would, I would vote on the latter, you know, just

[00:04:41] Jim: I would, because that's, no, you should, that's a cash register. You always say it's the cash register. Right. If I'm a manufacturing company, I'll go, I, I don't understand what all u it guys are doing, but I understand that if this isn't producing product, I'm not making money.

[00:04:56] Jim: So, who wins? Who wins in that?

[00:04:58] Dino: I would say if you're an IT security professional, and if you haven't visited your plants on a regular basis, meaning you're, you spend 90% of your time in the field, especially if you have 30, 40, 50 plants in your fleet, then chances are. You're not gonna be able to develop an all encompassing, detailed cybersecurity scope for your manufacturing environments.

[00:05:21] Dino: Right, right. and that's just getting out there and, and living through the production aspects of it. But startups, And or, maintenance windows when we're, taking the plant outta service for the weekend so we could go in here and do a few mitigations and to clean and repair and do some updating on some of our stuff.

[00:05:38] Dino: we could try to do a bunch of things in a short period of time so we can have the plant back up and running by Monday morning or whatever. Mean midnight on Sunday, right? I would argue if you're as an IT person, networking person, security person, or not working through that on a regular consistent basis, you will struggle.

[00:05:55] Dino: Cyber security solution for your organization at the OT level?

[00:05:59] Jim: Yeah. And I wanna say to my IT friends out there that hear that it's not, and it may not be your fault. And that's why I use the term capability. I. There's only so many resources to go around. So if you're it and you're scratching your head going, well, I can't get out there, I can't get that knowledge, you go, okay, you need a new capability.

[00:06:17] Jim: And is that new capability gonna be more resources, reallocated resources, are you gonna use services, and knowledgeable people on the outside and quite frankly, loop in your OT friends out there, loop in your production friends because. they might have some money to spend too if, they realize you're doing this to help their resiliency, right?

[00:06:37] Jim: They may be thinking about it and not even talking to you by saying, okay, well what do I need to do? I wanna jump to a couple other things here real quick, but to wrap that one up from a capability standpoint, and I think this'll be throughout any of these, security lessons that it does that.

[00:06:53] Jim: They need to at least start that conversation there. So, hey Dina, wanna, I wanna touch on the asset inventory, another component that it does a pretty darn good job of,

[00:07:02] Dino: right?

[00:07:03] Jim: it's something that the OT folks need to kinda listen to. I'll open with something and, and I tell all the clients this in our intro, meetings is that, I came from the IT side and as I, joined up with you here at Veta.

[00:07:17] Jim: One of my realizations was, well, hey, there are a bunch of engineers and don't engineers have good inventory, right? You would think they know. No, they don't. They have horrible inventory. they don't know what's inside of those panels specifically. They'd like to, they have a general idea, but they're more focused on what's going inside that machine and going out the.

[00:07:36] Jim: The outside and what's it producing, right? What are my raw materials? Is it making the other end? Then it is all the network and devices components that are on the existing side. So from an IT perspective, while you have a good job of your inventory, don't assume that the OT guys know everything that's connected out in their plant.

[00:07:55] Jim: And that'd be a great way for the IT guys to come out and talk to the OT and say, Hey, uh, there's some value here. But let's talk a little bit about that from, you know, the asset inventory to take that lesson to the OT side. what should the OT guys be thinking about? What should they have?

[00:08:12] Jim: What level of expectation should they have from getting a good asset inventory on the OT side, first I need to recognize it does that. There's probably a 20 to 25 to one ratio of OT assets compared to IT assets out there on that plant floor. So numbers are a lot bigger. and asset inventory. You know, when you got a manufacturing facility, let's say that's running seven by 24 by 365, those engineering and operations staff, there's a lot of people coming and going inside those manufac manufacturing facilities, replacing stuff.

[00:08:44] Dino: fixing things. And so how do you keep up with that asset inventory if over the course of a month several assets were replaced, new stuff put in, so what is my accurate inventory? Right? Somebody went to the store room, are the parts. Store and got what they needed out of the plant to go and fix things.

[00:09:02] Dino: Go put in a new drive to go put in a new, HMI or a new switch or some sensor or whatever. But how do you keep tabs of all of that? How do you know what went out there into the field if you don't have continuous monitoring to give you asset visibility? Right. And most asset visibility practices that we've seen to date, is to the IDF level, Not inside the panels. Where all of that stuff I just described is located. So is asset inventory important? It is. By getting asset inventory, you get information that tells you what your serial numbers are, that you actually have live, that are in the environment, so you can, do a better job of managing your warranty and maintenance programs and know what you need to keep in stock, right?

[00:09:43] Dino: Because you ca you can keep track of this information. You have the vulnerability and risk information that's provided if you're continually monitoring that stuff, some people would say. Do I need to continuously monitor that or is there some stop gap measures? And the question is just those do exist, right?

[00:09:59] Dino: But moving forward, you want to try to get continuous monitoring in place to be able to determine what assets do I have out there and what are their current situation from a vulnerability and exposure perspective, and who's remoting in.

[00:10:13] Jim: Right. Hang on. let's get to that remote. gonna stick on the asset inventory and then, then we're gonna, we're gonna do that remote thing again in a minute.

[00:10:22] Jim: but the asset inventory, right? every time we show what's possible to controls engineer or plant manager or facilities manager of what's possible. They look at us and they're like, holy cow, I didn't know that was possible.

[00:10:37] Dino: What about the companies that have already bought a tool, right?

[00:10:41] Dino: And they don't even give, and they don't even give OT access to the tool.

[00:10:44] Jim: is from the OT side. They go, wait a minute, you guys have asset inventory. Why don't I have my asset inventory? Right? Mm-hmm. It sounded funny, but okay. I want my asset inventory. and they start taking a look at, and you mentioned some of the things, but serial numbers and firmware versions.

[00:11:01] Jim: Vulnerabilities, whether it's on remote run or run, , there's a number of things. What, Rack slots. What? Nuts. The devices. they didn't even realize that was possible. To them it was a

[00:11:13] Dino: physical inspection that had to be had in order to get that and most times they'd have to take downtime so they could pull the equipment out of the panel to look at it to get the serial number so, you know, to be able to

[00:11:23] Jim: do, do the job active. Yeah, I mean, this is the stuff that, from an IT perspective, again, I come from the IT world and it's like, well, I can get everything that I need just remotely and hit it. you gotta remember that because of those devices and different devices that are out on the OT side, they don't necessarily respond to the same type of technology.

[00:11:45] Jim: So. not simple and clean as that, but once you have the right OT specific, uh, tool sets if you will out there to get your asset inventory, you know, hey, partner up with the ot, OT guys. Go back to your IT guys and say, do you have anything that can give me this asset inventory? Because there are tool sets out there and combined with, cybersecurity tools can actually give you asset inventory, which gets to kind of that operational, what's the OT value in this thing? And the OT guys need to start asking for it. And the it guys need to start saying, Hey, do you guys want this in the OT world? And if they know that it's possible, they're gonna go, that, that'd be good.

[00:12:28] Jim: That, I mean, we've shown these guys that, like you said, where they've had the tool up and running, they've looked at it. controls engineer, whoever it was at that point, said, wow, wait a minute. We've had this for three years. why can't I see this? Why don't I get this information? Why don't they have access to it?

[00:12:43] Jim: This would be valuable to me. my planning and just so many things that could come from that. But let's, take that over to the OT value, So this sort of. walking through going, well, hey, if, it can do asset inventory and OT doesn't have it, but it's a real value to them.

[00:12:58] Jim: What else is a real value to my OT friends over there for the IT guys to be aware of it and the OT guys to be aware of it, to ask for it. So, when we get around the process, integrity. Aspect of it. I mean you talk to this all the time, right? Process integrity. this gets to operational resilience and cybersecurity resilience, but if you got the right tool sets in place, those are one and the same for a manufacturing plan,

[00:13:24] Dino: Well, yeah. I mean, most manufacturers have. A wide range of industrial control systems in their plant. Handful, several. There's not just one uniform, automation technology vendor in the plant. So for example, you're not gonna go into a plant and find it necessarily to be a hundred percent Rockwell, Where Rockwell, if you wore a hundred percent Rockwell, Rockwell's got some, asset inventory stuff, asset center for example, to help you keep track of your control system inventory. Your PLC programs, your backups, things of that nature, so that you have a good inventory of what's out there. There are also O-D-I-D-S platform tools that will do that for you and do it on a wider, range of automation, technology, stuff you may have in your plant.

[00:14:08] Dino: So if you've got Siemens in there and you got Emerson in there, you got GE or Honeywell, or Beckoff or Mitubishi, whatever, you may have to able to get the same level of, asset inventory information. In that environment to where you're tracking PLC changes, process integrity, If somebody makes a change to A PLC, am I gonna be able to see that?

[00:14:26] Dino: Now, if you're talking to a controls person, that's pretty important, right? To an IT person, that means nothing, right? It means nothing to them, right? And so the question you have to ask yourself is the IT person who chose the OT cybersecurity tool, who's not given the OT person access to that tool for whatever reason, because they don't think that they should.

[00:14:46] Dino: gotta ask yourself, why did you pick an OT cybersecurity tool it, right? Why did you do that? If you don't have the input and follow up with the OT people, again, who 80% of that information is valid to them. Not used an IT right organization, but to the OT people. So, you have to get into that dynamic.

[00:15:04] Dino: And then, uh, here's what'll happen is once you get the right people in the room. You start uncovering this discussion that we're having. What'll happen invariably is it will start backing away and basically tell ot, it's like, Hey, you're gonna run your own plan. You gotta get your own tool. You need to fund this stuff.

[00:15:22] Dino: right. Is what happens. It does because it, once they recognize that their influence is small they, they don't have much control at that control point, and they're not really adding value. To the OT organization and ot, iss getting smart. They're getting smarter, they're getting wiser, they're maturing, and now they're starting to ask these types of questions, and I'm telling you it, what I see 'em doing is backing away.

[00:15:43] Dino: And then OT needs to start leaning in and start taking responsibility and accountable for these OT cybersecurity hygiene practices and also things that will help them reduce potential unplanned, unscheduled downtime. IE

[00:15:55] Dino: process integrity.

[00:16:07] Dino: the, IT world's well-defined, right? I mean, that's the difference. You have an environment from an IT perspective where they've got a pretty good handle.

[00:16:16] Dino: Generally speaking of their applications, the application flows, how they wanna control segment traffic belongs amongst the different business units within their environment. They don't have any of that for the plant floor, and so it's easier for them to come in and try to lay something on top, top down type of approach.

[00:16:33] Dino: To implement a zero trust in the OT world, you gotta do a bottom up. Again, melting pot. You have a wide array of different technologies and, protocols and systems within those control system environments. And we came up with a new term, I guess we could call it a new term, and I'll let Jim call this that, but normally we find flat networks in the OT space and sometimes we run across what Jim.

[00:16:57] Dino: Super flat. Yep. and super flat. and this is serious, right? Because it is serious, super flat to us normally in flat networks that we find at least the control. Is still underneath the PLC, not exposed to the overall plant network per se. Right. Right. Drive sensors. Right. Robots ser all flow meters.

[00:17:21] Dino: Right. All of these. Yep. Yep. Kinetic physical assets are usually always separated at io interlock for you. Controls guys out there and gals out there, you know what that is. Superflat means that stuff is on the same network as the business system network. Right, right. And this is a very bad thing. Right.

[00:17:36] Dino: And we've, seen this and so, now the question is, is. The only way to solve that problem and to start segmenting that environment is from the bottom up, right? 'cause you gotta start creating trust buckets within the plant of saying, I gotta get these flow meters over here, away from that plant network that's got email and internet access on it, and, and Google surfing sites and whatever else is being surfed on over there and get it away from the stuff that I use to make goods.

[00:18:03] Dino: And so if you have an environment like that. Zero Trust is never gonna help you at this stage. You got a long way to go to even try to solve that problem, and so zero trust in my book, you have to start thinking at it from a different approach, and that is a bottom up approach.

[00:18:20] Jim: Can I call it the bucket approach?

[00:18:21] Jim: Maybe Bucket approach. I like bucket, right? Because I, I use really technical terms on this, right? The super flat and the bucket approach, but yeah, that's what we've talked about and this gets to where you can get complexity if you're trying to do a top down and apply this. Over, a zero trust architecture and let's just stick with this networking zone issue with the, trust in the zones.

[00:18:43] Jim: You know, we still have the identity and the device and all the other things behind it, but just if you're trying to do with the zones. and you're trying to do it over the top, you're gonna have to start at the bottom to understand, well, what is in a zone? What is it trying to do? What is it supposed to be doing?

[00:18:58] Jim: And that's where you and I have been talking about the bucket approach, right? We got a bucket of stuff. Right. And that's in our super flat network. and it could be flat, it doesn't have to be the super flat network, the normal flat could still be an issue. But what we wanna do is say, okay, first of all, most companies don't even know what's in that bucket, a, a bucket for my technical bucket term is it's the facility or the shop floor, right? And they're in a bucket, and we can even call it a, zone, but we're gonna look at it and finally get visibility inside that bucket. And then we're gonna say, okay, we got that myriad of melting pot of stuff you referred to, right? And we're gonna say, let's reach in there and let's grab something out of the bucket. And now let's put it over here in the safe bucket. Right. And now that's the bottom up approach to trying to really get to what I would consider what zero trust is ultimately trying to do. It's just a different way of attacking it because you have to realize we're in a different world.

[00:19:56] Jim: we're now living with cats or dogs, one of the two, They're different. they're kind of the same, but they're different. But let's start doing that. What is this one? This machine is unique. This machine comes from Italy. We don't have any other machines like that, but this machine's exposed.

[00:20:10] Jim: So what do we need to do uniquely to address that? The ball outta the bucket and let's put it in it's safe bucket. Yep. Now let's go back to the big bucket,

[00:20:19] Dino: Well, and for our IT listeners out there, you know, trying to approach this with, network access control and for you goes at, for n or ICE or any of those IT tools to be able to, to take that and drift that technology down on the plant floor is, is like, putting a 16-year-old behind the wheel of a Formula One race car.

[00:20:40] Dino: They take out a long way to go to be able to drive that car, right? And putting that level of complexity and technology down at that level is a non-starter one. The cost would be ridiculous. Two, you don't know enough about the environment to be able to apply again, that top down approach into that space.

[00:20:58] Dino: So you have to look at different strategies on how you start segmenting that network without being, disruptive. and you can't take the plant down for weeks or months to, to try to figure several months or whatever to figure this out. You can't do that. So your windows are small to be able to get in there.

[00:21:13] Dino: So you gotta be very tactical and strategic when it comes to how am I gonna isolate and or segment these devices without technology that's expensive and costly. Again, back to the 16-year-old behind a four one race car.

[00:21:26] Jim: Yeah, and it's an evolution, right? It took decades and decades to get here, and it's gonna take some time to get out of it.

[00:21:33] Jim: But to your point, well, what's the alternative? Right? But this is an alternative. There's some really cool technologies we've seen in how they approach that from the defensible architecture standpoint that can get you to this. It's just waving the magic wand of zero trust. Don't worry, we're going zero trust.

[00:21:50] Jim: It is always a concerning for me because then it's about belief. I. But what is it actually happening behind the scenes? Which is where we live, Trust and verify. Which is why, you brought up that remote access. How many times do we hear, no, we don't have remote access. Not allowed in our environment.

[00:22:06] Jim: Well, right there. There it is. And there it is. And they're like, oh, is that what it's doing? Yeah. Yeah. That's what it's doing. So, because that bucket of stuff I is so unique and companies have multiple buckets of stuff, And a bucket like this plant's bucket of stuff is different than that plant's bucket of stuff.

[00:22:26] Jim: And I don't care if I got 12 plants making the same thing. I got 12 different buckets of stuff. Yep. And I can't, you'll have just say, here's the rule, this is what we're gonna do. And you gotta look at each bucket of stuff.

[00:22:36] Dino: there's a lot of competing, initiatives within these manufacturing environments to improve their, uh, ability to, to operate and to be safe and replace, old assets, Capital plans that they've gotta put together to determine, cause these machine centers can cost hundreds of thousands, if not. A few millions to tens of millions of dollars or more to replace these components. So it's not something you just wake up one day and say, I'm gonna get rid of half the plant and replace all those machine centers out there over the next 10 or 15 years.

[00:23:03] Dino: You might, but not in the next six months.

[00:23:05] Jim: that's a great point, Dino, because, from the IT folks we're sitting here going, Hey, uh, it's gonna be a quarter of a million dollars for another, virtual server rack or half a million dollars. And the OT guys are kind of like, okay, that's nothing.

[00:23:17] Jim: Yeah. Right. Go ahead. And that's still gonna be cheaper to replace your servers than it is to, you know, this, this bending machine or stamping machine that I have out there. I do wanna touch on a couple other things, right? They're important 'cause we're kind of really in the zero trust focused around the zones and the network environment, which, which there is, the concept's the same.

[00:23:37] Jim: The approach needs to be different, but other A areas. And one of the big key things that it needs to be considered when you get into the OT environment. Is that whole identity management stuff, Mm-hmm. Because the idea is that, okay, now we gotta sign on. Well, I mean, how many PP PLCs do you have, that have MFA on it that tied to some sort of L they server or your domain control?

[00:23:59] Jim: None. They don't. Well, I think Rockwell some of the new ones, but it's still expensive to get there. But what's the majority that's out there? And what do they do? They probably put a shared password on it. Now, or just an admin guest pass, if they change it at all. So suddenly now, this just one password allows you not only as identity into A PLC, but it allows you into an entire environment with not only the code that's on there, but the actual, the hardware or the application and the data, which is again, so that, that and alone just doesn't fit.

[00:24:32] Jim: that device doesn't work in the zero trust model. The other thing that I wanna say, and is, even though those are the PLCs, was the example, let's just talk the Windows machines out there on the floor for the identity for zero trust. How many times do we see operators using unique passwords and unique IDs on the Windows hmis?

[00:24:53] Jim: None doesn't happen. Yeah.

[00:24:56] Dino: I mean it, those operators are looking for an excuse to go to the break room because it's like, I don't remember my password. You guys need to come log this machine in. I'll be in the break room when you're ready to, to log it in and get it running. I've seen it. Right. So, yeah.

[00:25:08] Jim: I mean, and that's what happens. They're like. it's just an admin. might have one shared password so suddenly identity is completely out the window on Windows machines alone. And there are real reasons why they do that. I always get a kick or the, it guys are always, eh, well, no, they have to sign in.

[00:25:26] Jim: It's like, have you ever worked on a plant floor before? That's the, well, I mean, good luck with that. Good luck at going down there, see how that works out for you.

[00:25:35] Dino: Now you're speaking something near and dear to my heart, where I think from an, IT perspective, if your role and goal is to help secure, protect what's going on in your manufacturing environment, specifically around your control systems, is you're gonna have to spend some time working in your plants.

[00:25:48] Dino: And I don't mean a simple one day visit, I'm talking about working there. You know, work through a startup, work through a, a shutdown, Work through a, a new packaging line coming in to the plant from front to back, from the feed study all the way through to the startup and getting it operating.

[00:26:03] Dino: You know, there has to be some accountability. I. Because one, that's how you get to the OT folks to trust you. Two, the other thing you're gonna learn is you're gonna learn who their partners are. They work with, who are the sis, who are the OEMs, who's the automation technology vendors that, that they're involved with.

[00:26:17] Dino: You be, you have to become part of the Right, think globally. Act locally. You hear us say that a lot and for it. that's managing. 30 sites, 40 sites, 50 sites, whatever it is, and maybe there's a couple of 'em scattered around. That's great. But normally their focus is on the business system side of that, the carpeted side of that plant, not necessarily the concrete section of the plant.

[00:26:37] Dino: I mean, that's why when it comes to zero trust it's got a lot of. challenges to be able to implement something like that in that space. So that's what we would say about zero trust when it comes to ot.

[00:26:48] Jim: Yeah. So, uh, think, just from a time standpoint, I mean, we went through the, what I consider two of the biggest ones, the network and an identity.

[00:26:55] Jim: There's device and data, but kind of. Wrap up thoughts from my side. I wanna say, okay, first of all, zero trust. I mean, you hear us knocking on it. We're not knocking on zero trust. The concept's great, but it's a concept when it comes to applying it down to ot. If you take zero trust as it is the framework that exists in it and force that down to OT you, you won't be successful.

[00:27:18] Jim: You might. Think that you're successful and have the belief that you're doing that, but from what we've seen, it just, doesn't work unless you're in and involved in that plant four in that bucket. So this is where, that's why I like the bucket to bucket and the super fly food bucket, But you need to understand that bucket.

[00:27:35] Jim: 'cause every bucket's different inside there. You're, so if you can do that and then say, okay, what makes sense in this environment and work together with the ot. So that's what I, would say, and if you need help figuring out what's in that bucket or how do you look in the bucket that's what we do all day long.

[00:27:51] Jim: We're constantly looking in these buckets worked with some clients that we get 'em started right here. They'll go, Hey, mean we're doing that right now, right? Global company, they got a hundred, what do they got? 120 buckets. Something like that. And we're saying, Hey. Let's just start with the one bucket.

[00:28:06] Jim: Let's start with the one bucket, and then you guys, we'll show you how to go through that bucket, how to figure out what's in that bucket and what your options are to address what's in that bucket. And then you can decide how fast or slow, depending on what the business drivers are to move forward.

[00:28:22] Jim: How do you wanna rely on this? we can help you from this much to, you know, from cradle to gray, or we can, whatever that may be, whatever makes sense for the organization. But since this is such. so it's exploding space. It's very hard for companies to have the resources and the knowledge in the space that we do, because that's all we do all day long.

[00:28:39] Jim: Look in those buckets and figure out how to get the stuff out of the, the big mess of buckets into safe buckets. And that's, what we do. So zero trust, for my IT friends, start thinking about, the OT side. We can help you there. The OT guys, if you're trying to figure out how to look in your own buckets, we can help you there.

[00:28:55] Jim: Zero trust, great concept, great framework, but I also wanna remind my IT guys. Well, it's a great framework. The Purdue model is a great framework for the OT side. They don't even have that fully deployed yet in most cases. So coming with the zero trust framework, on top of that, it's a different pace.

[00:29:14] Jim: Dina, I'll, kind of toss it back to you.

[00:29:16] Dino: The bucket back to you. so talking about buckets, funding buckets. You have to think of the funding coming from different areas within your organization, and it's really important and, what we've seen and what we've influenced and work with is helping the IT team with the key stakeholders on the OT side, Bringing the executives, and I'm talking plant managers. I'm talking about engineering. Teams, operations management executives, you want them to be part of this discussion. One, because they can help fund this, You can't do it all by yourself. There's just no way, and not gonna want to, you need to get their involvement, right?

[00:29:51] Dino: You have to get them involved, not only to help you fund it. To provide resources, strategy, whether you're gonna do build your own practice, within the environment, or you're going to, you're gonna leverage organizations like ours to help you get started and or to, to help manage that practice for some period of time.

[00:30:06] Dino: So don't try to go alone on this as an IT executive, IT team to try to pull this off. You will fail. I am telling you right now, you'll fail. If you don't get the buy-in from your OT counterparts and get them on board and say, I wanna be a part of this. I see the value in it. we had a conversation today and the first question from some of these OT folks is, gosh, I need to start talking about my resources.

[00:30:29] Dino: Who on my team at the plant level needs to own this stuff? Who's gonna handle my events and my alert? They're not, IT events and alerts, they're ot. Right. Right. Events and alerts. And so it's relevant for them to know that they have some culpability, accountability and responsibility on this and to help fund it.

[00:30:47] Jim: I wanna use the bucket play one more time. 'cause you already said I don't go it alone. Don't go in there alone. 'cause if you spill that bucket. You're never gonna be allowed to have a bucket conversation again. Right. Yeah. That plant goes down and you break stuff.

[00:30:59] Jim: They're just gonna go, no, we're done with you.