Your Organization Says It's 'Green' on Manufacturing Security: Here's Why That's Dangerous

Speaker A: When it comes to change, patching, updating, modernization, they're driving that narrative with the OEMs or the SIS. They're choosing that path normally without any IT interaction. They're not asking them what SCADA system should I use, what HMI m should I buy, what switch should I put in this panel? It normally doesn't even know they're getting a new panel made. There is no IT collaboration in that aspect and OT is owning that. So they should kind of own part of the rest of that to a degree.

Speaker B: Welcome to the Industrial Cybersecurity Insider. In each episode, we dive into the world of industrial cybersecurity. Join us as we cover the latest trends, innovations and practical insights as we talk with leaders and practitioners across the industry. Gear up and let's get into this week's episode.

Speaker A: Hi, I'm Craig Duckworth.

Speaker C: Hi Craig. I'm Dino Busolocki.

Speaker A: Uh, kind of go back to this whole who owns cybersecurity? And when it's owned jointly, who's responsible? So OT security is really everyone's responsibility, but uh, who actually is on the hook when it doesn't go right, if something were to go wrong?

Speaker C: Well, when it's everybody's responsibility, that means it's nobody's responsibility, right?

Speaker A: Yep, good point. There's a lot of finger point in that situation. You're right.

Speaker C: And it exists. Uh, I can't emphasize enough. At the end of the day, it's the asset owner. I mean, when it really comes down to security, it belongs to the asset owner. And there's a clear delineation between control systems and what I want to call back office business IT systems.

Speaker A: Right?

Speaker C: That includes the plant network, firewalls, switches, the applications, the infrastructure. Who owns the asset at the end of the day and the things that IT owns is their responsibility. The OT side is, doesn't belong to them, it just doesn't. And I can't emphasize enough that because of that, OT does pretty much everything within their power to keep it from getting down to that control system level for, uh, some type of administrative management cybersecurity role. Right? Because of production, because of safety, things along that nature, right? Because you gotta remember the OT world makes money. That's your revenue. They generate revenue. And it's an overhead and expense and it's oil and water. I just went through this again today. There's pushback from OT folks. You got an organization that's failed an audit because they don't have asset inventory, right? To determine the risk vulnerabilities associated with that and the ciso, the global ciso, who owns that responsibility? Right? To. To your original question, who owns OT Cyber security? That ciso, I guess, is raising their hand. Maybe not as high as they would like, but regardless, they're raising their hand. But as soon as you get to the plant and you start trying to figure out or describe and define how to get that asset inventory within that control system layer, there's a wall.

Speaker A: Well, that goes back to the difference of, uh, responsibility versus authority. If the CISO has responsibility, then he, The CISO is going to be the scapegoat. Because in that example you just described, he doesn't have authority when he gets to the plant. He's being told, thank you, but no, thank you. So again, back to how do you get past that problem?

Speaker C: Well, it's by. You have to begin somewhere, right? So take the leverage. If it is driving this narrative and has this responsibility, they have the capability of getting this technology into the plant, right? To the things that they own, right? And we know, we both know that a lot of that OT traffic comes up into the IT realm, right? Where it would get captured for the asset inventory. You may not get everything that you need, but at least you know the things that are coming up, as we call the north, south traffic, right? You're able to pick up a few things where it, I think, sometimes falls short. And we've seen this before, we see this a lot, actually, where IT has bought it a tool to do that. But we both know that they're capturing maybe 20, 30% of the assets in the plant and missing a big chunk of them, right? But, uh, being able to show that to the engineering teams, the OT teams, and show value and benefit of it just from the little bit that you do have, right? Have that continuous conversation with them of doing what you're doing, and then how can I expand this? Which is where it can struggle, because firms like ours and even the OEMs, they're not bringing cybersecurity safeguarding measures into the projects that they're doing. We think that they should. We're looking at how we can put language in our proposals to be able to safeguard the project that we're there to do, right? You got a $2 million project to do this line modernization. You got some OEM equipment coming in. How do you ensure that there's no malware within the environment, within the scope of what you're working on, right? Not the whole plant, but the things that you're responsible for and the egress and ingress points of data coming in and out of that process area. Uh, because, you know, there's connectivity up and out and in. So it's coming in and it's going out. So are you. Do you have overwatch on that? Are you monitoring those communications and that activity surrounding your project, the safeguard, malware, malicious IPs, default passwords, rogue assets, things that can be disruptive to the environment or can slow your project down and, or cause, like a breach potentially. And so, that being said, the OT world has to get better at how they want to provide safeguarding, because if the client's doing it, the client's really trying to do that, then they would be laying those requirements at our feet in the RFPs that come out saying, here's how we are going to handle that. There's no malware in the environment. Here's how we're going to handle known exploited vulnerabilities per, say, malicious IPs, rogue assets. They would be defining that and making sure that we're following their guidelines. Right. And they're not doing that. Right. We, the hundreds of proposals that we do in a quarter, none of that stuff is in there. Right. So as a ciso, it's what I've always said in prior podcasts is these CISOs should be tapping in to the integrators and the OEMs that are working in their plants every day, all day, providing technology to see how they might be able to assist them with their cybersecurity strategy that they're pursuing. Right. And that's not neither.

Speaker A: It's not. And a lot of it, I think, goes back to the false sense of security, where the CISO is being told one thing or being led to believe one thing, and he's not as familiar and comfortable with the OT side to go and ask his own questions. And he's relying on other people to give him information. Versus because when you look at it, it assumes that the OT teams can handle specific decisions, and they can as it relates to uptime safety processes. But if something were to happen and there were malware, let's say, got started running rampant in the plant, the OT teams, their focus is going to be on how do I keep these machines safe and my team safe, versus worried about propagating that malicious virus or whatever it happens to be. And it's a different thought, it's a different mentality, and it's not aligned. Yeah.

Speaker C: It's not on the risk and compliance side. Right. If you're in control of the metric, take the CISO for example, and they put in a tool, an OT IDS platform, and are able to get something. They might. They would probably say, I was able to meet my metric because I told you that I would collect OT asset information and I got what I got. Even though you're missing 80% of the assets in the plant, but if you're controlling, if you're the one that's in control of the red, yellow, green status, then you'll pay. You'll say, green, I did what I said I was going to do. And they'll just ignore the other 70, 80% of the assets that they're not seeing or don't have visibility into because one, they don't own the asset. Two, they, they're going to believe they did what they were tasked to do.

Speaker A: Yeah. But for a devil's advocate, though, I'm the C. So I'm going to say, well, yeah, but 20%, if that's the number you say I have, is better than no. Percent, which I had yesterday before I turned this on.

Speaker C: Get it? Yeah.

Speaker A: Right. Right.

Speaker C: So I'm green. Right. I would say that I'm green and not red. Knowing that from a risk and compliance perspective, you just barely move the needle.

Speaker A: Right. I'm still missing 80% of my assets. So really, that green is not quite as green as it should be. Right.

Speaker C: And I've seen organizations do that. Right. It. If you're control of the, uh, metric, determine the status of how, where you are from a project perspective, then you did what you said you were going to do because there's nobody coming back that's going to call you out on it and say, yeah, just like the folks that we worked with a year or so ago that was in the beverage industry, that was missing 130 ot assets for a tool that they've had for years. Right. And I'm sure that didn't sit well.

Speaker A: Right.

Speaker C: When you think about risk and compliance, you're really trying to figure this out. Then the only way you're ever going to get there is you're going to have to leverage either the OEMs and system integrators that are operating in your facilities today, uh, or you're going to have to really push through the OT guys to implement these visibility tools to get the asset information you want. Like the pushback that I got from one guy. What's the pros and cons? I see more cons than I see pros because you're providing things into an environment that I feel like I may already have without Even knowing the difference between whatever it is that they're doing compared to what a cybersecurity platform would look like, that's collecting the fingerprinting of these OT assets.

Speaker A: Right.

Speaker C: And not even. And that's just a cybersecurity conversation, has nothing to do when you start talking about process integrity, about control system changes, assets coming and going out of the environment, remote access into the environment, online edits to your controllers, configure devices, unforeseen unknown traffic that's flooding your network on your control side. You're missing out on all of that. Right. Which helps you run better. Right.

Speaker A: Two schools of thought on that. One. I'm, um, the ciso and I'm like, I meet with my OT teams and they're telling me all the stuff that's fine. And I kind of know that it's really not. So do I want to hear again how bad my environment really is from somebody else? Uh, and truly, again, I think it takes it to a different level if I am the CISO and I now have a report from a third party independent verification that says, your baby's really ugly. And it's, you got some significant problems that, that now as an organization I have a legal and a, uh, responsibility to do something with versus just checking a box and going back to, well, I'm better today than I was yesterday. But at the end of the day, is that better? Okay, in standards or is it, ah, again, are you. Can you. Do you need to pull your head out of the sand and look at this and say, okay, I know that my baby's ugly. And here are the first three steps I want to take to, to try and do something in the next quarter, the next half or the next fiscal year, whatever it is, and put together that plan to begin making advances.

Speaker C: Yeah. Well, again, if you're missing out on 80% of your assets and you're good today, how do you know there's nothing malicious in the environment?

Speaker A: You have no idea. No.

Speaker C: You don't know. And so again, you're working in half measures here versus an overall plan and strategy. And personally, I believe the way to solve this, because we've been looking at this seven ways to Sunday for years. And not just us as part of the design group or our prior OT cybersecurity, but my time at Rockwell and in the channel with this. I know this problem pretty well. And what's missing is the OT ecosystem is not driving this narrative.

Speaker A: There's no ownership. Yep. In ot. Yeah.

Speaker C: But from a system integrated perspective, why not put safeguarding measures in your proposals that are at least at a minimum, asking those questions and determining what's client responsibilities and what's clarifications and exclusions. Right. In regards to case guarding, I want Overwatch on this project that's going to go on for the next several months in your plant. Here's the scope of it. Uh, there's a lot of technology, so I want Overwatch client has a tool. We need for you to provide Overwatch on this. Right. And we want to be able to do that data. If you can't do that or won't do that for whatever reason, then we should have the option to be able to do it for ourselves. Right. To provide Overwatch to look for those activities that could be disruptive in the environment. I don't want to be accused of bringing malware into the plan if it was already in there. Right. For example.

Speaker A: Yeah, and that makes sense. I would agree with you. That ecosystem needs to be driven by those asset owners. On, on the OT side, it's because when it comes to change, patching, updating, modernization, they're driving that narrative with the OEMs or the SIS. They're choosing that path normally without any IT interaction. They're not asking them what SCADA system should I use, what HMI M should I buy, what switch should I put in this panel. It normally doesn't even know they're getting a new panel made. There is no IT collaboration in that aspect and OT is owning that. So they should kind of own, um, part of the rest of that to a degree.

Speaker C: Yeah. Well, it's like the folks that talk to today that still don't understand what these tools do. Right. And they may even had a tool in there and how it was deployed and who did it and what technology they used. Maybe they got a bad taste in their mouth.

Speaker A: Right.

Speaker C: Because they didn't really work with a group that knows what the heck they're doing. My point is that the client's OT organization and many of them are still very. That's probably not going to sound good, but they're just not very mature.

Speaker A: But this is all new though, Dino. So that's not a, it's not a bad, it's not a bad thing.

Speaker C: It's been around for over a decade, right. And it's gaining momentum. I mean these companies are growing their billion dollar year software companies that are focused purely on OT cyber security. Right. And they're fanning out, they're bought by bigger companies, they got money being infused by big Consulting companies. It's like, was it Dragos with the Accenture infusion of cash and their role, whatever that's going to be. They bought Phosphorus Dragos. Did you got Armis was acquired by ServiceNow. Right. We've seen Microsoft do it, we've seen Cisco do it. And so to say that this is not a thing is somebody that's truly not paying attention. You're living on, uh, a rock if you think that. My job is to make sure that this line runs day in and day out for whatever productions. And that's all that matters. The only way you're going to see value and benefit from an OT cybersecurity tool is for it to come in with somebody with the chops who've implemented it hundreds of places for various reasons, to show you the value and benefit of what this tool can provide to you for multiple reasons. Not just the cybersecurity piece, but also the operational and process integrity piece that it brings. Right. And recognizing that the way that you're doing it may not be the best way. Right. And your risk and compliance, uh, I mean, you can change a lot in improving your cyber security posture if you got people pulling in the same direction. And right now I just, we just don't typically see it. And that's, that includes all three IT OT and the OT supplier, the OT ecosystem that's involved.

Speaker A: Yeah, they all need to be working together. They all need to be on the same page so that in the event something does happen, it removes the finger pointing that often takes place in that, uh, situation. But if you go back and you look at, let's call it the fire drills, the instant response fire drills, does each of the teams IT OT know what to do, who to communicate, how to proceed in the event something takes place? Is that being practiced? If you want to call it that, at minimum annually, ultimately every six months, so that everybody knows what to do. It's in today's environment with AI, the nefarious actors are taking advantage of vulnerabilities quicker than they can be remediated and fixed from the vendors, from the size, from the end users. And it's not a matter of if, but it's a matter of when. And there's got to be plays in place.

Speaker C: Right. Well, again, the thought, the OT guys already know they're way behind from a patching perspective. Right. They know that there's no way that they could ever patch themselves out of the predicament that they're in. Uh, nobody's expecting them to do that, but that Being said, it doesn't mean that you can't map the communication flows within your control system environment to determine what traffic is warranted in this space versus what is not. So you can put that MIC segmentation in place for those machines that you can't patch. There are other technologies that you can put in there to prevent exploitation of vulnerabilities like virtual patching. Right, We've talked about that. So there are paths and avenues to help solve that. I can't patch it will like it can. Right. It patches a will for the most part. Generally speaking, plan does not. So you have to take on, uh, different techniques. So this is not a technology problem, this is a people problem. It is, and there's a trust issue between it and ot. It just, you always hear it, it's there, it doesn't go away. And again, there's a very clear delineation on asset ownership in this, in the space between IT and ot. There's no question about that. Who owns that plc? Who owns those drives? Who owns that hmi? Who owns the network those control systems are sitting on? Right? Because there's us, there's two, there's always two. There's sometimes there could be three, but there's the plant network that it's got and then there's the OT network which the control systems run on and using TLCs as a firewall. The OT people thinks that they're still air gap and isolated because of that.

Speaker A: But again, that, that's a false sense of security. When you've got the ability to get down to those lower level networks, again it goes back to that mentality of, uh, we've designed this so you can't, but technology is allowing it to happen.

Speaker C: Well, you can even track it, right. At least on the plant network, if something's going on and you've got the right tools in place, at least you can follow the activity. Right? But once you get to the control system, it's all gone. Because they're not doing that. They're not monitoring. That was the term that they use, monitoring my network. To them, they view that as you're putting additional resources in my environment that can be disruptive and it's being managed by somebody else besides me.

Speaker A: I get it back to that inherent distrust of I will be 100% in control of my network so that I know what happens and no one else can do anything else in it.

Speaker C: That's right, yeah. Uh, because if you put something in their environment and they have an outage of some sort, it can be completely unrelated to what you put in that environment. The first thing they're going to do is take whatever you put in them. They're going to take it out.

Speaker A: Yep. No, without doubt. We see that all the time. Yeah. Yeah. Well, until next time, I think that's a great start. Hopefully organizations can kind of get an idea of how to better determine what that ownership needs to look like. So we're here to help. Feel free to give us a call. We appreciate everybody listening and watching. Have a great day.

Speaker B: Thanks for tuning in to the Industrial Cybersecurity Insider to stay up to date with our latest episodes, be sure to click the Follow or Subscribe button now. And if you found this podcast helpful or have a topic you'd like us to discuss, please leave us a review or let us know. Thanks again for listening. See you next time.