Episode 9: OT Cybersecurity Should be an Enabler, not a Disabler

It's the Empower Up podcast.

Jeremy Boren: I'm Jeremy Boren from Gray Matter. To start us off on season two of the Empower Up podcast, we're going to be talking about OT cybersecurity. That's operational technology cybersecurity. Since it's season two, to start things off right, just want to remind you about the name of our podcast, the Empower Up podcast.

It all It all goes back to Gray Matter's mission of transforming operations and empowering people. And one of the ways we do that, one of our big focuses, is OT cybersecurity. So we're going to be talking today with Scott Christensen and Tom Walker, both of Gray Matter, who are OT cybersecurity experts. And what we talk about touches on services and products that Gray Matter provides.

But believe me, there are tools and solutions that you can use at your company if any part of your job involves IoT devices, firewalls, OT cybersecurity in general. A good example of this is the Cyber Risk Assessment, which Scott is going to start things off by talking about. And it's a quick way to get a read on how secure your company's IoT devices and other assets are. And it also goes over the people side of the equation, which Scott will point out is just as important as any of the technology that you're using.

So since we're starting season two, just a reminder to rate and review us on Apple Podcasts or wherever you happen to listen. And so with that, we'll start a discussion with Tom and Scott.

Scott Christensen: The purpose of a risk assessment is to identify risk and vulnerabilities in my environment. and a good risk assessment not only shows you where your exposures are but also comes up with a actionable remediation plan so an idea of how do I fix these risks and how do I prioritize which ones I go after first.

Jeremy Boren: As I understand it the risk assessment is based on Department of Homeland Security is that right and some of the standards that they work with like NIST and IEC?

Scott Christensen: Exactly so when we when we look to do an assessment we take into account a lot of different factors but we leverage a couple different things one the NIST framework which is the DHS framework for cybersecurity specifically nest 800 and the NIST cybersecurity framework as well as other standards that might be considered industry best practices such as NERC sip or IEC or ISO so we apply all the different standards based on the practicality in them and the idea behind the assessments that we do is we look at the risk from the standards frameworks. We also look at it from an objective technology risk measurement tool. And then lastly from a couple decades of experience the observational things and then we kind of compile them all together into an overall assessment report that basically shows how do I apply risk against a specific standard as well as observational experience risk you know areas of concern beyond just trying to check a box and meeting a standard, actually showing a way to promote security within an organization.

Jeremy Boren: And then you can kind of prioritize those to help people understand which findings are more severe than others. Can you give some examples of what you might find in a typical case?

Scott Christensen: Yeah, absolutely. So it's not just prioritizing everything's a critical risk because we utilize the CVE common vulnerabilities and exposure score. which is a standard cybersecurity practice to rank things from a scale of one to 10, 10 being the most critical. So most assessments will have a deliverable like that.

But even then, there are items that don't always apply when it comes to an operational environment, or I'm not necessarily able to directly remediate them. So we come back with a way to remediate and put controls around it. So for example, one of the most common ones we run into is an unpatched system depending on what the patch covered it could be a risk from you know two up to ten but if we see a ten and it's a system that may not be able to be patched for one of multiple reasons you know unable to be taken offline it's a production device and yeah it's unsafe we're not in a maintenance window for nine months so we've come back with a remediation report with not only you're exposed here but here's an actual way a compensating control to mitigate that risks. It could be, you know, limit connectivity to the device, close a port on a firewall.

And then at some risk, we identify from a most cost effective way of saving this. So if you look at the way an attack happens in a network, it's a chain of events. And we don't necessarily need to fix every single link in the chain, we just have to break the chain. So where's the most cost effective way to break the chain, we identify that and then look to address that, because then then it puts a lot of the mitigations below it as less risky issues.

So we come back with different ways to approach the risk with a mindset of how do I keep operations up and running.

Jeremy Boren: Right. And that's because we know that IT departments don't have unlimited resources.

Scott Christensen: Absolutely. And because something's identified as a risk doesn't always mean it's truly a risk to the overall architecture and environment. So for example, if I look at something like an unpatched system and it's on a Windows XP that's out of spec and you know it's there's no more patches and it's vulnerable but if that device is not plugged into anything publicly or that device has a very stringent set of rules to access it that risk becomes very mitigated and it's much more effective versus say something as simple as you know a plain text password identified on the network you know that's a quick easy fix if we identify a bunch of plain text passwords the remediation is a enforce a better better password policy or limit access to devices that don't have that capability. Those become cost effective ways to address major risk.

And we look at it from that mindset of how do we approach each of those and get the largest impact with a limited resource.

Jeremy Boren: And I want to bring Tom in here in a second to talk about EmpowerGuard, one of the solutions we're introducing. But before that, and when we're talking about these risks, Scott, I like one way you've described it in the past, is falling into kind of three categories, people, process, and technology. Can you explain the philosophy there?

Scott Christensen: Yeah, and it's a very standard, but it's the philosophy in OT that's often missed is we try to leverage one aspect and we miss the other sides of the tripod. So if I'm looking at people, right, you know, are they following good policies? Are they doing the right things? The most common we look at in OT is the username and password sticky note.

I put that up on a monitor. It's not going to show up by any measurable way on a network scanning tool or an analysis tool. But I can observe it and see it and I can actually see that these people are not following good best practices. So putting recommendations around that, are my people following the right way?

And then the process. Do I have the right process and control? So, for example, remote access is one of the most common things we see. it falls into one or two categories often is either we allow everything and it could be team viewer remote desktop everything under the sun which has opened up my network to all kinds of risks but because I'm not managing it I'm not putting a process in place it gets often overlooked and then the other is you know the simple answer is well I don't allow it which is you start losing practicality the value of having remote management so you start looking at the processes are there There are ways to do things in a risk averse way.

And then lastly is technology. You know, have you invested in the right tools? And even if you've invested the right tools, are they deployed the right way? So if I have a firewall, but I keep all the ports open, what's the point of having a firewall?

So things like that. So looking at the technology and making sure that it's properly deployed and that the right investment or looking at tools that may be different than what I've looked at before and start leveraging other technologies to kind of expand and mitigate risks in my my environment.

Jeremy Boren: And in the category of different tools, Tom, I know this is something that you've been thinking about and before it had a name, you were thinking about it. It's EmpowerGuard, but can you kind of talk to us about how you and Scott started having a conversation about an issue of having OT cybersecurity at the edge and kind of some of the problems that you were facing in your previous position and wanted to work with Scott to try to solve?

Tom Walker: Yeah, it was about two years ago. Scott and I are at a conference. We're sitting in the bottom of a hotel in the lobby just talking. And I kept explaining to him the issue I had with I had multiple devices all out at the edge, all different form factors, nothing quite fit in a rack necessarily.

It was always wall mount, DIN rail mount. They were all over the place. and we were discussing what is something we could do can we make this into a single box that has all my tools right into it and this was before the term micro data center started being pushed around now or edge computing so that's basically what we're trying to accomplish with the EmpowerGuard device is putting that single appliance out there at the edge to do the data collection, some of the analytics and security all built on top of that so that I can secure the communications from it to my data center, to my cloud, to remote access for vendors. You know being able to manage that all through a single appliance, it was something critical I was looking for.

One of the big things we we were doing with Penn State was doing data capture of the building automation traffic. So we're capturing it, not only the traffic to look at the analytics and the security of it, but also capturing that data and pushing it up to a data lake. And so being able to do that all out at the edge and then remotely connect it securely to wherever. And in this case, we're sending the data of not only to the Penn State data center but also up to onboard data's AIoT platform.

So we're able to capture two things with a single appliance and not have to have all these separate tools out there at that edge.

Jeremy Boren: And that's one of the things that makes this different is that if you look at a lot of companies they kind of want to you know go they want to offer you a single single purpose box or solution, right? And so you end up stacking them up and having multiple ones. And that's not the case here, correct?

Tom Walker: Correct. Yeah. So they're all virtualized on the single piece of hardware.

Jeremy Boren: And it participates in making that risk assessment that we talked about earlier. And Scott, that can happen pretty quickly. I mean, this isn't something that needs to take weeks or anything like that to get a good read on kind of your network, you know, topology and what's going on, right?

Scott Christensen: No, absolutely not. I mean, we've seen as fast as 10 minutes being able to actually see network information and risk and, you know, high level, you know, details. So, you know, within four or five hours, you actually start being able to generate, you know, vulnerability assessment information and risk assessment information and be able to mine and dig deeper to issues within an environment. So it's amazing amazing how quickly we can span it up.

And what's important about what we do is we can even spin it up in a very passive way. So we're not going to impact the day-to-day operations. And that's kind of key to a lot of what we do is we look at it from perspective of how can I do this? I always equate to OT security is like changing a tire on a car doing 65 miles an hour.

It's not it's impossible, but you've got to take into a lot more things than you would normally take into into account when it comes to changing a tire. And it's kind of that same thing is how do I do that without causing us to risk other aspects of it? So one of the things we're able to do is deploy it quickly, pull back data fast and really take value out of what we get the data we get back. And the other aspect of it is because it's a multi-purpose box, we're able to actually take data and share it with other consumers of that data.

And we can do it in a secure way. So it's not just, I wanna look at cybersecurity. security, I can also look at it from that same data through the lens of an analytics might be important to the maintenance team, or I might be able to pull back my energy consumption data. It's a lot of that same information.

We can share it, and you're basically taking one hose in and then parsing it to the appropriate consumer. So it allows us to be extremely flexible and fast at how we kind of deploy security from an OT perspective.

Jeremy Boren: Two industries that we've kind of talked about that could you know really benefit from this manufacturing oil and gas why are those two you know kind of prime so

Scott Christensen: uh with manufacturing you start off with a limited resources available for ot cyber security uh oftentimes it's a person that's wears many hats he's kind of inherited the cyber security kind of role and so with that limited resource and limited kind of you know he's oftentimes behind the eight ball when it comes to securing the environment. So a tool that's kind of a Swiss army knife becomes very flexible and allows him to do more with less. And then when you look at the case of oil and gas, oftentimes the struggle they have is the data and the assets that they need to get information and protect are in remote locations. So they're not in areas where you want to be driving up back and forth constantly trying to set up or there's not someone babysitting it.

So it might be on a pipeline in the middle of the Appalachians. So they don't want to necessarily have to physically go to a box or a unit, but they want to be able to securely pull the data out of it. So it allows them to expand their reach pretty effectively and become less touches required to manage and deploy security for them.

Jeremy Boren: And have you found that companies have tried to do this and haven't figured out a good way of doing it?

Scott Christensen: It's often, it's a mixed bag, right? So the companies that have invested heavily and focused on it, there's quite a few good successes. But the companies that are just now trying to approach it or trying to do it in a part-time way tend to have a lot more struggles. And then the other aspect of it is a lot of times you find the same mistakes are being repeated because that information is not shared.

Whereas someone in our position who's done multiple different deployments and learned a lot of different environments, we know kind of where the pitfalls might lie. And so we tend to avoid them. And so you get much more of an accelerated deployment and maturity versus trying to figure it all out yourself.

Jeremy Boren: and follow us on LinkedIn and Twitter. You can find all of our content, including this podcast, linked on there, along with our weekly blog. It's called Tech Hub. Check it out.

It's a great resource for news and events that are going on in the industry. And also, just as a reminder, please do rate and review us. Apple Podcasts is a great place to do it. But wherever you listen, that'll work too.

So once again, thanks for joining us and we'll see you next time. Thank you.