I mean, cybersecurity is not just a technical discipline. You need to add
the additional procedural pods in your way of securing your OT environment. Welcome everyone
to the Industrial Security Podcast. My name is Nate Nelson. I'm here with
Andrew Ginter, the vice president of Industrial Security at Waterfall Security Solutions. He's
going to introduce the subject and guests of our show today. Andrew, how's
it going. I'm very well, Thank you, Nate. Our guest today
is Joan Hartig. He is the CEO and strategic advisor at Security OT in
Denmark, and he's going to be talking about deciding what to do next.
This is a next step decision support tool that security OT is working on for
industrial security. All right, then let's get right into it. Helloy,
and welcome to the podcast. Before we get started, can you say a
few words about yourself for our listeners and about the good work that you're doing
at SECURITYOTA. Sure, Andrew, and thank you for having me on the
show. So my name is Joan Hartig. I am a manager director in
Securito T and strategic advisor. We've been working with the production companies and utility
services for now six years. We have been helping them making risk assessments on
their OT. Cybersecurity Security T is a pure play OT security company where we
are originated in Denmark, but covering the Nordic part of Europe and also having
global companies as our customers that are in for instance, European countries and the
US. Our topic is risk and decisions. When I you know, you
mentioned that that security does risk assessments routinely. You know, when I look
at sort of generic risk assessments, most of you know, a fifty or
seventy five or one hundred and fifty page report, most of it seems to
be a long list of assets and whether they've been patched and you know when
the last time they password was changed? Is this? You know? Is
it? What is this what we need in in risk assessments? So you
know what what is the need over and above you know the asset inventory.
So so what we believe in is that that I mean, cybersecurity is not
just a technical discipline. You need to add the additional procedural parts in your
way of securing your OT environment. So like what is the criticality of an
asset in the production line should be the core consideration that you have, but
the things around procedures for backup, about your spare part stock, about incident
response plans, and in a patching procedure, whether the components are part of
that. That's normally not a part of an asset inventory database. Normally you're
just having a focus on the devices, but you haven't really put in the
aspect around how critical is this device. So if you have an offline printer
that is in the database, but you haven't really said, well, should
we have another printer to do the labels for whatever the medicine or can we
live without it for a period of time, And that should be a part
of the decision mating for the factory manager saying where do we actually need to
put in our money depending on the criticality of the device. Okay, so
you know we understand how we need to understand how important each asset is.
If the printer goes down, do we have to stop the production line because
we can't label the goods anymore? Once you sort of understand importance, what's
what's the next step? What are you using this information for? So the
methodology that we have made is basically to try and to calculate a risk score.
So the risk gore is based on the importance or the criticality of device
versus the part that we actually have versus the things that we actually done for
either protecting it or being able to recover, respond or or detect an actually
attack against the device. So we have looked into the cybersecurity framework with the
four phases with the protected, respond, and recover. So like protect,
we would look into the technical protection of the printer or the PLC or the
HMI. It could be is it put in in a different different network segment
or do we have remote access capabilities with would be a negative thing to have
on a device, or we will also ask into the process around this.
We'll also on the detection side, we would look into do we actually monitor
the device or the the network for incidents that could occur or do we have
a respond plan? Do we have incidents respond plan for this? Do we
know the ownership of the component or do we have SLA on the spare part
saying well we have one on stock or we can call a vendor and they
would be here within four hours with a new printer for instance. Finally,
we look into the recovery part about for instance, backup frequencies, do we
have ever tested the backup? Or where do the backup resides? So,
depending on how you're answering the questions around these things, we would calculate a
risk go and that LWITSCO would be a kind of an equation between the criticality
and the different things you've done around an asset. Andrew, I can't recall
exactly when or who, but I feel like we've talked about at least one
or two risk tools on this show in the past. What's different with the
one we're talking about here? What I see different here is sort of a
deep, a deeper dive into availability. Joan mentioned it a bit, and
you know he's going to touch on it again later in an interview. He
talked about spare parts. He talked about our backups available. He said,
do we have agreements with the vendors to replace components within within a handful of
hours if they fail? You know, we're talking about availability. We're talking
about keeping production lines up. We're talking about keeping the lights on in power
plants. You know, we're talking about address seeing risks to production. And
this is what a lot of engineering teams in a lot of sites focus on.
You know they yet they sort of have they figure they have safety under
control, and what they're thinking about top of mind day in, day out
is availability, is reliability, is keeping uh you know, production going in
the face of you know, routine equipment failures and and you know, occasional
errors and omissions and this kind of stuff. And so you know, to
me, this seems to be a way to engage those teams in cybersecurity by
pointing out that you know, uh, cyber security risks are relevant to availability,
and if you can build up sort of a big picture of risks to
availability, of risks to reliability and position cybersecurity in there, you know,
down the road, it's going to be easier to take the next step about
saying, well, what other cyber risks are there? How could they reach
out of the reliability realm. I don't know, into your safety realm or
your equipment damage realm. But you know, given the focus of a lot
of businesses on reliability, it makes sense to me to build that focus into
a cyber risk tool and you know, deliver in a sense. Uh,
you know, a couple of benefits, benefits for cybersecurity as and uh,
you know, benefits in terms of increased confidence and increased insight into the reliability
of our production processes. So criticality is important. You know, does the
production line have to stop if the printer malfunctions because we can't you know,
label the product anymore. But you know you're gathering you know what Once we
understand criticality, you know what else is there? How do we use that?
So our methodology is looking in two different aspects of how to evaluate the
risk of the asset. So we are relying on or looking into the cybersecurity
framework with the three different phases. It is the protect, detect, respond,
and recover phases. So when we're looking on one component, we are
looking about the protection pat saying do we have the technical protection in place like
firewalling, antivirus, network segmentation. But we will also look into the more
soft pat so to say, the procedures around it, saying well, do
we actually have a PATS and vulnerability process around these devices. On the detection
side, we would look into saying do we actually monitor would we discover an
attack against the printer or the sorder or the HMI or the PLC. Where
does the alarms go? Do we have a lock for this? On the
response pat we will look into the more soft parts saying well, we need
an incident response plan. Is that is this component a part of that?
Do we actually have ownership on the component? Do we have s l a
about about the replacement of the device, is it end of life? And
to support these issues and on these components, and on the recover side,
we'll say, well what about backups? Do we do backups? Do we
do the do we do a test of the backup? And where is it
located? Actually, if we need it, can we get it? And
we're using all these information to kind of put it into an algorithm or algorithm
where we where we calculate the risk or so by doing the risk or calculation,
we can actually go in in and say, well these components have a
high the most negative risk or and thereby we should start to make decision making
about getting these risk goores on a on a sceptable level. Okay, so
that that kind of makes sense in the abstract, But you know, I
understand you do this all the time. You have a tool, you know
in your world when you're doing a risk assessment, when you're putting all of
this information together, where does the data come from? Do you do You
press a button and it appears, so how magically do you? You know?
Do you enter the data manually? What you know? Where? How
do you? How do you do this? We do when we go out
making these assessments, we do see a lot of spreadsheets going on, so
people are putting in ASID information in different spreadsheets and having that as a as
as A as their as IT management inventorial lists. So that is that is
we in the tool we are enabling the import of these spreadsheets. It could
also be that we have a structured as IT management platform that we can that
we can import information from. We also see seeing from some customers where we're
done the assessment that they don't have any idea about what is out there.
So what we see is also going out making an active scan where we're using
like nosoumi to do and as smart pulling uh run where we are getting information
back from poc s, h m i S and scale and twitch and things
like that. So we are building up the asset database from that play.
So it's different ways that we can import into our tool and then starting up
a base of of assets. The other side is that that we might when
we go out. We do manual registration of OG devices. So we do
go out and having the tool. It's it's able, it's can it is
enabled on a on a on an iPad where you actually can go out and
and and register devices that might not be connected so you can't see it on
the scan. But it also can be new devices that have not been been
been registered yet in the original database. So we do have different ways of
getting information into the into the into the application. That makes sense, you
know, it sounds like you're importing stuff. There's some you know, some
manual data entry. Can I ask you know how often does this data set
change? I mean and and and how do you in a sense, how
do you track those changes? If if the business implements an incident response plan,
that's not something that you can scan the devices and discover that suddenly there
is an incident response plan for these devices, whether they used to be you
know, how how often does this change? And how do you keep track
of it? So so the the idea with the tool is that it's not
just an at risk assessment tool that you're doing once a year or once a
requarter. This should be a continuous work where the operator of the production line
are registering changes so or it could be on a more global scale. Let's
say that they have done an initial risk assessment and figuring out that well,
on the backup part, we don't have any backups. It's clear when we
walk through the three hundred OT components on the factory floor that we don't have
a backup. So we going out through the decision making of the report saying
well, we need to buy a backup solution. And when that backup solution
has been implemented, basically you're going into the tool and making a bulk update
saying, well, all the devices on production line five, they are now
a part of backups, so you can make a bulk update saying well,
now we have this production line enabled on backups, automatic backups, and thereby
you can see that your maturity and your security level would be better due to
the fact that your risk or would be better because you have entered that now
we have a backup solution implemented on the factory flaw. So that's the idea
about this that this is not just a one shot, but it's a continuous
work with enhancing our resiliency and our ways of working with cybersecurity in ot Okay.
So we have the data, you know, it's a wide variety of
data. We are maintaining the data. You know. A truism that I
try to go by is it's only worth acquiring and tracking data if you're going
to use it. Otherwise it's wasted effort. So can you tell me once
you've got an accurate, up to date inventory understanding credit? Can the understanding
all of these other characteristics of the security program and how they apply to each
of the assets. Once you have all of this, you know, arguably
valuable data set. How do you make it valuable? How do you use
it? What do you use it for? So actually we've been running a
beta tist at the customers right now. Hopefully the tool would be released in
the binning beginning of next year in twenty four. The experience that we had
from the tool and the beta customers is that they actually like like and can
see a great value in a structured and a centralized way of making reports.
So we have some of the customers that are in the beta program inable to
go out and say we would like to kind of compare five or six different
factories and by having KPIs like we would like to see the number of the
number of unsupported hardware that are more than five years old, for instance,
and we might put in a KPI in the factory on the factory level saying
well, we won't have a critical infrastructure that are more than five years old.
That that that's not that's a a KPI we're putting in as a measurement
for saying that's where we need to go in and make an investment so we
can keep this KPI. And and that's what people like that. It's it's
it's done in a structured way, and they can track how far they are
on the on the goal, so to say. And they can kind of
measure one period where they had made an assessment and then they're going out the
year after maybe making a new one, so they have a track on what
has actually been improved here. So that that's that's a that's a key point
that we're seeing from our beta data, Beta sister, that that that's a
great value for them. Okay, so you know the the inventory and this
sort of standard set of characteristics and standard calculations gives you a ruler. It
lets you measure the you know, Compare the strength of your security on one
part of your production line versus another. Compare the strength for your security between
factories. Report to your management team, you know, key performance indicators.
Is that is that the main benefit is that what you use the tool for.
So so the main benefit here is that that we can kind of look
into how the risk score is is is deciding which investments that are done from
a management perspective. So so driving the risk gord to an acceptable level would
be would be the reports would be included in the reports about what's your next
step be. So, Nate, let me recap just a little bit here.
I heard sort of two benefits out of this risk scoring system. One
is that you get a number out of the process at the end saying,
you know, sort of adding up all of the risk of downtime at at
a facility, and you know, the number kind of makes sense. You
assign a number to every device in the facility, add it all up.
What does this mean? Well, it means larger facilities with more stuff are
at greater risk of downtime, you know, all everything else being equal.
It gives you a ruler to sort of measure risk of downtime across facilities,
you know, so that you can you can again make investment decisions. Where
should I if I want the biggest bang for my investment dollar in terms of
reduced downtime due to cybersecurity risks, due to reliability risks, where am I
going to put my next dollar? Well? Which facility is at greatest risk?
Okay, now that I figured out the facility within the facility, and
I say, well, which components in the facility are contributing the most?
Those are the components I should focus on. What are the characteristics of those
components that are contributing to most? Is it that they're not backed up?
Is it that they're old equipment that we can't buy on, you know,
from the vendor anymore, and we don't have spares for anymore. Is it
that, you know, multiple vendors are remoting into the same device, and
if any one of them makes a mistake, there's going to be finger pointing
and it's going to take forever to figure out what happened. You know,
these are all characteristics that contribute to risk. And you know, here's a
sort of a score sheet that lets us figure out, you know, if
we've got x dollars to spend this year on on risk reliability, risk from
cybersecurity to you know, normal equipment failures. Where should I focus that and
how do I drill down and you know, select the components that that need
upgrades, that need that need remediation. So what you're saying thing is that
a key output is the actual risk score for a production line or for a
set of assets, and if that score is unacceptable, then you know the
next step is obviously to fix it. Do your customers understand the meaning of
a risk score? Do they understand the difference between a plus seventeen and a
minus four hundred and thirty two? Do these numbers mean anything? So the
tool gives you the ability to look into what is actually causing a negative risk
on and thereby making decisions based on that knowledge. But clearly the numbers is
mostly for the decision may make us saying well a bad risk gore is probably
not good, so we need to look into those. So basically, when
we're doing these assessments, you will make us a sort at the end saying
well, which one are the worst ones? Do they have any characteristics the
ones with a bad risk on? And do we see a kind of a
trend saying well, we don't have an incident response plan, or we don't
have necessary backups, or we don't have spare parts in so can we as
a company on a seal on a global scale saying well, we need to
look into either a technical solution or we need a procedural part like incident response
saying well, from a global perspective in a company, we need to go
out and develop an incident response plan because the risk or showing that that we
don't have that. So so that's the kind of way you're going from a
detailed level on the component part and kind of putting it up to a more
global consideration about where should we put in our efforts because we can see all
the factories are missing whatever. So that's also the idea that that the risk
WORE can be used on different levels in the company, not only for the
operator but also for the factory manager but also for the whatever. The risk
governance sports saying well, we can see that there's an issue about this all
over the place, so we need to do something about it. Okay,
So so the tool you know, shows you what is sort of sticking out
as as most exposed or most you know, consequential. Can we do what
if scenarios? I mean, let's say we define an insert response plan for
production line for or we h you know, deploy antivirus throughout factory number three.
Can we see how the risk score will change as result of those those
actions or will change if we if we carry out those actions. It is
on our wisk list to have that on a on a on a future version.
It's not there yet, but but still what we can can can tell
the customers is how does the which part of the questions are actually impacting the
risk orre most? So we can go out and and and saying like whatever
a negative or backup gives you a negative of minus fifty or whatever. So
so we can show the customer how have we defined the algorithm behind it,
saying which one do we see as the as the most critical part that gives
a bad risk orre And we also in the process for looking into whether the
customers should be able to give input to how the risks score should be calculated.
So our definition of the risk or might not be suitable for another customer,
but it's not in the in the in the play right now to go
out and and kind of tailorize the risk or for a specific company. But
we can tell the customer how is the risk or def and what what how
how does for instance, backup or spare parts of our missing incident response plan
impact the risk on we We can do that, but we don't have the
the what if kind of play in the application yet. You folks are in
the European Union, You're in Denmark, and this too is the big news
in the Union, you know the last couple of years. Does this tool
give your customers a leg up on this too? I think the thing that
when you're looking into this two, the headline for NIS two is basically doing
a risk based approach and using that as a as a decision making for how
do you how do you secure your your utility service or your production or whatever
your bank and including in that this too there's a lot of focus on for
instance, asset management, vulnerability management, incident management, and and other important
disciplines. So it will be enforced here in in October twenty four and and
we believe that that the methodology and the tools that we have can can help
complying with these requirements from this too, These to also request that that that
management the management team of the organization have authority understanding about the security level of
the company. And we believe that that putting in a key performance indicators about
where you are as a company from a cybersecurity perspective is important for the management
team to to have the insight and the capability is to approve new incentives where
they can say, well, it's not it's not good with a negative risk,
or it's it's it's you need we need to do something. So the
questions about how you can can equip the customer the sea level with with the
right knowledge, that's that's one of the key the key the key outputs from
from a risk assessment tool as ours. But again it's not just doing risk
assessments, also doing the as a continuous work around cybersecurity. How can we
improve, where can we improve and also track the improvements in the tool.
You know, Andrew I. Risk has been an important theme of our podcast,
especially recently. But when we use terms sometimes in this area, like
risk based approach, it just kind of seems a little bit vague and open
to interpretation. Oh it's it's very much open to interpretation. I mean,
in you know, I'm familiar with the North American market in some parts of
the market. You know, sort of in common usage, risk based is
you know, synonymous with doing whatever you want. Because risk based says I
assess the risk, I decide how at risk I am. I determine my
business is risk tolerance. And so you know, anything I do is by
definition risk based. Because I've assessed the risk, and because I've determined the
tolerance, I can set the tolerance bar. I can tolerate as much risk
as I want and therefore spend as much or as little as I want on
cybersecurity. That's sort of the common usage. The thing is that that common
usage and regulations don't jive. This too, is, you know, a
directive from the European Union to the Member States. The Member States, to
comply with the directive, have to define regulations for critical infrastructure for cybersecurity,
and the regulation that the directive instructs the Member States to produce regulations that are
risk based. The Member States are not going to say you can do whatever
you want. The Member States are going to do something that says you have
to have you know, you have to provide evidence that you have assessed the
risk and that you're taking steps to address the risk. And here's a tool
that provides evidence. You know, this is a tool that's that that you
know, auditors are going to look at and say, yep, you have
done the risk assessment, you have identified what's most at risk. You have
so this is you know, this is a step in the right direction.
It sounds like so you said that the tool is coming out in Q one,
but it you know, it sounds like you've been using something like this
tool for some time, you know, previous versions of it. Whatever.
How has the tool been received by your customers? I mean they they've presumably
been using beta versions, you know. How how what what value do they
see in it? So so, first of all, they like the idea
about having the the the aspect around how can we secure how can we protect
the availability of a production flow or utility service with the with the pump station
and things like that, So having a clear view on how do we protect
these things from and sorry, having the availability availability of running for either the
production line or the utility service, and and and people like the idea about
adding information to the traditional asset management tool where they have what we say,
kind of static data or a non kind of critical information added to their their
the data from from the assets. So they have perceived it very well.
And yeah, normally we see that that it's it's been using. They have
been using spreadsheets which are somewhere or somebody has updated it somewhere at some point
of time. So they like the idea about a structured way, one place
to have the data and they can work with them. We have built a
solution around traditional Microsoft platforms like ESQL and power BI, so they can can
get a good insight and have a structured approach to how data are covered and
and stoed. So this makes sense. You know, a tool to automate
the process of tracking you know a lot of security characteristics. A tool that
you can press a button and say, well, where is the next investment
in security that's going to pay off the most in terms of increased reliability of
manufacturing and critical infrastructure. Thank you for joining us. This this all makes
sense. Before we let you go, you know, can you sum up
for our listeners what are the most important lessons here and you know what should
they be thinking about going forward? Yeah, well, from our experience and
also what we hear all the time is that if you don't know your OT
infrastructure, you're not able to protect it, and we believe that is true
when we're doing assessments. About ninety percent of the assessments that we've done we
have found components that were not registered or even the operator didn't know it was
dangerous. And that's I guess that's also our learning here saying that the whole
thing about awareness on the factory floor, about putting in modems or putting in
devices that can actually help the operator for being more effective might have an impact
on the security in the factory flow. So having a structured approach about as
management from a rich perspective will help the customers to do the right decisions.
And we believe that there's a need for going into the details here, having
the specifications on a component level to make that decisions. So I mean we're
just seeing I mean you need to put in also not only the technical protective
solutions, just as network segmentation or whatever anti virus of monitoring, you also
need to look into the overlaying procedures for maintaining at the right level of cybersecurity.
I mean, just the reason attacks that we've seen on water utilities in
the US and in Ireland and where vulnerabilities were used to lay down water utilities.
Also actually in Denmark will be seen an attack against twenty two energy companies
just recently where vulnerability in a firewall were utilized. It all makes sense to
go out and actually look into the procedures and that can help us protecting the
infrastructure regardless of its utility, service or production. So and that's I think
that's important output from this that we don't only only look on the technical part,
but also having a focus on who's actually doing what in our companies.
So about the tool, I mean reach out on LinkedIn. We would like
to have customers onboard to evaluate the solution and you can see more on our
websites. But thank you very much Andrew for having me here. Andrew,
that seems to be the end of your interview with Yan. Do you have
any final word you'd like to take us out with today? Yeah, I
mean I learned something here. I mean this this tool sounds like a step
in the right direction in my understanding. It does three things. It identifies
all risks to reliability to reliable operations from the mundane you know, lack of
spare parts to the cyber you know, lack of an incident response plan.
It gives you a ruler to compare risks across sites. Again, it helps
with investment decisions, which site is most in need of reliability investments, which
site is most in need of security investments. It helps make decisions about how
to spend those security dollars most effectively. And it provides the kind of evidence
that we're going to need for this two rate regulations, evidence of disciplined,
risk based decision making, not handwaving, but actual numbers and justification for security
investments. All right, Well, with that, thank you to Jan Hartik
for speaking with you, Andrew. And Andrew is always thank you for speaking
with me. It's always a pleasure. Thank you, Nan. This has
been the Industrial Security podcast from Waterfall. Thanks to everybody out there listening. B