There was so frustrating for me to get into the field, and I don't
want people today to feel that level of frustration and it just shouldn't be that
hard. Welcome everyone to the Industrial Security Podcast. My name is Nate Nelson.
I'm here with Andrew Ginter, the vice president of Industrial Security at Waterfall
Security Solutions. He is going to introduce the subject and guests of our show
today. Andrew, how's it going, I'm very well, Thank you,
Nate. Our guest today is Mike Holcomb. He is a fellow for cybersecurity
at FLOOR and he's the global lead for Industrial Control System and OT cybersecurity practice,
and he's going to be talking about changing careers. He's going to be
talking about making the move from wherever you want are in engineering and it somewhere
else, making them move into OT security. Then, without further ado,
here's your conversation with Mike. Hello Mike, and thank you for joining us.
Before we get started, can you say a few words about yourself and
about the good work that you're doing at Floor. Sure, Thanks, thanks
for the opportunity to come on the show, Andrew. And yeah, for
those that don't know me, my name's Mike Holcombe. I'm the fellow for
Cybersecurity at FLOOR as well as the ICSOT or Control Systems Cybersecurity practice at FLOOR
globally for those of you that don't For those that don't know about FLOOR,
we're one of the world's largest engineering and construction companies in the world, so
we get to build and I get to work in some of the world's largest
industrial control environment. So I'm very fortunate not only to work in these large
environments, but also work with some of the greatest engineering mind in the field
today. So it's really exciting and I can ask for a better place to
be in wanting to work in cybersecurity and in security and all these unique environments.
And our topic today is getting started in the OT security space. You
know, can we start at the beginning? How did you get started?
For when I got started, I go back to twenty ten and getting into
OT cybersecurity. So now I've been a long time IT cybersecurity practitioner twenty five
plus plus years. It was twenty ten when stexsnet was first announceder got the
news about this new I was just amazed at this technical, technological marvel that
had been created to reach out in the world and manipulate something out in the
real world. And I was just really fascinated with that concept. And of
course we had always thought about different types of attacks and things of that nature,
but here is where we actually saw it. It pulled off and it
was very, very real all of a sudden, and then started asking the
questions about you know what, what about power plans and water treatment facilities or
railways right what happens there, And started asking those questions, and then started
reaching out to folks to have those conversations. And of course back in twenty
ten, there weren't a lot of folks that wanted to have those conversations.
You know, you had it people that didn't care about OT, which didn't
even really necessarily call it OT back then, and then you had the folks
in OT environments that they didn't want to talk about cybersecurity because I don't think
a lot didn't want to let on that they weren't doing anything for cybersecurity back
then and just didn't understand it. So it was it was a struggle.
Initially for me, it was really really frustrated. I think that was probably
for a lot of folks, you know, at that time, and I
just ended up twelve and a half years ago getting a call to go work
at Floor. Like I mentioned, we're one of the world's largest engineering and
construction companies. And so after about the first year of working there, you
know, keeping my head down, trying to learn the ropes of the new
job and get my feet under me, I started to realize, yeah,
we probably have some control systems around here, and started making those connections with
different engineers and in the company. You know, right now we have four
thousand control system and electrical engineers, for example, and so there's a lot
of folks we work with all over the world, and there's quite a few
that are always very willing to lend a hand, have a conversation in,
to jump on a call. And so I've been very fortunate just to build
that knowledge kind of organically, kind of grassroots movement since you know, probably
the last especially the last ten years, and getting into you know, working
with the different departments, and then you know, really starting to build out
what a cybersecurity practice for a company like Floor looks like, to where we're
helping our clients build right a cybersecurity program for their environments, whether it's a
power plan, whether it's an LNG port facility, whether it's a like commuter
rail or open pit mine manufacturing, and the list goes on and on.
But you know, we're clients didn't necessarily want to have those conversations even a
couple of years ago, whereas after clonal pipeline that really changed the landscape,
and all of our customers are very engaged and want to have those conversations.
So for each of those projects, we look at building out the cybersecurity SPACs
again to work with a client to understand their risk tolerance, their risk threshold
and budgets and help them design again the right cybersecurity program for their environment.
So let me contrast that with my own experience, and so we have you
know, two data points here. I got started, I had a computer
science degree. I got started doing software development for the first i don't know,
fifteen twenty years of my career, eventually developing industrial control system product,
you know, rising through the ranks of the development team, winding up managing
teams. At one point I was responsible for the IT security of the local
office, and so I had dabbled a bit in the security space. This
was you know, back before security was a real thing. Like in the
mid nineteen nineties we're talking about. You know, the big news that I
remember was Y two K. HY two K was the big thing. You
know, it was in a sense non news. Nothing happened, but there
was enormous preparation on the industrial side that went into that, you know,
uh rebuilds, patching everything. It was. It was amazing. And then
there was of course nine to eleven, which you know, if you remember
the Aaron Turner episode a couple of episodes ago, you know, he talked
about how the nine eleven event, how he was part of the process of
that turning into today's industrial cybersecurity initiative. You know, in about two three,
I was still working on the io T middleware that was connecting a lot
of control systems to SAP, connecting a lot of these networks together, you
know, in hindsight, contributing to the security problem. And you know,
the business that I was part of was sold off the the you know,
the new management said we're taking this into industrial cybersecurity, and I said,
really, that's a thing, because this was you know, this was two
three, it was the very earliest days of that. You know, I
finished up the IoT middleware project, while you know the rest of the business
took our control system product and moved it to se Linux Security Enhanced Linux.
So I wasn't part of that. I sort of I saw that from the
outside. I thought, wow, that's a lot of work. It was
a lot of work, and as far as I can tell, nobody,
zero points, zero sales. That was not what the world was looking for.
You know, I got pulled into the the project to build the world's
first industrial SEM security information and event management system. You know, in control
systems terms, it was. It was a single pane of glass. It
was an HMI for cybersecurity of your control system. And that was how I
got involved. You know, that project went on for a long time.
Eventually I got pulled into promoting that project out in public, talking to you
know, prospective customers at conferences and face to face about the cybersecurity problem landscape,
the solution landscape where the you know, the Industrial Defender SEM fit into
that. Industrial Defender has long since moved on. This was, you know,
fifteen years ago. I don't think the SEM exists anymore. But that
was my own genesis, you know, dabbled a bit on the IT side,
heavy into software development, very technical, and got pulled into the product
development side of industrial cybersecurity in sort of the mid two thousands, almost to
my surprise, because somebody else did the market research to figure out there was
a market here. This was a thing that was happening because I'd never heard
of it. It was it was very early days. So that was that
was twelve years ag go. You know, very few people were doing this
stuff. It was possible to sort of drift into it, just show some
interest and you know, become part of the evolving field. What's your advice
today if you've got people who want to get into the OT security space.
I definitely have a lot to say about about that subject, one of my
favorite to talk about, since it was so frustrating for me to get into
the field, and I don't want people today to feel that level of frustration.
It just shouldn't be that hard. And so, you know, when
you talk with folks with it backgrounds like like myself, there's to get help
get started. Really there's a focus on needing to think like an engineer.
I just go back to when I took my first stands ICs O T course
the g c SP. It was it was really fascinating. The best thing
about the class was it was half IT people and half OT people. And
I remember a gentleman in the front of the class asked a question and it
was really what I thought was a really basic question around networking. It's like,
oh, I could answer that, but it was the way he asked
it. It was completely different on how I would have thought about it.
And started talking with him, you know, and he was an engineer in
a water treatment facility, and that was really a first time I had talked
with somebody from from that world and really starting to look at things from his
perspective. And so I think that was a great experience. And so coming
from the IT world, we have to learn to think like an engineer,
see how they see the plant, how the plant works, and understand each
plant. Each you know, OT environment is completely unique right there. They
have their own physics. Even you can go to two different power plants and
they can be completely different. And so being able to understand how that plant
operates, that's that's a first part of not only helping understand how best to
protect it, where we're focused on how do we ensure physical safety of on
site personnel in the general public and environmental safety and then of course the operations
of the plan. And that's very much, very different from the IT world,
but it's the engineering world. And so when you look at learning to
think like an engineer and then the other really is just I think a it
can feel like a very unsurmountable hurdle to people is learning about different OT systems
and you get caught up. At least for me, I remember, you
know I cs OT, SKAT and like what you know r TU, HMI,
PLC, is what are all these things? And it's like, oh,
you can learn some acronyms, but and then you can start to read
about it, but it's it's it's challenging right at first you can really start
to get your head wrapped around the concepts and understand how each of these different
assets works and how you use that to build and run OT facility. Right,
So I always like to focus on you when I do a couple free
classes every every quarter. That is we focus on how we build a power
plant from start to finish and walking through that process because it helps people not
only think like an engineer and understand the physics of how we're generating electricity in
this facility, but we can also look at all the components that go into
building out that facility, and we can then really learn about PLCs and hmis
and dcs and what each is doing and what they really mean. And I
think that really helps to click in the place for it people. But it's
very foreign. It was at least for me, you know, when first
getting into two OT so, so that makes sense in a sense in the
abstract. Learn about the physical processes that you're you're you're looking at, learn
about the automation systems. Do you have concrete advice? Is there stuff you
know? Would you read about these things? Do you take courses? What?
So? What are concrete steps people can do to achieve those those goals,
those learning goals? Sure? No, A great question, and I
actually should mention I So I wrote a couple of free e books that I
published and they're on LinkedIn and my website mike qulcom dot com where people can
find them and so, and they're not too involved, and mostly it's a
list of different resources and some I guess tips and tricks and a lot of
those go into some of those practical tips, right, so suggestions on different
books that you can read. There are some great books that are out there.
They're not a ton, but I think there's there's definitely a few that
everybody should it should be reading, even books like Sandworm, just to get
an understanding of the importance of IC S O T cybersecurity. I'm a big
fan of a few others, you know, so I don't, I guess,
go too far down that rabbit hole. But you know, between your
books, I honestly take a lot of value out of podcasts. I listened
to your podcast before. There's a few others in the space I also listened
to. You have a lot of great guests that come on and share a
lot of practical knowledge that people can learn from. I remember I was starting
a new mining project at floor and I had not worked in mining before,
and just at the time, you actually had somebody from mining on the show,
and I was able to pick it up and I learned so much from
that conversation. And so that's that's one way trying to get hands on experience,
I understand, you know. I was very fortunate that it wasn't too
long before I was able to go on site and be in an actual power
plan that we were building. Uh, that's luxury, I understand a lot
of people don't have. But you're trying to get some type of hands on
experience, right, So it's building out a home lab, you know,
getting a PLC, starting with some basic PLC programming, maybe hook up in
HMI and start to build that out. So those are some of the things
that definitely suggest So, yeah, there's there's books out there, and I
really take a lot from some of the podcasts out there and including your own,
uh, and then trying to build into that hands on experience of if
you don't have the luxury of already working in OT or maybe you can find
a mentor and that works in OT and that they can bring you on site.
Sometimes I hear that that happening from from time to time, and that's
a lot of experience, especially people from it. That's that's experience that you
just can't even pay for. So at this point, we've talked about how
Mike started off in the industry and how Andrew you started off in the industry.
I don't participate in the industry to the same degree that you guys do,
but of course I do in a tangential sense. And I recall that
when I was getting first started, I had a little bit of background in
it knowledge, but I didn't know the first thing about industrial security. And
I, as Mike suggested, picked up a book. It was a read
book. It was your book on a long flight, I believe it was
an eleven hour flight. I read through, pushed through most of your read
book, and by the end of it, I had a good enough sense,
a good enough base to start talking about these subjects, mostly just asking
you questions, and so I can empathize and agree with Mike's general sentiment.
The latest numbers in the twenty twenty three Threat Report on OT cyber incidents show
that the threat environment has changed fundamentally. At the beginning of this decade,
OT cyber attacks with physical consequences have changed from a theoretical problem to a very
real problem, more than doubling every year. The new report is focused on
deliberate cyber attacks in the public record. These are attacks that cause physical consequences
in process industries and discrete manufacturing. Most of these attacks are ransomware, though
the fraction of activist attacks is growing, and the report's appendix includes a complete
list of all cyber attacks since Stuxnet that meet these criteria to see how today's
OT cyber threat environment has changed. I invite you to download the report,
a joint effort between Waterfall Security and the ICs drive OT Incident Repository. You
can download the report at Waterfall dash the Caqureecurity dot Com SLASH twenty twenty three
dash Threat dash Report, or just go to the resources menu at the Waterfall
Security site and click on white papers and ebooks. So to put the shoe
on the on the other foot, you know, you came for sort of
from the from the IT space into industrial control systems and OTE security. Do
you have advice the other way around if people are coming out of out of
engineering or other sort of aspects of the OT space and and want to get
you know, up to speed on cybersecurity. Sure, sure definitely. And
I and I get with that disclaimer, right, I am, you know,
tried and true. You know I have an IT cybersecurity background, but
I do work with a lot of folks in the OT space, and I
work with you know, I get and meet a lot of folks on LinkedIn
and elsewhere to to have conversations with and help and and so whether it's at
the office or elsewhere, you know, I always talk about, you know,
for folks coming from an OT background, one of the things that really
surprised me is a lot of OT people or that come from different aspects of
automation, they don't necessarily have the fundamentals of networking down. I was really
surprised. You know. I always think, you know, of engineers,
they know everything in the world, and you found a lot of engineers aren't
that familiar with with networking. I was really surprised. So that's so it's
just like anybody coming into it cybersecurity. The first thing I always suggest they
learn is networking, especially of course with tcp IP since that's you know,
the main protocol that we use on all of our internal networks, right even
in OT for better or for worse, and the Internet of course, so
that's that basic foundation for connecting our systems together and then learning the basics of
cybersecurity. So I always tell folks to really look to the security plus stification
that Comtia has and even if you don't necessarily look to get certified, even
though I suggest people always do, but just the knowledge that you can pick
up from picking up one of those steady guides or going through a Security Plus
course or except you get the basics the fundamentals of cybersecurity from the IT perspective,
and then that really gets us to where now we're on this kind of
common playing field where we can have folks from the OT side of the house
and the IT folks from their side of the house really come together. And
I talked about it, it's we always talk about these different sides of the
house, but we always forget that it's the same house that we're all living
in and trying to protect. And so we can come together with kind of
this basic understanding of networking in cybersecurity and learn from each other's perspectives and then
and you kind of put together to build out that plan on Okay, how
are we going to protect our house from somebody trying to break in and do
harm. So you mentioned the Security Plus certification. A question that I get
regularly and have you know, limited insight into into answering is sort of the
more general question about certification. What should I be certified on if I want
to practice in the OT the industrial security space. You know, you've mentioned
security plus. Can you know is there are more general answer yeah, and
we talk about you know, OT cybersecurity. There's there's there's The certification landscape
is somewhat limited compared to the IT world, but but there definitely are some
some certifications that are worthwhile for people to pursue. I think in my opinion,
you know, I always struggle sometimes because I always want to make sure
focus people really are are working on gaining the knowledge and the experience to work
in you know, OT cybersecurity and not just trying to go take a quick
course and take a certification exam. And then I don't imply that they know
everything about OT cybersecurity, because certification, that's that's not the goal, right,
that's not the end game for for the certifications. But there are some
great you know certifications out there, you know, from the typically, especially
in the US perspective, we look to Sands and not only the Sands Institute
and and their courses and certifications that we can we can mention I have all
three of those, in part partly going through the master's program and also just
being a longtime Sands student and having taken those courses that have been very fortunate
to do so. And then the is s the I S a I C
six two four four three series as well that I say created. So I
think for for me personally, the knowledge in the Sands courses is bar none.
I also realized that I was very lucky when I took the Sands Grid
course with Rob Lee. It was actually at the exact same time that the
Trisis incident was happening. So not only am I sitting in class with Rob
Lee who's teaching and you would get to have cyber conversations and go to dinner,
and but also his company is responding to one of the most important cybersecurity
incidents in the OT world still today, and so we were getting you know,
played by play in what was going on behind the scenes, which that's
you know that you still can't you can't pay for an experience like that,
which does bring up the fact that the Sands courses are very expensive these days,
and I understand that not a lot of people can afford them. Again,
the knowledge is second to none. Robbie still teaches his incidentt Detection Response
course for OT a couple of times a year. I personally think, you
know, to be able to be in the room with him and engage and
ask questions you can't. You know, that's in valuable experience. But again,
you know, ten thousand US dollars essentially now to take a class and
the certification exam is hard for a lot of people. And I'm very fortunate
to work for a company that has provided me those opportunities. So the is
A series is a very valid alternative. I think a lot of people,
and especially engineers, have have the is A certifications. They have four courses
that you take and then you have to take the course to take the exam,
and it's about eight thousand dollars if you're not an is A member.
So for their entire series, right, it's already less than one, Sayan's
course. And so I think the one thing to keep in mind about those
courses is that they're designed to teach ot professionals some basics about cybersecurity and introduce
the six two four four three standard. It's not going to and unfortunately the
master certification. Right when you pass all four exams, they give you a
what they call the ISAIC two six two four four three Expert Cybersecurity Expert Certification,
which is a horrible name because I think we could probably all realize that
if you take what is it about twenty four thirty hours even for let's say
forty hours of course materials, and you pass a couple exams, it doesn't
make you an expert in anything. So I think it's it's it's not a
great name, but it's it's a certification that shows that you have a basic
understanding of cybersecurity and different aspects of cybersecurity and how they're implemented in the OT
world. So if you're looking at getting certified and demonstrating that basic level of
knowledge, then I think the say you Know series is going to be the
most effective for people, in part because of the cost and in part just
because of the time and that there is learning involved and there is good,
good information that to get out of it. And for me, Sands,
you know, it's people always joke about, you know, drinking from the
fire hose when you go to a Sands course and you're just flooded with information.
And they have some of the greatest thought leaders in the industry that lead
those courses, like Rob Lee and Tim Conway and with Michael Leesante you know
before them and Derek Harp had was on that original team. So you can't
beat the Sands materials. It's just the cost is so expensive. So and
then there are other alternatives out there. There's the folks in Germany. I
think it's called TUV or TV ryland. I one day I'll figure out how
they pronounce that, you know. I start to see you know, more
individuals with those. Uh, we have some engineers at floor and I've seen
others with the Exodus certifications. So that are a little bit like the I
s A six two four four three, you know, but a little bit
you know Sands and you know, bit more from the vendor perspective with with
dedicated courses at again, like is a you know, you know, reduced
costs, right, relatively less expensive than than Sands courses, but not as
much knowledge or information. So let me dive a little deeper. You mentioned,
you know, people coming to a lot of training and you know,
desires to learn about cybersecurity without basic networking. I've observed that as well,
you know, some years, depending on when the course runs. I teach
a course at Michigan Technological University. The audience is mostly engineers. It's a
graduate course in engineering, and yeah, I find it necessary to burn you
know, two three maybe four hours of a forty hour pool of lectures,
you know, and assigned reading and exercises on the basics of networking. What
is the ethernet? What is a frame? What is you know, the
art protocol? How do you resolve IP addresses? How does IP rite on
top? You know, once you leave the ethernet into the internet, what
does IP look like? Is this? Is this what you mean? I
mean, how how much of that in your estimation? How much? How
deep on that do you really have to go? I would say very similar
when I do do those types of classes, you know, at least a
couple of hours, and I do training also with our engineers at floor on
a regular basis, you know, definitely at least a couple of hours.
But I think that's the same concept or the way I look at it is
this idea that if we want to understand how to protect our environments from the
attackers, and we have to understand how they're getting into the environment and how
they're actually conducting and pulling off these attacks, and of course they're doing this
over the network, and so we need to be able to understand the fundamentals
of networking to be able to ultimately better understand how to protect our environments,
so we do cover everything from again focus on TCPIP since that's going to be
the main protocol we're using in all of our environments, and of course that
opens us up to the wonderful world of Internet connectivity for better or for worse,
and down to you know, we start to look at things like how
does our work and how does IP routing work, and then that leads into
the conversations like when we start talking about well, how do we best protect
our OT network, well, we always are going to suggest we start with
secure network segmentation. So you can't have those conversations about things like network segmentation
and putting a firewall or a firewall to DMZ between IT and OT before we
already at least have the basic understandings of networking. So that's why it's it's
always definitely a big focus for me is we need to understand the fundamentals of
networking to be able to understand how all these components talk together within IT,
within OT and now it T with OT and then also on top of that,
how we're connected to the Internet, all in ones that some way shape
or form, and so how do we be able to protect the network from
attack. But again, we have to have at least a basic understanding of
networking before you can really start getting into those fundamental so especially like things like
how do we do secure network architecture? Now you've mentioned standards six two four
four three. How big a role should standards play? How you know?
How familiar you do you figure that people on both the you know, coming
from the I side or the engineering side into OT security, how how familiar
do they need to be with standards? You don't have to know them in
and out necessarily unless your job requires you to. But I think they're great
references, especially for people that are getting into cybersecurity. They're great references to
starting to learn about the different aspects and all the different domains, everything that
comes together to create a fully functioning cybersecurity management program in OT environments. And
whether it's a power plant or a manufacturing facility or railway, it it doesn't
matter the environment. But the standards will show you all the parts that you'll
use no matter what type of OT environment you're in. So six two four
four three is the gold standard everybody looks to today, but it's not you
have to pay, you know, to get the full copy, So it's
not something that's probably is rarely available to everybody, even though it's still a
lot of great information. I think that one can be a little overwhelming at
first as well for some people, at least I know it was for myself.
It just didn't come across as to me as kind of a straightforward standard,
I think because it's written more from an engineering perspective. So for OT
folks it probably is. It probably feels it makes a lot more sense than
for folks coming from an IT background. I suspect at least that's that's for
me, well kind of what I was thinking. So I can also gravitate
towards NIST, you know, so we have nis ice in OT uh and
so people can also look to that as a standard. I think that has
a much more kind of familiar look and feel if you're coming from the IT
cybersecurity world, uh and so, and it's freely available, so it's something
that you can access today and you can look through it to see an all
the different components that go into building a cybersecurity program for an OT environment.
So I do think there's there are they can make some great references and then,
of course, depending on if you work in an OT environment today,
you might also have you either requirements to adhere to those standards or frameworks,
or you might also have other regulations like if you're empower generation or transmission in
North America and the United States and Canada, you have to be very familiar
with nerk zip. So all all great resources for either people that are in
the field or for those that want to learn more about OT cybersecurity. So
you know, good list of resources there. The is a standards you know,
ie C six two four four three standards. They're the same thing.
You do have to pay for them. I don't pay for them legally.
What I do is I buy an is a membership. I just renewed my
membership. You know, if you renew early you get a twenty percent discount.
I think I paid eighty five US dollars to renew. You pay this
every year and you get online access to the standards. You cannot download them,
you cannot print them, but you can read them. This is this
is what I do. I don't have copies of all the six two four
fourth three standards when I need you know, the standard as a resource I
log in on my ISA account, and you know, Mike mentioned NIST.
Let me go just a little bit deeper on this. Uh, this eight
hundred and fifty three DASH fifty three is sort of the the IT standard that
everyone uses. The this cybersecurity framework is you know it ISH every one uses
it. Missed. Eight hundred DASH eighty three just came out. Version three
of it just came out, and it's focused on applying all that stuff into
the industrial space, and so it's much more industry focused. You know,
I use it routinely. It's got really a very readable first one hundred pages
of kind of introduction. So I recommend very much the eight hundred DASH eighty
three standard courses standard certifications. Is there anything else that we've missed you?
What would you encourage people to do to make the transition. I think the
other big thing that we didn't talk about that I like to focus on because
I see how rewarding it can be is to get people involved with the community
as as a whole. So different, completely different type of networking that we've
been talking about. But when you look at and I understand, at least
speaking from my own experience, I'm an extreme introvert, I don't want to
get out and talk to people as much as I might seem to and and
so the last thing necessarily I want to do is is is get out and
talk. And at the same time, it's so amazing when whether you go
to a class or you're you're on social media like LinkedIn right, and you're
getting to talk with people from all over the world from different backgrounds and different
perspectives, and they come they work in it and OT and they get they
have different experiences and they work in different types of environments. You can learn
from so many different people that are out there, and you can also share,
you know, from your own experiences and give and they can learn as
well. So it's it's really amazing experience. You can also see that when
you go to conferences. So I just encourage people whether you try to go
to you know, some of the larger conferences like the sands I C s
on it or S four, or maybe even some of the smaller, more
local conferences like b Sides. You know that you can get together with people
and everybody's there really just to learn and share and have a good time.
It's just very easy. And I see this all the time for people in
both IT and OT, where we're just doing their job. We're keeping our
head down, got the blinders on, we're just getting things taken care of.
But if we're not out there, you know, only learning and sharing
with each other, but also you know, understanding what's evolving out there in
the world. Right, we need to make sure we're staying current and understanding
what's going on. I'm the ICs OT cyber security landscape has changed drastically over
the last two two and a half years. I would say even more so
in just the last couple of months, if not just a lot couple of
weeks. Right, we had news of the power being turned off in the
Ukraine again back in twenty twenty two, even though they just announced it.
Not sure why it took so long, but you know, that's definitely an
involvement or evolution to understand how that was not ICs specific malware that was living
off the land techniques that were used in that attack, Right, That's something
that we need to be aware of as OT defenders. We can look at
the Danish coordinated attack by I think allegedly Sandworm, right, which was detected
by the Sector Serve team, Right, and that alone has other implications that
we all need to understand and be aware of as OT cybersecurity defenders. So
if we're not, if we're just doing the job keeping our heads down and
we're not out there talking in the community, we're not in you know,
on social media like on LinkedIn, sharing information and reading the latest news and
out there going to the conferences, listening to the podcast, reading the books.
If we're not staying update, we're not staying current, then then ultimately
we're not doing our jobs as cybersecurity defenders of our OT environments. You know,
Andrew, had Mike not have said that, I haven't necessarily had the
feeling that lately industrial security has changed all that much. If anything. One
of the cases that he's referencing there in Ukraine was sort of a rehash of
a few instants that had occurred between Ukraine and Russia before. I don't know,
do you disagree with me? Do you feel like things are really rapidly
moving these days? I don't know about rapidly, but things are changing,
and I'm not sure that you know a lot of practitioners are tracking these changes.
So the change you mentioned was living off the land, you know,
for anyone out there who doesn't already know what that is. It's using,
you know, instead of writing your own malware, your own remote access trojan,
your own virus, your own who knows what, instead of writing your
own attack tools that have signatures that anti virus might detect. That, you
know, are artifacts of code that can be detected on a machine. You're
using the tools that are already built into Windows or Linux or whatnot. I
mean, Linux is a treasure trove of tools, and so if you look
at a compromise machine, there's really no evidence there's nothing installed on the machine
that shouldn't be there. If you look at network traffic, it's the traffic
that sort of normal allowed tools are putting on the network, and so it's
it's sort of more devious than average. Is it new? Well, I
mean people have been talking about this in the IT space for a while.
I think it's new ish in the OT space. You know, something else
that's changed that people are not tracking is you know, the latest Waterfall threat
report shows that this decade, since twenty twenty, the attack world has changed.
We've gone from a state for a whole decade where cyber attacks with physical
consequences. You know, the lights go out as in the Ukraine, or
equipment is damaged as in the you know, the steel mill in in Germany.
A decade ago. These attacks used to be sort of trickling along at
you know, one or two or three a year, and now we've we're
starting to see what looks like exponential increase. We went from you know,
five in twenty nineteen to eighteen to twenty three to fifty seven last year.
You know, the world has changed. Is it dramatic and fast? I
don't know, but we do have to keep track of these It's it's been
great. Thank you for joining us. Before we let you go, can
you can you sum up for us? Can you you know what what should
we take away? What are the most important things to remember? If you
know we're either on the ITS to the engineering side, wanting to make the
leap into OT security. Sure think I think the main points is it doesn't
matter if you come from IT like myself, if you come from OT background
like many of my colleagues. It's it's the IT side of the house.
It's the OT side of the house. We all live and work in the
same house. We all want to protect the same house. We have to
work together to be able to do that. You know, not everybody in
IT wants to learn about OT and not everybody in OT wants to learn about
cybersecurity. So if you're one of those people that does, and when you
encounter others that are like you and that they do as well, learn and
work with each other and share and encourage each other, because it's going to
take all of us together to protect our very unique and critical environments. Because
as we just touched on, you know, just real briefly, the threat
landscape has started to change dramatically and it's only going to get worse from here,
and it's going to be on all of us to make sure that we
protect our environments, to help ensure right that we're protecting the world around us
right for our families and our friends, and no matter where in the world
we live, we're all in this together. I always like to talk about,
you know, and protecting the world, but it does take us all
all working together. So but I appreciate you you having me on the podcast,
but I do appreciate the time for being on the podcast the INFI it
was great to get to come and talk with you and share with everybody real
quickly. If anybody's looking for us down the road, of course, you
can find floor at Flora dot com. You can check out jobs dot flora
dot com. I think we have about thirteen hundred opening right now for it,
and of course ot engineering professionals all around the world, so definitely check
out the site there. And if you're looking for me, you can find
me on LinkedIn. I'm always on LinkedIn, and you can also find my
resources at Mike hocom dot com. But again, reach out anytime. But
I appreciate the time and for everybody for listening to the episode. Andrew,
that was your interview with Mike Holcom. Do you have any last word that
you'd like to take us out with today? Sure, I mean what what
Mike sense you know makes perfect sense. Take training if you can afford it.
You know sands or is a or you know. I wasn't aware of
the tuv rhineland or the exited training. Read the standards. I especially recommend
the free NIST eight hundred Dash eighty three that is focused on industrial systems.
It's free, it's readable. You know, when you have opportunity, try
to attend some conferences you know, there tend to be comfort which is more
local and more distant. You know, controls your travel costs. And when
you're at a conference, network ask people questions and you know, maybe to
expand on that last one just a little bit. You know. I've been
attending conferences for over a decade because that's part of my job. I'm a
techie, though I struggle with networking. I had a really great networking experience
at the ICs conference in Denmark just a couple of weeks ago. It's been
fifteen years, but I may finally have figured this out. When you get
an expert in front of you with you know, a beer in their hand
and a snack in the other, you know, yes, introduce yourself,
ask what they do, and then you know, from your knowledge of the
field, ask a controversial question. I mean I sat down with the folks
at the Sector assert they were at the event in Denmark a couple of different
times, continued the conversation on LinkedIn. You know, eventually it was bold
enough to ask the question, this attackted Danish critical infrastructure. Why was there
no report of any other infrastructure in the world being targeted? These firewalls that
were exploited are used widely. The the you know, the the vulnerabilities were
well known and I got a useful answer. Now, it wasn't a clear
answer because there's confidentiality agreements. There's only so much these people, these experts
can tell me. But I was always afraid of asking people controversial questions,
and don't be experts love to talk about what they're doing. If they cannot
tell you something, they will explain why they cannot tell you something. And
that context in itself was useful for me in terms of understanding the scenario.
So, you know, I would encourage people to sign up to the skato
sect mailing list or sign up to the ISASP ninety nine Standards Committee mailing lists.
You get a lot of stuff. You don't have to read everything on
the lists, but what you get is a sense of what people argue about
and what's controversial, so that you have ammunition at your next, your next
networking session. So that's that's my little nugget of you know the I had
three really interesting, you know, conversations at networking at this event in Denmark
by asking questions that are a little bit controversial. Well, with that,
thank you to Mike for speaking with you Andrew, and Andrew, thank you
for speaking with me. It's always a pleasure tonight. Thank you so much.
This has been the Industrial Security Podcast from Waterfall. Thanks to everyone out
there listening.