Yorkship. Non compliance can cause fines of up to one million dollars per day
per violation, so that's that's a lot of money. Welcome everyone to the
Industrial Security Podcast. I'm Nate Nelson. I'm here with Andrew Ginter, the
vice president of Industrial Security at Waterfall Security Solutions, who's going to introduce the
subject and guest of our show today. Andrew, how are you? I'm
very well, Thank you, Nate. Our guest today is Katherine Wagner.
She is the VP of Industry Solutions for Energy and Utilities at ASSURES and our
topic is compliance. I mean compliance can be a very expensive process. We're
going to be talking about automation. How to automate you know, some or
most of this compliance work so that it doesn't cost us so much. All
right, then, without further ado, here's your our interview with Katherine.
Hello Katherine, and welcome to the podcast. Before we get started, can
I ask you to say a few words about yourself and about the good work
that you're doing at a SHOREX. Yeah, good morning, Andrew. I'm
very happy to be here. I am Katherine Wagner, the vice president of
Industry Solutions for Energy and Utilities at a shorex SO. I have a background
in engineering and an also software development and management. I have nearly thirty years
of experience with systems integration from the compliance and a bunch of industries. Used
to be a bunch of manufacturing and now it's a mostly energy. For the
last eleven years, I've been with a shorex helping our customers implement solutions for
NERT and other quality and compliance related requirements while being a product manager for our
for NERT compliance and related systems that focus on a reliability and resilience. I
also help guide the strategic vision and seek expansion opportunities into other regulated industries within
the energy sector or even other critical infrastructure sectors. A no doubt assure x
SO Assures has been a leader in quality and compliance management systems for over twenty
years. We operate in highly regulated industries such as energy and utilities, which
is my part of it, SO, pharma and biotech, medical devices,
manufacturing, and food and beverage, and those are things I don't really deal
with all the time, but our company does, so thanks for that.
We're going to be talking about compliance management in just a minute, but I
understand that you folks got started you know years ago in the space of quality
management. Are the two fields related, Yeah, andrew their natural their natural
evolution from one to the other. So quality management involves things like managing documents,
processes, procedures, issues, nonconformances, kappas, which are corrective and
preventive, corrective and preventive actions, you know, audits, suppliers, customed
changes, risk workflows, approvals, so all those things to meet regulatory obligations
and optimize quality. So compliance management, you know, has similar elements but
with a different language. That's the way I like to think about it.
For example, you know, in the quality space, manufacturers must manage their
suppliers. They have supplier risk assessments, contracts, contacts, what parts they
supply, communications with those suppliers. And in the utility world, we must
manage vendors. So that requirement is defined and SIP thirteen supply chain risk management,
but it includes things like vendor risk assessments, vendor contacts, vendor contracts
so the hardware, software and service that that vendor supplies, and vendor communications.
So it's a different terminology but very much the same. So that makes
sense, you know, And this brings us to our topic, which is
compliance management? I mean, you know, I was introduced to the idea
of compliance and management with NERK SIP back in the day. And of course,
you know you're in the electric sector. You you know much more about
this than I do. UM, can you talk a bit about NERK You
mean, you know you read NERK and it on the surface, it looks
like any other security standard. Um, you know what you know? But
you know, I imagine you have to comply with the security standard. What
what is compliance in the NERK ship context context? But you know what is
what is NERK? How does this work? So? You know, NERK
SIP is all about cybersecurity. It's cybersecurity as it relates to energy folks.
So that is, you know, making sure that you have controls so that
your your power facility or your UM, your substations and your control centers so
that they're all secure so they're not going to get hacked, so that the
grid stays up ultimately, and you know, it really involves protecting the people,
processes, assets and data uh that keep the grid running. And you
know, the NERK SIP is really about the cybersecurity. But compliance with the
NERVE TIP is what happens when the auditors show up, right, you've got
to be able to produce all the data and evidence that those auditors want as
it relates to the ship standards. So that involves this thing called the ART
so it's Evidence Request Tool the auditors. Over recent years they've produced the spreadsheet
so that everybody reports in the same way. So it makes it easier both
on the regulators and on you the entities that are being in compliance. So
that Evidence Request Tool people spend hours and hours filling it out. The first
it comes in two parts. So the first part is a bunch of lists
of data. So they list out their sites, they list out the cyber
assets at those sites, They list out all the people interacting with it,
who has access to those things, and a couple other parameters, you know,
physical security parameters, electronic security parameters, data storage locations, vendors and
other things. But all that data is supplied in lists at the first part
of the audit. And then the next thing that they do is the auditors
pick sample sets from those lists, okay, and then they request more data
from the entities so they you know, they have these They have at least
seventy five different reports that they ask for, which is very detailed. Data
on every single requirement is in the nerdship standards. So some examples of those,
like, you know, was this location commissioned or decommissioned during the audit
period. You know, they might want to know all of the access authorization
records for a set of individuals, all security patches that were released, evaluated,
applied for a set of assets, Evidence that the full configuration change process
was followed for any kind of you know, patch installation, you know,
incidents, cybersecurity incidents, UM that the response plan was followed for each incident
that they they asked you about. So all this data is very challenging to
organize. UM. You know, it's not trivial at all to pick out
this data. I've heard some horror stories from our customers that it takes weeks
and weeks of pulling data from different systems. UM, you know, the
learning management system, the HR system, the asset management system, you know,
pulling all this data and then they have to manually cross reference and reform
at it so that it fits in the CRT so that the auditors are happy.
So Nate, let me just jump in here. I mean, you
would you would think from listening to to Catherine's description, you know, thank
you NRK for thoughtfully providing a spreadsheet, which is, you know, a
template. It's got lots of tabs, one for each kind of asset,
got all the columns of all of the information for all the assets you got
to put in there. You wouldn't think that was a lot of work,
but you know, I have personal experiencing in another realm, this is a
much simpler project. You know, at Waterfall we just finished I was working
with a bunch of colleagues finishing our annual threat report, and part of that
process was putting a spreadsheet together of about a hundred security incidents with about a
dozen characteristics of each security incident and just getting the data into that What looked,
you know, seemed like a simple spreadsheet, seemed like a simple job.
Just seemed to take forever. And you know, with a nerk Hip
spreadsheet, we're not talking a hundred rows. We're talking, you know,
probably five times that many for each one of your plants. You know,
if you've got seven hundred substations and computers and network devices and whatever in those
that's a lot of data. And you know, firsthand experience you know,
I get it now. I've I've heard people complain about spreadsheets in the past,
and having struggled within myself for the last several weeks, I get it
now. I you know, I see why putting that volume of data and
go spread to to something that really does beg automation. Okay, so there's
there's a lot of data, and it makes sense, you know, when
you're dealing with large amounts of data, makes sense to automate that process.
Um. But can I ask you sort of a subtlety here, Um?
You know, the people who are looking at automation for compliance is the main
motivation here? Saving money, you know, reducing the cost of gathering all
the data, or you know, is there something else at work? You
know, does the does the machine? Would you know, would a machine
gathering of the data sort of do a more thorough job? And I don't
know, reduce your compliance risk somehow, the risk of an auditor saying you
have missing data. Absolutely. You know, companies want to save money and
that is a huge motivator. But there's a bunch of different aspects to that.
You know, the first aspect is kind of obvious. They want to
avoid regulatory penalties um and I think everybody knows that with everybody in the industry
knows that NERKSIP non compliance can cause fines of up to one million dollars per
per violation. So that's a lot of money. And there has been some
examples in the past. You know, there was one entity that got charged
something like, you know, ten million dollars for cybersecurity non compliance. You
know. The second motivation is really, you know, what is the cost
of poor cybersecurity, And that really says, you know, if you're not
secure that the hackers can get in, and those hackers cost money, whether
it's ransomware or you know, they start controlling your equipment like they did over
in the Ukraine a couple years ago. They can cause damages which houses you
know, the money to go and fix that up. But you know,
not just the fixing the problem that those hackers caused, but also it damages
the utility's reputation. And that's a really subtle cost. It's hard to put
a finger on a number, but it's out there. You know. The
last thing that affects the cost and why we want to do some of these
better management of compliance is a desire to reduce workload and improve efficiency. You
know, without a good program, people spend hours and hours preparing for audits
and then doing compliance tasks. I've heard over and over again over the years.
How you know their users, you know, hate doing compliance. They
don't want to do it. They save it to the last minute. The
compliance team, you know, it's hard to force them to do that work.
If you get a system in place, then you you know, make
it minimal impact on the SMEs and then the compliance team has everything in a
central location. So that I've heard that there's been incredible savings preparing for audits
because of having a good program. So there's the three different ways that I
feel that utilities are saving money with a program, avoiding regulatory penalties, having
good cybersecurity, and then reducing the workload of their employees. Okay, so
you know automation makes sense. You know, saves money, makes the job
more thorough, um, you know, makes us more secure actually arguably.
But you know it's one thing to wave a magic wand and say let's automate
the whole thing. Uh, you know, it's another thing to actually do
it. What what is this automation actually look like? You know how does
it feel to use it well, Andrew, The real goal is to make
sure that you stay in compliance year round, you know, not just waiting
till the audit to go find out if you were in compliance or not.
You need to be able to prove it at any point in time on short
notice. And that's why people use compliance management software. Now, any good
compliance management software is going to include features for managing the compliance data and protecting
it so that the right people get access to it and the wrong people stay
out. Tracking responsibility, knowing who's responsible for what tasks for what regulations and
then documenting that, managing documentation and evidence, managing risk, issue tracking,
incident tracking, and then the mitigation plans are corrective action plans to resolve those
issues. Task management, and especially important is the notifications, reminders and escalations
so if those tasks, those compliance tasks are not getting done or not getting
logged into the system, that people are reminded and people are aware and there's
visibility to those tasks so that they do get done on time. Audit reporting
is you know, the output of the compliance management system when you're dealing with
NERK. You know, there's two pieces of it. There's the SIP Evidence
Request tool that I talked about earlier for all that SIP data. But then
there's also the management of the R SAUCE, which is the older the other
the other NERK standards have to do these R sauce. They're Reliability Standard Audit
worksheets and they're really filling in a narrative and listening out the evidence that they've
collected to meet that requirement. And those are time consuming. So software will
help pull that data together and help you report on it when it's necessary.
Okay, so there's there's a lot of stuff that needs automation. But how
do you actually do the automation? I mean, you know these records,
do you pull them from I don't know, the brains of the PLCs or
do you you know? How do you how do you? You know?
What? What does automation actually do in terms of gathering and organizing the data
for you. There's a lot of different ways that automation can help you,
and there's a lot of different forms that that can take. Let's look at
an example. Okay, so for one of the requirements says that you have
to verify at least once every calendar quarter that the individuals with active electronic access
or unescorted physical access have authorization records, so you're comparing you know what they
have access to based on access lists too, you know what they've been authorized
to do. So that might really involve two different systems, well many different
systems because they have access to many different networks or um OT devices or you
know it devices and so on, and you know the access card system to
get into different areas of the plant. So you can do you can set
up the automation to help with that in a couple different ways. So one
of those is a very manual way. If you set up some sort of
a scheduled task that once a quarter somebody is going to be required to remember
to go out and pull the asset lists manually from the devices and then pull
the authorization you know information from that system, and then manually compare those two
lists together and see TOULD for any animalies. So that's awfully manual, but
it is automated because they're automating that task every quarter. You could also set
up something that you know, you have a quarterly task initiated, but it
uses integration to automatically pull that data from the various networks and other software out
there or the devices themselves to get those asset lists, you know, and
automatically pull the data from you know, whatever is tracking the authorization records.
And then either you could have a person do the comparison between the two now
that they've automatically got the information, or maybe you're clever enough to put together
some sort of uh, you know, computer program to do the comparison and
perform that validation automatically as well. The last way that I can see,
the last good example I have setting up automation to help you out, is
setting up a daily feed or daily pulling of information from those other sources,
pulling it into the compliance management software so that you always have the ability to
report on or see the two different things and make that validation. And you
could even go further than that and set up controls so that the system can
detect some discrepancy between the two and it can alert on it, send out
emails, or show it up on a dashboard, or even initiate other tasks
and workflows to get that accomplished. So, you know, that's a good
example of a couple of different ways that you can do automation within the NERK
set environment, and I have a list of examples here, things like you
know, pulling the network for asset lists and open ports, querying assets for
baseline information, connecting to an HR system to get your up to date employee
information, you know on the learning management system to get your training information,
patch discovery services to obtain patch information, and then things like scheduling document review
when evidence collection tasks. So a number of different ways to leverage automation.
In the beginning of the industrial security revolution, engineers were told to use it
security principles, protect the information. We were told. We knew this was
a poor fit, but it was all we had. Today. The top
security priority at industrial sites is safety. Don't kill anyone, don't cause an
environmental disaster. And the second priority is reliability. Do not shut down our
factory or infrastructure. Today, safe and reliable operations use unhackable protections from cyber
risks, not just cyber security. For a deeper look at the evolution of
the revolution, we invite you to download Waterfalls report on the Emerging Consensus for
Industrial Security engineering. You can access the report at the Waterfall website, Waterfall,
dash Security dot com, slash Engineering, dash Consensus, or just go
to the resources menu and click on white papers and ebooks. So andrew,
it sounds like luckily a lot of this long and arge risk process can be
automated. But is there anything outside of the scope here, Like what do
you still really need to do by hand? That's a good question. There's
there's a couple of answers to it in terms of what's possible today and what
could be possible in the future. Let's take you know, just a simple
rule. There's a requirement to change passwords every I don't know, twelve months
or eighteen months or something like this. And you know if I mean if
a PLC even has a password. But you know, network switches have passwords,
firewalls have passwords. A lot of gear nowadays has passwords. May not
be per user, maybe aired, but still a password to password, and
you know, if it exists in the in the SIP world, it has
to be changed periodically. Um, it's one thing to ask the question of
the device. You know, do you have a password? Who who's got
accounts? You know, list the accounts on the device that you know that
that's sort of a more common feature of devices that you're able to figure that
out. But you know, trying to figure out when did the password change?
I mean, does the device even keep track of when the password changed
the last time? Is not even something you can ask the device? So
you know some of the data? Can you know is some of the data?
Is there? Some of the data you just have to keep track of
manually. You've got to make a note in your compliance tool or something saying
I change the password because the device can't tell you when things happened, when
was the last patch applied? You might be able to ask the device which
patches are applied, but can you ask it when we're applied? So you
know, that's a long way of saying, you know some of it you
can automate. Some of it you have to keep track of yourself in your
system. You can either keep track of it on a sticky note, you
can keep track of it in a software system. But down the road,
you know, it seems to me that all of this stuff can be automated
in the long run. Now you might need the cooperation of the device vendors,
you might need to upgrade the versions in the device vendors. It seems
to me there's sort of nearly infinite opportunity to like innovate and create new software
to simplify this process here. And you know, it strikes me that over
time you're going to see more and more of that happen because there's just so
much money being spent by the electric utilities on this compliance task. And if
they're spending the money doing it manually, you know they are open to spending
less money getting it automated, and you know, spending more money on automation
on you know, newer versions of devices that keep track of some of this
stuff automatically, newer versions of automation tools that can poll the data from devices.
So it sounds to me like it's an area that's that's sort of right
for innovation. So that's a lot of stuff that that a compliance manager could
do. And you folks produce these products. You you know, you you
produce sella a compliance manager for Nerve, SIP among others. U can you
talk about you know sort of not just you know, what does your stuff
do, but in a sense how does it do it? I mean,
you know, if I say yes, I'll take three of the assurance things.
What am I buying you know, seats in the cloud or you know,
agents that that snuggle up to the PLCs together data. What what does
your system look like? Yeah, so you know assured software. We do
have cloud options and on premise options. I will say that most of the
nerve entities that use our software have it on pre ms due to the sensitive
nature of the data that they're trying to manage, and it is probably a
little bit easier to secure the integration with those third party devices and so on
and other software if you're all on premise. So what does it look like?
So we have a user interface which is browser based, and behind there
there's a database and a server. You can configure those in all different architectures
so that you have load balancing and fail over and all sorts of things.
We typically have things like a development environment, a testing environment, and a
production environment. And our software. We have the asharts platform, which has
all the features to create solutions, any solutions, whether they're energy solutions or
life sciences and manufacturing solutions. That platform gives you the ability to create unlimited
dashboards and forms, has the security, has the database layer, and it
does all the code or has all the code in it. Everything that you
do with a sure XS point and clip Dragon draw up easily configurable, et
cetera, et cetera, and then we use those features on our platform to
create the whole suite of these NERK compliance management solutions. So we we call
that eCos a Surex Energy Compliance System, and that is a full suite of
solutions that does both the OWNP NERT compliance management and the SIP compliance management,
and then it can be extended to do a bunch of other things as well.
So what our customers do is they install the you know, they get
the platform installed, then they load up our solutions. Some of them focus
in one area, some of them focus in a different area. We provide
all of them, and then the customers configure our system. Our confis a
sure X is highly configurable, and you know they adapt the forms and the
workflows to meet their needs. Okay, So and that's where you can do
all of it without integration. You know, human is interacting with things.
Tasks are assigned to humans to go and do things, or you can start
plugging in that integration to pull the data and interact with all the third party
software. So you know that ECO solution is focused on NERT compliance and all
their compliance management aspects. And I do want to say that, you know,
we're expanding our offerings so not only to do with NERK SIP, but
things like the TSA pipeline security directives. You know a lot of our customers
are you know, energy customers, but they also do gas and that makes
the guests pipeline very applicable. And those TSA regulations are similar enough to the
NERK SIP regulations that our existing solutions can be easily adapted to meet those needs.
And of course after we do that, you know, then there's the
It probably makes it easy to expand into like the ner or the TSA,
the rail and the airport directives since they're similar as well. In this episode
we're talking about these specialties you know, energy um, when you talk about
NERK SIP, but what about other industries? Andrew, Yeah, you know,
you might imagine that, you know, NERK SIP is what twelve or
fifteen documents by now with a lot of detail in them. You might imagine
that if you have sort of a compliance system set up for NERK SIP,
you could use the same system for you know, other industries, because you
know, if you've already got fifteen standards in the NERK package, is that
not everything you might need for everyone? And the answers No. I mean
the the TSA, you know, like six weeks after the Colonial incident came
out with a new security directive for pipelines and it was only I don't know,
you know, it was as long as one or two of the NERK
of the fifteen NERK standards put together, so it was like only a fraction
of NERK, but still it covered different stuff. Concrete example, it it
talked about dependencies. It said, if your OT system depends on your IT
system, then you have to get rid of those dependencies. And if you
can't get rid of them, you have to document them, you have to
report them to the TSA, because every one of those dependencies means that if
you cripple the IT network and you cripple the systems of OT depends upon,
then you've crippled the OT system because the OT system needs the crippled IT systems
to work. None of those words exist in nerks SIP. This is sort
of a new concept in the TSA. You know, in spite of the
NERK ZIP documents being much bigger than the TSA document, that might beg the
question if we have these characteristically different regulatory needs and standards and whatnot. Are
they equally or more or less automatable, you know, like for talking about
power versus water tree or whatever. Would Cathy's kind of approach work in an
equivalent way elsewhere? And that's a good question, And in fact I asked
Cathy that question, so you know, let's let's go back to her and
see what she says. And you did mention the the TSA directive, And
I mean, I've I've been looking at the TSA directives over the last several
weeks. They seem very different from NERK SIP. I mean, they're they're
structured differently. You know, the the TSA director has, for instance,
a section in the requirements that says, your goal as a pipeline operator is
to keep the pipeline running at necessary capacity, even if the I network is
crippled. And you know, they don't define necessary as whom it means,
you know, necessary to the business or necessary to the society. You know,
a lot of these pipelines are critical infrastructure. You don't have to keep
it running at full capacity. At necessary capacity, I'm going how can you
you know, how can you utter it against but you know, I look
at the thing and it has that's sort of a high level requirement, and
then it's got a bunch of much more specific requirements that seem sort of much
more auditable. Can you talk about you know, this seems like a fairly
different animal from NERKSIP. Can you talk about what can you track in that
space? Well, Andrew, I want to say that we're not trying to
control the OT or the IT network or any of the devices that operate on
it. You know, We're really focused on pulling in and gathering that data
that we're gonna need for compliance purposes. And we also are able to coordinate
activities that may result from the interruption to the network or even just some changes
to the network like firmware updates and security patches and access changes so on.
You know, among other things, the TSA Security Directive mandates that you must
have a cybersecurity Incident Response Planning. Okay, this is very similar to SIP
eight, which is the Cybersecurity Incident Reporting and Response Planning, So same idea,
and you have to have a plan for dealing with things. Both of
them require an update, up to date, documented plan for responding to cybersecurity
incidents. You know, that includes the procedures for what needs to happen,
but it also includes the roles and responsibilities of all the people that are going
to be dealing with those incidents, and then of course notifications to whoever needs
to be notified after the incident. I want to end with you know,
sit it's a little bit more prescriptive and that it says within ninety days you
must document the lessons learned from the incident and then update the plan accordinally making
sure that each person who has a role in the plan is notified of those
updates. Well, thank you, Catherine, this has been great. Before
we let you go, can you sum up for us? I mean,
what's what's the most important thing to remember about the world of compliance automation.
Well, compliance automation, especially with cybersecurity things like NERK SIP, it's challenging.
There's a ton of data to coordinate, there's a ton of people to
coordinate, and it makes sense to automate those tasks and gathering up that data.
Anytime you can take the human element out of it, you're you're improving
things. Um. So we do, of course have the software to help
you with that. If you'd like. We also have experienced people that you
know, we've worked in a lot of different industries to help with quality and
compliance. So please, you know, reach out to us our website of
courses www dot ass u RX dot com, and then you can always reach
out to me on LinkedIn if you want. I'd love to hear from people
and talk about how we can help solve your problems. So thank you Andrew
for having me here today on your podcast. I really enjoyed it. It's
been a lot of fun. All right, Andrew, that was your interview
with Katherine. Is there anything that you can take us out with today.
Yeah. I mean I remember seeing the very beginning of the compliance automation space
when I was at Industrial Defender over a decade ago, and you know,
I have to confess that at the time, I really did not recognize sort
of the business opportunity that the space you know represented. You know, I
thought the big challenge back then was designing the security system, making things secure
and not proving that you're following the policy that you've set up. I thought,
you know, that's I just I was dismissive of it, I recall
as a younger man, but you know, this space, to me,
is not going to go away. This is a space that you're just going
to see more and more demand for as regulations increase, as the cyber threat
environment gets worse, We're probably going to see more and more governments all over
the world issuing more and more regulations. And I'm sorry, they're all going
to be a little bit or a lot different, but you know, every
one of them, every regulation is going to demand that you prove that you've
complied with the regulation. And you know, as I said, it's not
just a matter of sort of housekeeping. Get you know, put put some
automation in there so that you can get rid of the horrible spreadsheets. But
there's opportunities to gather the data automatically from a huge variety of it systems,
of industrial systems. You know, this to me sounds like a space with
a lot of opportunity because businesses are going to spend money on reducing their need
to spend labor and money, you know, doing the stuff manually. So
you know, I think this is a an industry, a piece of the
industry that's got a bright future ahead of it. All right, Well with
that, thanks to Catherine Wagner for speaking with you, Andrew, and Andrew
is always thanks for speaking with me. It's my pleasure. Thank you name.
This has been the Industrial Security podcast from Waterfall. Thanks to everybody out
there listening.