It goes back to twenty sixteen when the French government published the first national regulation
on cybersecurity for critical infrastructure. Welcome listeners to the Industrial Security Podcast. My
name is Nate Nelson. I'm here with Andrew Ginter, the vice president of
Industrial Security at Waterfall Security Solutions, who's going to be introducing for us the
subject and guest of our show today. Andrew, how's it gone? I'm
very well, Thank you, Nate. Our guest today is Eric Vautier.
He is the Group CISO Chief Information and Security Officer at Group ADP, which
is Airport du Paris, the Paris Airports, all three of them. And
our topic is cybersecurity regulations with a bit of a focus on of course this
too, which is what everyone's doing in Europe. Then, without further ado,
here's you and Eric. Hello, Eric, and welcome to the podcast.
Before we get started, can you say a few words for our listeners
about yourself and about the good work that you're doing at ADP in Paris.
Hi, Andrew, So Miami is Eric? Vote, I'm the groups I
saw for a Group ADP, so mainly I'm an airport guy. I've done
almost all my careers in ADP. I started something like fifteen years with airport
IT and then I moved to to cyber in two thousand and eight. And
I started with that because I think it's very important to know the job,
to know the company you're in before doing cyber security. So I was lucky
enough to start with airport IT and then moved to cyber within the same company
and in a duct chair ADP. This is the company operating the free airports
around Paris Paris, France. As you can guess from my accent, I
guess. So we have CDG, which is international. This is the biggest
airport in France, and I think the third one right now in Europe.
And something very important also is number six as sky tracks quality ratings worldwide.
Second airport is Early, which is mainly domestic and European, so second in
France. And last is the leu Burge, which is famous for his air
show. And maybe you don't know it, but Le Burgie is the busiest
business airport in Europe. Cool. Thanks for that background, you know,
before we dive into cybersecurity, can we take a little bit deeper. Can
you talk about your airports? You know, can you talk about automation.
I mean cybersecurity is relevant to you know, when computers are automating physical processes.
I mean the automation that passengers see at airport is you know, flight
signage, they see ticketing, they see you know, on their on their
cell phone apps. They sometimes see baggage tracking. Is that it what what
happens under the hood at an airport. No, actually, this is kind
of the tip of the iceberg. Of course, of course for us,
this is very important for our passengers to to have this seamless, seamless journey
throughout our airports by modern technology. I t but I think the most critical
part to make the airport efficient and operational is under the radar kind of and
very easily. You can compare an airport like CDG for instance, uh to
to a city. Still taking the example of CDG, we have our own
automatic train reaching every terminal. We have also water treatment of course you can
imagine water on the ramp with pollutants and etcetera needs to be to be dealt
with, of course. And last thing, maybe people don't know, we
have our own power plant to make sure we we we have constant electricity.
And other than that, you have like in a city, you have car
park management, we have logistics, we call them baggageingly system or BHS for
for the passenger bags of course, and this is this is a key issue
for for the passengers to have their bags of course delivered to the aircraft.
And last point, maybe people don't not see it like that, but the
ramp the runway for instance, is kind of similar to a road right now
in big airports and major airports, and you have these kind of traffic lights
to allow planes to enter the runway. So really all this automation is under
the radar or under the surface, if I want to stick to the Iceberg
metaphor you mentioned rail. I've visited a you know, a metro control center
in Spain many years ago, something like twenty operators sitting in the control center
while the metro was running. Each of the operators has you know, five
or six of their own screens, their own keyboard mouse, They have shared
projection screens with a sort of a rendering the entire system and you know where
the locomotives are and where the cars are. Is there is there a control
center like that for the airport or you know, does every bit of the
automation, like the baggage have its own little control center somewhere. Good question.
Actually we have both. Of course, each each system has its own
team to to make sure it runs smoothly. And going back, for instance,
to the train, our line is on. Our train is only one
line, of course, so very simple in comparison to a metro. So
BHS may be more tricky because as you know now BHS embeds X rays and
tomographs, et cetera, so it's kind of complicated logistics equipment. So as
I mentioned, every system has its own control room control room. But of
course, and I think your question is very relevant to modern airports. We
need someone to get in real time information about all these processes because at the
end, at the end of the day, what the passenger wants is to
be in the aircraft with these bags, with cattering, et cetera. So
you need to interface or to make sure to coordinate and synchronize all these processes.
So we have this trend in airport for some years now called APOC,
the Airport Operational Center, kind of big control room for the airport with all
the screens as you mentioned in your metro example. So we are we are
going in this direction definitely for for major airports. You did not mention some
systems that I kind of expected you talk about at some point. You know,
you did not mention the radar, the air traffic control, the you
know, the interface to what I assume is a nationwide air traffic control you
know where does where does that fit? Yeah? Actually I think it's my
answer, will will We'll be valid for all Europe. It's more you mentioned
nationwide. Actually it's European, uh, European size air traffic control system.
Like the name is EUER Control, which is kind of inter governmental or I
don't know if that's the White World, but trying to coordinate air traffic control
all over Europe. And but as you mentioned, for for friends, this
is dedicated to civil aviation, so DIGAC and they are completely responsible for controlling
the aircraft up to the docking point in the airport. The only interface we
have with aircraft kind of kind of saying is the runway, which is under
the responsibility of ADP. But for the rest talking to the pilot is dedicated
to civil aviation. So Andrew, now that we're getting started here, I
recall it must have been years ago that we spoke with another expert specifically in
airport security. Right. Do you remember the name of the guests. I
do. That was Mark Lindick. He was the head of cyber defense at
Minich Airport. It was a long time ago. That was like episode twelve,
I believe, And yeah, I you know, I didm'tly recall the
episode Mark was I think most of the episode we talked about a new training
program that you know, he and Munich Airport were running for critical infrastructures back
in twenty nineteen. As far as I know, they're still running it.
But what I remember from the episode, what struck me on the episode was,
you know, Mark used the same words that Eric is using here.
He said, look, Andrew, you know you're thinking about airports the wrong
way. Think of them as a small city. I remember him saying the
word small city. Now the rest of his description, I remember talking about
escalators and security cameras and elevators. I remember coming away from the episode,
you know, he said the word small city. But I remember thinking of
you know what he described as, you know, as a large building,
because we talked a lot about building automation. But you know, what Eric
is talking about today really sounds like a smart city. Their own rail system,
there own power plant, their own wastewater treatment, their own water distribution
system, their own power distribution system. It really sounds like a smart city.
Everything is automated, and everything's going to become more automated because of course
everyone wants, you know, the experience of going through the airport to be
a more pleasant and be cheaper, and that's what automation gives us. It
makes everything cheaper. Building off that to the theme of this episode, regulation
seems like pretty important, or at least maybe ever present thing when you have
such a structure as you're describing, right, it does, and Eric's going
to get into this, but very briefly, there are differences between smart cities
and airports, and there are enormous similarities. The differences to me are in
a sense obvious. You know, you have a huge physical security focus,
and of course you know regulations in airports, you have security lines, you
have X ray machines, and I assume you know there are regulations for all
this. You don't tend to see, you know, regulations for X ray
machines in smart cities. But the similarities are obvious. You know, smart
cities have all sorts of regulations either in place or coming into place for critical
infrastructures. Airports are critical infrastructures and they're small cities, so yeah, we
are seeing a lot of similarities there as well. Yeah, so thanks for
that introduction. I mean, our topic is regulation and eventually cybersecurity regulation and
this too. But you know, can we start with a big picture of
regulation. What does the regulatory environment look like for an airport in France?
Actually it's nowadays it's quite a complex environment because we have so many different regulation
coming from different origins. So we are first critical infrastructure regulation, so national
one regulation, national regulation first and then it became then one regulation, so
we're still under this these two in France. And on top of that we
have also sectorial regulations aviation ones of course here and one with dealing with physical
security in airports UH. And the second one, of course and it's very
important for our passengers, is safety regulation under the UMBREDA of i k UH
International Civil Aviation Organization. So this is for for Europe, but I think
it's quite similar to to the US, where you have different entities also regulating
like T S A, F A A and I guessize Siza or Caesar and
so this is it actually kind of multiple layers dealing with similar topics, so
complexity and you know are our focus here is cybersecurity. You know, can
you tell us a bit about about sort of the big picture of cybersecurity in
France and eventually you know how it starts applying to airports. It goes back
to to actually twenty sixteen when the French government published the first national regulation on
cyber security for critical infrastructure. It has been a three years work in discussion
with the cyber Security Agency and eventually in twenty sixteen we had this first regulation
asking critical infrastructure operators to fulfill quite a number of requirements, so he started
there. Two years later we had kind of similar regulation at European level called
NICE Network and Information Security Directive now it's nie one because we have this NIEE
to on the horizon. And then later on we had to implement regulation around
as I mentioned before, sectorial and the first one was physical sexuality under the
responsibility of dig MOVE part of EU of course, and the next year or
at the end of the year or next year, we will have a regulation
on safety published by AASA, which is a European Agency for Safety in Aviation.
Let me start with ANCI. You know, I saw the regulation come
out in twenty sixteen. I was impressed. I mean, it's two volumes
and to me it was surprisingly readable. You know, it is I think
the most understandable regulation in the world for critical infrastructure cybersecurity. I recommend our
listeners look it up and read it. It's you know, search for classification
method and detailed Measures n C A, N S S. I. But
let me ask you when that came out, the regulation seemed, you know,
in my read of the the the prologue to the to the the regulation,
it seemed to me to apply sort of once you did an audit once
when a new system was created. You know, it didn't really apply retrospectively
to existing systems. You know, I understand that that NIS, you know,
demanded that that France or that all member nations create regulations that I thought
were sort of ongoing that sort of had a permanent effect rather than a one
time audit requirement. Can you talk about, you know, where did where
did ANCI start and how did this change it? And is that you know,
is that still where it is today? Where you know, how did
we get where we are today. It's a it's a very long story.
So I tried to to to resume it, uh at best. Yeah,
So I agree with you about the clarity of all this regulation. If I
may pay a tribute to ants there, I think it's worth it. First,
they didn't publish this regulation without consulting different sectors. That's the way we
organize for critical infrastructure. In France. We have something like eighteen sectors critical
sectors, and within that, of course, it depends depending on different ministry.
And they started to discuss with us so main operators like for instance in
aviation like Air France atc SO, DGC and an ADP for instance, because
they had their own ideas, but they wanted to make sure that these ideas
were applicable in real life. So it took something like free of discussion,
of course, and the we had his own goal and and so they managed
to public this kind of joint result, if I may say so. Of
course, ninety ninety five percent is ANCI and five percent maybe is due to
conversation with operators. So it started like that. But I will slightly contradict
you. It's for each and every system and we had at the time three
years for old system to comply with our regulation, which is very extensive,
as you mentioned, encourage also people to read it. And but and it
was also kind of the beginning of cybersecurity by design in regulation. So the
new system you mentioned, you're exactly right, they are supposed to be secured
when they enter, when they when they're implemented, operationally implemented. But we
had we had to go back to the all systems and make them also compliant
with OR regulations. That's that the kickstart in France, if I may say
so, And and two years later we have this NIS dire Active And honestly
it was promoted and maybe a bit driven by France at the time at EU
level, for I guess, and maybe I'm wrong, but I guess because
we already had in France this experience or ants he had this experience of creating
the text. So if you look at it, NIE one and French regulation
are very similar, and it was also very clever from ANTSI, if I
may say so once again, because it means that for critical operators in France
we were already compliant to NIE one, if we were compliant with the French
regulation. That's how it all started. Yeah, h I am still confused.
NIS I thought was a directive from the European Union to the member nations
saying the member nations have to produce regulations. So the director was not was
not regulations by itself. ANTSIE already had these regulations that mandated an audit at
the beginning of life for the for for a new system. But I thought
the NIS directive said the regulation has to be sort of more than one audit.
I kind of missed. How did how did NIS? You know?
Is there is there more to antsy? Is there another document that people like
me should be looking at saying, oh, here's the sort of the current
world of NIS in addition to the original ANTSI good question. Maybe I was
too too quick or not precise enough. Yeah, you're right. A directive
in European sense means that every member state has to transpose it into its own
regulation. So what ANSI did very easily. They said, okay, we
already have our own regulation and it fits to the requirement of the directive,
so they kind of transpos it so you have your rights a specific text,
which is the nice directive transposition in French regulation, which is I would say
almost exactly, because maybe some words are different, but almost exactly the regulation
we already had in plants place in France for critical infrastructure. So there it's
really perfectly aligned, if I may say. So, let me ask you.
You mentioned earlier cybersecurity rules for safety systems, cybersecurity rules for physical security
systems. Can you so you know this was sort of history by now and
these two is coming. You've got safety, you've got physical security. Can
you talk a bit more about sort of the modern regulatory environment and what you're
facing today. It's quite similar. We will still have the same players in
place, and I think we can stick to the European level because it's valid
for France. We will still have the three origin of text. So I
mentioned AAZA for safety, I mentioned DIGI move for for security, and these
too is under digit Connect which is kind of ITM Ministry for Europe. And
this last one is for each and every sector of the economy uh and the
two other one are really dedicated to aviation aviation. So the difficulty for us
is that these text texts don't really align and they have some different requirements depending
of course, depending on the topic. Of course, we have a large
share of commonalities kind of actual cyber security, but we have we have slightly
different requirements. For instance, on safety, they're applying their safety regulation for
i would say every day safety regulation, and for instance, when you investigate
an accident, aviation accident, you need to to keep track of something like
five or more even more data on the on the equipment. So they just
transpose it to to cyber security and said, if you have a cyber incident,
you need to keep five years of records. And I'm sure your listener
will find this very important, maybe too much, maybe we think something similar,
but so you see that they didn't try to to understand what would be
the implications of saying, just give us five years of records and things like
that. And risk analysis is slightly different, different depending on the regulation.
So same thing, how do we conduct a risk analysis for AZA, for
digit move for digit connects, And so that's that's really the tricky part of
it, making sure we don't do we don't duplicate our work just to prove
something we do once. And so especially airports, we have been advocating for
this during the the rulemaking task of this this regulation, saying you need to
you need to align, you need to to kind of kind of overlap your
regulation and don't do specifics in your own track. So Nate Eric did not
say the word, but the word I hear used in lots of other contexts.
You know, talking about this issue is harmonization. Owners and operators are
talking about it. Government authorities are talking about it. Manufactures of you know,
automation and security equipment are talking about it. And it's you know,
we're seeing more and more cybersecurity regulations. I mean ten fifteen years ago,
there was almost nothing. There was NIRKSIP, you know, there was sea
FATS, which you know was chemical facility. Anti terrorism in North America had
you know, like three paragraphs on cybersecurity. It was almost nothing. Today
there's nrk SIP, there's this too, there's the original THISS, there's you
know, every every country has some kind of critical infrastructure cybersecurity, and often
in different regimes, you know, for airport safety, for you know,
the safety of water treatment systems. Every sort of authority has their own cybersecurity
standard. And so everyone is saying, look if I have to do a
cyber risk assessment for six different agencies according to six different rules, do you
know how much effort that is to to cross all those t's and dot all
those eyes. Can't you guys sort of harmonize? Can't you normalize these things?
So I only need to do one cyber risk assessment to sort of one
uber global set of rules and be done with it. And it's not just
risk assessments. You know, there's risk assessments. There's audits, you know,
different authorities coming in Every every two months, a different authority drops in
on YouTube to do an audit. At the end of the year. You
know, you repeat it just it costs too much. Incident reports Lots of
different authorities are requiring incident reports. If if you've got a multinational that operates
critical infrastructure in multiple countries or in multiple continents, and there's a cyber incident
at you know this this owner and operator somewhere, how many different authorities do
they have to report it to? How many different formats do those reports have
to take? How many different kinds of detail do those reports have to supply?
Manufacturers It's not just owners and operators. Manufacturers are complaining about the same
thing, saying, look, increasingly, you know, in different jurisdictions,
they're required to report vulnerabilities to different authorities, sometimes in confidence, sometimes in
public, with different levels of information. Again, they're they're saying, can
we not all get on the same page? People, Do you have any
idea how much paperwork burden you're imposing on you know, operators and manufacturers.
And it's you know, it's not just Europe, It's not just ns too.
I hear these issues arising in North America. I hear them all over
the world. Any time that you have multiple authorities, anytime that you have
multinational corporations operating in lots of different jurisdictions, you have these harmonization problems.
This is sort of a hot topic, hopefully for the next three four years,
until it all gets sorted out across our fingers, so pulling it all
together. You know, the big news in Europe is this too. It
is again a directive to the member nations, and in my experience, there
is enormous there is widespread interest in this too. You know, we're talking
airports here, but you know, when I attend security events in Europe,
when I interact with customers or prospective customers in Europe, everyone talks about this
too. How big an impact has this too been for the airport because you've
been sort of critical infrastructure from the beginning. How big has it been?
How big will it be for the airport? It depends on the site.
Actually, yeah, you're right, these two is a very big thing in
Europe right now because its coverage is much larger than the previous regulations. For
instance, in France, right now we have something like two hundred and fifty
three hundred critical infrastructure operators with these to the estimate because today nobody can really
say, but the estimates is fifteen thousand companies. So you see the difference
between between the two as far as coverage is concerned. This is the first
the first change. A second change or so for the size of it or
the width of it is the number of sectors they want to extend it to
sectors that we are not under the previous regulations. So once again, more
companies, more operators. And going back to your question specifically on airports,
for I deep it won't change anything nothing for major airports throughout Europe will be
the same thing. But with needs to all airports. When you read the
text that we need to wait for official lists. But when you read the
text, you may get that all airports, big or small, will be
under needs to And this is a big issue of course for small airports that
may don't have the teams right now, may don't have the cyber security in
place exactly like major airports have. So I think this is really what's what's
the main concern for people in Europe, small withold sell small companies more than
big companies that are already doing a lot on cybersecurity. Okay, so you
know it makes sense that that, you know, in a nation that had
ANTSY almost ten years ago, and you know, it was, like I
said, it was very well done. In my opinion, that the largest
airports you know, aren't see much change. Are you going to see any
change? I mean it seems to me that you know the world has changed
in the last ten year cybersecurity wise. What kind of changes you know,
do you see coming of any Yeah, I said, big airports on't see
the difference internally, if I may add, but I think we will see
a major difference on outside. And when I say outside, I mean the
supply chain. It was the main critics we had at the time of this
one, saying that all requirements were on the operator and as you know,
and especially airports, no, no one is really alone doing his job.
And we have in airport quite a number of suppliers I, T, O,
T whatever, and this supplier where suppliers sorry, where outside of this
Nie one director. So this is something that has changed and is very important,
meaning that there will these supply chain company. They will also have requirements
being kind of indirectly part of critical infrastructure. Just to give you an example
I mentioned previously cyber security. In physical security, if you're a passenger,
you have put your bags in X rays, very easy, easy to spot.
And this six rayse right now is tomography plus a computer. So of
course we have cyber security questions around it and on this one which could just
add question send send questions to this manufacturer saying please be gentle and add some
cyber security. Now with thisess to they fall under it. So they can't
say this is the airport problem, but it's also their own problem now and
then we'll have to fulfill this requirement too. So coming back to something you
said a moment ago, you know fifteen thousand edies, lots of smaller airports,
the smallest entities don't have a lot of money to spend on cybersecurity.
You know, the smallest nations don't have a lot of money to spend you
know, defining regulations much less enforcing them on smaller entities. Does this to
address that? I mean, if if there's going to be that many entities
and that many people, you know, getting paid to do cybersecurity, on
the one hand, that's a lot of money. On the other hand,
saying you know, we don't have the money, it costs too much doesn't
make the threat go away. How do you how do you balance security and
cost in this too good question? I think there've been a lot of discussion
around this topic. And for instance, the Association of European Airport has been
advocating for kind of exemption for very small airport airports, but actually small airports
they don't have a lot of it OT and if they have the consequence of
a failure, maybe maybe not as important as in a big one where you
have this optimization as we mentioned before, thanks to IT and OT automations.
But I think cyber security maybe is a proportional issue. You you depending on
your size, you you you put a kind of proportional amount of money.
For instance, if you want to secure a small system. You want to
have so many equipment cyber security equipment. We have something which is quite fit
fitted to the side of the airport, and a bigger one. A bigger
airport like ADP will spend a lot of money because we have a lot of
systems. But when you have smaller systems and in a limited number, I
guess this is kind of the same amount of money. You said security costs
too much. I have a kind of sayings which is maybe it costs that
lack of security may cost more, even more if someone finds you and destroy
or damage your system. So I think this is something which is of course
this is interpretation, but I think it's something it needs to It's I think
the right world may be adequate level of cyber security, meaning that you need
to assess your system as set the cyber security risk on this system, and
put the adequate measure to our controls to reduce that risk. So, of
course it will change things for smaller companies. They will have to hire people
and put some equipment in place if they don't have already that they didn't do
it already. But I think it it's not of course, when you spend
nothing, and spending something is a big deal. But at the end of
the day, I don't think this is such a big deal in comparison to
the impact and the consequence lack of security may have. Andrew, if I
could bring us back to small airports for a moment, there's something timeless in
you know, small organizations not necessarily having all of the budget the large ones
do to deal with cybersecurity. But of course not having security and then having
an incident ends up being much more expensive in the end. So what exactly
are we proposing that small airports in this kind of situation do to keep up.
Well, that's that's a good question, and it's a question that is
confusing to a lot of practitioners. I think part of the answer is is
what Eric said, which is, look, the smaller airports tend to be
automated less. They tend to have less automation, and therefore they have less
exposure on the ot side, you know, on the industrial side, to
cybersecurity attacks, and so they need less security. So that's a good thing.
It means you don't have to spend an ADP size budget on cybersecurity for
you know, us small airports OT systems. But what it also means,
it's a question of economies. I mean, why do we deploy OT automation,
why do we deploy computers there at all? It's to save money.
And what we have to be careful of in small airports is when we look
at our existing automation, when we look at new automation opportunities, it's important
that we look not you know, don't just say, hey, I could
spend one hundred thousand dollars and save one hundred and fifty thousand dollars over the
course of three years. That's a fifty thousand dollars benefit. Here we go.
You have to say I could spend one hundred thousand dollars on a new
system, new automation, and how much more cybersecurity would I need. You've
got to include the cost of securing your new automation. You can't just you
know, if you've got something that is sort of automation that is marginally beneficial,
it's going to save you know, fifty thousand dollars over three years on
one hundred thousand dollars investment. To me, that's marginal. If you had
a one hundred thousand dollars investment that would save you six hundred thousand dollars over
three years. Well, then you can afford to spend one hundred thousand dollars
of your savings on a proper cyber security system for that new piece of automation.
But if you if your payback is marginal, you know, really we
probably shouldn't be deploying that automation. We need to be deploying automation where the
payback is big enough to you know, provide protection from the new risk that
we're introducing. This is you know, this is the thing that confuses a
lot of a lot of practitioners and that that I think is going to become
very crystal clear for small operators in the years ahead. We're coming up on
the on the the end of our interview here, let me ask you.
We've been talking about sort of the history of cybersecurity in the aviation industry.
In France we've been and in Europe we've been talking about the present, which
is this too. You folks at you know, the the the the Paris
airports, you personally have been working with authorities, with French and European authorities
on cybersecurity for a very long time. Now, Uh, you know this
too is something that is sort of the current big news. But you're talking
to these authorities. Can you look into the future for us a little bit?
What's you know, what are you working on now? What are we
going to see coming out in the next year, two or three? I
can't really say, so we'll guess, and I hope when we get back
to this interview in three years time, maybe it will be still valid.
I don't know, but I think there are maybe some films that are not
relycovered. This is continuous improvement loops. These regulations and for instance right now
needs to is generate to every sector, so they don't go into details.
I mentioned things we have in aviation for instance, but once again this is
not detailed enough, I would say, or detailed for the operator for instance,
in airport. I mentioned safety and security, so we are supposed to
do our homework on this topic, but they don't say exactly what we need
to do to secure a safety system for instance. So I guess with experience,
with return of experience from operators and maybe some incidents, uh, maybe
they start uh defining more precise regulations, like maybe they're in nuclear and maybe
sometimes in rails also as far as I know, so maybe it will be
kind of drilled down for bisectors. So I don't know, for instance,
for for pharmaceutical or food industry. I don't know if that's something specific that
that is not detailed enough in the in the under needs to that's that's maybe
one topic. Another topic maybe for specially for aviation, but maybe it's similar
to to other sectors. Is the notion of ecosystem. Right now, the
regulation focused on operators, so ADP has to be compliant on his own,
but of course ADP without an airline, without air traffic control, without aircraft
manufacturers, we are useless. So this ecosystem as a whole needs to be
to be secured also by design. So we are very at the early stage
right now. We are kind of sequencing the airport does this, the airline
does that, et cetera. He has that I mentioned before try to do
that to work as an ecosystem and shared a risk analysis for instance in the
text. But I think, once again this is only the early stage,
and I think later we will we will need to reach that ecosystem cyber security
by design. And last point, which is not much of a prediction because
it's already in place. We have a new text in Europe called Cyber Resilience
Act, which is defining what we should put in place to be resilient.
I know this is the kind of gimmick right now, but meaning we are
doing a lot in prevention with needs to and in case we have an incidence,
how do we react? This is reside you to me, more than
business continuity, and so we have also this kind of new topic. I
would say as far as the regulation is concerned, and I think we'll have
also a lot of work to do to be able to recover as quickly as
possible in case of a dramatic incident. So something that you know, I've
been thinking about that occurs to me thinking about the interview so far, fifteen
thousand entities. That's a lot, you know, just in France, that's
a lot of entities to audit. If you're ordered every three years, that's
a lot of auditors. Is how's that going to work? Yeah? I
think this is a good question, Andrew. Actually you should ask answer about
this better for me. And once again this is my interpretation. I think
it shows the way, it shows the way the regulators want want to proceed
now before needs too, Let's say this one and sorry for the technical terms.
It was a kind of ex aunte. This is Latin. Sorry for
that. And friends, this is an excellent regulation, meaning that the regulators
can come to you and said, prove you've done what's in their regulation,
the requirements of the regulation. With the number of companies as you mentioned,
I think it will be an ex post regulation, meaning that and you're right,
and C won't be able to go to each and every company, but
let's put it like that. We'll go after you if you have an incident,
and you will have to prove that you implemented the regulation as best as
you could. Of course, it's cybersecurity. It's not an exact topic.
We still have a space for interpretation. But I think if you if you
are not able to prove you you did your best, then you have a
problem. And especially something quite strange at the beginning, but the first the
first articles of the regulation mentioned the responsibility of the top management and one article
says, I don't know if it will be applied one day, that they
can remove the CEO or the top management team if they prove unable to deliver
cybersecurity. So I'm pretty sure that for some operators could be the case.
And if you have an incident, good luck with that because they will come
with the text and maybe use this article. Let me cover that ground again.
I'm not quite sure this is what Eric said, but what I heard
was an interesting idea. Whether he meant it or not, what I heard
was, look, there's a problem about it. I mean, that was
the question I asked. Do the math. If there's fifteen thousand organizations that
need to be audited every three years, that's five thousand organizations a year.
You know, if an audit takes you know, I don't know, a
week or ten days on site and another week or ten days of writing up
after the fact. We're talking practically speaking, one audit per month per auditor.
You know, if we have five thousand person months of audits to do
every year, you've got to hire you know, something like six hundred auditors
plus their managers and their infrastructure. We're talking you know, six or seven
or eight hundred HighRes on the part of the regulator. That's that's a lot
of money. And but you know what I heard was, look, in
the past, the big fish, you know, sort of covered by the
original NIS directive and the original anti directives. The big fish, Yeah,
you want to do thorough audits on them because they're big fish, they're critical
infrastructure. We care a lot about their cybersecurity. If you've got a lot
of smaller airports and you know, smaller entities that you need to audit,
do you really need to do a really thorough audit on every one of them?
Are they all equally important? And the answer maybe no. You know,
you can probably do a less thorough audit. You can burn through these
organizations, these smaller entities faster, So do that, don't hire quite as
many people. But what happens if there's an incident after the fact, it
makes sense that you're going to do a deep dive on cybersecurity at the affected
organization. You know, there may be consequences for the affected organization. This
it's going to be a public process, is my guess. You You you
can, you know, publish learnings and best practices to the entire industry,
all other smaller players when you have these incidents. So it you know,
the the concept that the regulator might say, we're going to do a deep
dive on a small entity when those entities are breached. That, you know,
if I heard it right, I haven't heard anyone else, you know,
talk about that. That strikes me as an interesting approches and something that
probably the regulator could sort of do on their own. It doesn't have to
be specified in the regulation. This can just be the you know, a
practical way of dealing with it, so that that's something to think about.
That's, you know, to me that that was an interesting takeaway. There's
a lot of ground that we covered here. What what are the big what
are the big takeaways? What if you wanted to summarize what's going on and
sort of give people a lesson going forward? What what should we what should
we learn from this space? Yeah, I don't know if I'm the best
person to say so, I'm just a piso in an opereto. But things
maybe that could be useful to your listeners. First is regulation is not Regulation
is not going away. So if you think you can't avoid it because you're
too small, or maybe you're in the right within bracket in the right sector
meaning not covered by regulation, forget about it. Actually, when you look
at the regulation, it's not rocket science, just asking you to do everyday
cybersecurvity, but but make sure you do it actually and more importantly, I
think when you have regulation. This is something I've observed in ADP for for
more than ten years now. When you have regulation, you have the intention
of your CEO or your top management. So for SIZO in the room,
I think use the regulation wisely to get you budget and interest and enraise awareness
within your company. And maybe for CEO, I don't know if some listening
now. I think one important thing is cyber security is not a technical topic.
Actually it's a culture. On one I mean culture in companies, but
also a culture in everyday society. Every every everybody now has its own smartphone,
I guess, and this is it. So you need to understand what
cybersecurity for your smartphone as well as cyber security for for your aut system in
your in your factory. And I think that's in a nutshare very high level.
What needs to is trying to implement do every day cybersecurity because it's protecting
your rocketical assets and help you deliver the service you you you promise to deliver.
That's maybe two to two things I want to address to two people doing
it. And last topic is for suppliers. I mentioned the supply chain before,
and I have only three words for them. It's cyber security by design.
Please with this one. As I mentioned, we have been fighting with
some equip equipment manufacturer saying this is our obligation now, so please help us
reach that now with NIS too, it's their obligation too. But once again,
this is this is no longer an extra for an equipment. It needs
to be secured by design. So pay attention to this regulation. You will
help your customer and you will also help your company to be to be as
competitive as needed. So that would be my free takeaways for NI to You
know, Andrew, I feel like this happens sometimes where we start an episode
with a certain topic and then we just end up talking about this too a
lot. Yeah, this two is a very big deal in Europe, but
to be fair, you know, regulation is increasing in a lot of places
in the USA. For example, the the TSA has issued a cybersecurity directive
to airports as well. That said, for now, the directive is confidential.
I mean, I'm assuming the directive looks a lot like to their rail
and pipeline directives, but I don't know that for sure. So you know,
regulations are increasing in a lot of places, and I mean there's a
truism in the industry and the cybersecurity industry. Never waste a crisis. Nobody
wants a crisis. Nobody wants their OT systems to be breached and you know,
fires to start and people to be injured. Nobody wants any of that.
But if you have a crisis, never waste the crisis. Use the
crisis to spring some money, loose money to solve the cybersecurity problem that you
knew from the beginning needed to be solved. The same thing with regulation.
Nobody wants regulation, but if you have a regulation coming down on you,
don't waste the opportunity. Use the opportunity of the regulation, use it to
spring some money loose and yes, do the paperwork to comply with the regulation
and make the changes that you knew needed to be made in terms of technology
people process solve the problem in addition to dealing with the regulation. And yeah,
this too is affecting tens of thousands of organizations all throughout Europe. Enormous
change in terms of societal expectations, enormous interests. So yeah, never waste
a crisis. Never waste a regulation. It makes sense to me with that
thought. Thank you to Eric Voutier for speaking with us. And Andrew is
always thank you for speaking with me. It's always a pleasure. Thank you,
Nate. This has been the Industrial Security podcast from Waterfall. Thank you
to everybody out there listening