When you remove that first area of defense and you no longer have a human
performing that function, you got to ask yourself the question, well, how
can I provide oversight, protection, safety and security for my site? Hey
everybody, and welcome to the Industrial Security Podcast. My name is Nate Nelson.
I'm here with Andrew Ginter, the vice president of Industrial Security at Waterfall
Security Solutions. He's going to introduce the subject and guest of our show today.
Andrew, how's it going. I'm very well, Thank you, Nate.
Our guest today is Michael Almeida. Michael is a senior account manager at
Force five and Force five does physical security for electric utilities, and physical security
is tied into cybersecurity. You don't have cyber if you don't have physical So
he's going to talk about physical security and the connection to cyber All right,
then let's jump right into it. Hello Michael, and thank you for joining
us. Before we get started, can I ask you to say a few
words about yourself for our listeners, and you know, talk about the good
work that you're doing at Force five. All right, Andrew, thank you
so much for bringing me on your podcast. Honor to be here. My
name is Mike Almeida. I am a senior account manager at Force five.
I've been with the company for about five years all together in the power utility
space. I'm entering my thirteenth year in here. I had a previous career
in the United States Army as an officer for a number of years, and
my career sends from being a SIP auditor working for power utility and now working
for a vendor. At Force five, we focus on reducing risk at every
entry point of a power utilities facility. So thanks again for having me,
Andrew. That's great. And our topic today is physical security interacting with sort
of supporting industrial cybersecurity. You know, we're the Industrial Security Podcast. Most
of what we talk about is cybersecurity. How does physical security fit with cybersecurity,
Sir, it's a great, great question, Andrew, and I'll tell
you. At the crux of the matter, physical security really ensures that you're
keeping the bad actors out of your facilities. You're doing your best job to
validate that those individuals have a business need, that they've met your site specific
training, they meet all your policies before they come on site. And it's
important to limit who comes on your site because therein lies the problem. Right.
The first part of any type of criminal or bad actor is always looking
to circumvent your physical security process, and with the right tool set and the
right skill set, once they get inside your facility without being challenged, that
gives them the opportunity to get to areas of your facility that house critical infrastructure
protection components. Especially when we talk about cybersecurity, this could be network cables,
switches, routers, you name it. The moment that they get the
physical access into your site, cybersecurity is just a key stroke away. Right,
So in principle that makes sense. I mean I agree with you.
Can you give us an example, I mean, you know how much trouble
can we get into? Yeah? So this actually is It brings up a
funny story, not really funny, but a really important story of understanding why
cybersecurity is so important. So, as I mentioned in my introduction, I
did spend a number of years in the military and I was deployed. This
is back in two thousand and eight. I got a phone call from my
brigade communications officer about two o'clock in the morning and she told me, which
is this is now a declassified operation, but we had to disable every single
USB drive across all of the computers in my area of operation, and at
the time I probably had over two thousand pieces, and I was geographically dispersed
in nine locations in Iraq, and I had twenty four hours to do it.
My soldiers and I completed the mission. But the reason we had to
do that is because there was a signature of a malware that was attempting to
send information from our secret Internet protocol to Russia. And what we discovered in
our after action review was that it appeared that the virus or the trojan horse
originated from a USB stick that someone had plugged into our network, whether it
was inadvertently or inadvertently. More than likely was probably a soldier who went to
the Morale Recreational Welfare center to go and talk home, contracted the virus on
that device and brought it back and put it into our secret computers. But
the reason I bring this story up and the importance it is if you allow
just about anybody to come onto your site without properly vetting them and making sure
they meet those credentials, they can easily take a jump device, plug it
into one of your network switches or plug it into a computer that controls some
of your industrial control systems, and wreak havoc just like we experience, which
by the way set us back about a decade in terms of technology. So
that's I would absolutely consider that something you should look at when deciding whether or
not you want to let the right people in on your site. You know,
Andrew, When it comes to somebody physically at a plant, it's not
even something that I really associate with cyber I just assume that a cyber attack
occurs when some remote entity tries to get in through technological systems, not when
somebody's literally at a plant. Is this something that happens outside of the context
of like Stuck's net, And if so, are there any defenses against it?
Yes, you know, yes, and yes. Let me give you
sort of a more mundane example to start with. You know, I was
working at at Industrial Defender a long time ago. We were, you know,
building software and we had to test it, and so we had a
large test bed and to standardize our testing, we would reset the entire test
bed to sort of a known state between runs. And that meant taking you
know, Linux CDs, and we'd take an image backups of the hard drive.
Basically, you know, every sector on the hard drive from zero to
as big as big as a hard drive was, and you know, between
runs, we would just put the image back on the hard drive and start
from exactly the same state. So we had to do this. And you
know, I gave the the Linux boot CD and all of the backup CDs
to one of my colleagues who'd never on this before, explained how to do
it, went away. Two hours later he comes back and he says,
Andrew, do you know that with this Linux Boot CD, I can boot
any device in the office here and read all of the data off the hard
drive, you know, And I said yes, I said, welcome to
the dark side. If you can touch it, it's yours. Now,
this was back in the day before hard drives were or flash drives were routinely
encrypted. So to your answer, is it is it real? Is it
mundane? And yes, back in the day, you boot into Linux and
you can read you know, every every bit on the hard drive. Nowadays,
this is why the modern world, modern equipment is is encrypted. The
hard drives are encrypted. If you try to do this you'll get garbage back.
But you know, the bad news is that not all of the equipment
in industrial control systems is modern. A lot of it's still older. And
you know, even modern equipment is vulnerable. If you can touch it,
you have a huge advantage. So sort of a second example is Chinese intelligence
agencies have been accused of doing this to visitors in China. People who visit
China are encouraged to use throwaway devices and not log into any of their important
cloud based systems while they're visiting. Why because Chinese intelligence agencies have been accused
of tapping the hotel on the shoulder, you know, having you know,
tapping, tapping your business partners that you're there to visit on the shoulder saying,
you know, take this man out for a three hour binge somewhere and
then tap the hotel on the shoulder, get into the hotel room. Uh,
you know, look at the the laptop, figure it out and leave,
you know, do it again the next day and come back, and
this time they know exactly what model laptop you have. They've got the tools.
They take it apart, they insert a device, you know, that
a very tiny device between the keyboard controller and the motherboard. And now this
tiny device is recording all of your keystrokes. They come back at the end
of your visit and do the same thing, removing the device, putting your
device all back together again. And now they've got on that little chip all
of the key strokes that you've entered, all of your passwords that you've used
in the last three days. They log into your systems and you know you're
sunk. So and in the modern world, this is why many of the
cloud systems, if you want to log into them, have two factor authentications.
So to your question, yes, if you can touch something, you
have a huge advantage in terms of compromising it. And yes, this is
why we see two factor authentication. This is why we see encrypted hard drives,
This is why we see a lot of modern technology being applied because this
is a real problem. So can we talk about that's the problem? Can
we talk about the solution? I mean, it sounds simple. Do we
not have Is this not why we have guards, gates and guns? You
know, we absolutely do, Andrew, we have guard to gates and guns.
But I can tell you that with the recent financial economical strains, especially
in big businesses, it's becoming more challenging to borrow money and So what I've
seen recently, especially one of my large customers, is that they've made a
decision to move away from a contingent guard force because the cost is astronomical.
At the end of the day, they're beholden to their shareholders. And so
when you remove that first area of defense and you no longer have a human
performing that function, you got to ask yourself the question, well, what
can I do? How can I provide oversight, protection, safety and security
for my site if I don't have somebody that's looking over them. And you
know you know this Andrew be in the power utility space. Power plants are
the It's the bread and butter of how power utilities not only make money,
but allow us to flip a switch and let the lights go on. So
if we can't afford to allow a physical person to do that, we have
to do something different. And that's one of the reasons why at fours five
we provide solutions for outage management and really help provide internal controls that can vet
individuals making sure that they have a proper business need, they're not on some
watch list. They have your site specific training, so you have confidence knowing
that individuals who come on your site not only are who they say they are,
but have the appropriate business need and also meet all the training and policies
you've set in place to protect your organization in the first place. If you've
got organizations that have done away with their guards, I mean, I mean,
what happens if you know, worst case, you know, someone ignores
your security fence, brings a saw, cuts through the fence, cuts through
the doors on the way into the plant, into the server room. I
don't know, with a USB in his hand. Do you not need guards
at least for incident response? I mean, what do you do if you
don't have guards and you've got a situation like this? Right? And this
ties back into your incident response plan as you just mentioned, right, So
the first thing you have to do is, if you know you're going to
move away from a contingent workforce or contingent guards, you have to make sure
that your policies and procedures adapt to that. Right If you're not, if
your policies and procedures say, notify a guard, and obviously you're not using
guards, you need to make sure that there's something in place to follow.
And really it boils down to your level of risk tolerance, Right, do
you really want your employees confronting somebody they think is a bad actor, or
do you probably want them to do something like call nine to one one,
right, call a security company, whatever it is. And more than like,
your sock has probably done both already because they have videos. Most power
utility companies I know have video footage pointing at those critical facilities, and so
if they see somebody that that's not recognizable, they're they're probably gonna go ahead
and start putting in their contective or the protective controls to make sure that they
do that. But the truth is, the more realistic situation is somebody finding
a way to get into your site during a major outage so they can blend
in with the environment and do things being undetected. So that makes sense in
principle. You know, if there's an intruder in the site, there's no
guards, you call nine to one one, you call the authorities. Your
sock might have done that for you, But there's operational decisions that have to
be made if someone has you know, cut into the survery room, if
someone is wandering around the facility with a hammer in their hand, and you
know, with clearly militia intent. They've cut their way into the facility.
The authorities aren't there yet. Do you keep generating power? Do you keep
producing oil out of the refinery? What you know, isn't there a decision
point that has to be has to be made about, you know, what
do we do with someone on site like that? Do we have to shut
down out of out of safety. It's a really, really awesome question,
Andrew, and I guarantee you you're gonna hear different answers from different people,
but I can tell you. You know, Mike Tyson had this famous quote
and it says, you know, everybody has a plan until they get punched
in the mouth, right, So when you think about that, at the
end of the day, your policies, procedures, your your business continuity plan
should absolutely have those steps in there. And if they don't, really it
comes down to the station manager. It's his decision on what to do in
that scenario. I guarantee you your executives are probably concerned about profitability and also
concerned about making sure that the plant generates money to keep the lights on.
But in that moment, the plant manager might be about safety and security for
his employees, and so at the at the end of the day, I
think the responsibility falls on the plant manager whether he continues to have operations going
or he chooses to shut down. And there's a lot of factors considering that.
Right, If they're in a you know, let's just say this happens
in the summertime and it's at the peak of day and it's hot and you're
at your peak load, you probably don't want to shut down your site.
But if it's something that happens in the middle of the night where it's not
really a peak load there, there probably will be more considerations to actually have
the plant shut down while you deal with the security issue. That makes sense,
Well, that makes sense. You mentioned you mentioned NERKSIP a couple of
times. I know there are rules in NIRKSIP about physical security. Can you
can you talk about those rules? I mean, oh, pause, hand,
I'm okay. Something else. You've said a couple of times you talked
about outages. Now you know the questions I've been asking you, I've kind
of been assuming we're talking about physical security during operations when there's you know,
the usual complement of people on site, when you've got power coming out of
the power plant when you got you know, gasoline going through the pipeline.
You've talked about outages a couple of times. Why why are you talking about
outages? What's what's special about them? So outages are something that that commonly
occur for large generation facilities. So if you think about a car, right,
every every so often, you've got to bring your car in for maintenance
so that way it keeps running well. Power plants run on the same schedule.
There are certain components of those plants that have to shut down for maintenance,
and so during these times you can have a large contingent coming on site.
In fact, there's a plant that I visited not too long ago produces
about thirty four hundred megawatts of generation and at their peak outage, they can
have about fifteen hundred people on site that are contractors that you don't know them,
They don't know you, but they were there to perform a service for
a certain period of time. And so when you think about having a large
group of people you don't know anything about them all over your power plant,
around your most critical assets. That creates a security challenge. It also creates
a safety challenge because they've probably never been on your site before. Sometimes they
have to bring vehicles on your site, so now every person and every vehicle
it's on your site creates a liability unless you find a way to validate them
and ensure that they have a proper business need. So it's important. This
is an important part of the power utility space because if those plants don't get
everything done that they have to get done on outage, and they have to
extend their outage for any reason, it puts strain on the bulk electric systems,
on the interconnects as a whole, because now someone's got to pick up
the slack for the power that's not being generated. So again, yes,
it's a for profit industry that generates power for dollars, but at the same
time, if you can't fulfill your obligations how the whole entire landscape is expecting
you to, then it puts unnecessary strain on the system as a whole,
and that can create issues like rolling blackouts and whatnot, which we all remember
from two thousand and three, But that wasn't that wasn't due to a plan
outage. But the point is we have to make sure that during those outages
we're getting everything done that we have to to keep the system online. And
we're also making sure that safety and security is a focal point of ensuring that
none of those contingent workers are going to be in a position where they can
do something to sabotage or inhibit your ability to provide services to your customers.
Let's talk. Let's talk NRKSIP if we can. You know, we're going
you're giving the power plant example. Let's say part of the the outage is
to expand uh the capacity of the server room so we can put more servers
in there to do more stuff, you know, more predictive maintenance or whatever.
And so one of the people who's got to go into the server room
isn't electrician. They're setting up the new rack or three with you know,
uninterruperable power supplies. They're connecting it to the power. They've had to add
some new breakers. They're in there working for a couple of days doing electrical
stuff. But this is the room that contains all of our control system computers.
How does that work? You know, the plant is down, it's
not producing power. You know, do you just let the electrician in there?
What's the rule? Yeah, that's A. It's a it's a really
important rule and this is this is Ryan SIP six. When you have somebody
you have a critical or you have a physical security perimeter that's defined in NERDSIP,
there's two ways you can do it. Right. If this is a
contingent worker that you know that you've done a personnel risk assessment on, you've
performed a seven year background check, they have a valid business need to be
in that space unescorted, you most certainly can give them privileges to go into
that space unescorted. In my history of being not only an auditor but working
for Power utility, this is going to be the exception, not the rule.
And the reason is because this is somebody that's doing work or service for
a small period of time and they're not going to be back, and so
you typically want to reserve those types of authorized unescorted physical access for people that
you trust that are going to be there from a longevity perspective. More frequently,
what we see is when you have a visitor coming into a physical security
perimeter or PSP for short, you have to escort them at all times within
line of sight. So you've got to make sure you document what their name
is, who they're there to see, document what the reason is for them
being in there, what time they arrived, what time that they left.
This is typically done manually from probably say about eighty percent of utilities do it
manually. But again that creates a challenge, right because if you don't,
if you have sloppy handwriting, or you're not putting in the correct information and
there should be an event, then you're relying on what's written on that paper
to see who's in that space, who is the escort, to try to
decipher what happened. I can tell you that there's been a lot of times
on the physical security side where an incident's happened and when they go back and
try to figure out who's in the space, they couldn't decipher the handwriting.
So now they have to go and rely on cameras and rely on different angles
and talk and call up the person who they believe is in the video.
And as you're doing that, it's taking time, and the more time you
take, the more likely whoever it is that doing the malicious act probably is
going to get away with it and be undetected. Just a word of clarification
here, Michael has mentioned the NRK SIP standards a couple of times. NIRKSIP
is a family of standards. It's got like, I don't know, thirteen
or fourteen volumes, and you know the standard that's called SIP zero zero six
six SIP double oh six talks about physical access control. It says stuff like,
you know, if you have an important a piece of the electric system
that is covered by NRKSIP that's medium impact or high impact, because there's sort
of three categorizations low, medium, and high in the NRK SIP. If
it's medium or high, you have to have a process that restricts physical access
to these systems. It's usually described, you know, colloquially as a six
walls rule. You have to have a floor, you have to have a
ceiling. You have to be sealed floor and ceiling, and on four walls.
You have to to have a you know, a system in place,
keys or technology or something that prevents random people from walking in. You have
to have a way to They use different words, but you have to have
waited to clear people who are allowed into it. You know, if you
let people in whenever they want, they have to be trusted people. See,
they need to have background checks. They need training. They you know,
they need to know what they're doing. If you have uncleared people like
the electrician who needs access to the space, they have to be supervised constantly
by a cleared person. You have to have technology in place to monitor if
somebody enters the room who's not authorized. You have to have alarms in place
to detect unauthorized access. All of this, you know, is part of
Zerzoo six because, to a greater or lesser extent, if you can touch
a system, you can compromise it, or you certainly have a tremendous advantage
in terms of compromising. The latest numbers in the twenty twenty three Threat Report
on OT cyber incidents show that the threat environment has changed fundamentally. At the
beginning of this decade, OT cyber attacks with physical consequences have changed from a
theoretical problem to a very real problem, more than doubling every year. The
new report is focused on deliberate cyber attacks in the public record. These are
attacks that cause physical consequences in process industries and discrete manufacturing. Most of these
attacks are ransomware, though the fraction of activist attacks is growing, and the
report's appendix includes a complete list of all cyber attacks since Stuxnet that meet these
criteria. To see how today's OT cyber threat environment has changed, I invite
you to download the report, a joint effort between Waterfall Security and the ICs
drive OT Incident Repository. You can download the report at Waterfall dash Security Slash
twenty twenty three dash Threat dash Report, or just go to the resources menu
at the Waterfall Security site and click on white papers and ebooks. So let's
get into the details about the good work you folks are doing at fours five.
You have solutions in this space. What do you have? Who's using
it? You know? How does this work? So we got started,
ironically, we got started in the SIP space. I actually worked for a
utility company and I discovered Force five at the recommendation of a peer, and
at the time we talked about SIP six. Here we were in when there
was eight regulatory regions at the time, we were in all of them,
and so we had manual paper logs at these physical security perimeters and as you
can imagine, we were getting audited by all eight regional entities and we would
probably get audited every year. And it's something that we consistently had a problem
with. And so when I when I approach FORSE five, I said,
hey, listen, I'm going to make your business requirements very simple for you.
I want an appliance that includes software and hardware. I want it all
one. I want something that can easily be used regardless of the austerity of
any type of environment, whether it's a power plant, it's a substation,
it's a control room, it's a corporate lobby. I want the look and
feel to be the same, and I want a dedicated support line. I
don't want to have to figure out what the hardware needs to be. You
figure it out for me. All I have to do is pick up a
phone or send an email and get help. And that's how Gatekeeper was birth.
And so we now have an automated solution which is the only escort driven
self service log in KIOSK in the industry today that enforces those policies of NERKSIP
at your PSPs. And so instead of relying on paper handwritten errors trying to
decipher that, we have the ability to enforce your policies and procedures. So,
whoever the authorized escort is, he or she is the only person that
can use the system and start a visit your visitor can't. We put all
the onus on the person with the responsibility and that's how we got our start
and NRK SIP and then i'd say about a year and a half later,
we were approached by a plant manager that said, Hey, that's great,
but I don't care about those requirements. I have hundreds of people coming to
my site during an outage. They don't need to be escorted. I just
need to make sure that they have met all the training. They're not on
some sort of watch list that they have a business need to be there.
If you can figure that out, then I see a path through your solution.
And so Force five worked with with some of the outage coordinators and some
of the plant superintendents and plant managers, and that's how the evolution of the
outage management solution of Gatekeeper was birth. And so in this scenario, we
use height turnstyles. We can provide a building or no building, and we
augment those turnstyles with our kiosks to perform access controls. And so if you
think about what's important to a plant manager, they want to make sure that
this person has the site specific training to enter the site. They want to
make sure that they're not on some sort of watch list or have been terminated
or kicked off a plan in the past, and they want to make sure
that they have a valid business need during an outage. So when you take
all those pieces and you assign them to an identity, are chios in a
quick moment. When you use biometrics, they can either use their fingerprint or
they can use their face. Once they come to the kiosk and identify themselves,
the system does all those checks quickly, and if you meet all the
criteria to enter the site, we fire the turnstyles, and if you don't,
we deny entry. And if you metro watch lists, not only do
we not deny entry, but we send out emails, text messages and robocalls
to interested parties letting them know that somebody that's a bad actor is at the
front gate of your facility. And uh, you know you mentioned biometrics.
I mean it's great. Biometrics are high tech? You know, are they
necessary? I mean most places I go they use badges, right, necessary
and necessary? Are are are are definitely good questions? So I can tell
you that for your trusted environment, badges are okay, and they're okay because
you you know who the people are, and you know that they're they they
have already been validated by your company when you talk about your untrusted environment,
which is the reality here with a contingent workforce. In my experience in my
career, I've seen a plethora of things happen. In fact, one time
when I was working for utility, it happened to be at a plant and
there was a large group of contingent workers with a plant with a leader.
There was a contingent workforce. Leader was overseeing all those people, and towards
the i'd say, after lunchtime, this gentleman grabbed all the badges from his
staff and let them out. There was another outage happening not too far away
that they had a contract for, and the priority for that company was that
those staff be there. And at the end of the day, when he
went to go swipe out his badge, guess what he did. He not
only swiped out his badge, but he swiped out the badge of his entire
team. And so for our company, we wound up paying for ten to
twelve individuals that left early right so with badges The problem with that is all
they're intended to do access control looks at the card serial number, make sure
that it matches an authorized entry on that list, and lets him in.
When you use biometrics, it's very hard to fake a face or a finger,
right, so you have to have something phis that's unique to you.
And so when we what we found is not only is it expedite the process
of logging people in, but it also gives you stronger validation knowing that the
individual who presented that credential, whether it be facial recognition or biometric fingerprint,
when you have them presenting that credential, it's a higher confidence of validation.
So you know that they can't hand their thumb and they can't hand their face
to somebody else because you can only use it to go in and you can
only use it to go out. And the system is smart enough to know
if you've went in one time, we were not going to let that same
identity in because it's already in the system. It sounds like that that scenario
that you gave there with the with the badges. You know, the benefit
that the system was providing the plant is, you know, is not really
a security benefit in the sense that it's you know, keeping out people who
shouldn't be there. It was kind of an operational benefit, and you know
in a that's this is this is commonplace. A lot of a lot of
folks that we have on talking about different approaches to solving problems in the industrial
security space. A lot of the time those approaches have sort of ancillary operational
benefits. So you know, you've given us one. Do you have other
examples of, you know, how you can use what appears to be a
security tool to you know, just make the plant more efficient. It's it's
funny you say that, Andrew, because one of our customers recently this year
gave us an interesting story I'm going to share with you where they We always
tell our clients make sure that you tell your contingent work for workforce when you
use the solution it's for a safety and security perspective, because they'll be more
apt to adapt it in everyday routine. But one thing that that he shared
with me was he's always used this same scaffolding company for a long period of
time, and over the years, he said he thought he was getting build
or overcharge for certain type of activities. They were performing, and he could
never validate it because for TNM or time and materials contractors, it's paper based
count cards. For time cards, timesheets right. So he'd say fifty percent
of the time he'd argue back and he'd win, and fifty percent of the
time he'd pay the invoice. And so as soon as he leveraged our solution,
he got his first invoice from the company, and when he looked at
it, he said, ah, you know, this doesn't seem right.
And so he decided on his own accord, you know what, I'm going
to go into gatekeeper and look at the resources that I got for the week.
And what he discovered when he put his invoice alongside the record of who
had actually been on the site, the invoice was for nearly double the amount
of individuals he had on the invoice. So let's just say it was forty
He only got twenty and they were supposed to work forty hours for the week
and they only worked twenty hours. And so when he went back to this
guy, he said, hey, I got your invoice, but I'm not
paying it because you overcharged me. And the guy's like, come on,
man, you know we always go through this conversation every time we have an
outage, you know, I won't do that to you. And he said,
I get it. I said, but I just pulled my report from
the solution that we have for safety and security or GATE, and I can
tell you down to the second who was on my site, and I can
tell you that I got half the resources on this invoice at half the time.
So I'm not paying this invoice. And the gentleman's like, well,
let me let me look into that and find out what the problem is.
And the next day he calls him back. He goes, oh, I
sent you the wrong invoice. I apologize, here's the right one, and
and he kind of my client kind of chuckled, but he said, ever
since that scenario happened, he never has gotten overcharged for an invoice because they
now look at this as a timesheet. So again it's a safety and security
solution, but the contingent workers looking at his timesheet. In addition to that,
one of the things he's been able to discover in using the data that
was typically stale written on paper, now that it's in a database, he
actually can predict whether or not he's going to have enough resources as I mentioned
earlier. You know, if you're you don't have the resources to meet an
outage and you have to extend it, that puts some strain on the power
system. Well, using this solution, he can say, well, I
was supposed to have forty resources at forty hours a week, but for the
past three weeks, I've only had twenty resources at twenty hours. So there's
a he can predict, predict that he's going to fall short in that area
and maybe do some other other methods to help condense that time a little bit
shorter, or bring in additional resources to compensate for the lost time that he
had because he didn't get the resources he was promised. So that's that's an
operational thing. And one other story that I want to embellish here for a
moment that I think is important is the security aspect. And I think this
is operational because operational risk is something that everybody should consider, especially when you
have industrial control systems. We had a customer who had a contractor that got
into an incident with the plant manager and as a result of that incident,
he was placed on a watch list and walked off the site and told that
he was not allowed to come on that site ever again. A few weeks
later, that contractor decided to go work at a different site for the same
company. It's the same utility company, just under a different outage, and
it just so happened when he arrived, the watch list identified him as being
a person that shouldn't be on the site. And that plant manager happened to
be there that day because he worked the zone, and so he looked at
that individual says, don't ever come back to one of my plants ever again.
You're not allowed here. And as a result of that, the company,
the vendor company he worked for, it terminated his services because he could
not perform it. So lo and behold. Several weeks go by, this
individual work gets a job at a new vendor company that happens to have a
contract for an outage at the same power utility company, and when he showed
up for the outage and placed his finger on the reader, it detected him.
Regardless of what uniform he wore, we were still able to identify that
this is the same individual that's on the watch list. He should not be
on site. So the customer was extremely happy because there were three use cases
in a span of six weeks where an individual who was someone that should not
be on site was caught and was identified prior to allowing that individual to get
on site. So that's a great example of the robustness of a solution.
So safety, security, financial, reconciliation, any of those things are important
to your plants. The point that Mike just made it definitely speaks to what's
been sticky in my mind throughout this interview, which is that the technology that
he's describing seems most useful to me, or rather most commonly useful, not
necessarily in that crazy state sponsor like Stucksnet scenario where you're dealing with spies,
but where you're dealing with more run of the mill insider threats, which I
imagine are going to be much more common for customers of his. Although it
occurs to me as well, I don't know if I'm misunderstanding the exact nuances
of the technology here that it might make more sense to have like a list
of people who are allowed on a site and then just exclude everybody else by
default, rather than having like an expressly bad list and then going from there
unless there's a good and a bad list. In my best understanding, and
I didn't quite ask the question this way, but in my understanding, there
are both an allowed and disallowed list. It's not like you allow everybody accept
people on the on the the disallowed list, you don't let any stranger into
the site. My understanding is that before you let someone in, they have
to be entered into the system. You might presumably enter them into the system
when they arrive, but you know, presumably they you know, assuming they
have someone to vouch for them, their their host at the site. But
even if you have an allowed list, you know, the the biometrics I
think come into play when you have a disallowed list. You've got biometric information
for the people that are disallowed. You know. In the example of the
worker who changed vendors, they might well have you know, I imagine they
could have registered with their new employer with a subtly different name, using a
nickname instead of you know, the long spelling of their full name, and
they show up as a different name, a subtly different name, working for
a completely different employer, making their first visit to the site. So they
are on the allowed list, but then the disallowed list catches them because of
the biometrics identify them as the same person with a different name who's been banned
from the site. Cool some some very convincing use cases. You know,
let me ask you. We've been talking about what you folks do. Can
you talk about the future, what's coming in this space? Well, I
think, and this is kind of ironic because we've talked a lot about visitor
management and how we you know, ensure the right folks come on site.
But more recently there's been a lot of shootings at substations. In fact,
last year, I think it was over one hundred and thirteen shootings at substation.
So it's definitely got the attention of a lot of executives in the space.
And as a result of that, we've partnered with a company and we're
now producing what's called BOSS. It's a ballistic overlay shield system and the intent
of this is to provide enhance ballistic protection, security and resilience for substations and
critical assets by reducing those potential attack vectors and threats. Right, So you
think about those that room that we talked about, that hypothetical room with all
this network and security equipment being shot at now is a physical threat. But
again, you damage that equipment, it creates a problem, and so we've
developed a solution based out of poly your you're I think it's polyethylene is the
proper pronunciation, but it's been tested by the US military for over two decades.
But the solution we have now can stop a seven six two round,
which is typically fired from a three TOZH eight Winchester rifle hunting rifle or an
AK forty seven. So as you look at some of these threat vectors and
threat actors, that type of caliber and lower is probably what they're going to
use to target your substation. Whether it's just a discgruntled worker trying to get
back or really somebody that's trying to do damage. This is a big threat
that we're seeing that has certainly got the attention of many power utility executives,
and we feel like in our ability to call ourselves a risk company, this
certainly fits the bill when we talk about how do we reduce risk from those
type of attacks at some of the most critical systems like transformers or whatnot in
the power utility space. There you go, I mean distressing that this is
the world we live in, but it is I mean, this is I
guess this is why we have jobs you know, physical security, cybersecurity,
the interact. You know, thank you for joining us and providing these insights
before we let you go, can you sum up for us? So at
the beginning Andrew were talking about tying physical security and how it relates to cybersecurity.
Right, So if we take cybersecurity at the crux of it, that's
the place where you can predominantly do the most damage undetected in your facility.
And so if you know that that's one of the higher risk to your facility,
to your infrastructure, you want to make sure that that is protected from
a physical standpoint. And taking cybersecurity back to physical if I had a handful
of takeaways, here's what I tell you. Understand the risk that you have
to your environment and what your tolerance is for it. If manual processes like
paper, you're willing to accept that risk, then this is probably not for
you. But if someone circumventing your security, getting to getting someone like an
electrician to a switch room where you've got problems, where you've got critical infrastructure
that can get if it gets damaged, can cause a big problem, you
probably want to automate it. And when you look at automating it. You
want to make sure that you can validate, enforce, and discover things about
your organization. Right, so you log the visitor, you validate their identity
that they have a pro business need to do that, You enforce your policies
and procedures, and you discover trends about the information that you're getting. If
this sounds like something that piques your interest or it's a need at your power
utility, visit forcefive dot com. We only work with power utility companies,
or feel free to reach out to me. You can find me on LinkedIn.
Just look up Mike Almeta, the same name you see in the podcast
title. Andrew, thanks again for having me on today. It's been a
pleasure. Andrew. Usually I ask you for a last word here, but
this episode has given me a lot to think about. I think that the
overall takeaway for me is that physical security is dovetailed always with cybersecurity, that
they are necessarily interlinked, and when you don't have the former, you can't
have the latter. And also, you know we've done over one hundred episodes
of this show. I think that we times take the physical security side for
granted. By talking about you know everything else that happens on the computers as
if that is just going to be taken care of. But at the end
of the day, you know, you need people like Michael to do that
basic, assumed, implicit work so that then we can talk about the more
sophisticated defenses that we spend all our time on. Absolutely, I mean one
of the principles that that you know, I talk about a conferences sometimes,
you know, we talk about the cyber perimeter. A lot of people say,
oh, but the cyber perimeter is it? You know, is there?
Really? Is it dead? Because you know there's experts on the IT
side say the cyber perimeter is dead, and I come back with yes,
but and it might be dead on IT networks. But you know, that's
not the point. The point is that all important industrial facilities have a physical
security perimeter, all of them. They all have, you know, if
not guards, gates and guns, at least you know, a fence and
you know, the a system like Force five at the turnstile letting people into
an out of the side, controlling access to the site. There's always a
physical primeter. You don't let the public walk into a dangerous facility and you
certainly don't want, you know, random malicious actors walking into a dangerous facility.
So yes, absolutely there's always a physical perimeter. It's essential to cybersecurity.
You don't have cybersecurity unless you have physical security. So you know,
good call. Well, thanks to Michael Almeida for speaking about this with you,
Andrew. And Andrew is always thank you for speaking me. It's always
a pleasure. Thank you, Nate. This has been the Industrial Security Podcast
from Waterfall. Thanks to everybody out there listening.