Speaker 1: Somebody to take on the risk of installing it and
owning it, but also trying to influence the cybersecurity metrics
into that asset.
Speaker 2: Welcome, there's the Industrial Security Podcast. My name is Nate Nelson.
I'm here with Andrew Ginter, the vice president of Industrial
Security at Waterfall Security Solutions, who's going to introduce the
subject and guest of our show today. Andrew, how are you.
Speaker 3: I'm very well, Thank you, Nate. Our guest today is
Ian Fleming. He is a solutions architect for ot industrial
control systems and cyber physical solutions at Deloitte, and today
we're going to be talking about how the money flows.
We're going to be talking about working the numbers, arranging
the budget so that there is in fact budget for
industrial security.
Speaker 2: Then, without further ado your interview with Ian floh Me.
Speaker 3: Hello, Ian, and welcome to the podcast. Before we get started,
can I ask you to please introduce yourself and say
a few words about the good work that you're doing
at Deloitte.
Speaker 4: Yeah, hello, Andrew, thanks for having me. My name is
Ian Fleming.
Speaker 1: I lead cybersecurity efforts with operational technologies at Deloitte. My
team really focuses on helping organizations secure their industrial control
systems like building, automation, physical infrastructure systems that are typically
overlooked when it comes to cybersecurity. Prior to Deloitte, I
worked for really heavily Empower. I did a lot of
operational technology cyber was involved in a lot of NERK
sipwork actually enabled a lot of some of the vulnerabilities
that we're trying to patch today. So I feel like
I've come into the consulting side to pay penance for
what I've done in industry.
Speaker 4: Lately, Delight, I've been working on.
Speaker 1: Integrating security as part of a core operations, especially in
industries and areas of government civil where the line between
physical assets and cyber assets is becoming increasingly blurred. We
also work to make sure our clients can effectively manage
risk related to these systems, and just proper alignment between
security investments with business goals.
Speaker 3: Our topic today is budget, you know, shaking the money loose,
managing the money. We don't get any anything done in
most businesses unless there's a budget to get it done.
And we're going to talk about sort of the OT
security budget, the industrial security budget. But can we start
with it? I mean, do IT teams have the same
struggle for budget that we observe in the OT world.
Speaker 4: That's a good place to start.
Speaker 1: I mean, IT teams do face their challenges with budgets,
but they're often more straightforward nowadays when compared to OT.
I think an IT cybersecurity costs are generally tied to
a business process or a system that the top top
floor of the office understands pretty clear. But often like
cloud based solutions, where information is an asset, they're easier
to finance and frankly it does work more from a
top down of the organization. It initially couldn't get funding.
They've been able to really structure their sales pitch towards
real business goals, which is a great You know, it's
something that OT You think it would be easy for
them to describe it, but they top floor tends to
just throw money at those problems whenever things break, versus
IT where they see it more as a strategic advantage.
Speaker 4: If you move data between say cloud.
Speaker 1: Provider cloud providers, you're doing upgrades of infrastructure relatively easy.
In IT, you can handle the issues in a more
agile way. At the same time, it has been rapidly
transitioning from company owned data centers which were once inside
of an office building, to cloud based, more operational expense
type models where logical security nowadays we refer to it
as security as code, it automates much of the security
work in IT now. These models do allow IT teams
to dynamically shift their resources and manage security through software,
which works really well in environments where assets are entirely
virtual and easy to scale, and that's the reason why
operational expenses have really exploded in IT. But let's look
at the other side, Like an OT where my clients
are working in and where I'm focusing some of my
time at Deloitte, we're dealing with physical assets like machines
and sensors, industrial equipment, where failures mean real world space
and time consequence. It goes beyond just the information. It's
physical stoppage of production. So the problem is also compounded
by the fact that it often has to compete with
the physical maintenance budget for operations, which typically isn't really
seen much in IT, especially with the advent cloud and
everybody in IT moving that direction. As far as physical
capital projects like industrial automation systems or infrastructure they are
also fundamentally different. Most of the projects in OT are architected,
designed and budgeted and financed over really long life cycles,
like twenty year life cycles before refresh. When a capital
projects such as you know, physical infrastructures initiated, all costs
including materials, labor, maintenance, think of building a building or heck,
even just renovating your kitchen in your house, they're budgeted
up front and financing is typically secured through like a
large one time capital expenditure.
Speaker 3: So, Nate, you know, we're talking about budgets here. A
lot of our listeners, I'm guessing are like me and
have sort of a limited understanding of accounting and budgets.
I mean, we tend to be focused on bits and
bytes and buffer overflows and you know, cryptosystems. So let
me let me give you just a little bit of
background here. You know, when I started the episode, I
had sort of a small business owner's understanding of accounting
and budgeting here. You know, I've operated my own small
business from time to time, and when you know, when
I operated my own business, there's you know, there's two
kinds of expenses. There's what's called capital expenses and operating expenses.
If you buy, let's say, a delivery truck for a
delivery business, the truck, you know, is going to deliver
value to you. You're going to use the truck for
like a decade, and so the government generally requires you
to declare that large expense as a capital investment, which means,
you know, I always thought it was sort of a
liability to declare that because I have to. You know,
what I'd like to do is reduce the amount that
I pay in taxes. And so if I could claim
the entire cost of the truck against my revenues that
year as a small business owner, as a sole proprietor,
I would pay less taxes. The government says, no, no,
you can't do that. You have to, you know, assume
a life span of three or ten years or something
for the truck, and you can only claim a fraction
of the expense against your taxes and reduce your taxes
slowly over time because you are, you know, the asset
is reducing in value over time. Expenses like gasoline that
you use up you know, that day, or you know,
the over the course of the next week, you can
claim the entire amount of the expense against your income,
you can reduce your taxes. This is sort of the
naive model I had of capital expenses versus operating expenses.
You can claim all of operating expenses right away. It
turns out that in big business is claiming capital costs
over a period of time. Let's say, you know, the
delivery truck over ten years is an advantage because you know,
big business wants to show a profit every year, wants
to control their expenses every year, control the expenses.
Speaker 4: That they claim.
Speaker 3: And so if they have to buy you know, a
fleet of trucks, a thousand trucks in a particular year
and they're going to last ten years, then they don't
want to show that they have negative profit in the
year that they had to make that, you know, in
the year that the money left the business, because it
left the business that year to buy the thousand trucks.
They want to show that, you know, to account for
that expense over the life of the asset the trucks,
so that they can show a consistent profit. So, you know,
this is sort of capital versus operating as is different
in small business versus large business. And you know in
heavy industry, which is you know, industrial security.
Speaker 4: We're all about industrial here.
Speaker 3: In heavy industry, there tends to be extreme pressure to
reduce operating expenses. When you build a mine, you invest
I don't know, three billion dollars in you know, before
the first shovelful of ore, you know, with gold or whatever,
and it comes out of the mind. You invest a
massive amount. This is your capital investment. And once you've
made that massive investment, generally you're under pressure to minimize
the cost of operating that asset over the course of
the next thirty years because you're producing a commodity. You know,
even gold is a commodity, and you know, you sell
the gold at the world price for gold. Gold is interchangeable.
Nobody cares if it's your gold or somebody else's gold.
You're fighting with every other gold mine on the planet
to produce gold. And you know, even gold gets more
expensive every year to produce as the supply diminishes. To
produce gold at uh, you know, at a price that
will that will show you a profit. So operating expenses
are always under extreme pressure in heavy industry, and they
capitalize their investments. So that's sort of accounting one to one.
When I came into this I have learned from Ian.
So I'm thinking let's go back to Ian and learn,
you know, the mistakes I've just I've just explained to
you and sort of the naive understanding of accounting. Reflecting
on what you just said, the thing that that I
think I caught was that there's roughly two kinds of budget.
There's capital expenses and operating expenses. You know, in the
OT world, everybody wants to minimize operating expenses, and you know,
capital is is kind of what it is in the
IT world. I think I heard you say that everything
is becoming operationalized, meaning it's all going into the opex budget,
But you're saying that in you know, capital budgets are
still really important in the OT space.
Speaker 4: Is that the key difference here.
Speaker 3: Between between these two spaces is the budgets.
Speaker 1: Well, I think that's a it's a really good question,
and it has been something that I've been struggling with,
Like how to operationalize an OT cybersecurity program when it's
being funded through what like I was talking about earlier.
Typically on it is more of an operational expense budget.
Speaker 4: You don't really tie the ongoing maintenance.
Speaker 1: Of a computer system that's anticipated to run for five
years on a capital expense. It's like replacing Oracle or
a Salesforce application would be a CAPEX, unless, of course
you're buying all of.
Speaker 4: The software as a service.
Speaker 1: See those those lines have been grade. But because those
physical assets do have a long lifespan and the security
typically and when I say security, it's also availability of
those assets are tied to those those physical assets. So
whether it's built into CAPEX or drawn down over time,
it needs to be sustainable from a resourcing perspective, like,
for instance, in power I worked in power systems for
several years power delivery and distribution. We had a financial
metric called TIER meant timed interest earned ratio and a
pre CFO and a prior life taught me about this
because I had no idea how to tie like a
cybersecurity tool that was that was designed to protect an
operational asset. So the tier measures a company's ability to
meet its debt obligations by comparing its income before interest
and taxes to the interest, expos and expenses on its debts.
So basically the life cycle of that asset. You wouldn't
be under the water, you know, underwater on your loan.
So the tier ratio can indicate whether your organization has
that profitability from that asset that's operational to cover its
debt obligations and ongoing operational costs. When I figured that
out with the CFO, and this is several decades ago,
I was like, Okay, that's how I'm going to tie
my cybersecurity program to a specific, a very specific operational asset.
And when I say operational assets, it's in physically, it's physical.
It has a physical a cyber physical component to it.
That actually helped me budget long term ot cybersecurity measures
towards the asset. And that's some of the work that
I've been doing here at Deloitte is tying that by
getting it down at the low level, like how is
this asset being budgeted and financed in order to convince
somebody to take on the risk of installing it and
owning it, but also trying to influence the cyber security
metrics into that asset to where the op X, the cost,
the ongoing cost of protecting that asset from cybersecurity is
also encompassed inside that operational the I'm sorry, the capital
expense of that asset.
Speaker 3: You talked about tying costs and interest to income. So
when you say that you're tying cybersecurity to an asset,
we're talking about an asset like you know, in a
power plant, a generating unit, not an asset that generates revenue,
not like a bolt or a PLC that represents only
an expense. Is that the kind of is that the
sort of size and classic asset that you're tying cybersecurity to.
Speaker 1: Well, cybersecurity can be tied to any single component or
group of components inside of the power plant. I'd like
to think of the system itself. I do a lot
of model based systems engineering at at Deloitte as well,
and we don't typically look at each individual components as
being completely autonomous from the process that it's designed too,
you know.
Speaker 4: To operate.
Speaker 1: So it would it would be all the entire syst
I mean, the whole idea of doing a capital improvement
or a capital project is to account for also the
you know, the financial risk you know of doing the
investment or performing the investment on the asset, but also
reducing the you know, proper engineering to reduce the total
cost of ownership.
Speaker 4: Of that asset.
Speaker 1: If cybersecurity isn't tied in to those models. It makes
it very difficult to not just bolt on because it's
being designed without cybersecurity in mind. But like for your example,
a PLC, if a PLC is designed inside of a
power plant, let's just use that as an example, and
there's no cybersecurity maintenance tied to that as part of
the model for financial keeping, keep keeping that that asset functioning. UH,
it's going to make it very difficult in the future,
over years or even an adjustment to a thread or
a risk to find financing for that.
Speaker 4: And when you then you're running into the patching.
Speaker 1: Problems, right, You've got to go through design assessments and
everything all over again.
Speaker 4: However, if if a device like a.
Speaker 1: PLC was engineered and designed in that system knowing that
it had to accommodate a twenty year life cycle, and
there will be times that that they'll have to be
system systematic updates and upgrades due to either compliance regulatory
which is really difficult to plan for. But you know
for a fact that the equipment itself is probably UH
is probably going to be replaced over time. I did
one project at for a client regarding a tunnel and
that was one of their transportation tunnel and they were
extremely concerned about that because they knew that the technology
was going to improve over time. So as part of
the capital improvement project, it was a fifty year life
cycle creating a budget for cybersecurity improvements and functional improvements
over time. Instead of creating another capital project in the future,
it was just built into the maintenance of that capital asset.
Speaker 3: You're saying that we need when there's a capital project,
that's the time, not just you know, lots of people
say it's you need to build cybersecurity into your stuff beforehand,
not afterwards. It's always more expensive afterwards. What you're saying
sort of in addition is that you have to build
the cybersecurity budget into the capital budget. At least, that's
what I'm hearing. You know, Have I got that right?
And you know, if I may you you've been working
you mentioned with building automation. You know when you when
people try to tie the you know, to make that tie.
How's that working in sort of in the parts of
the industry that you're working with.
Speaker 4: Sure, and I do.
Speaker 1: Work a lot in government with a lot of government facilities,
those types of things. When it comes to building automation
systems so h VAC lighting, even even water treatment systems.
Speaker 4: It's clear that that cybersecurity.
Speaker 1: Is a is an after botom these systems we go
in the UH, there's not a really clear point of
reference for even what assets are on the network, and
we are having to delve into like IT tools just
to determine what physical inventory is out there.
Speaker 4: And again it goes back to the whole it. Data
is the asset.
Speaker 1: It's easier to justify protecting the data because you can
move it if there's a failure. But in OT such
as HVS systems, refrigeration, those types of systems, food process
and plant goes down, you're not just losing data, you're
risking the physical assets.
Speaker 4: Themselves, sport spoiled food.
Speaker 1: Damage, machinery comes in the challenge that physical operations are
always under pressure, reduced as operation expensive, and cybersecurity seen
as an extra cost rather than essential part of keeping
that system running safely and being available. Ironically, the way
I feel about it is working in OT versus IT
a lot like how cybersecurity was reviewed in the early
to mid nineteen nineties. We didn't really have cybersecurity budgets
back then everybody was just looking at it as operations.
I just need the information and the product was more
important than keeping it secure.
Speaker 4: And I feel like a lot of these.
Speaker 1: OT systems, such just building automation, that don't really have
the cybersecurity component.
Speaker 4: Added to it.
Speaker 1: If we look at the way they're budgeted and the
way that they're brought online as a capital investment, and
you design in that cyber security component to it, whether
it be in contract or through supply chain, you know,
that is.
Speaker 4: What sets the budget.
Speaker 1: That's what gives us the big wins and integrating security
as a core part of operations, particularly in industries where
there's that vague line between where cyber can control or
impact those physical assets. I mentioned the tunnel earlier, that's
a great example. We recently worked on a tunnel maintenance
project they had to address. They wanted us to address
cybersecurity as a priority. They basically made us cyber physical
commissioning agents. So any type of PLC or logic controller
they was touching an Ethernet network or had some kind
of routable protocol that was creating some sort of function
inside this structure, this infrastructure. They wanted us to look
at that from a not only a design perspective, because
knowing what we've seen the TTPs that are happening today
and in the past, how they can how we can
make those cyber components more modular to where we know
we're going to have to upgrade, say passive network monitoring.
Well maybe we're doing passive network monitoring today, but in
the future.
Speaker 4: We might want to do active monitoring.
Speaker 1: Just using that as an example, just designing those hooks
in to where in the future wouldn't require a massive
heavy lift. It's akin to, you know, having a spare
tire or some sort of a designed a resiliency built
in for cybersecurity purposes on an operational system.
Speaker 3: So let me chime me in here, Nate. This is
sort of my learning curve as I went through the episode,
you know, start with it. One of the points that
Ian made was that almost everything is becoming operational costs
in it. You know, in years past, you know, twenty
years ago, if I bought a laptop as part of
my small business, I would have to you know, claim
that as a capital expense, and I could only claim
a third of the cost of the laptop every year,
and I had to keep tracking it for three years.
You know, to me it was annoying. But again to
big business, they like capitalizing things. It normalizes their profits
in the IT space. Though today you know, increasing the
in many jurisdictions. If you buy a laptop for fifteen
hundred bucks, you just claim the thing right then and there.
It's not worth capitalizing. It's not big enough to drag
out the accounting over three years. If you buy a
server farm at a cost of fifty million dollars, you
know you still are going to and you expect a
life of five years out of the server farm. You're
still expected to capitalize that. The thing is almost nobody
does that anymore. People don't have You know, a lot
of businesses don't have their own server farms anymore. They're
renting the farms from someone else out of the cloud,
and the rent comes out of the operating budget, not
the capital budget. Because someone else owns the asset. You
can't capitalize somebody else's asset, so you don't have big
capital expenses in it anymore. And again, you know, when
you apply that principle naively in ot you wind up
fighting for capital or sorry for operating budget every year,
and you lose sometimes and cybersecurity sort of falls by
the waveside, and we have all these problems, and this
is what we're trying to solve. The insight here is
that what you want to do is associate the cybersecurity
cost with the asset that you're protecting. And the asset
is not the computer. The asset is the generating unit
or the tunnel or you know, a physical asset. And
you know, to me, that's counterintuitive. It's an ongoing expense
every year. Yet it's part of the capital plan, the
capital budget for the asset. Why does that make sense?
And you know, he didn't quite say it in this
many words, but in chatting with him, you know, he
gave the example of a tunnel and maintenance. I mean,
what do you maintain in a tunnel. There's equipment in
a tunnel, you've got to blow in a long tunnel,
you've got to put air down there, or you know,
over time all you're left with his co two and
nobody has anything to breathe, especially if you're driving through
the thing. You have to drain water out of there.
If the tunnel is low enough to be below the
water table, you really need strong pumps. If the water
if the tunnel is under a body of water or
under a river. So you've got a lot of equipment
in these tunnels, and what he's saying is that the
cost of maintaining the equipment is part of the capital
budget and I'm going really, and he says, yeah. The
reason for that is because the asset the pumps for
the water, the blowers for the air. The value of
the asset depends on correctly maintaining that equipment. If you
don't maintain the equipment, the value of the asset declines.
You can't use the asset anymore, or the equipment wearas
out faster than it's supposed to. It's supposed to last
twenty years, it only lasts four years because you never
maintained it. And so the maintenance cost is an ongoing
cost every year. But it's part of the capital budget
because it's essential to the asset.
Speaker 5: And what he's.
Speaker 3: Saying is that in the modern world, if you want
to protect the automation that controls the equipment that's essential
to your asset, cybersecurity protection should be part of the
assets budget, not part of your you know, cut to
the bone operating budget, which was you know, which was
news to me. So this is this is sort of
the theme going forward. You know, what I'm hearing is
that we need to build cybersecurity ongoing costs into capital plans.
It sounds contradictory, you know, capital sounds like one time
and operational. You know, cybersecurity is ongoing, you know, Is
this is this new? Is this something that there's there's
precedent for in in the OT space already?
Speaker 4: Oh?
Speaker 1: Absolutely, that's a that's a really good point. I mean,
that's most OT systems are designed and with under capital
to account for operational expense over.
Speaker 4: The life of that asset.
Speaker 1: Like let's just use a you know, a contrarian example
of what happened with with al Equippo OT breach that
the water facility out in Pennsylvania. It's a great example
of consequences when you know, potential consequences of cybersecurity in
these types of OT environments, these these water treatment plants
and uh water utilities, if it's not properly integrated to
the long term financial planning and in life cycle management.
Speaker 4: In the case, l equipment like remote access was added.
Speaker 1: To a PLC, that PLC was exploited, led to a
bridge and uh, you know, if we look at this,
you know, it's pretty obvious that the there was a
functional upgrade requirement they wanted to be able to remotely
manage this PLC if it was managed, if that if
that functional improvement to that capital asset was managed as
a CAPEX project instead of an operational improvement like an
OPEX budget, because it just adds you know, uh, remote
control or interactive remote access as a day by day
function for for regular maintenance of information technology systems. But
if it was designed and built into the system from
the very beginning as part of the overall project cost,
the change would have been memorialized in documentation. There would
have been a change to an as build of the
function of that system. The architecture engineer, the system integrator,
all the people that was involved in the original design
of the system could have included in the initial setup
of the interactive remote access feature that they wanted a
long term security strategy that embedded that function into the
life cycle of the asset. They could have also modulized
that cybersecurity function for planned replacement as new remote access
protocols came out.
Speaker 4: Finance might also account for that expected.
Speaker 1: Life of the asset, and if the cost was too much,
whether the risk appetite was low, and say no, this
isn't worth it. At least you'd have some sort of
document that was showing what the cybersecurity expenses over that
asset life cycle was going to be. You could have
accelerated depreciation of that asset. It would have been more
of a financial and a risk management decision versus, hey,
we need to enable interactive mode access on this machine
or on this this logic controller. Now it makes it
a lot easier to inenforce cybersecurity policies and just general
operations policies and adjust to new standards while maintaining existing
protections without having to worry about annual budget constraints.
Speaker 4: If say there's a bridge, there's two ways of bridge.
Speaker 1: You want to you want to put more load on it,
There's two ways to do it. You could just overload
the bridge by changing out the weight limits sign right,
or you obviously have to recreate the structure and reinforce
the base of that structure to carry the additional load.
In operational technologies, it's pretty clear that that's very unsafe doe.
In information technology, it's not because there's not a intrinsic
tie between the OT system and the context of operations
that that system is operating under, and that the physical component.
It's just like, okay, we're just installing interactive remote access here.
Speaker 4: So if a project is budgeted through a capital.
Speaker 1: Expense, it's going through like a long term plan of
how long that asset is supposed to the last and
how it's supposed to be maintained. It shouldn't be an
opex budget that we're adding more I features to it
without taking into context what that system was supposed to
be used for, and if we're circumventing any of the
controls by adding IT based cybersecurity and interact feature sets
to that asset. I feel, Andrew, that's where most most
of you know my past life I've gone wrong is
taking the IT approach, which you know, hey, it's a VPN,
it's it's it's it's encrypted, there's nothing wrong. But I'm
not really looking at the operational context.
Speaker 4: Uh that that.
Speaker 1: That I'm that should be the attention that should be
given to the opera operational context of the asset that
I'm I'm modifying.
Speaker 4: Does that Does that make sense?
Speaker 1: I guess I'm I'm trying to tie that op X
to the CAPEX budget and the asset, the long term asset.
And I've seen this over and over again. It has
been a pattern. Without using too many examples from clients
that I've worked with, but those were most of the problems.
If you're you're modifying code in a virtual environment, there
there's very little physical consequence to that. Uh. But when
you're when you're doing it to an operational asset, it's
very very different set of consequences.
Speaker 3: Let's assume we can get cybersecurity costs for the life
of the asset built into the capital plan for the
improvement whatever it is. You've got those costs built into
the plan up front, how do you manage that financially?
How do you how do you pull money out of
that over time? And and what happens if you run
out of the money that you budgeted or you know,
you know, because cost to gook have gone up, or
what you know, what happens if you if you use
the physical asset not twenty years, you use it for
thirty years, and you haven't got the number in there
that you know is gonna you can draw down for it.
Is it like a fixed number that you're drawing down
and you have to guess right with the number or
how does that work?
Speaker 1: Yeah, the maintenance, the maintenance cost for you know, I'm
not suggesting they need to be uh like, it's all
going to be CAPEX. But if op X, yeah, I'm sorry,
it's all going to be CAPEX. Maintenance is going to
be an operational expense over the lifetime of the asset. However,
if there's not a what I'm advocating for is cybersecurity
being part of the CAPEX plan. So think of designing
any type of physical asset. You're going to have components
that are made to be pulled out replaced, like conveyor belts.
There's a maintenance plan for that asset. Now what you
just described. There is a problem. It arises when, like
the TCO, the total cost of ownership metric, a financial
metric remains static and doesn't account for either business growth,
added functions demands, uh, you know, asset improvements, those types
of things over time. For instance, we would install it's
the whole overloading the bridge. We wouldn't replace just by
moving the weight limit sides. We'd have to reinforce that
structure itself because it's a it's a safe it's a
safety issue stank thing with al equippa of water. The
TCO will have to be dynamic when it's in the
In the operational expense side, it has to adapt to
the evolving functional demands of that asset and including a
threat landscape of cybersecurity. But the CAPEX part the capital experiense,
it reduces the operational expense considerably. If you plan for
those systems to be replaced over time, you might have
to accelerate the depreciation of a life cycle or the
acceleration of that asset.
Speaker 4: Uh, you know, replace versus fix.
Speaker 1: If you don't build into the model componentry that needs
to be replaced over time.
Speaker 4: So I hear what you're saying.
Speaker 1: I mean you kind of threw me an interesting one thereon, like, well,
it has to be dynamic.
Speaker 4: It's not all all.
Speaker 1: I just hope being clear that I'm not I'm not
advocating for the full operational technology secure of an.
Speaker 4: OT asset to be fully capex.
Speaker 1: The problem that I've seen is when people, when when
asset owners deploy assets without even without even taking into
account cybersecurity concerns during the development and the financing of
that capital asset.
Speaker 4: Think of it this way.
Speaker 1: It's usually commissioned first, and then we go buy a
product and call it, you know, cybersecurity vendor A, and
we try to force force it on top of that
asset and more. A better approach would be, Hey, we
need to bring cybersecurity in on this. Let's look at
the model of the system, figure out where the more
significant risks are, and design the system to account for
a cybersecurity UH over the life span of the asset.
Speaker 4: It does.
Speaker 1: It does create issues because it doesn't usually think that way. Remember,
they're mostly capital I mean, they're mostly operational. You know
if if if if azure comes out with something tomorrow,
they'll shift over to it. If you make a decision
today with a capital expense, you have to be able
to live with that, with that UH, with that solution
for a specific period of time, based on that based
on your maintenance budget. Just just like a UH.
Speaker 4: You know, if.
Speaker 1: You know a high op X type UH component fails
on a on a truck, you're you're going to replace
it just to keep the capital ascid alive.
Speaker 4: But there's better ways to deal.
Speaker 1: With it than just continually UH raising that operational expense
over time. I hope I'm being clear on that that
I'm not advocating for the entiresire OT cybersecurity budget to
be one hundred percent in the capital expense or the
capital expense of that asset. It just OT Cyber needs
to place the table to influence the design of that
OT asset.
Speaker 3: Let me time in here again. In sort of my
learning curve, there's a difference between a capital expense and
a capital plan. A capital expense is one where you
spend I don't know, three billion dollars over the course
of eight months, and then you reap the benefits of
that over the next thirty years. Because you've built a mind,
you've built a power plant, use you built something that's
a capital expense. You spend the money once. A capital
plan is setting money aside in future budgets, in my understanding,
setting money aside in future budgets to deal with that asset.
You've made a capital investment. You can't just spend the
money and expect the thing to run. You've got to
maintain this stuff, you've got to secure it, you've got
to operate it. All of those costs are built into
a plan for the asset, and from time to time
the financial people have to reevaluate that plan. So for example,
let's say, you know, we've just put a solar farming
and you know, we've got I don't know, lithium batteries
that we're using to store the power for the farm
for you know, overnight use, and these batteries wear out
every I don't know three years and have to be replaced,
and the life of the solar farm is expected to
be twenty years. If the price of lithium batteries got
shoots through the roof, the cost of maintaining this asset
has now shot through the roof, the numbers we put
together saying the ASCID is going to pay for itself
in twenty years don't work anymore. You know, it may
there may be a point where we say, you know,
we're going to shut this down and you know, wait
for three years and see if the price of lithium
comes back to normal, or you know, we're just going
to shut it down and get rid of it. It's
just it doesn't work anymore because you're reevaluating the capital
plan for that asset, and you know, in a sense,
you might have the same thing with.
Speaker 5: Cybersecurity.
Speaker 3: It's not like you've put maintenance money in a bank
account to be drawn down over twenty years. It's not
like you put cybersecurity money in a bank account to
be drawn down out of twenty years and you might
run out of money. That's not how it works. It's
part of the capital plan. And if there's a sudden
change or a permanent change in your expenses, for example,
a new regulation comes down that makes cybersecurity for this
asset much much more expensive than it used to be,
so expensive that, you know, the asset was only performing
marginally to begin with, and now we've tipped it over
and it's just not profitable anymore, we might choose to
shut the asset down. That's part of in my understanding,
that's part of the capital plan for the asset that
needs to be reevaluated in light of current conditions. It's
not part of the capital budget. You know, the capital
expense happened when you build the asset, but the plan persists.
That's that's my limited understanding here of of of how
this works.
Speaker 2: Answer a couple of questions for you. You know, the
more we talk about long term capital plans and twenty
year timelines, and these these amortized cybersecurity budgets, are we
then accounting for patching and upgrading legacy systems over these
many of your timelines.
Speaker 3: I did not ask Ian that question, but I think
what what springs to mind is patching, you know, legacy systems,
legacy automation, twenty year old automation, because that's how long
the power plant lasts. You know, we put automation in
place for that. The question, you know, question is should
should money not have been set aside to upgrade the automation?
And the answer is yes. If you need to upgrade
the automation to reap the benefits out of the asset,
then you have to budget for that. But when we're
talking cybersecurity, I mean, part of the problem, I think
is that it's an afterthought. But you know, even if
you plan upfront and you look at a system and say, well,
I'm going to take it down every five years for
a for maintenance, for essential maintenance, and that's the opportunity
to upgrade everything. And you know what do I do
in between, Well, there's new vulnerabilities a week after we
turn the asset back on, you know, can we patch
those things? I think that comes down. I'm guessing it
comes down you know, partly too is it in the plan,
but partly as well, just cost benefit. If you can
put compensating measures in, like strong network segmentation or you know,
device encryption, or if you can put a compensating measure
in that achieves the security objective and is cheaper than
the really expensive patching process because of all the engineering
this involved, maybe you should use the compensating measures, not
you know, because you have no other choice, but because
you've rationally looked at costs and benefits and said it's
way cheaper to use compensating measure than it is to
try and keep this, you know, the software up to
date week by weeks as.
Speaker 4: New vulnerabilities right now.
Speaker 3: So that's again I didn't ask you in this, but
you know, applying the principles he's laid out that, that's
kind of what makes sense to me.
Speaker 2: And the other question I had, as as Mike Tyson says,
everybody has a plan until you get punched in the mouth.
When you have a very long term cybersecurity plan in place,
how do you account for all of the ways in
which your needs are going to change and the threat
landscape out there is going to change.
Speaker 3: And that's a good question. And I think that's the
difference between sort of a capital expense and a capital
or an asset plan. You know, an expense happens one time.
The plan is something that lives for the life of
the asset, and as conditions change, you know, the cost
of lithium changes, the threat environment changes, the plan might
have to be reevaluated. Regulations change, you might have to
reevaluate your plan. But you know, that's sort of part
of the answer. A second part of the answer is
engineers tend to be heavily involved in asset plans because
they're designing the asset and they're the ones that have
to design the asset to deliver the value over a
ten twenty thirty year period, and so engineers are heavily involved.
And this is I think why the engineering community that
I see a majority of them, it's not universal, but
a majority of them are really embracing cyber informed engineering
because this is an upfront process that shows them how
to subtly change their designs upfront in ways to just
take certain entire classes of risks off the table. You know,
the threat of a cyber attack causing a massive boiler
to blow up in your face. You can take that
off the table with a mechanical over pressure relief valve.
You can take other kinds of threats off the table
by subtly changing the design of your network, so the
design of your automation and these changes in a sensor
are permanent. They take those classes of threat off the
table permanently, and so that simplifies long term planning. So
you know, they're embracing CIE and you know, the asset
plan is something that's reevaluated periodically over the life of
the asset, and you know, new conditions about the cost
of maintenance, the cost of security, the need for security,
you know, the cost of insurance. All of these conditions
are built into the periodic re evaluations of the asset plan.
You don't have to get it perfectly right. Twenty years
in advance. We've had lots of guests on the show
over the course of one hundred episodes talking about, you know,
building cybersecurity into technical plans for the management of automation assets.
What I'm hearing you say is that you know it's
not one number, it's not one time, it's that cybersecurity
budgeting needs to be part is what I'm hearing needs
to be part of the ongoing budgeting and capital and
asset management process that you know large organizations have. Is
that what you're.
Speaker 1: Saying, well, that that is the intent of asset management
in an operational construct, right, I mean it's it's about
influencing the budget or influencing the books on inventory that
you have on the shelf. That's where really good asset
management forecasting come into play.
Speaker 4: Even from an OT.
Speaker 1: Or a cyber perspective, it just feels it's like there's
a disconnect there because of the financing method and the
way that things are operating with cloud and virtual virtual
software that that's not operating inside of a DAATA center anymore.
We need to be realistic about how long these assets
will last and how long it will cost to maintain
their security. A really good parallel can be drawn from
the history of maritime insurance in this story and the
shipping indust I've been working with the mts IAC lately,
so I got a really good crash course on how
the shipping industry. Vessels are classified based on build quality
ongoing maintenance, which directly impacts their insurance premiums. Actually, it's
one of the oldest. I think it was one of
the first insurance companies that came to out of existence
was the merit time. So, for instance, ships that receive
high classification rating from a society that classifies.
Speaker 4: The building rating.
Speaker 1: Given a rating from the Lloyd's of London, it indicates
a vessels a very high quality construction, well maintained. They're
also from MTSISEC. They're even tying cybersecurity rating systems into vessels,
which I thought it was fascinating. At the last ms
IX I went to this actually is built just to
lower or maintain or just put some sort of a
marker on what the expected insurance premium will be, because
the higher that rating, the lower the insurance premium would be. Conversely,
the ships of the lower classification ratings from those societies
or those that fail to maintain their rating will have
higher premiums or they'll be considered out of class, which
is unensurable.
Speaker 4: So the same principle if it.
Speaker 1: Would apply to OT cyber if the asset outlives its
original budgeted timeline or a cybersecurity cost increase due to
the threughaut of regulatory you know, landscape. The organization should
have that process in place to reevaluate that cybersecurity posture,
much much like how the ship's classification ratings would be
reassessed over time. If this asset loses its high rating
because of neglected security or added features that were taking
into it, you know, bolted on over time, the organization
would face increase risk and.
Speaker 4: Higher cost re maintaining.
Speaker 1: And I'm sorry for for mitigating those risks and not
maintaining that asset.
Speaker 3: Can I ask you an open question? You know you've
been doing this for a while. What else should we know?
Speaker 4: What?
Speaker 3: What am I not smart enough to ask you about? Here? Oh?
Speaker 4: You know the hard part.
Speaker 1: I think Waterfall, I go, I go far back with
you guys in prior lives working in power and I
did like the approach with the data that diodes and things.
One thing that that open my eyes working with Waterfall
on other projects in my prior lives with utilities in
an industry is the importance of the collaboration between an
IT leader and those operations to people that are in
the field working on things, and including that finance team.
I think having that cybersecurity built into Capex it's not easy.
It's a hard thing to describe. I think we've done
a pretty horrible job at trying to describe it here today.
But it does require that clear communications about the risks
benefits long term cost savings, and I do feel like
if we can explore this deeper, I hear a lot
of the leader's.
Speaker 4: Business leaders saying the same thing.
Speaker 1: There's this disconnect between what's valuable in it cybersecurity, those
metrics of those KPIs, you know, the number of vulnerability
that we're searching for, or a number of threats that
were thwarted, and it's disconnected from like actual production or
you know, just just maintaining that business relevance with cybersecurity.
Speaker 4: I feel like cybersecurity just.
Speaker 1: In general is more like quality and engineering. The launer
I've been in the industry, and because I'm finding myself
focusing more on how to articulate the problem in financial
terms and using historical references to tie all this stuff together.
It's not really about the whiz bang, latest and greatest
vulnerability or attack. While those are sensationalize, It's really about
how do we sustain and how do we adapt, And
as a cybersecurity practice, and specifically in operational technology and
not even specifically just in cybersecurity in general. How we
can look at this differently and how we can describe
it differently to get attention that that the asset deserves,
and our profession how we can make things better. So
I don't know if that answered your question, but this
has been something really top of mind for me for
a while. It's I wish I could tell you all
the things that I'm involved in there we actually do
hear a light, but the ones that I did bring
up during this call were published in either the Wall
Street Journal or other places that they got some national
attention put in for some awards. So it's just kind
of a I'm just hoping that we can challenge everybody
here to think a little bit differently about the cybersecurity
problem and how it can how cybersecurity as a practice
can address some of the some of the problems in
our industries that we serve.
Speaker 3: Before I let you go, can you can you you know,
take us through the highlights? What what are the key
takeaways from from you know, our discussion here?
Speaker 1: Yeah, sure, Andrew, you know the key takeaways that I
have just three, really, there's one OT cybersecurity is fundamentally
different from it, mainly because it deals with those physical
assets that can't be moved to the cloud, can't be
replaced easily.
Speaker 4: Or shifted.
Speaker 1: The second one is budgeting for OT cybersecurity shouldn't be
an afterthought for a capital project. Trying to integrate it
into the physical the life of the physical asset, I
think is key. That's what's going to keep your budgeted
over the life of that asset. And the third try
to seek out collaboration across it, not just inside your
you know, the IT circles, but also the operations people
that are designing e NA firms and include finance. So
I think that's cfo's I think that's really essential for
the long term success of of a cybersecurity program. You
have to have a resourcing plan. That resourcing usually starts
at finance. It's how everything gets gets it's maintained over time.
And if you're struggling to secure that funding for those
cyber don't don't don't.
Speaker 4: Fight for op X every year.
Speaker 1: Try to try to work design work to design that
cyber maintenance into modulars for those modules for those capital projects.
From the start, it's really a smarter way to secure
your operations in a safer way to fund your ongoing
maintenance of a physical operational asset over the life or
over its operational life cycle.
Speaker 2: Andrew, that was your interview with Ian Fleming. Do you
have any final words to take us out with today.
Speaker 3: Yeah, I mean I learned something here. I'm about sort
of financing for big business. You know, I learned that
that accounting for big capital expenses, accounting for those expenses
over time is actually a benefit to get stabilized as
your profits. And I learned that, you know, large assets
tend to have a capital plan that associates critical recurring
expenses like maintenance and insurance and cybersecurity, you know, couples
those expenses to the asset, so you don't have to
fight for those allocations every year. You know, you either
spend the money or you retire the asset. They're part
of the asset. I also learned that, you know, you
kind of have to speak the financial language to make
this happen. You've got to be able to communicate with
the people who manage the budgets. You've got to be
able to talk about assets and depreciation and management and maintenance,
you know, use that language to work cybersecurity into that equation.
And you know, the lesson is if if you can
get cybersecurity into the asset plan, then you know you're
going to have an easier time of managing cybersecurity and
other sort of operational essential operational outlays for that asset
over the life of the asset. And Ian didn't mention it,
but he's on LinkedIn. You know, he has a lot
of papers on this topic, and you know he does
more general cybersecurity stuff. This is just a piece of
what he does. He's got papers on that other stuff.
If you're interested in digging deeper on these or other.
Speaker 5: Sort of cybersecurity topics, there's a whole ot section at
the Deloitte website and you can just connect Ian Fleming
on LinkedIn at Deloitte and he'll be happy to point
you to his you know, his writing and you know,
help you dig deeper into the topic.
Speaker 2: Well, thanks to Ian for speaking with you, Andrew. And
Andrew is always thank you for speaking with me.
Speaker 3: It's always a pleasure. Thank you, Nate.
Speaker 2: This has been the Industrial Security podcast from Waterfall. Thanks
to everyone out there listening. Thanks to everyone out there listening,