Speaker 1: And having some kind of you know, local copy is
better than not having any The modern best practices is
to have that that copy actually in an immutable storage
in the cloud.
Speaker 2: Welcome listeners to the Industrial Security Podcast. My name is
Nate Nelson. I'm here with Andrew Ginter, the vice president
of Industrial Security at Waterfall Security Solutions, who's going to
introduce the subject and guest of our show today. Andrew,
how's it going.
Speaker 3: I'm very well, Thank you, Nate. Our guest today is
Stephen Nichols. He is the country manager for Canada at Akronus,
and we're going to be talking about rapid recovery of
OT systems in different kinds of emergencies, including cyber attacks.
Speaker 2: Then, without further ado, here's your conversation with Steven.
Speaker 3: Hello, Stephen, and welcome to the podcast. Before we get started,
can I ask you to introduce yourself for our listeners
and to say a few words about the good work
that you're doing at acronis.
Speaker 1: Absolutely my pleasure to be here. So my name is
Steven Nichols. My current role is as the country manager
for a Chromis. But I've been doing technology and in
all sorts of different places from professional services account management
for about twenty years, and in that time I've worked
at a number of different companies. Most recently, I've been
at Acronas for about six years. Prior to this current
role that I started in January, I actually ran our
solution engineering team for the Americas, so I've been deeply
involved in setting up pocs, working with our partners and
our customers to make sure that they both understand the
technology and get the most out of it. Acronus, who
have been around for about twenty two years, have a
solid background in backup and recovering of data as well
as cybersecurity, so we understand that space and we've definitely
got ways we can help you to solve the problem
of uptime and data availability.
Speaker 3: Our topic is rapid recovery, which you know, to me
implies recovering from some kind of backup in of course
OT networks, you know, some of which are our critical infrastructure.
We if something goes wrong, something breaks, something gets hacked,
we need these things to come back quickly. So yes,
but you know what I'm used to seeing at I
don't know, power plants and such, is that you've got
the control network with you know, a bunch of equipment
on it. You've got a lot of the time a
parallel network. Most of your devices have two network interfaces,
one to the real time network and one to call
it a management network, and there might be a network
attached storage device on the management network that stores backup
files for all of your equipment. You know, you're solving
a problem. Is is this the problem you're solving? Why
is you know, a parallel network and a network is
to that storage not not enough? What is the problem
we're solving here?
Speaker 1: The thing generally when we're talking to you know, in
that that space, when we're talking to customers, the real
thing that they're trying to solve is up time. So
there they downtime is incredibly expensive disruptive, especially you know
with in supply chain issues where you're talking about just
in time delivery. There isn't a lot of flexibility and
there's a whole lot of cost when you have downtime.
So making sure that there is a way if again,
whether it's hardware failure, whether it's a corruption of the data,
whether that you know, haven't forbid that should be some
kind of cyber attack, making sure that you have the
ability to recover from that quickly is super important. And
let me give you an example. There's an auto manufacturer
that we work with and if they have a problem
you know, with their you know, one of their systems,
the only solution that they had prior to working with
us was that somebody from Germany had to get on
a plane and bring a you know, a new device
and get that installed. So that's a huge amount of downtime.
So being able to have a very reliable recovery of
that data and not just being able to recover that
back to the same device, because a lot of times
it can be actual hardware failure. So it's about being
able to recover to dissimilar hardware and be able to
do that quickly and efficiently. And that means being able
to to back those control systems up. It means being
able to work within the network environment from a security
point of view, and it means being able to uh,
you know, for example, if it is just data corruption
is not physical hardware, being able to what we like
to refer to as weaponizing non I people. So if
it is just you know, on that individual endpoint, then
being able to do that recovery quickly and simplify that process,
so it doesn't you don't have that bottleneck of it. Tuh.
The other thing that we're we're seeing that is really
driving a lot of you know kind of that that
approach is around compliance. So in a lot of cases,
from a compliance point of view, making sure that there
are reliable backups of those systems and the ability to
do that in a secure way makes a huge difference
to checking those boxes from a compliance point of view.
Speaker 3: So that all makes sense in the abstract, but you know,
the concrete example I had in mind again was you know,
ICEE sites roll their own they've got a storage server,
they keep the backups on it. But to your point,
you know, for reliability, if ransomware gets in there, your
backup server had better not be online or it's going
to get encrypted, just like everything else got encrypted. So
now we need offline copies, and you know, for compliance,
a lot of the compliance regimes say, well, your offline
copy has to be off site in case, I don't know,
there's a fire in the building and you lose all
your backups because that was the room that caught fire.
Is this is this what you're talking about? Is this
the problem we're solving here?
Speaker 1: Yeah, absolutely, and you know, again having some kind of
you know, local copy is better than not having anything
one hundred percent. But you start to get into a
lot of complexity when you're trying to solve that that
problem with kind of you know, home baked solutions. So
you know, ultimately the what the modern best practice is
is to have that that copy actually in an immutable
storage in the cloud. So, you know, using the Purdue model,
having the the agent you know, move up through the network,
make be able to you know, securely initiate that communication,
copy that to to the to a storage or management
server on site that can be in a d M
z uh and then have that copied out to the cloud,
whether that's an uber public cloud like Azure or a WUS,
or whether that's to you know, a dedicated cloud solution
you know, like a Chronus offers. Being able to do
that and store that in a mutable way is really
where you're going to check those compliance boxes without adding
a large amount out of operational overhead on top by
using a solution this designed to solve this problem.
Speaker 3: I know, this is one of the things a Cronus
does you solve this problem. Can you talk about your solution.
You know, what have you got? How does it work? Please?
Speaker 1: Being able to solve for that problem really requires a
few things, and one of them is ease of use.
It's about being able to back up and restore that
data without a lot of overhead or complication. And in
a lot of cases that restorees even to dissimilar hardware
if you have physical failure, Even if you know it's
the same model of hardware that you're getting from the
same manufacturer, there might be a slightly different chipset, a
slightly different thing like that. So being able to restore
that dissimilar hardware. One of the things we have is
something called universal restore. It means as long as we
can load three drivers, we can make bootable. So as
long as we've got the chipset driver, the network driver,
and the storage driver, and we have technology in place
to be able to detect and load those drivers automatically,
and even if we can't, we have ways you can
manually inject those meaning that the ability to restore and
get that system back up is paramount and we know that,
so we really focus a lot on being able to
do that. And the other thing that I think is
really important about how we solve that problem is easy
of use, so you know, just a handful of clicks.
Being able to deploy, you know, configure the settings for
a backup or being able to recover that backup means
that you're you don't have to learn a complicated interface
to be able to get things to work.
Speaker 3: Can we go back to the basics. Don't know how
your system works? You've talked about cloud, you know, how
do you get data out to the cloud? We talked
about Purdue model. How does that work?
Speaker 1: Our solution is sort of divided up into three pieces.
So the first piece is an agent. So that agent
gets installed onto the control system. It is you know, Windows, Linux,
broad support for any of those legacy systems. But with
that agent, once it is installed, that's what initiates the communication,
so whether that's going out to what we call the
management service. The second piece that's installed on premise, and
that is the piece where you're going to set up
all of the settings, where you're going to do all
of the configuration, and the agent is going to reach
out to that management server to say, hey, what what
are the settings? What do I you know, how often
do I need to back up? If you need to
initiate a recovery that can be done from the device
or from the management server. And basically the agent is
the one that's going to be initiating. That's how we
respect the Purdue model. That management server, that second piece
lives in the DMZ, so it's the part that can
be connected both to the secure network and to the Internet,
meaning that it can then copy those that data out
to the cloud or go and retrieve it from the
cloud and bring it back on premise. And the advantage
of that is it can you know, you have a
way to be able to securely move that data. But
it's the agent, it's doing the heavy lifting, and that's
what's installed on the actual control system itself.
Speaker 3: So Nate, let me jump in for a second. I mean,
this episode is a little bit unusual in that I
can only remember one other episode in all of our
over one hundred episodes where we've talked about the recovery
pillar of the this cybersecurity framework. You know, the this
framework is, of course, hundreds of experts got together and said,
here's what a complete cybersecurity program looks like. It has
six pillars. In the modern instantiation of the of the
framework govern identify, protect, detect, respond, and recover six pillars.
And I only know if I only recall one other
episode where we talked about recover, and that was the
Salvador Tech episode. So here we are talking about the
recovery pillar, you know, and it's it's important. I mean,
in especially safety critical industrial stuff. Nobody wants the system compromised.
Nobody wants you know, heavy industry, nobody wants, well forget
heavy industry, their factory, anything to go down. And you know,
if it goes down for any reason, we want to
be able. We have to be able to bring it
back or you know, we've done the business that is
serviced not just go down because of cyber attacks. It
might just go down because equipment burns out. This happens.
You've got to be able to recover from these these outages.
And you know what is there? We're talking about backup
and recovery. You know, it's a pillar. Is there? Is
there anything else? The only other thing I know of
in that pillar is rebuilding from known good original media
as an alternative instead of backing up and restoring, rebuild
a machine from scratch, which probably takes a lot longer
than recovering from backups, So yeah, most people back their
stuff up, and you know, might also have recover from
from known good media as sort of a second level
of recovery option to be used in I don't know, emergencies.
Speaker 1: For whatever reason, do you.
Speaker 2: Think it's inherently just less complex than those other five pillars,
such that fewer people would either be involved in that
space as specialized in that space as vendors or want
to talk about it on podcasts or is it very fruitful?
And maybe we, just as podcasts hosts, have not been
doing a good job of finding these folks.
Speaker 1: Well, I don't know.
Speaker 3: I haven't actually gone out to see who else is
in the space. I know a Cronus is one of
the major players. I see them everywhere. But I think,
and I don't have the niss CSF open in front
of me, but from what I recall, there are far
fewer things to do requirements in the recovery pillar than
in many of the other pillars. So it is sort
of because there's fewer requirements, it's arguably a little bit easier.
It's you know, there's not as much to do, so yeah,
I think that's part of it, But it is important
and so yeah, maybe we have been remiss. I'm happy
that we have Steven as a guest here. This is
an OT system. You know, sometimes they're old and slow,
you know, sometimes they're modern and fast. Is the is
the backup data passing across the same you know, competing
for bandwidth on the same network that is doing the
real time I don't know, train control or something horrible
like this. Is it on a separate network and you
know these agents? Do you get pushback from the vendor saying, no,
you're not installing your agents on my stuff. You've invalidated
and support agreement. Blah blah blah. You know, can you
talk about the problem of doing this on an OT network.
Speaker 1: First of all, the agent is very lightweight. It does
a little bit of the work, so it will actually
compress that data prior to it being sent, meaning we're
actually sending fewer packets. It is designed to work in
a in a in a high latency environment because the
which means that it doesn't demand a lot of priority
on network traffic. To be able to do that, it
can be configured in a way to work over that
same operational network, or you can configure a separate network
that it's the flexibility of the model I think that
is really important. And as far as you know those environments,
we actually have really tight relationships with a number of
ot vendors. So I talk about Honeywell, e v R, Emerson,
Delta V and Ovation Rockwell. You know, they have OEMed
our product, they've tested it, they've validated it on their systems,
and they resell our solution, which means that they're certified
for those systems. And because of those tight relationships, you
can be confident as a customer that you're getting a
solution that is going to be reliable and not interfere
with the primer use of that device, because one hundred
percent the backups are important. But if it's not delivering
the service that it needs, if you're not you know,
moving people or energy or water around, you're ultimately, you know,
making more problems than you're solving.
Speaker 3: Well, you talked about low bandwidth, you talked about not
competing with the control system. Is it possible to throttle
how much of the network you use for the backup function.
Speaker 1: One of the things about the protection plan or the
backup plan that we have the configuration settings in those options.
We have the ability to set up limits on the
amount of bandits, so you can say a certain percentage,
you can say some certain number of kilobits per second,
and you can also have that change at different times
of the day, different days of the week. So I mean,
if you're running twenty four to seven, you can have it,
you know, consistent across the board. If you have you know,
more priority times that you know you need that operational
information to take priority, and you have you know other
times where you can have the backup take priority. Of
both of those things, we can absolutely accommodate. It's about flexibility.
It's about making sure that you have all of the
capabilities that you need without interfering with the primary requirement
of the network.
Speaker 3: We've been talking sort of again in the abstract systems agents.
You generally can't take a Windows agent and install it
on a PLC, and you might have a challenge installing
it on an old XP system that we still see
running in the plant. Sometimes. Can you talk about, you know,
what kinds of platforms you support.
Speaker 1: Let's start with PSC. So in most cases that information,
those configurations are actually being backed up or protect did
or exported to a control system somewhere, and that's usually
being done by the proprietary software within the within that vendor,
and once it's on the control system, we have the
ability to back that up. Additionally, we have those deep
OEM relationships in a lot of cases, what is actually
being done to back those up directly is the Acronus agent.
And when we talk about legacy systems, we've been we've
been in this data protection, in this this backup and
recovery business for twenty plus years, and we know that
a lot of these systems absolutely rely on legacy operating systems.
So we have maintained support for even out of supported systems,
back to things like XP you know, Windows Server two thousand,
you know, lots of those those systems, And the reason
that we do that is because we know that those
those critical systems can't easily be updated.
Speaker 3: We've talked a lot though about sort of the process
of backing things up. The agent's back things up. You know,
the PLCs have have got relationships with you folks. They
might have you know, your software embedded in them. That's
that's all good. Can you talk about the other side
of the coin. There's I don't know, a cyber attack
or you know just plain old electrical fault in you know,
part of a high power process and you know a
half dozen you know, a couple of Windows devices, a
couple of PLCs fry. So we scramble to find replacement hardware.
We get the replacement hardware there, and and then what
how do we restore?
Speaker 1: Yeah, I think that's a great question because you know,
I've often said that, you know, backups are wonderful, but
it's really recovery. It's the ability to get things back
up that that matters. And so if you kind of
touched on a couple of scenarios there, and we have
a couple of different ways to address that. So uh,
let let's start with the last one you mentioned where
it is now new hardware. So I talked a little
bit earlier about our universal restore, So really it doesn't
have to be exactly the same hardware, and I think
that's that's important. But in addition to that, just generally,
how do you how do you go about get recovering?
And when it's a physical machine, the we have the
ability to have bootable media, so you can you can
go to that management server, you can create a bootable
a USB or or CD, you know, optical drive version
that you can go boot on that machine. It will
give you all you know, very very quickly. It installs
a lightweight version of an operating system and uh it's
it will be registered to the management server and be
able to pull down and do that recovery, whether that's
you know, information you have stored locally or even if
you have information that is stored in the cloud. So
it makes the process of being able to do that
just a few clicks on the physical hardware itself. The
other option, let's say that you don't have a you know,
damaged hardware, but it is in fact, you know, some
kind of cyber attack or you know. Another example could
be the challenge with crowd strike a while ago, where
you know, you have some kind of just you can't
boot the system. It's physically the physical system is fine,
but somehow there's been some corruption or some damage. In
that case, we actually have the ability right on the
machine what we call one click recovery. Technically it's three
or four clicks, but it gives you the ability to
on boot hold down the F eleven key. It will
boot into that recovery manager that can be on the
machine and then you can, you know, simply choose to
restore from a backup a week or a couple of
weeks ago before the problem occurred where that ransomware happened,
and that gives you the ability again very very simply
without needing a lot of time to configure and understand.
It's just a matter of a couple of clicks.
Speaker 2: Steven just mentioned there the crowd strike incident, Andrew. At
the time we're recording this, I assume that we're going
to release it some weeks later. But at the time
of recording, we are almost one exact year to the day,
just two days off of the anniversary of when a
faulty configuration update caused crowdstrikes flagship program to bug out
and do blue screens of error in what was I
think eight point five million devices. This was probably the
most highly publicized it or cyber related event in history,
affecting hospitals, shops, airlines, flights were grounded across America. I
think that the number that I found on the web
was that it caused somewhere in the region of ten
billion dollars in damages all told by the end, a
number which is probably relatively rough, and also reminds me
of the last time such an event occurred, or at
least that I can remember, which would have been an
actual cyber attack, namely not Petia, which, while it caused
fewer public and very visible errors to the general public,
managed to cause hundreds of millions of dollars in damages
for very important supply chain companies or not. So this was,
if anything, ever was to be a case study in
what it looks like to do recovery. It was the
CrowdStrike instant last.
Speaker 3: Year, and I agree with that absolutely, and the crowdsyke
incident was not a cyber attack, but you know, it
does illustrate what some people what I have worried about
for some years on the side of cloud connectivity for
control systems. If you know, an honest mistake in software
development could or testing or whatever the process was, could
cause you know, eight point five million PCs to go down,
and you know, industrial consequences in terms of grounding air
flights and shutting down other processes. If that's possible through
human error, it's arguably possible through a deliberate attack as well.
And you know, so crowd Psyche was not an example
of a liberate attack, but it's an example of the
scale of what's possible. Kassea was actually a deliberate attack.
This was on the IT side, not the OT side,
but it was ransomware that was inserted into a cassea
software update server and infected I think, what was it
eight hundred or one thousand businesses all at once, sort
of on the scale of not Petya, but you know,
ten years later using different technology. So you know, I
worry that it is possible to use these these cloud
based systems to reach back and you know, kill a
lot of industrial stuff that might otherwise seem very heavily defended.
Speaker 2: And I think that this kind of risk has come
up on our podcast before because sometimes we talked to
vendors who provide cloud based security services, for example, security
operation centers through the cloud. In this case, the question
that naturally comes to my mind is if the cloud
is a vector for such widespread destruction, potentially through malicious
or honest means, then is cloud based recovery a good idea.
Speaker 3: That's an important question. But you know, here we're talking
about a backup system. We have to be careful that
we're not throwing out the baby with the bathwater. You know,
look at the world. Most you know, the vast majority
of industrial sites are already connected to the cloud. One
more connection is not changing your threat profile materially, and this,
you know, their corners connection is a connection to a
backup service, something that is increasing your resilience. That's increasing
your you know, the strength of your security program. This,
you know, backing up and recovery is part of the CSF.
You don't have a complete security program until you've got
this capability. And you know, unlike the other cloud connections
at most industrial sites, here's a cloud that increases your
resiliency rather than simply increasing your efficiency, which you know,
predictive maintenance and other sort of conventional cloud connections do.
So you know, that's part of the problem. Part of it,
you know as well, is that you know, we need
we need a way to recover and there are measures
we can take. I mean, I talk about, you know,
plugging my own book network engineering in my latest book
Engineering Grade OT Security, you know, free copies of which
are still available from Waterfall. Check out the website or
send me email. There's a chapter on network engineering. You
can talk about extra inspection, you can talk about you know,
high lockdown, separate paths to the Internet. You can talk
about uni directional gateways when you deem the threat of
compromise over that information flows as a credible threat. So
you know, yes, in theory it's a risk, but what
you have to look at is in practice, what's the
benefit here? And you know, if I recall you know,
Steven said later in the interview, they have the option
of on premise backups as well. Now you lose the
off premise capability, but yeah, there's a lot of options,
and you know, you need to look at the big picture,
not just oh, look there's a cloud connection. You know,
we're doomed. That's it's not that simple. So you mentioned
crowd strike. I mean I find that fascinating. It was
a lot of hosts that went down with CrowdStrike. Is
this sort of hypothetical or is it real? Did you
have customers in your knowledge who were hit by CrowdStrike
and you know recovered this way? You know, you've you've
been deploying this, you were you were a part to
the services team at a Cronus for a long time.
Tell us, you know, what's the experience of using this, Like.
Speaker 1: Yeah, I've got to the crowd strike example is you know,
I brought it up because it is real. We actually
do have a number of customers. One in particular I
can think of that had about two hundred devices and
they they reached out to us to say, hey, can
is this something that a coronas can help with? And
we were able to, you know, walk them through the
very simple process. And they had about thirty of those
machines in particular that were remote where they didn't have
IT people who could easily access those machines and their
process of recovering those booting into safe mode, being able
to you know, go in and make registry changes. Although
that takes a lot of IT experience, It takes someone
who kind of knows what they're doing. You don't want
just your average person and doing that. But for those
remote machines, what they were able to do was walk
a non technical person. Again, this is something we kind
of call weaponizing the non IT employees and the ability
to walk them through a very simple process that took
two or three clicks and was able to fully recover,
meaning that they were back up and running with those
devices in an average of five to fifteen minutes. As
opposed to having someone have maybe have to travel two
or three hours or maybe even longer than that to
be able to recover. And that makes a huge difference. Again,
it's you know, going back to what problem we're solving,
it's uptime. It's the ability to make sure those systems
are online and doing what they need to do.
Speaker 3: Just going in and deploying this in an OT network.
I mean sometimes it's built in the vendor. As you
point out, you've got relationships with the vendors. When you
get the control system, it's there. You know, if I
want to apply something like this after the fact because
you know my vendor didn't support it or whatnot, you know,
what what's that feel like?
Speaker 1: So we really try to make it a flexible model
to deploy. So you know, if you've got a small environment,
you know, maybe it's a highly secure environment, you can
actually deploy and register those agents just by you know,
through sneakernet right walking around with a USB and doing that.
But that doesn't really scale, right, So I think back
to you know, we have a large logistics company that
we work with in North America and they needed just
again a broad range of devices, so they were able
to work with scripting and group policy to be able
to deploy that out, and we were able to get
that onto about sixty thousand end points within thirty days,
and that really made a huge difference to their You know,
choosing us as a as a provider is that because
the effort it takes to actually get this deployed in large,
complex environments can be a huge deciding factor.
Speaker 3: Most of the discussion we had so far, you know,
applies sort of universally. It applies if you know there's
an electrical fault and I have does machines fry? It
applies if there's a software fault, and you know eight
percent of crowdstrikes machines are blue screen. But we also
worry about cyber attacks and recovering after cyber attacks. Is
there anything we need to do differently or everything we
need to think about differently in the world of cyber
versus sort of normal failures.
Speaker 1: Yeah, for sure. And part of that is that sometimes
just recovering doesn't eliminate the problem. Right, If you're just
recovering the ransomware back on, it's really not going to
give you the level of protection that you need. So
although the process of the backup and the recovery aren't
dissimilar in those cases. One of the huge things is
a lot of those control systems. Historically the approach to
cybersecurity has been isolation, right, it's been the air gap network.
So the reality is there are fewer and fewer truly
air gap devices today. People want to be able to
manage them remotely. People, you know, there's lots of those
types of things, which increases the vulnerability of those two
cyber attack but putting you know, a full suite of
protection on that device. A lot of the times it's
older operating systems that don't support the modern anti virus
and anti ransomware solutions. And secondly, there usually isn't a
lot of resource capacity there to be able to do that.
So how do you solve for that? And one of
the things that we can do is once we've taken
the backup, we have the ability to scan that backup
through the same engine that we would use to scan
you know, actively on a system to look for things,
meaning that we can mark a backup as safe to
recover or infect it. So if you did have a
ransomware attack that that that you know had some some
case where things were affected and you needed to be
able to recover from that. You can with a high
degree of confidence know that you can choose a backup
that isn't just going to reinfect those systems. And the
other piece that we have and this is this is
something kind of the first thing we did in the
in the world of security is something we call active protection.
What active protection is, it's a behavior based engine that
runs at the agent level and it detects processes that
are suspicious, particularly when files start to become encrypted. So
what it can do to text that knows that that's
not a normal behavior can stop the process and then
revert those files from system cash. This means that again
you're you're aware that there's a problem, you get on
alert that that has happened, but it means that it
should help to prevent that that downtime and then you
can go and do a recovery from a backup which
has been scanned and marked is safe.
Speaker 3: And we've been talking about OT but I understand you
folks do this kind of thing for I T as well,
So you know, in a sense you're exposed to the
the the sort of the I T O T traditional
sort of conflicts or debates or you know, you're you're
you're living in the in the world of both I
T and O T. How's that working.
Speaker 1: You know a lot of people that I talked to,
you know, bring up this idea of O T and
IT convergence, and when they do, you know, the first
things that come to mind are, you know, being able
to manage O T devices remotely. It's it's about having
you know, a network topology that will support the convergence.
But you know, in our case, it really it's about
being able to have a single solution. It's about you know,
getting away from siloed tools and being able to have
a single skill set. U have expertise, have a single
vendor that you can work with that can support those
So you know, we have and all the things we've
been talking around the the OT about you know, backup
and recovery, being able to recover to dissimilar hardware, about
you know, enabling the end user even to do some
of some of those tasks, being able to centralize the storage,
being able to work with remote workloads as well as
on premise workloads. You know, it's it's about that bringing
all of that together and being you know, it's the
same software, the same vendor, the same management server can
you know, very very similar interface. You don't have to
go and use a different tool and therefore have to
become experts in more and more pieces of software. It
really lends itself well to bringing efficiency and operational excellence
to both the IT and to the OT.
Speaker 3: What strikes me about this, mate, is that we're talking
about using the same backup technology suite for OT and
IT both. You know, I'm reminded that this a lot
of people nowadays, when they hear the phrase iotic convergence,
they think connecting those networks up, you know, the cloud scenario.
We talked about the original vision back in two thousand
and five when the Gardner Group coined the phrase, you know,
IoT convergence and coined the phrase operational technology. The original
vision is that teams would come together. Why do we
have two sort of centers of expertise in the company,
one for SQL server for use on the OT side
and one for SQL server for use on the IT side.
It makes no sense combine these teams. It's the same knowledge,
you know. Why are we using a different relational database
on the OT side than on the IT side. When
you know, we have an application that needs a relational database,
it can use any one of them. On the OT side,
we use SQL server. On the IT side, we use Oracle.
But on the IT side, long ago we bought an
enterprise license. We can deploy as many Oracles as we
want free of charge. Why would we keep buying the
same solution from a different vendor. Combine these, uh, you know,
increase our leverage with the vendor, reduce the amount of
training required. This was the original vision for i OT convergence.
And you know we we see that here in the
a Chronus Solutions saying you can use the same technology
across the board. You know, it was only pushing a
decade later that people started talking about ITOT integration in
terms of connecting the networks. And of course everyone almost
everyone connects the networks today. But the original vision is
this vision, which is reduce the complexity company wide. Well,
this has been great, Thank you Steven. Before I let
you go, can you sum up for our listeners? What
should we take away from this episode?
Speaker 1: Well? Thanks, it's been a great conversation. So you know,
if I was looking for what I'd like people to
take away, it's that we can provide a reliable, secure
way to back up and more importantly, recover their OT
environment as well as their IT environment in a way
that is going to increase up time and help those
sleep at night, so things are properly protected. And we
can do all of that in a way that is
closely aligned with their vendors. With the OEM relationships that
we have, it's easy to deploy and easy to manage. Ultimately,
if you're looking for more information, you can certainly go
to a coronas dot com. But if you want to
start a conversation, please connect with me on LinkedIn and
I'll get you connected with one of our engineers and
we can do a deep dive.
Speaker 2: Andrew, that appears to do it for your conversation with
Stephen Nichols about recovery. You know, not the maybe sexiest
topic we've talked about on the show, but equally important
to anything else we've discussed, and important that some folks
are focused in this area.
Speaker 3: Absolutely, it's you know, it's recovery. Backups are underappreciated. There
sort of happened silently behind the scenes until you need them,
and then it's a mad panicle. And we've covered that somehow,
haven't we And yeah, you know, here's a way to
cover it. The new buzzword in OT security is resilience,
meaning if you get hacked, when you get hacked one
of these days, minimize the impact of the attack. And
one of the ways to minimize it is rapid recovery,
you know, And there's operational benefits. I mean, on we
deploy equipment industrial settings that often that's expected to last
well over a decade, which is sort of beyond the
lifespan of you know, a lot of it. Equipment stuff
wears out, you know, the ability to replace with slightly
new or slightly different hardware and recover and keep going.
That's an important operational benefit forget cyber attacks. And you
know what I didn't know about, you know, was the
clever bit of of offline anti virus scanning built into
the solution, saying you know, both anti virus scanning and hey,
you're not supposed to be encrypting those files. Why is
there new copies of these showing up? You know, ransomware detection.
You know, these are our lovely augments to sort of
a like you said, a mundane backup capability.
Speaker 2: Well, thanks Stephen, for being on the podcast with us.
And Andrew is always thanks for speaking with me.
Speaker 3: It's always a pleasure. Thank you man.
Speaker 2: This has been the Industrial security podcast from Waterfall. Thanks
to everyone out there listening.