Speaker 1: Let me abstract the policy from the network infrastructure such
that you can have a group of devices or a
device itself that essentially associates with an IP address that's
an overlay address.
Speaker 2: Welcome listeners to the Industrial Security Podcast. My name is
Nate Nelson. I'm here as usual with Andrew Ginter, the
vice president of Industrial Security at Waterfall Security Solutions. He
is going to introduce for all of us the subject
and guest of our show today. So, Andrew, how are you.
Speaker 3: I'm well, Thank you, Nate. Our guest today is Tom Siegel.
He is the CEO and co founder of Blastwave, and
he's going to be talking about distributed asset protection, which
is a fancy name for a very common problem in
the industrial space. We have, you know, stuff devices, computers, assets,
cyber assets all over the place. You know, might be
distant in pumping and substations, might be local. The stuff
was bought, you know, on the cheap. It was the
lowest bidder. It's old, it's ancient, and we have no
budget to rip in place. So what do we do
about cybersecurity? And this is something he'll be walking us through.
Speaker 2: Then let's get right into it.
Speaker 3: Hello Tom, and thank you for joining us. Before we
get started, can I ask you to say a few
words of introduction, tell us a bit about your background
and about the good work that you're doing at Blastwave.
Speaker 1: Sure, Andrew, thanks for having me so my background as
I started my career as a chemical engineer at Caterpillar.
I also spent eight years at Eli Lilly, designing and
building processing facilities to make medicine. I was also a
certified safety professional during that period and managed a twenty
four to seven liquid incineration operation which burned a thirty
thousand gallons of liquid waste per day, so a shit ton.
And then I went to Emerson did business development corporate
strategy there. Then I did product management at Alta Vista.
Then I went on to do sales support at Apple,
where I was at Apple for almost ten years. And
then that's when I started my entrepreneurial career. I started
a mobile telephony company, started a solar storage company, started
a wine importing business, then played professional poker for a
few years, and then eventually started this cybersecurity business called
blast Wave. I co founded that in twenty seventeen, and
our mission then is the same as it is today,
which is to protect critical infrastructure from cyber threats, and
we wanted to kind of come at this with a
very different approach than other cybersecurity companies in that we
kind of started from first principles thinking about what are
the three highest kind of classes of threat and categories
of threats and can we actually eliminate those. The biggest
categories probably no surprise to anybody here, but it's fishing,
credential theft, et cetera. I'm like, well, let's just get
rid of user names and passwords altogether and come up
with a different model for MFA that can actually apply
to industrial settings. So we did that. The second category
of threats was really cvees and vulnerabilities, and could we
make those unexploitable. We came up with a concept called
network cloaking, which I'm sure we'll discuss which kind of
addresses that issue. And then the last one is human error,
which is impossible to get rid of. But if you
can make human beings make fewer decisions, they can also
make fewer mistakes. So we also incorporated that into a
lot of are UI and UX.
Speaker 3: That's wow, that's a history like none other I've ever heard. Tom,
you know, make like I'm thinking, makes makes my own
what I thought storied background look completely mundane. You've been
in lots of different industries. Now I understand that you know,
a lot of what blast Wave does right now is
upstream and midstream, and we've never had someone on the
show explaining how that works. I mean, I think we've had,
you know, one person on talking about an offshore platform
at some point. But you know, when you're looking at
the industry, can we start with the industry? What's what's
the physical process physically? What's this stuff look like, what's
it do? How does it work?
Speaker 1: Yeah, it's really interesting because I can talk about the
physical process and it's also evolved quite a bit in
the last twenty years. So, first of all, just stepping
back looking at the industry, the overall oil and gas
market globe generates two trillion dollars of revenue per year,
and that generates one trillion in profit. So there's a
lot of money in this business. And that also means
that there's a lot of gallons of oil and a
lot of cubic feet of gas that are being extracted
and transmitted and sent everywhere around the world. And the
other thing that's interesting is that, in spite of how
old this industry is, there's between fifteen and twenty thousand
new oil wells created per year, and in fact half
of those were done in the Permian Basin, so about
eight thousand wells were created last year in the Permian Basin.
I don't think people realized the magnitude of which the
oil and gas companies are continuing to create wells and
extract oil. The other thing that's interesting about it is
twenty years ago we had a traditional vertical drilling approach
to oil and gas, and in that to last two
decades we've noticed that there are capabilities to actually now
drill horizontally. And what's pretty interesting is you can actually,
as you start drilling a well today, you create the
initial bore, which is usually a foot or more in diameter,
and then you can send these kind of devices and
drill bits down a relatively sloping curve that over the
course of maybe one hundred or two hundred meters, you've
now done a ninety degree angle, and then you can
start drilling horizontally, which allows you to have higher probabilities
of not hitting a dry well. It gives you more
capabilities for lower cost extraction, and so it's been a
great boon for the industry. Hydraulic fracturing, which is another
technique that's been exploited to get much higher yields out
of these wells, also contributed to the recent boom in
oil and gas. So there are many, many things that
have to be considered when you start doing this process.
You know, you've got to go through site selection, permitting,
you've got to do all this site prep. And one
thing people may not realize is site prep means building roads.
You have to build an entire infrastructure to get to
and from these wells. And then once you start actually
drilling the well, it's much like a CNC machine if
you've been in a factory like Caterpillar or something where
there's a fluid heat transfer fluid that allows you to
you know, cut the metal. In this case, they use
a mud that both stabilizes the well bore and it
also helps you manage pressure. And that muddud flows down
through the drill pipe and then it comes out around
in kind of an annulus, almost like a doughnut, that
comes back up the outside of that drill pipe to
be then cleaned. Having the rock kind of cuttings removed
from it using a screening and operation, and then you
kind of reuse the mud and so forth. So there's
a lot to it. And increasingly much of this is
being automated, and you're having connectivity that is absolutely essential
to be your eyes and ears and these wells, because
once you start producing oil and gas, these things are
hours and hours away from each other. They're very remote,
very rural areas, and so that connectivity is absolutely critical.
And you may have you know, we have one customer
who has seven hundred sites that they're trying to manage,
and so they have to have the ability to do
this in an automated fashion, which requires not just connectivity
but secure connectivity.
Speaker 3: Cool. I mean, you know, it's a piece of the
of the the industry I never dug into. So thank
you for that. Can I ask you, you know you've
said in the modern world, you know, increasingly everything is automated.
I mean, that makes perfect sense. The example I often
use is you buy an automobile, it's got three hundred
CPUs in it. Everything, Every every device, you know, every
non trivial device you buy nowadays has a CPU in it.
Can you talk about the automation in these these drilling systems,
in these these upstream systems. You know, what does what's
that automation look like? Is it like built into the
device like an automobile. Is it a program wile logic controller?
I mean, I'm familiar with, you know, power plants vaguely,
I mean monthly. I don't get out much. I'm a
I'm a software guy more than a hardware guy. But
I've had a few tours. You know, I know what
a PLC looks like. If I visited one of these
well sites, would I recognize the automation? What's it look like?
Speaker 1: Yeah, you would definitely recognize the automation. So what you
see is your classic kind of SCATA tech stack, if
you will. So you'll have remote terminal units, You're going
to have PLCs. You're going to have these things mounted
on a din rail in a cabinet and there can
be various size cabinets. At some well locations, you're going
to have just a few number of devices. And then
at some other well sites, again I go back to
the horizontal drilling, You're gonna have a much bigger operation there.
You're also going to have those well sites connected to
what are called tank batteries, so that you can essentially
manage the flow of oil and gas into these storage facilities.
So there's a lot of automation that's necessary, using kind
of pid control loos to maintain equilibrium within these systems.
And there can also be oftentimes challenges that happen, shocks
to the system where let's say, in the case of
oil and gas, the price starts dropping. Well, when the
price starts dropping, the motivation of the business unit is
not to just keep cranking production at maximum capacity, and
so you actually want to have dynamically. You want to
manage your operation dynamically based on economic conditions that can
change over time. And I'll tell you something else, Andrew,
about what's happening today. There's a lot more uncertainty in
the business world today than there was four months ago.
And I think that is going to affect oil and gas.
It's going to affect the price of oiling gas. It's
going to affect the supply of oil and gas. It's
going to affect the transmission across borders. So these kinds
of things can affect the automation. I'll call it like
uber automation. Okay, not just between the actual plant operations
and facilities, but also between different entities in the upstream, downstream,
and midstream ecosystem. So there's a lot of there's a
lot of very interesting factors that affect that. And I'll
tell you one other thing that's kind of interesting. That's
everybody's talking about AI, and there are some of the
larger oil and gas companies are trying to figure out
how to apply AI to optimize their operation. And you know,
everybody knows that there's there's automation that's used to help
identify ways to to to deliver predictive maintenance to rotating machines,
but there's also uses of AI in oil and gas
to prevent things like spills. And one of the big
challenges is it's easy. If you go talk to someone
at BP or Shell or Chevron and you say can
I get data to the cloud, They're going to go, well,
heck yeah, there's all kinds of great things that can
allow you to get data out of your process. And
in fact, I think you're associated with a company that
does a really good job of doing that kind of
one way transmission of data. And the other thing is,
but once you have that data and you're using it
to build AI models, then how do you get deliver
those set points and control variables back to the process.
It scares the crap out of these people the idea
of connecting their control network to a much less secure
cloud network or corporate network, because as we all know,
security is a continuum. It's not Boollyan secure or insecure.
So I think there's a lot of interesting things that
are happening with that, and I think just to kind
of close the story on that, one company, for example,
is pulling that data, they're analyzing it actually an AWS
and then they are taking some of those control variables
and they're using a human in the loop process so
that they'll say this is the recommended set point for
this process, and then the human and the loop then
implements that through their control HMI. So there's a lot
of very interesting traditional ways in which automations apply to
oil and gas, but there's also some very interesting evolving
mechanisms that involve machine learning.
Speaker 3: So Nate, let me jump in and give sort of
a bit of context here. Yeah, you know, AI and
cloud based systems. In my opinion, these are the future
of industrial automation and pretty much everything you know, the
question is not if the question is win, because different
kinds of cloud systems are going to be used in
different kinds of industries at different times, you know, with
different intensities. You know, I care enormously about this topic
because I am writing my fourth book. The working subtitle
of the book, possibly the title of the book is
CIE for a Safety Critical Cloud. You know, when you
have cloud systems controlling potentially dangerous physical processes, how do
you do that? There are designs that work, you know.
I I'm keen to to listen to the rest of
the episode here. I'm keen to, you know, when I
had Tom on, I was keen to learn from him.
When I write these books, I try not to make
up solutions myself. I tend to get them wrong when
I do that. I try to learn from experts like
Tom and you know, gather up the best knowledge in
the industry and try and package it up in a
digestible format. So, yeah, you know, the cloud is the future,
and I'm you know, when we recorded this, I was
keen to learn from Tom about what the future looks like.
Speaker 2: And I know we're about to get right back into
the interview and what I'm about to say, actually kind
of has nothing to do with you just said, but
before we go. A few times now it feels like
you guys have mentioned the terms upstream, downstream, midstream, and
I just want to make sure I'm clear on this
before we continue.
Speaker 3: Sure, this is this is standard oil and gas terminology.
You know, people say, oh, oil and gas as if
it were one industry. It's not. Really. There's three industries involved,
and each of these these you know sort of sub
industries have a lot of different kinds of facilities. So
the stream is generally considered be the pipeline. So we're
talking upstream is producing stuff to feed into midstream the pipeline,
and downstream is taking stuff out of the pipeline for
refining and such. So, you know, sort of next level
of detail. What's involved in upstream exploration is considered part
about stream. Initial drilling is part of upstream. Offshore platforms
are part of upstream. The you know, onshore pump jacks
are part of upstream. You know, the whole infrastructure building
roads is part of the upstream process. Midstream is pipelines
and tank farms, and you know, in the natural gas space,
you need to do sort of an initial separation and
you know, discard waste from the product. You might even
need this in liquids to take you know, if you
can do an initial filter and take water out of
the oil and pump it back down, you know, the
dirty water back down into the well, sort of waste
or carbon dioxide out of the natural gas. There's initial
processing facilities that are sort of pre sending stuff into
the pipeline. There's tank farms where the pipeline store stuff.
Sort of intermediate, there's liquid natural gas ports, there's oil
you know, oil ports, there's oil tank This is all
part of midstream, the process of moving stuff and from
place to place, and you know, to a degree storing
it while you're moving it. And then downstream is sort
of everything you do after it comes out of the pipeline.
So there's refining, turning it into diesel fuel and jet fuel.
There's the finished processing on natural gas, taking out all
of the natural gas liquids, you know, making it basically
pure methane with not much else. You know, there's even
you know, stuff like trucking gasoline from the pipeline to
the gas stations is considered part of downstream. Midstream kind
of rears its head again because you might have the
concept of a gasoline pipeline. So you got the oil
pipeline bringing the crude oil to the refinery. Then you've
got the you know, you sort of hit midstream again
taking the finished product gasoline and sending it to consumers.
Then you've got the truck, you've got the gas stations.
Each of these sort of upstream, midstream and downstream sub
industries has sort of many components. I've lost it now,
but I saw a list once of you know, here's
all the different kinds of things that can be in midstream,
and it was like I countered it was twenty seven
kinds of things. So it's a complicated industry, but very loosely.
You know, upstream produces midstream transports and downstream consumes in
a sense, refines and produces the goods that we actually consume.
Human in the loop, I've heard that described as open loop.
You know, in power plants, which I'm more familiar with,
you monitor the turbines the AI and the cloud comes
back and sends you a text message and says, you know,
you should really service you know, the turbine and generating
in at number three sometime in the next four weeks,
and it goes into my eyes, goes into my brain.
I go and double check with my fingers. I type
on things, I say, you know, I think they're right,
and I schedule the service that's open loop. And yeah,
it gets scary when you start doing closed loop.
Speaker 1: And I would say that one of the key things
if you look at some analogous systems where they have
actually gone from open loop human and a loop, if
you will to closed loop, you could. I'll give two examples.
One would be autopilot on planes and another would be
self driving cars. And in both of those cases, you
don't just switch from open loop to closed loop. No,
you do an extensive amount of testing and validation, and
you also in many cases build redundant systems that allow
an additional level of supervisory control on top of your
normal process control loops. And so like an example that
I had heard about was a company that was looking
at having tank level measurements and looking at an AI
model that would actually analyze the input feeds to that
tank model. So and it would pull data from third
parties that would look at the truck routes for the
tankers that were pulling oil from that tank, and so
you could actually synthesize that data. Now you would have
to put in place a lot of i'll call it
ancillary systems and ancillary testing to make that safe enough
to be like an autopilot on a car, because you know, theoretically,
now with all that supporting testing, autopilot on a car
is supposed to be safer than humans. And with people
on their phones like I see them these days, I
think that's become an increasingly.
Speaker 3: Low bar fascinating stuff. The future of automation, I'm convinced.
But you know, if we could come back to the
to the mundane, you talked about phishing, you talked about
you know, cvees, exploiting vulnerabilities, we're talking about protecting these
assets in you know, the the the upstream and midstream
oil and gas. You know, can you can you bring
us back to cybersecurity? How does how does this big
picture fit with with what you folks do and what
you're focused on cybersecurity wise?
Speaker 1: Absolutely. So. One of the things that's interesting is, you know,
I love talking to customers, and I try to spend
at least fifty percent of my time actually listening more
than talking to customers and understanding what their challenges are
and how we can solve those. And in the case
of oil and gas, there were three customers that came
to us and told us the identical story, and they
became our largest customers. And the story they were telling
us was that they had these highly distributed assets all
over these these very wide geographic areas, and they had
spotty cellular and they had backup satellite to enable that
connectivity that they need. They need the eyes and the
ears in the field because it would be cost prohibitive
for them to get in a truck and drive out
there to monitor that, you know, every few hours. So
the challenge they brought to us was the security team
didn't like the operations team having this insecure connectivity to
these remote areas, and so the security team said, you
need to do something about that. And that's where blastweed
came in, and we said, you know, we can actually
use our software define networking solution to cloak those assets
so they're undiscoverable to adversaries, but also segment them so
that if there were malware that were to get introduced
in one area, it would not to others. And then finally,
you would have the ability to get secure remote access.
And one of the coolest parts about this is this
is not a bump in the wire kind of solution.
This is a solution that allows routing and switching between
groups of devices and users. So it cuts across firewalls
as if they don't exist. It doesn't route traffic based
on source and destination. It routes it based on identity.
And this is something I think is very unique to us,
and it's something that I think customers absolutely love. And
this has enabled us to address a benefit that we
hadn't even thought about, which was when oil and gas
companies acquire other oil and gas companies that one of
the first things they face are the need to maybe
reip this architecture because oftentimes the IP space there's overlapping
addresses and the you know, that can be problematic. It
can take a lot of time, it can take a
lot of money. And that's another solution that we've been
able to deliver. Come almost by accident. We had one company,
oil and gas company that acquired a thirty billion dollar
acquisition target. That's a big company that you're acquiring, and
they were able to protect that with blast shield in
three weeks of acquiring them, and they didn't have to
re ip anything. Again, that's just because of the way
we do this network overlay. So there's a lot of
cool things that that use cases that have we've discovered
through the process of listening and talking to customers.
Speaker 3: You know, you've said the phrase sd WAN, you know,
software defined wide area network. I have never figured out
what is an sd WAN. I mean, I've worked with
firewalls for twenty years. I you know, I did a
lot of different kinds of networking, not not hugely. I
mean I never worked for a telco. But but can
you work with me? You know, what is an sd WAN?
What is your sd WIN? How does one of these
things actually work? What does it do?
Speaker 1: First of all, I said SDN, not sd WAN, So
I said software to find networking, which is a principle,
not sd WAN, which is an architecture. So but what
I what? I guess the best way for me to
think about this, And keep in mind, I'm a chemical engineer,
not a software engineer, So that means I'll if it
takes me, it may take me longer to understand these concepts.
But when I finally do, I can probably explain them
to people. So the the way I've learned this is
that we essentially establish we abstract the policy from the
network infrastructure, so such that you can have a group
of devices or a device itself that essentially associates with
an IP address that's an overlay address, much like you
get network address translation. All right, so you have an
original IP address, you have a translated IP address, and
the software to find network then uses the overlay address
to both communicate with each other to establish the most
efficient route because performance is very important in OT environments
unlike IT environments, and this allows us to optimize the
path for any given packet, which is also very cool.
So that's one of the elements that I think is
important in software to find networking. The other thing is
is that it creates this illusion that it is a
point to point between two different devices or two different groups,
And so that's part of the abstraction. So if you
don't have to like set the path, which is what
firewalls do path looking at the routing how you go
from this firewall to that firewall, from this port to
that port, when you just abstract that too, I want
to go from this centrifuge to that control room. It
doesn't matter if the infrastructure changes. And this is a
very powerful benefit of software defined networking because if you're
just looking at the device you want to protect and
the user who wants to connect to that protected device,
as the environment evolves, and it absolutely will, you don't
get put in the penalty box like you would in
a firewall situation, where you could get firewall rule conflict.
And if one thing to think about, Andrew, is when
you think about the breaches that occur, about one hundred
percent of those breaches already have firewalls, and so that
means that the firewall didn't work properly, which is usually
a result of a firewall rule problem, or the environment
has evolved in such a way that it's no longer protected.
There's a hole. And of course we all know that
adversaries just need to be right once, whereas us defenders,
we've got to be right all the time, which is
very tough unless you're my wife.
Speaker 3: So Nate, let me jump in here. You know, I've,
as I told Tom, I've wondered about this space of
software defined networking wide area networking for sometime and I'm
beginning to wrap my head around it. You know, he
gave the example of, you know, you might imagine that
we've got you know, the Internet, you know, local area networks.
Wire networks were designed so that devices have Internet Protocol
addresses and they talk to each other, and you know,
routers move messages from one network to another so they
get from the source to the destination. Why is any
of this complicated? Why do we need any more than that?
One example that that Tom gave was you know, acquisitions.
If Company A, you know, I mean there's there's Internet
addresses the ten dot series, you know, two to the
twenty fourth addresses our private addresses. Private businesses can assign
them to their you know address to assets on their
private networks, and you know, never show those those addresses
to the public, to the public Internet. That's fine. There's
another set, you know, one one sixty eight is a
sixteen bit address range that everyone uses. So you might say, so,
so what Company A uses you know, let's say ten
dot you know, zero dot one through ten do zero
dot you know twenty They've got a lot of assets,
they use up a bunch of the address space, and
then they buy company B that's used the same addresses.
Because they're private addresses, you don't have to register that
you're using them in public. And now all of the
equipment has the same IP addresses, and you know, for
each IP address, there's two pieces of equipment in the network.
How do you route messages from from these subnetworks, from
these assets to each other. This is the problem of
you know, renumbering. When you acquire a business, often you
have to renumber. It's a it's a pain in the
butt on it networks. It can shut you down until
you're done and tested the renumbering on ot networks, and
nobody wants to shut down. So you know, if there's
a piece of technology, I mean the textbook technology is
network address translation part of most firewalls. It lets you
hide some private addresses and assign a different address to
sort of that set of of private addresses. You got
to you got to set up a whole bunch of
firewall rules. You can do that sort of manually painfully,
but you know, it gets worse than that. I mean,
I was talking to Tom after the recording. He gave
me an example. You know that I didn't capture on
the recording, but he said, you know, Andrew you know,
they're they're working with an airport, and the airport's building
a new wing. I mean, this is common airports expand
and in every you know, let's say there's twenty seven
gates in the new wing. Every gate has got one
of those machines, those those ramps that that sort of
snuggle up to the aircraft and the door opens and
people come out and step onto this device that has
I forget what the name of it is, moved up
to the aircraft and then they walk into the into
the airport building. Every one of these devices has automation
and has computers. Every one of these devices when you
buy it from the manufacturer, the manufacturer assigns the same
private addresses to every one of their products. So now
you've got twenty seven of these ramps in the new wing,
and every you know, batch of twenty computers or devices
that are built into the ramp have the same IP addresses.
How do you route this stuff again? You can put
firewalls in place. You can do so now you need
a firewall in every ramp. You need technology, and it
gets it gets more complicated than that. For example, you know,
many years ago, I worked with a bunch of pipelines.
I remember one pipeline, you know, one thousand kilometers long,
pumping stations, compressor stations all the way down the pipeline.
Communication was important. You have to communicate with these these
stations or you have to shut down the pipeline. You know,
it's illegal to operate a pipeline in that jurisdiction unless
there's human supervis and so you had. You know, there
was a fiber laid along the right of way for
the pipeline, and from time to time some fool would
run a back ode through it. So you'd need backup communications.
I could you not. This pipeline had something like seven
layers of backup communication. There was satellites. There was DSL
modems to the local Internet service provider. There was cable modems.
When there were a local Internet service provider, there was
I don't think I think this was before the era
of cell phones. There were there were analog modems that
you know, we're talking fifty six kilobit you know, one
hundred kilobit per second modems that you could route in
an emergency Internet protocol down very slowly. But and and
they had built their own by hand. They had rolled
their own what today I think would be called a
software defined wide area network, where the task of that
component was to say, I need you know, I need
to send an Internet Protocol message from the SKATA system
to you know, a device five hundred kilometers away. What
infrastructure is up, what infrastructure is dead? If a piece
of the infrastructure, the communications infrastructure, has failed, then you know,
activate another piece of the one of the backups, and
change all the routes, change all the firewall rules so
that all of the messages that have to get from
A to B can get from A to b. It was,
it was, It seemed to me ridiculously complicated, But in
hindsight it sounds like the same kind of need that
modern software defined wide area networks address. You know, they
address security needs as well as just the basics of
getting the messages from one place to another when the
underlying infrastructure changes from moment to more. I think of
wide area network, I think of routing. So there's a
routing element, You've got multiple pads. The system sort of
auto heels and figures out the best pads or presumably
the cheapest pads. But you've also talked about users and security.
You know how does How does this routing concept work
with security? How is security part of this? You've also
mentioned firewalls. Can you can you can you dig a
little deep?
Speaker 1: Well? I think I think we in a way are
disrupting firewalls that are used for uh industrial, lots of
industrial applications. There are great uses of firewalls. They're a
fantastic tool, but it's it's kind of been used like
the if you have a hammer, all the world looks
like a nail, and you know, especially again, I'll talk
about these remote oil and gas locations where you may
only have five or ten devices, and so the idea
of having a firewall to segment that is ridiculous. The
expense would be prohibitive. So that's one of the other
reasons why it's so cool about the way we can
scale dramatically from protecting five devices at a very remote
well site to two thousand devices with a single gateway.
So there's a lot of flexibility that we have that
firewalls can't deliver. And when you look at a comparison
of a project that involves a firewall as a solution
versus blast shield, are we take one tenth of time, cost,
one fourth as much. We can deliver this with half
the administrative lift. It's much easier to deploy as well,
and it actually works. So there's a lot of benefits
that we bring over a firewall a solution.
Speaker 3: Can we come back to the technology. Can you tell
us what does this stuff look like? I mean you
said it's not a bump in the wire physically. What
does it look like? Is it a dinrail box at
each of these sites? Is it a dinrail box on
a central tower? Is it what is it? Something in
the cloud? Can you talk about what is it that
is solving these problems?
Speaker 1: Sure? So there are basically five components that we have
to our platform. The first to create the authentication handshake.
One is a client that runs locally on your HMI
or on your machine. And then you also typically have
either a mobile application that provides the MFA without passwords,
and that was patterned after Apple pay. So I spent
a decade at Apple, and so the idea was, let's
try to use some of that technology to provide stronger authentication.
The other thing that we have is we have a gateway,
and the gateway is a software appliance and it can
be deployed on X eighty six bar metal. It can
be deployed on containers, it can be deployed on Kubernetes clusters,
it can be deployed in the cloud awsgcp az're. It's
very flexible, and it can be operated both in passive
mode and active mode, so in the pat traffic path
or outside the traffic path. We also have an agent
that can run locally on a machine, which most people
know what agents are. And then finally there's an orchestrator
that is used to drag and drop devices and people
into groups and then establish policies between those groups. So
that's a little bit about the way the technology is
set up. And one of the things that we found
is that you can have people who are i'll say
less sophistic hated than many CCNA trained professionals, so they
don't even need to know how to use command line
to deploy our solution, so it's relatively simple. We have
an example where one person is managing twenty two thousand devices,
so again that provides a benefit to them in terms
of op X reduction ongoing. So that's a little bit
about the way the technology works and these the way
these components fit together. Because that it's your question, Andrew.
Speaker 3: That's close. I mean what you've described is sort of
the pieces of the puzzle, but you know, I'm still
a little weak on how they work together. I mean, again,
we've used routing a couple of times. To me, there's
two ways to do routing. You can either take the
message messages into one of your components, I'm not sure
which one and figure out where they belong and send
them on their way yourself. You can be a router
or and I understand you know sometimes some software WANs
can do this. They reach out to routers like firewalls
and just routers and who knows what else that can
route messages and they send commands to those devices when
things need to be routed differently, you know, is one
of these models what you use? How how do you
guys do the routing?
Speaker 1: Yeah, so let me talk about how these pieces all
fit together. So the software appliance that is the gateway
sits upstream of the switch and usually downstream of the firewall,
and what it often will do is it will provide
what we call layer two isolation. And so what that
is if you think about we can essentially turn a
forty eight port switch into forty eight d lands, so
that each one of those is its own ENCRYPTI unit
that can't see their neighbors and can't talk to their
neighbors unless the policy allows that to happen. And so
that level of very granular control is something we can
deliver because of the way the gateway controls and manages
the routing that you're discussing. Now, there's two other components
I didn't really talk that much about. One was the
authenticator and the second was the client. And the client
is different than the agent, and so what the client
does is essentially is a challenge response between either the
sso the PHITO two compliant key or the mobile authenticator.
And so what it'll do is essentially produce a QR
code that the mobile application would scan and then apply
your face ID, and then you would be into the system,
but not authorized or permitted to see anything unless the
policy had already been allowed. So that's the way we
manage both the authentication and the authorization, and that's also
the way we manage routing of traffic between devices, gateways
and the groups that those devices are kind of encapsulated in.
Speaker 2: So in his answer there, Tom was trying to describe things.
But admittedly I was getting a little bit mixed up
because there were certain things that were upstream from other
things and downstream from other things, and layers two and switches,
and can you Andrew just help simplify everything we're talking about.
Speaker 3: Here In my understanding, they have a few different kinds
of components. And I might have got this wrong, but
you know what I got out of it was, you know, imagine,
you know, firewalls can do network address translation. They can
say I've got a bunch of addresses here, I'm going
to show you a different address to the world. But
you know, managing them in sort of scale, at scale
with tens of thousands of devices can be a real challenge,
especially if each firewalls only managing a handful of devices.
That's a ridiculous number of firewalls to manage. So what
Thomas gott I believe is a I think you call
it a gateway device is something that sort of sits
between let's say a small network of five to ten
devices and the infrastructure, and you can assign whatever IP
address you need to to that gateway. It might in
fact have two addresses, one on sort of the infrastructure
side and one on the device side. So it has
a device address that is compatible with whatever stupid little
network of five you know, local always reused, you know,
ramp IP addresses, the airport ramp addresses. You know, it's
compatible with that bit of address space. It talks to
those five devices, and when those devices send it messages,
it forwards those messages into the infrastructure, and it figures
out the addressing, It figures out the it does encryption.
If you've got sort of more conventional Windows or Linux communications,
you can put his software on those devices. They that
that software will do the crypto. The software will connect
sort of natively into the infrastructure and sort it all out.
And then, you know, the thing of beauty is okay,
those pieces kind of make sense. The thing of beauty
is what I heard was they've got a management system
which says, okay, you have twenty thousand devices. You know,
half of them have exactly the same IP address. That
doesn't matter. This device over here in this building in
this country can talk to that device over there. It's allowed,
you know. But when that device wants to talk to
Andrew's laptop, because I'm a maintenance technician, Andrew has to
provide two factor authentication, so you can you basically you
stop caring what IP addresses these devices have you don't have.
You're not configuring routing rules. You're configuring permissions in a
sort of a high level user friendly permission manager, and
all of the routing nonsense and the encryption nonsense is
figured out for you under the hood, so you can
you can think about, you know, your your big picture
of devices that need to talk to each other, who
should be allowed to talk to each other? Instead of
how do I route this when the IP address is conflict?
You don't have to ask that question anymore. Cool, So
that starts to make sense. I mean, can you talk
a little bit about you've been doing this for you know,
twenty seventeen, this eight years. Can you talk about can
you give us some examples to help us understand, you know,
how this stuff works.
Speaker 1: Having run this for almost eight years now, the journey
was not a straight line we went through. We originally
started out, believe it or not, Andrew as a hardware company,
and the thesis was to build an unhackable stack. So
this sounds naive, and it was. We were going to
start with a chip, a new chip that we had
a partner developing that would have an onboard neural net.
It would create seventeen key pairs, and it would encrypt
the bootloader in the factory and burn a fuse so
it couldn't be reset. And that was the foundation of
our product. And then we were going to write our
own kernel, write our own operating system and this was
from someone who helped write the OS ten kernel. We
were going to write that in such a way that
it used byte codes and would not be exposed to
buffer overflows and other issues, so it could We were
going to use formal methods to even prove the kernel,
and then we'd have our networking layer, which is what
our company is now, and then we'd have our own
SDK to manage applications that would also use formal methods,
and then finally we would have the authentication layer that
we also have today. So we went from a five
very ambitious levels of tech stack to two, and then
we have other people doing some of those other things.
I think the market really wasn't ready for something that complex,
maybe that secure from a you know, on the higher
end of the security spectrum, if you will. The market
just really wasn't willing to pay that, and so we simplified,
we pivoted, and then, by the way, once we did
come out with our hardware product in February of twenty twenty,
there was another global issue that hit everyone that caused
us to then pivot to a software as a service model,
which then required some more development everything else. So we
didn't really launch our product until late in twenty twenty
one and started getting our first customers very shortly thereafter,
and since then we've grown very rapidly, to the point
where this most recent year we quadrupled our revenue and
tripled our customer count. So it's been an exciting ride.
So let me give you an example. One customer, again
an oil and gas customer, who was again trying to
They were faced with a challenge where they were going
to have to build their own cell towers, essentially become
their own wireless isp. And this is not unique to
this oil and gas customer. There are many that are
facing that and I don't know if you or your
audience knows, but it's about a quarter million dollars to
build a cell tower and you have to have many
of them. So in a relative sense, we are not
just delivering security to this customer, we're also helping save
them a ton of money. So instead of ten to
twenty million dollars, they're spending a fraction of that, which
is also very interesting. When they did this acquisition, there
was another company that did an acquisition. They wanted to
sell off certain components too, So they wanted to sell
off the salt water rejuvenation or I don't know exactly
what the right word is, but they wanted to offload
this asset. And one of the things that they were
able to do very quickly because all of our segmentation,
all of our granularity and access is done in software,
we can essentially just take that new entity, put their
users in a group, put the devices that they control
into another group, and they would have complete control of
just their newly acquired saltwater assets and no visibility, no
access at all to the oil and gas parent company.
So that was another great example of using this in
a creative way.
Speaker 3: So you've mentioned acquisitions a few times. I mean, I
live in Calgary, this is oil country. I hear about
these acquisitions all the time. You know, is this is
this sort of part of the genesis of your organization
is is this How often do these things happen? How
complicated are these sort of mergers and acquisitions technology wise
that happen all the time?
Speaker 1: Well, they happen very frequently, especially again in oil and
gas in the in the case of oil and gas,
because one customer or sorry, one asset owner has a
certain tech stack that can only profitably make money up
to a point, and then they can sell that asset
to someone else who has a richer skill set that
can extract more profit, more money, more revenue from that
same resource. And I would say an example that we've
also seen where people are pleasantly surprised about blast shield
is when there's one oil and gas customer that acquired
a company and their biggest fear was they were going
to have to do an IP space assessment and figure
out whether they were overlapping IP addresses. And so instead
of having to do that, which they didn't have to
do at all, they just deployed our software overlay, and
immediately we're able to segment using software each one of
these devices, even regardless of whether the underlay IP address
was the same. That saved a lot of money in
truck rolls that saved a lot of money and hassle
and headaches in managing that that IP space, which which
they were very happy about it. And the way they
described it, actually they described it two ways to me.
One way was, my god, this is like a Swiss
army knife, and the other guy said, this is like
duct tape. It's like networking duct tape. It has it
provides lots of different purposes, and it's very versatile to
deliver things, to basically deliver the network they want with
the network they have.
Speaker 3: So let me just sort of emphasize. Uh, Tom has said,
you talked about changing IP addresses a few times. I
talked about it a few times. I've actually, you know,
from time to time, had to change IP addresses on stuff,
you know, not so much in an industrial setting, just
just you know Internet protocol networks, just you know, business infrastructure.
And here's the tricky bit. It's very hard to do
that remotely. You know, imagine that you want to remote
into a remote substation. There's nobody there, but there's one
hundred devices and you have to log into each device
with I don't know SSH or remote desktop, and you've
got to change the IP address on the device. And
at some point you've got to tell the firewall that
it's talking to a different network of IP addresses. And
if you do that in the wrong order, if you,
let's say, hit the firewall first, now you can't send
messages to any of the devices because the firewall doesn't
know how to route to those devices anymore. They have
different IP addresses, So you have to undo that. Now
you go into the device and you give the SSH
command a Linux box, you give the command line command
to change the IP address, and it stops talking to
you because you're connected to the old IP address. You've
got to try and connect to the new IP address.
Only the firewall won't connect you to the new I
address because it's IP address hasn't been updated. So now
you have to sort of blindly change all these addresses.
Then you change the firewall, and then you see if
you can still talk to these devices, and three of
them have gone missing. Why did I fumble finger the
IP address? Is there some other problem? It's just really
hard to do this remotely. And so again, if you
have you know, seven hundred sites, you've got to put
people in trucks and drive out to these wretched sites
to make these changes. If there's a way to avoid that,
you can save a lot of money. So yeah, I
kind of get that that it's really useful to avoid
doing that. So this is starting to come together for me.
I mean, you can do the network you know, address
management in your what did you call them the gateways,
and that you know, gives you an enormous amount of flexibility.
But and it's it's the client that does the crypto,
or maybe it's the agent I've lost.
Speaker 1: Yeah, so the client is used to authenticate the agent.
The agent runs on typically a server in the cloud,
those kinds of maybe a historian type of applicant use case.
The gateway is the workhorse because so much of OT
infrastructure cannot run an agent, and so because it can't
run an agent, you need to have a gateway that
can do the encryption and decryption of traffic. Now, when
you think about the way a lot of these processes
are controlled, they use PLCs, and the PLCs, you know,
we don't encrypt the traffic below the switch, we don't
interfere with that. However, with the traffic that is upstream
of the switch, all of that's encrypted wherever it may go.
So I think that's that's the way it's done.
Speaker 3: One other technical question. You know, you mentioned cvees and
exploits and vulnerabilities earlier. I mean, I'm familiar with you know,
let's say firewalls that say they do stuff like virtual patching,
meaning if there's a vulnerability in a PLC, the firewall,
you know, if it sees an exploit for that vulnerability
come through, will drop the exploit and will protect the
you know, prevent the exploit from reaching the device. Is
is that the kind of thing you do when you
talk about about protecting from exploits or are you doing
something else?
Speaker 1: We're definitely doing something else. And I think the approach
that we take is we use this networking cloaking concept
where you have to authenticate first before you can see anything.
There's no management portal, so there are zero exposed web services.
If you run a network scan on a UH factory
that's protected by blashshield, you're going to come up with nothing.
And what that means is if there are cvees, and
I guarantee you there will be, there will also be
zero day viruses, okay, which may not be on anyone's list.
And so in those both of those cases as well
as ancient devices that are never going to be patched.
You've got a way to deal with these unpatchable systems
because they're unaddressable and so it's going to be very
difficult to exploit those cool.
Speaker 3: So, you know, I understand you're you're you're heavy into
oil and gas with all of the examples we've been
talking about oil and gas, but I'm guessing you you
are active in other industries as well. You know, given
your personal background, are you active in other industries? What
can you give me some examples of what's going on there?
Speaker 1: Yeah? Absolutely, I think manufacturing is a fantastic, uh kind
of industry for us. They oftentimes have our a little
bit earlier adopters as it pertains to machine learning, predictive maintenance,
those kinds of things, advanced analytics. And we had one
manufacturing customer, in fact, who was hacked, and many manufacturers
do get hacked from time to time. They were hacked
and the board asked the SISO to have an assessment
to figure out what their risk posture was, and before
they could complete that assessment, they were hacked again. And
so this really lit a fire under the entire kind
of security team, and they basically came up with a
list of findings, and with those findings, they started implementing
those findings and they were testing various kinds of solutions.
And in one facility, they had ten different lines, manufacturing lines,
and they had deployed Blashield on one of those manufacturing lines.
They got hacked a third time. Now this time though,
nine of the ten lines shut down, whereas the line
that was protected by Blashield continued to run. And what
was really interesting about that is how quickly the organization responded.
The CFO of this company responded and elevated that to
the parent private equity company. And now that's leading to
us becoming the default standard for not just that one
company and all of its seventeen plants, but also the
parent private equity company and all the other manufacturing facilities
that they're trying to manage.
Speaker 3: I mean, I've learned a lot. Thank you so much
for joining us. Before we let you go, can we
ask you to sum up what are the key concepts
we should be taking away from from our conversation here.
Speaker 1: So I think the company as it was founded was
tried to establish protecting critical infrastructure based on first principles,
and the first principle was to try to eliminate entire
classes of threats if possible, and so our solution then
tries to eliminate phishing, credential theft, so we have an
MFA passwordless feature. We also allow you to segment using software,
we cloak your network so it's undiscoverable. Thirty five percent
of all cvees discovered last year are what are called
forever day vulnerabilities, and so that network cloaking capability means
that they're not exploitable. And then finally, we also have
a secure mode access component in there, so we're trying
to deliver a lot of value to our oil and
gas manufacturing customers so that they when you couple this
with a continuous monitoring and visibility tool like a Nozomi
Drago's Dark Trace armis Skate Offence Industrial Defender, you know,
the group Clarity. So when you combine those two, you
get a ton of protection at a very low price.
Speaker 2: So that just about does it. Andrew for your interview
with Tom, do you have any final words to take
this episode out with?
Speaker 3: Yeah, I mean I really like Tom. You know, the
customer that gave the duct tape analogy. You know, you
have lots of little networks, sometimes thousands of devices. Half
of them have literally the same IP address or half
of these you know, tiny little subnetworks of five devices
on on airport runways or on you know, networks that
you've acquired with you know, acquiring an oil field. They
all have the same IP address. They all have the
same IP address range. None of it's encrypted. It's just
a mess and you know this is something that lets
you patch it all together. You need crypto, You need authentication.
You know, passwordless is good, use certificate instead. They're harder
to fish. You know, you need to hide all of
these repeated subnets with the same IP addresses. You need
a permissions manager, you know, saying A can talk to BE.
You know you need infrastructure underneath the permissions manager to
make the messages from A go to be. You know,
you need to have some synthetic IP addresses so that
when you set everything up, you know, your SCATA system
can talk to an address and a port I don't know,
probably on the gateway or some piece of the infrastructure,
rather than the real address that's repeated you know, a
hundred times in your infrastructure this. You know, this, this
just makes a lot of sense. I I. You know,
it seems to me there's a bright future for this
kind of of again, duct tape or you know, just
patch it all together and make it work, and you know,
throw some security on top of it, crypto authentication. This
is all good. I'm impressed.
Speaker 2: Well, thank you to Tom Cego for speaking with you
about all of that, Andrew, and Andrew, as always, thank
you for speaking with me.
Speaker 3: It's always a pleasure. Thank you, Nate.
Speaker 2: This has been the Industrial Security Podcast from Waterfall. Thank
you to everybody out there that's listening.