Speaker 1: Security was mostly discussed as technical topic and there is
not enough frameworks conveying important security and security risks in
the way that the stakeholders can easily engage risks and
CC for me enabled that.
Speaker 2: Welcome listeners to the Industrial Security Podcast. My name is
Nate Nelson. I'm here with Andrew Ginter, the vice president
of Industrial Security at Waterfall Security Solutions, who's going to
introduce the subject and guest of our show today. Andrew,
how are you?
Speaker 3: I'm very well, Thank you, Nate. Our guest today is
Toomomi Aoyama. She is the principal development lead for Private
SaaS that's software as a service at Cognite, which produces
industrial control system software. And we're going to talk a
little bit about what she's doing, but mostly we're going
to talk about her translateation of the Consequence Driven Cyber
Informed Engineering textbook Countering Cyber Sabotage, her translation of the
book to Japanese.
Speaker 2: Then, without further ado your conversation with Tomommy.
Speaker 3: Hello to Mommy, and welcome to the podcast. Before we
get started, can I ask you to say a few
words about yourself for our listeners and about the good
work that you're doing at Cognite.
Speaker 1: Sure, thank you very much for having me. Andrew. By
the way, I'm Tomommy and I've been I see security
domain over a decade and I started as an academic
researcher and my fascination for this domain was always about
how can we enable this collaboration. I started with from
understanding trying to understand how safety and security risk assessment
can be combined, how security risk specialist can communicate with
safety risk specialist and share the metrics, share about you.
That was the first research topic that I was working on,
and then I gradually shifted more towards okay, how cyber
risk or auti security risk can be expressed to the
business continuity risk or business risk. And through the academic
position I had in Japan, and while I was doing
a PhD and doing the assistant professor and teaching, I
was lucky enough to be able to join some government
project where I was able to support asset owners, design
and evaluate the cyber table topic exercises, business contrinity exercise
drills for as quake drills also and also develop help
government to develop this large Auto Security Capability building Center
called ic CE, where I supported building up the training
curriculum and international engagement. And now I'm in Cognite and
still I'm fascinated again. I'm still fascinated by this collaboration
piece in LTI security area. Cognite is a company that
builds the lt data platform software in oil and gas,
chemical energy manufacturing and so on and so and the
Cognite operation is based on software as a service on
a cloud data platform. And when we talk about the
cloud security and there is a shared responsibility model that
do you share the security operation responsibility together with the
cloud service providers and asset owners. But the usual model
that they have is too colored, very simplified to colored
model and there is no space for the salas company
like Colonite, and especially when you consider about the most
of the organizations in most critical infra operators would select
a hybrid model where they have the public cloud, private
cloud on PREMI system all together. And a set owner
wants to have the total visibility and data governance over
all the platforms and all the systems. There's no really
guideline for that, there is no established model for that.
So Cognite what I'm doing as using my background in
research and also also in all the security. You may
try to understand and navigate the conversation with customers trying
to navigate the Cognite towards how can we support this
new era for the asset owners where they want to
have the data control and strong data ownership. So that's
where I am today.
Speaker 3: Cool. So you know the industrial cloud is coming, you know,
it's it's great that you're contributing to that at Cognite.
You know, our topic is a little different today. Our
topic today is consequence driven cyber informed engineering. And a
couple of years ago you translated the book on the
topic countering cyber Sabotage Consequence Driven Cyber Informed Engineering, the
book that Andrew Bakman and Sarah Friedman wrote. You translated
the book into Japanese. So I wanted to ask you
about that, but before I do, can I ask you
maybe introduce the book to our listeners. What is uh
you know, CCEE? What is cyber informed or consequence driven
cyber informed engineering?
Speaker 1: CCE is quite mouthful, consequence driven cyber implument engineering. It
was originally part of the cyber implement engineering. It's one
of the pillar of the cyber implument engineering, which is
the flmwork for you know, combining cyber the engineering side
and how we can enable security mobile the design security
built into the engineering engineering process and I defintional of
that especially focused on this consequence driven risk analysis part
and they develop this CC medal. It comes with the
four phases. Starting from phase one consequence prioritization, which is
quite important one for me. And Phase two is systems
and system system analysis meaning how systems or dependencies between
the systems, resources, information, data, people are contributing to the
consequence the worst, worst worst case that you want to
avoid to happen. And phase three is the consequence based targeting.
This is why you bring in there a little bit
attack as perspective and more than in security perspective. How
those dependency between the systems or the past to the
consequence can be compromised. How can how attackers can take
advantage of this dependency to make the concepts happen? And
then phase four is all about mitigation and production. Okay,
how can we how can we cut those the domino
effect for attackers to enable the consequence to happen in
the most efficient way and preferably, how can we do
that by combining the engineering method and traditional cybersecurity tools
and solutions.
Speaker 2: Andrew. These are concepts that we've talked about in a
number of episodes before. But for anybody who hasn't listened
to those, could you just do a quick review.
Speaker 3: CIE c C sure CIE is the big tent cyber
informed engineering. It's all about engineering and cybersecurity together. You know,
the engineering part has been neglected historically over pressure relief, valves,
manual operations. As a fallback, these techniques that are used
to manage physical risk can also be used to manage
cyber risk. CCEE fits within the big tent. I mean,
all of a great deal of engineering is under the
big tent, all of cybersecurity. CCEE is a bunch of
techniques and it's it's more than what's in the book.
But the book itself has really three big chunks. One
is consequence evaluation, and they recommend don't start with your
simplest attacks. They recommend start with your biggest fish and
and do something about them first. So consequence analysis and
then some a few chapters on you know, engineering mitigations,
but the bulk of the book is about system of
systems analysis to understand your defenses, to look for choke
points in your defenses where you can choke off attacks
most efficiently with minimal investment, maximum return in terms of
security for minimal investment. So that's that's the big picture.
CEEI is the big umbrella. Ce ce IS is actually
a formal training program. It's a piece of CIE. But
CI is big enough that just about anything fits under
it that that has to do with industrial security, and
see C is a chunk of that. Translating a book
is a big job. You know, the CC book is
hundreds of pages, and you know you've got to you've
got to be sure that the translation is right. You know,
it's it's a huge investment. Why why would you undertake
that big job with this book.
Speaker 1: When I first met the idea of CC, I was
a researcher at university in Japan, and my research area
was trying to understand how we can communicate and engage
with stakeholders about AUDI security in an efficient way, and
how we can do the risk assessment that both understands
security risk and also safety risk and also that their
implication to the business impact. And we struggle to find
the way how this can be achieved in one way
or a simple way, and my running hyprocess is back
then and also now. This is my belief is that
the autisecurity is a communication problem, that there are a
lot of it's a team effort. AUTI security is definitely
a team effort. You cannot just have very experience or
the expert bulb to save the world. Every time. We
need to engage the stakeholders, internal stakeholders, different teams to
understand the security and in the same way as you
do in their own job language. If it's an operator,
they need to understand what such security means for their operation.
If it's a business leader, they need to understand cybersecurity
auti security implication in terms of how it impacts their
initiatives and their investment. And it is I found it
very difficult because a security at least back then when
I was doing the research academic research, security was mostly
discussed as technical topic and there was not enough frameworks
or ways of conveying important security and security risks in
the way that the stakeholders can easily engage risk and
CC for me enable that especially the first part of
CC in a consequence prioritization, you don't talk about you
don't talk about threat actors. You don't talk about security solutions,
you talk about what matters most for your business and
business continuity. That makes it very simple but easy to
align any stakeholders organization. So that's why I thought that
this idea I really want to convey to my community
in Japan in my mother language, and I want to
be that catalyst to deliver a message.
Speaker 3: That's why can I ask you how it came about?
You know, it's one thing to read a book and say, hey,
this is good stuff. It's another thing to reach out
to the authors and actually make it happen. How did
this happen?
Speaker 1: When I first met the idea of CC, it didn't
know quite me immediately about translating the book. I think
back then there was no book yet published either. I
got to meet Andrew at Esport and he was presenting
about the idea of CC. That's when the idea of
CC very much clicked with my academic interest and I
want to talk to Andrew at the Bier Bash and said, hey,
I really like your idea. I really want to really
promote this method in the community in Japan. That's the
kind of beginning of my engagement with CC teams and
one of the big time point was Japanese government. In
collaboration with YES government, we organized the capacity Bility building
training for in the Pacific countries and ic c OE
in the SHE Cybersecurity Center of Excellence which is the
auto security training organization that the support in Japan was
the wand of providing training together with US training trainer
teams which was I n L, and we ended up
providing the c C training for in the Pacific countries
UH together with Andrew and CC team in I n
L and trainers in i C c o E. And it
was very fun engagement. It was interesting how CC was
received from the participants also, and after Andy and I
were celebrating the successful delivery of that training, it really
came to my mind immediately and said to Andrew that
can I translated this book? I really think I can
translate this in a meaningful way and can you support this?
And that's the kind of beginning, And it took another
two years or so to actually translate the book.
Speaker 3: Okay, so you ran into Andrew at s four, you know,
one of the authors of the book. As far as
sort of where the world of industrial cybersecurity you know
today comes together. You also mentioned the Industrial Cybersecurity Center
of Excellence in Japan, a government agency. How were you
connected with them? How did you connect those dots?
Speaker 1: So I was fortunate enough to be involved in from
the very artist stage of ICCLY and from the establishment
phase of ICILY at twenty seventeen. And they my university,
well the university I used to belong as the assistant
professor and now still support us as a visiting researcher.
They take one third to one force of calriculum at
SC So that is my connection to the organization. And
currently I also support the international engagement that I see.
I see c does so when they want to do
the the international engagement such as the training overseas training
or inviting the international speakers to the s c E curriculum,
I tend to support it. So the joint training we
provided between Japan and US, that's also some project that
I supported, and that's why I was involved in suggesting
that CC could be the good topic to introduce to
Japanese and also in the Pacific audience.
Speaker 3: Let's talk about the translation. I mean today you can
take you know, a word document and pumping through I
don't know Google translate or something. There's other translators on
the market as well, and you know, say here, try
translate this into Japanese. When I've done this with my
documents for uh, you know, a German market in particular,
I speak a little German. I looked at the result
and it was full of mistakes and I had to
correct it. So you know what was involved in the translation?
Did you press a button and it worked? Did you
have to review it at you know, in detail? Did
you have other people reviewing it? How did how did
the actual mechanics of the translation come about?
Speaker 1: And drew? It was all all me. It was one
one person operation and it was painfully long.
Speaker 4: And you know, especially I haven't I have done translation
of for example, eight hundred series, some documents I have
translated in Japanese, so I have done mini projects.
Speaker 1: But not the book, So it was the different level
of beast. I definitely use the help of machine translation,
sentence by sentence just to create the baseline, but most
of the time it was more confusing than helpful. So
most important thing that I needed to create was the dictionary,
the translation dictionary to be consistent throughout the book on
how we translate for example, well, as you can see
in the time of the book, the consequence this world
appears unlot in the book, and I was very intentional
and also a little bit cheeky when I translated this
in Japanese. I intentionally translated as a business consequence because
I didn't want the lead readers to mistake in consequence
as information bridge or some technical consequences or piece of
the consequences. But I want this to start, this book
to be the starter of the conversation with different aspects,
seeing the security from the different perspective, more from the
business perspective, business risk perspective. So I intentionally change the
translation from consequence in Japanese business consequence and some So
this process of creating dictionary and be happy with this dictionary,
that was a very challenging part. There are a lot
of terms in CC books that very common for probably
militarly a domain or government people, but it's not so
much resonating word when it's directly translated. So I also
needed to understand each concept concept very deeply. And Andrew Bachmann,
the author one of the OLDSO was kind and generous
enough to have multiple session for walking through those terms.
What they mean, was a backstory of these terms, one
by one, So that really helped me a lot.
Speaker 3: So, Nate, you know, I've written a couple of books,
I've translated some material, especially into German, and in my experience,
you know exactly what tomorrow we talks about. Terminology is important,
especially when you're translating a technical document. In a lot
of the world's languages, a lot of computer concepts are
showing up in those languages as English words sort of
transplanted or adopted into the language. This despite the language
often having its own words for those concepts. In German
in particular, sort of fairly words that in English have
comparatively you know, short simple words for a certain technical
concept might have a you know, in English, they'd like
to jam a few adjectives and nouns together into a single,
very long, very complicated word. And what I observe in
you know, the German community that I interact with is
they've adopted a lot of the short English words rather
than using the long formal German words. And when you're
putting together a translation, you've got to figure this out,
you know, if you use the native language words and
the community that you're addressing isn't using those words. They're
going to look at your stuff and it's going to
be a harder read. It's not the terminology they expect,
and vice versa. If you use a bunch of English,
you know, transplant a bunch of English words into the translation,
and this is not what the community is used to.
They're going to look at this and say, you know,
this doesn't it again, it impairs comprehension. And this is
you know, this is not the only challenge with translation.
What I found with German in particular. I don't know Japanese,
but I know that in German there are linguistic concepts.
Gender in particular, everything is gendered. The and when you're
when you're you know, doing a little bit of dialogue,
A said this and B said that, and you use
the word you. You've got to select the word very carefully.
There's the familiar you, there's the formal you. And in
English you don't have all this stuff. And when you
translate material from English to German, the t you know,
I used the machine translator. The machine translator just gets
it wrong. Machine chanceller this says, well, you know, I
need this concept in the German translation and it doesn't
exist in English, so I'll just make it up. And
they picked the wrong one pretty consistently, So there's a
there's a lot of repair that you know, choose the
terminology care and then you've got to go through it
and just repair what the what the machine translator does.
Speaker 2: And I'm wondering how you felt about the particular point
of translation. She highlighted in her answer how she translated
consequences to business consequences, because you know, you and I
talk about these concepts a lot, we don't really focus
on them through the business lens. Usually it's like physical consequences,
for example.
Speaker 3: And you know, I was thinking about that myself after
the interview here, and you know, reflecting on it a
little bit, I wonder if it's because it sort of
reflects Tomomi's focus on risk assessment. She was doing a
lot of risk assessment work in her research. And you
know who consumes the results of a risk assessment. It's
generally the business decision makers who have to decide, am
I going to provide funding to my engineering team, to
my IT teams to fix this problem? Explain to me
in one syllable words, how much trouble we're in and
they want to understand the impact on the business. My
own focus, I tend to work more with the engineering
teams who are tasked with, okay, you have a budget,
solve this problem, and they change the design of the
systems in order to prevent physical consequences, in order to
you know, keep things from blowing up, in order to
keep trains from colliding, and so I might you know,
if if I were doing this, I might have been
tempted to use to substitute business sorry, a physical consequence
rather than business consequence. But you know, thinking about it,
that might just be because of who I communicate with.
And you know, Timmy said at the beginning, it's all
about communication. You've got to get these concepts across these
sort of chasms of understanding. I'm curious about intellectual property.
I mean, I see the Idaho National Laboratory, you know
logo on the CCEE book. I know that you know,
Sarah Friedman and Andrew Brockman were employees I think of
Idaho National Laboratory at the time they wrote the book.
I'm assuming that i n L owns the copyright on
the book, but you did the translation. Can you talk
about intellectual property. Do you own the Japanese translation?
Speaker 1: How?
Speaker 3: How does that work?
Speaker 1: Well? At least I know, I don't own the copyright,
so it was primary work for hire. I was. It's
kind of two fold contract. So one sign is my
contract with I n L as the service provider, meaning
that I will provide this translation service for them so
that they can have the Japanese version of manuscript in
their organization. And on behalf of IL I sending the
manuscript to the publisher and I s CI in Japan.
They founded they founded to publish this book in Japanese,
so I was just bridging it in between.
Speaker 3: Okay, so you know a lot of work doing the translation.
How has it been received?
Speaker 1: I got the very kind words from people in Japan
that they enjoyed the book, and some people mentioned about
specific part of the job, that specific part of the
book that touched They resonated with them very well, which
is super rewarding to me. But the first review I
got on a public platform on Amazon was very funny
to me. It was it was it said that the
full stars, great book, great contents, minus one stuff with
a bad translation. So that really made me laugh. Yes,
it's it's I know I'm not the professional translator. I
cannot translate in the same level as how people would
translate and great novels into Japanese. I can't yet, but
at least I made them read, So that's a win
for me.
Speaker 3: Indeed, it's it's disappointing when you get stuff like that.
I remember, you know, when I published my books, you
get I get positive, I get negative. You gotta you
gotta shrug it off, you know. The I think the
lesson is that the material is now available to a
Japanese audience that doesn't speak English. So you know, have
you got any sort of reaction from you know, even
verbal or face to face from the industrial security in Japan?
How useful has CCE been in Japan?
Speaker 1: Most of the people, majority of people reach out to
me saying that the cc is very inspiring method and
inspiring approach. But I'm reading between the lines and most
of the times, CCS is a little bit too big
of the project and it's not something bite size for
most of the people to easily adapted tomorrow. So that
is one challenge that I found during and after this
translation project. The great feedback I got not necessarily negative,
but I think it really really represents what Japanese community's
character is. Is that one person told me he's a
risk assessment or the riskuss on a specialist. He's supported
many many organizations. He said that the tomommy CC needs
to be done and DOWNE needs to be easy and
easy to do for anyone. Right now, CCE is only
useful for the people who understand audio security at the
deepest level. That's not enough. It needs to be easy
for any person possible. And that's something I'm thinking about
a lot these days, thinking about aut security solutions and
a lot of ALTI security project It's naturally targeting towards
the critical asset operators, critical infrastructure companies, and middle organizations
government funded organizations. So the project fund in the size
is huge. But there's a concept that cyber property line,
cyber poverty line, where organizations, even if they know about
cybersecurity and not at the risk, they just simply can't
afford it. They just don't have the resource of available
and any solution at the hand to mitigate the risk.
And CCE is elegant concept and right now I'm thinking
how we can make CCE and any other OT security
or cybersecurity concepts framework solutions to be affordable and easy
as possible to implement fast because especially when we told
when we think about supply chain security and security as.
Speaker 3: A whole another I don't know, you know, legal NIT
Maybe in my understanding, CCE is trademarked IDH National Laboratory
certifies training providers. You can only call yourself a certified
CCE training provider if you've been certified by I n L.
I'm curious, is the Industrial Control System Center of Cybersecurity
Center Excellence is it certified?
Speaker 1: No? I S theory is not are defined to provide
CC or accidentally training at the least of my knowledge,
but I can talk a little bit about how we
introduce CC as a concept. So I scily runs one
a curriculum for industry's professionals and they basically leave the
work for one year to focus on the RT security
training from basically nine to five plus their own research
project hours, and in there we teach many principles from
traditional IT security network security aspect to ot or engineering
discipline and risk management business disciplines and the recently we
also add cloud digital transformation. Those do main two and
CC feed into the category of security leadership and one
of the trainers, Hero Shisasaki, the a colleague of mind.
He introduces CCE as part of the message that they
can use when they are building the security strategy for
their own organization where they go back to the company.
So some of the framework they also introduce is this CSF.
They also mentioned about using the sixty four Posse three
and other twenty isol twenty seven K also and as
one of the other tools that they can use to
frame their own security strategy, they introduce CC. So we
don't go in the detail in the same way that
the I NAIL folks provide CC training, but we we
explain the CC concept and the trainees engage training at SIC,
engage in CC and how they can use CC's concept
and the framework to present their security strategy to the executives.
Speaker 3: In the course of translating the book, you zom will
be developed a deep understanding of the material. You have
to understand the material in order to translate it correctly.
How's that served you? I mean personally? You know you've
developed a deep understanding of CCE translating the book. Your
name is on the book, you know, can you talk
about has has the experience of doing this translation, you know,
changed your career at all.
Speaker 1: So the book was published last year twenty twenty three
in June in Japanese, and we haven't done any book
to or anything. And I'm also based in UK. Now
I'm not based in Japan, so I don't really have
day to day way to engage with people actually get
a book in their hand, so I'm not really feeding
any burning change or anything. But internally, it was such
a prettivilege to be able to dissect the word by
word and really really print the book in my brain
by translating the work and feel Andy and Sarah's work
so close. And also the book has the part that
written by Mike Sante and I had never met him
in person, but I can't really express how I felt
about translating his part of the book because his word
the opening was that the opening section that he wrote
it was so powerful and it was such an honor
to translate that in Japanese. And when I hear the
good word and good feedback from people in Japan, I
always think about the part that Mike wrote in English,
and how I also try to match his energy to
put in the translation and yeah, so externally and carry
out project wise, I don't see a lot of changes,
but it was in town that it was a big
change for me.
Speaker 3: And if I may come back to the present day,
I mean, you're working at Cognite, You're doing some sort
of cloud stuff on the industrial side. You know, the
industrial cloud is coming for everyone sooner or later in
some capacity or another. You know, is your sort of
deep background in cybersecurity Is that part of your role
at Cognite today.
Speaker 1: I have to say, when I first learned about what
is Cognized Mission and what they are trying to achieve it,
it made me really anxious because I was very much focus.
I wasn't. I am also very much focused on security
and you know, reliability and operation, and I was more
worried about how these new technologies disrupt the reliable operation.
So that was in the beginning, but right now, as
in the project, what we are trying to achieve is
how can we make sure that the when we provide
software as a service, it doesn't disrupt the security or
reliability of the operation the physical person itself, especially the
digital transformation. Transformation it started in the enterprise area and
then it's getting close and closer to the critical operations.
And when I look into the most of the documents
on how to deploy cloud technology in a secure way,
a lot of government guidance and best practice was treating
public cloud as the starting point, and there was not
enough information about how do you manage the security and
governance of hybrid setup or the private cloud set up,
and especially how do you continue providing a service when
the stakeholder between the SaaS providers like Cognite and Cognite
and asset owner and cut service provider this how how
can you manage these three parties or more potentially more
parties involved. How do you make this tight connection while
giving the data owner asset owners therefore visibility and for
control on security Given this is largely driven by security
requirements and the my background give them a little bit
perspective to balance out the need for digital digital transformation
and need for pushing through the boundary and understanding and
accommodating the asset owner's needs and I and security teams concerned.
So that is where I am, and then I also
see quite the connection between the CC. Again, I'm seeing
CC as the tool to help the communication and understanding
what is a consequence and especially in terms of what
we do at Cognite, understanding the dependency between systems, dependency
between the data and systems and people and critical process
that's really important. And having a CC framework in the
back of my head it really helps me to have
a dialogue with customers, industry and stakeholders in talent in
and accellary.
Speaker 3: Well, Tom, Momie, thank you for joining us. It's been
a real pleasure talking to you. Before I let you go,
can I ask you to sum up for us? You
know what are the key messages we should take away here?
We've been talking about CCE, we've been talking about translating
the book, We've been talking about the importance of the cloud.
You know what should we take away from this episode
and from your experience in these arenas.
Speaker 1: Oh, it was really great fun doing this interview with you, Andrew,
Thank you for having me. My takeaway is that the
communication and collaboration that's really key to enable all the security,
especially at the same speed as digital transformation. CC is
a useful tool to enable that communication and collaboration. You
get to examine your security strategy program from different perspective.
And now ccbook is available both in English and Japanese.
So if you have Japanese colleagues, if you have somebody,
if you know somebody in Japan, reach out. They may
know about CSE and now you can talk about CC together,
which is awesome. And right now I'm in Cognite looking
forward to adapt the CC principle into industry cloud systems
and try to again enable that collaboration between the cloud
stavice providers, asset owners and sales provider combined and learning
about how we can bring the data governance back to
asset owners again. The book is available. CC book is
available in Amazon. And if you're coming to Japan, let
me know or let I c C know. Well, we
always have happy to talk with you. And if you
have experience with industrial cloud, public cloud, private cloud hybrid,
if you decide not to use cloud in the industry
space and why let me know. I'm on LinkedIn happy
to talk with you about your challenges and your experience
and them from you.
Speaker 2: So thank you, Andrew. That just about concludes your interview.
Do you have any final word to take us out
with today?
Speaker 3: Yeah, I mean I'm looking at you know, a lot
of the topics we talked about are very timely. I'm
you know, I'm a big fan of C and C.
I e uh, you know, it's all about consequences. Consequences
drive the strength of required security programs. But you know,
I'm looking at you know, I'm on the end of
my career and I started in technology and sort of
worked into cybersecurity and risk assessments. I'm you know, my
most recent book, the topic is risk. It's not in
the title, but it's it's all about how do you
use an understanding of risk to decide how much cybersecurity?
Do you know? How much engineering to do? I see
Timomi working the other way. She started with risk and
with sort of communicating with business decision makers and is
now tackling what I believe is the future of industrial automation,
and of course, industrial cybersecurity goes with industrial automation. She's
tackled in the future, which is the cloud. And the
vision for the cloud is very compelling. It's, you know,
the cloud can save in all amounts of money, it
can add flexibility, it's you know, it's a tremendous vision.
The question is how much the vision can we realize safely?
And I think the answer is almost all of it.
We just don't know how yet. So I look forward to,
you know, keeping track of what Tomomy is doing at Cognite.
I look forward to an opportunity to invite her back
in a year when she sort of figured out a
bunch of this stuff, because the world needs to understand
how to reap the benefits of the industrial cloud without
incurring unacceptable physical risk. So you know, to me, it's
it's huge that she's taking this deep understanding of risk
and risk assessments and now diving into the technology and hopefully,
you know, leading the way for us in terms of
the industrial cloud.
Speaker 2: Thank you to Tomommy Ayyama for speaking with you, Andrew.
And Andrew is always thank you for speaking with me.
Speaker 3: It's always a pleasure. Thank you.
Speaker 1: Nick.
Speaker 2: This has been the Industrial Security Podcast from Waterfall. Thanks
to everyone out there listening.