Name: IT, Meet OT: Building Integrated Security and Compliance Programs Across Digital and Physical Environments
Uploaded: 2025-07-30T17:17:48.052Z
Duration: 58 min 8 s
Description: IT, Meet OT: Building Integrated Security and Compliance Programs Across Digital and Physical Environments

Transcript for "IT, Meet OT: Building Integrated Security and Compliance Programs Across Digital and Physical Environments": Alright. Hello. Welcome, everyone. I am Tariq Wiley of Apptega, and welcome to our webinar on building integrated security and compliance programs across digital and physical environments. I'm, happy to be joined today by Erik Holmes and Enrique Azuara of, Cybolt. And they're here to share their expertise, answer your questions about how organizations can secure OT alongside IT, without disrupting their operations. So, could you please introduce yourselves? Tell us a little bit about Cybolt, what you do. Absolutely. My name is Erik Holmes. As mentioned, I'm the vice president of security services at Cybolt. Cybolt is a cybersecurity service provider that offers comprehensive services to clients. So you don't have to go shopping around for multiple providers, but you can work with Cybolt for all those needs. I'll pass it over to you, Enrique. Hi. Vice president for the OT security team. My name is Enrique. And, you know, t, I've been, too many tears now, I think. Because, so I've seen seen many things that, we will be sharing with you lots of pieces. Yeah. We're gonna have a lot of fun today, so make sure you get your beverage of choice ready to go. And, Tariq, I think you'll get us kicked off. Yeah. Yeah. Thank you both. Before we dive in, I'll hand all over to you. But, first, just a couple of housekeeping notes. Really, we want this to be engaging. We want this to be as conversational as possible. We really mean it as a discussion. So if you have questions that you wanna answer throughout, please put those in the chat that's at the top, right of your screen. We will prioritize any questions from the audience throughout. So, you know, please, throw your questions into the chat, and we will, we'll definitely try to get to them. Otherwise, if any questions remain at the end, we will follow-up. But hopefully, we can get through, everything. But, that's it from me. Otherwise, I'm gonna throw it over to you, Erik and Enrique. Yeah. Yeah. Take it away. I'll step aside. Very cool. Well, today we're talking about IT meeting OT. So we're gonna set the table a bit. Enrique, before we dive too deep, what exactly is OT, and how is it different from traditional IT? Okay. So let's keep it simple. Right? So OT, operational technology, is all those systems that we use to monitor and control physical processes in the world. So what does that mean? When digital touches the physical world. So the water that goes to your house, the energy or the electrical that goes to your offices, the food that you eat at your home, all those goes through processes. Right? So the machines that does that, the airport that moves your luggage, everything uses operational technology. That's that's OT. So we've been living in and around OT devices and space for a long time, but it's never really made the the headlines in the cybersecurity space until a few years ago. Can you talk about why OT is suddenly a high priority, target? Sure. The thing is and and, again, we're old enough to know, the stories previous to COVID. Right? So in the old days, when you went into manufacturing or an oil and gas, we always said like, oh, we're never going to the cloud. We're not touching the IT. IT is for people that that does the office. We go into the plants and we get dirty. Well, even though that was not really true, that was the mindset that it was isolated and separated. Now post COVID, we everybody understood that you have people that has to connect to the networks. Right? So everything is getting connected. Now everybody listens about phishing. Everybody listens about ransomware. Those attacks are coming into OT. The difference now is that people is noticing that when you when you hit a critical infrastructure, the impact the the impact is huge. Right? It's not you're losing your email. It's you're losing control of the box or the pressure of the pipeline that get that gets you have gas. Right? So that's that's why now it's not only a target, but the awareness of everybody is is has increased. So we're talking about the impact from an OT attack. So, like, the the oil pipeline that happened about, I don't know, what, eight eight or nine years ago, the impact is much larger than it would be maybe on the IT space. So that's a that's an but it's also an easier area for threat actors to focus on. We're talking about older systems, maybe less security controls in in the space, and we're gonna dig into all of that. Before we do, I'd love to start with really great stories. So, Enrique, you've been in the trenches with tons of clients. Can you can you share a you can't make this up moment that you've seen in an OT environment? Sure. As you said, there there are many, and and and I can come up with with some. But one that happened to us, and this was an auto part manufacturer, and we were doing a walk through through the plant. And we will explain why we want to do walk throughs, but we were walking through. And then we went into this robot. So the huge robot, they they made us this part, and it was totally isolated. No cables. No nothing. Right? And and so I opened we opened the cabinet, and I asked this guy, okay. So this is robot. This is critical for you. Yes. Right. And then I look up those. So there's the the machines, the PLCs, whatever, the controllers. But then I see a this little black box on the top. And I said, like, hey. What is this black box here? And he goes blank, and he says, I don't know. And I said, but who could probably put it there? I said, like, probably a third party, but I and he had no clue who put it in for what purpose. And then right beside the black box, I see a network connector, with no cables. Right? But you have I mean, PLCs are connected to switches. So I said, what if I get a cable and then I connect this cable to that network connector? What do you think would happen? And she immediately said that, oh, you will get connectivity. So I'm like, oh, man. So you're telling me I can get connectivity from your isolated robot just by plugging in a cable, and then you have this black little box that you have no idea who put it in, why. And we were conducting an audit for for them to to comply. Right? So that was like, okay. And and, unfortunately, that's the rule. Many times, that's the rule. Wow. Yeah. Kinda surprising maybe for everybody at that point to to not be able to monitor your network enough to know that a black box was plugged in. But for a third party to come through and run an assessment or audit to find it right away is one of the things that scares me the most. So we're gonna dig some more into that in a bit. But, going back to how many environments you've been in, you've seen environments across all kinds of verticals, maybe health care, logistics, rail, mining. Is there one thing that organizations always get wrong about OT security? I think the number one myth is gonna be air gap. Oh, we're air gap. Right? That's that's the one thing. And and, again, unfortunately, until you do okay. Let me let's go back to stories. Right? This was in the jungle in Colombia, oil and gas company, and we were looking at the OT guy, doing the SCADA system where he controlled the valves and the pressures of the of the pipes. But then I asked, okay. I see your computer, and you have two interfaces configured. What is the other one? I was like, oh, that's for IT. But how do you do it? You're connected to the OT suite. Right? And he showed me. I mean, he walked, went back to the rack, and he said, like, oh, I just changed this cable. He said this in front of the CISO, in front of the director, and I just look at them as I'm like, no more question, mister George. Like like, I'm I'm okay. Right? Like, this is the type of things people do. So these air cap things, is one of the biggest myths. You know, I think it's also the same, myth that's in the IT security space. People will say, well, my network is completely segmented. My crown jewels over here cannot be touched from the person in HR. And oftentimes on red team assessments, we find that just not to be true. I think they start with good intentions. But what's the saying? The the road the the road paved to hell is is sorry. The road to hell is paved with good intentions. And so over time, people might punch holes in their security for convenient or to get something finished. But a lot of times, we forget that we did that and there's nothing telling us to go back and undo it. So yeah. I I agree. I think the air gap, myth is is just that. It's a myth, and we've gotta be careful to to check those things on a regular basis. So that was something that was shocking to me in my my first few engagements in the OT space as we do SOC operations for them. But I think there's some other things that would shock some people in the traditional IT world. So for the folks listening who live in the IT world day to day, how would you describe some of the culture shock of stepping into OT security? I I'll I'll I'll call it the back to the future. So when you go into OT, you start seeing Windows x d's, Windows seven. You start seeing flat networks. No no concepts of using firewalls. No concepts of using segmentation. So it's funny because, when I teach classes to to our teams, or to customers, I will say, like, you start teaching people about, okay, what's a firewall and why do you need it? Seems that in the eighties, you were you were saying, right, in IT. Now if I go to a customer right now and and I tell the customer in IT, you you need a firewall, it's gonna be like, okay. I they get it. Right? But you hear it like, hey. You need to start putting a firewall between ITOT. And that's a concept like, okay. Yes. I can figure that. And then, hey. But you still need a SIM. You still need this. So you go back to explaining things, and we will discuss about, asset management, etcetera. But then you will start asking, like, can you switch with a four mirror to get the traffic and then analyze? And then you you see their faces, and you you're like, okay. I have to go back and explain what a managed switch is, what an unmanaged switch is, what a poor mirror means. Because, I was in Asia, in South Korea, and and I have this story going up to a to a switch was which was unmanaged. Right? And the guy was sure he knew what I was talking about when I explained him to him for Mirror, etcetera. And then some people here in America told me, like, what? Asia is, like, a first world country. And I was like, first world country, nothing. I mean, they they have the same misconceptions. Right? So Yeah. That that's going it's back to the future. And I I think you're right. When I first step into some of these environments, even today, seeing a Windows 98 computer, a Windows seven or XP, which would be just just nonsensical in the IT space these days is not abnormal. It's very, very normal in the OT space. So when we take IT folks and we drop them into an OT environment and they see environments without segmentation, without firewalls, without monitoring, no EDR, and old computers, they start to freak out a little bit. So we've gotta help them realize that this is still normal in the space because the machines that are operating and moving things in the physical realm as you put it cannot be updated in some cases. And we're gonna dig into that a bit more. But, you know, as we walk through the space, one thing we recognize is the OT security problem is vast, and it differs from from from plant to plant inside of a company. It differs from vertical to vertical in some ways. To help us organize our thoughts and become more secure, Sands created the five critical controls to help secure these environments. Can you kinda give us a highlight of the SANs, five critical controls for ICS and OT, Enrique? Sir, first off, huge credit to to Robert Lee and and Tim Conway. They built this this aper in Sans. We are huge Sans, followers. And it truly, we did a lot of compliance, with being in this space, so they put it together. And they put the five critical controls for ICS. Right? So very quickly, the first one and and they they lead you to great conversations. So, like, the first one is incident response. Right? So you have to have a plan. When some of my customers we discuss incident response, they immediately think, oh, how many hours do I have contracted to someone for when I get in a problem. Right? And that's not about incident response. The incident response discussion is, are you prepared with I mean, I'm gonna ask you, me or whoever is gonna do the incident response. Do you have network diagram? Do you have an asset list? Do you have what's critical? Do you know when you can plug in off, plug off, a, a, stuff or or not? Like, that's that's the topic about incident response is you have to have a plan. You have to do drills. You have to be prepared. Right? It's not just contracting some hours. Then second point is defensible architecture. You have to think about, again, back to the future. You have to split major security zones. What does that mean? Split IT from OT. Put a firewall. Please put a firewall. And then start doing zone needs. Right? So we base ourselves very much into sixty two four four three. So we do zones, which is quite as a zone. It's just a group of devices that have the same requirement, the cyber the same cybersecurity requirements. Right? So treat them as such and do micro segmentation, etcetera, EDRs, SIMs. So make sure your architecture is defensible. That's the second point. Third point, continuous monitoring. You have to have the visibility and monitoring. You have to know what you're proc securing, but you also have to be, sure that you know what I I always say, it's the devices, but also it's who the devices are talking to. Are they talking in between them? Are they talking outside? What are they doing? That's a piece of monitoring. And one of the big mistakes or the big takeouts here is just because you put up monitoring tool and and when you go into OT, there there will be many vendors that do visit the telemonitoring. Just because you do that doesn't mean it's complete. Right? Technology has some language. Just because these are OT is legacy. Right? So you have to make sure monitoring and your alerting goes in line with what your critical processes are. The fourth point, secure access. Again, pre COVID, this notion of no. No. Everything is there again. Post COVID, remote access. You have your maintenance people from Germany. Right? And then you won't be waking up at 2AM, so you have to give access. So one of the things I hate when I talk about remote access in in OT is when they tell me that, oh, I have a VPN. So the VPN goes directly to OT, and and then it's encrypted. So you don't know what's happening. You the the most you can get is who connected at one time. Right? But you're bringing up a ton directly to your OT. So I I personally don't like that kind of things. And then the fifth is risk based vulnerability management. I hate it when when when you put in tools and then you have a your 4,000 vulnerabilities in this, and that's it. And there are very good, very good, now tools like Dragos, Clarity that will tell you, okay. Now, next, never in the case of Dragos Sure. Which I love. At least they give you, like, some place to start because they have analyzed this. But when you do the so so you have those risk, but then you give it to the operational people and say, like, hey. You have this. They will say, like, wait. I I just want my my factory to be to be working. So Yeah. So these five critical controls, they're great for discussion to start. Yeah. And I think that's something that was needed because when you have the OT folks who are kind of leading and managing those environments, they weren't security first. So they weren't confidentiality. If you think of the CIA triad, confidentiality and data security weren't their number one thing. Enrique, what is the number one focus for OT security? Okay. So whatever piece you're trying to do, if it's controlling, if it's incident response, if it's defensible architecture, if it's, secure, everything has to be aligned with two things. Not only one. Two things, safety and availability. Those are gonna be the two priorities, the OT guys, the automation part piece of the company is gonna be thinking about. Right? So let's go to the stories. I was in against South Korea. It was a it was a plant. And then we had a we had a malware in a in a computer. This computer was an XP computer. This computer was in charge of the robots. It immediately said, like, hey. Let's put it off, and then we will clean it. And, like, no. No. No. Of of course, the the plant manager said, like, you cannot pluck pluck, that comp computer off. That's the one that's controlling the robots. So the whole concept of, okay, how do now how do I do incident response with these two priorities, safety and availability? By the way, this plant was not going to shut down. It was 24 by seven. It wouldn't shut down until seven months later. That was the maintenance windows they will have. So you have to take this into consideration. You just don't apply IT rules to the OT world. Right? No. That's huge. So in IT security, we're always thinking, let's keep the threats out or let's pull things offline to secure them. But in OT, we're thinking, let's keep the manufacturing line up. The way our business makes money and supports our our clients is by keeping things moving. So much slower to take things offline to or remediate or to patch. And we're gonna dig into all five of those, these areas as we go. But I've gotta ask you, when the framework first came out, what was the OT horror story that made you believe these five critical controls were no longer optional but absolutely required? Okay. Horror horror stories. This is, okay, a horror story. This is a a transport company. They they use a railway. And the first piece of information that we got was, and the first misconception was every Windows computer is an IT computer. And I was like, wait. And then my question was like, okay. Does this computer can change a rail? And they said, like, yes. And then I said, like, look. This is an OT computer. So you have a digital computer touching the physical world and moving it. So we started with that misconception of, no. No. No. That's IT. And in IT, I had my three layers, to protect them. So that's the first, thing we found. Then we found a flat network. And thirty minutes into the meeting, they were showing me how they have the CCTV, for the whole rails. They have the operation center where they manage the the the the trains, etcetera. And then I look, to the left, I see an assistant, and I said, like, can I just use the computer for a moment? So I go to the computer, and I start communicating to everything. To and when I say everything was the CCTPs, the operation centers, the biometrics in the data centers, the, actually, the HVAC, the UPSs. Everything is everything. The answer to that because people tend then to to to feel attacked. Right? Like, you're putting them on the spot. Yeah. So they said like, oh, no. No. But the the problem is the director wants to connect to everything. That's why we have to have open open, ports. The thing is then we moved to the knapsack that they had internally. And I start asking, what are your policies? I said, like, no Internet. So I immediately take the computer and YouTube. So they were like, oh, wait. Wait. Wait. Wait. That was for training only. Okay. So I asked the CISO. This is the web by by my side. I said, like, okay. Actually, he he's the one that told me, you won't be able to go to an auto content web page. And they're like, okay. I know some. So I go in, and, of course, I click on it. Right? Yeah. And the agent was crazy. He's like, please please stop. This is my computer. I'm like, yeah. I'm gonna stop. But, again, these type of things. So, anyway, computers, username admin, I will click in. No password. I will be in. At the end of the day, unfortunately, the horror story ends up, after discussing the five controls and, hey. You should be looking at this kind of things. It was just couple of weeks later. Guess what? My work in the control center. So they had to go through the pain of saying, like, okay. This this was real. It it and and, actually, they said, like, you put it in to to to show your point. That was like, no. We of course, we didn't. Right? But that's that's the problem there. You already proved your point earlier. But, yeah, I think that's what we we run into in OT environments who either have excuses for why there may be holes in the security because they had to create an exception for some point in time, or there's a person at the at the organization that needs to be able to access more than one thing from the same device. But these these horror stories are the same horror stories we had in IT twenty years ago that made us realize we have to start putting something in place to protect our organizations. So it's unfortunate that OT is just now catching up, but at least we do have some guidance, a framework to follow to help it catch up in the right order for OT security. So, Enrique, a lot of times we're stepping into OT environments that have been running for decades. Would you would you recommend implementing the SANS controls in order? So would you start with instant response or work your way down? Would you start them in parallel, or would you say one is maybe more important than the others and start there? So, I think, again, the fast controls are are conversations that you have to you have to have. But, if I had to start somewhere, I would say visibility and sec remote access secure remote access. Those two will be my starting points. Now I will always touch when I go into these very, very legacy places and they tell me, like, but there's nothing connected. So, again, there's this conception that if it's not connected, it's not attackable, right, or it's not of risk. And then I go into conversations where it's, where where I'm saying, but wait. Where are your backups for these fields? Right? But because you have the machine, and you depend on that machine working. Right? Yeah. So where are your backups? And then the answer was and this happened to me in Latin America. The answer was like, oh, my provider has it. I just have to call them, and he will be here in thirty minutes. And I'm like, okay. What was when was the last time he took it? And then blank blank face it. They want me. Right? So, yeah, visibility, secure remote access, but you have to start ask ask asking questions. And and, actually, I'll I'll take a question here from him that he's asking. How do we actually deploy architecture and securing PLC traffic, right, versus machine data, with brokers and data lakes. Yeah. So it will really depend on the on the how legacy and how how smart your infrastructure you have. So I've been in places, for instance, ports, where you have to, do the architecture for the cranes. Right? So forget about the email the the email. Forget about databases. Forget about having the. These these switches have nothing. They just connect, and that's it. Yeah. Probably a little bit more, and they will be called hubs. Right? And for the people that is my age, that's gonna know what a hub is. So we we tend to do some and, again, we're very much into some. So we use the ICS four ten example also or sixty two four four three. So, instead of thinking, I have to deploy VLANs or or PLC traffic, what I tend to do is go back and let's think of major security zones, minor security zones, segmentation, stoning, micro segmentation, crypto segmentation. Everything will build down into what are my critical assets and what do I need. Right? So if I need to secure the POC traffic because it's, do I need to encrypt it? Can I encrypt it? Right? We don't know that that we can do that. Right? I have we did a gas pipeline. The the thing there was using satellite connections. Correct? Yeah. So okay. So if I saw satellite connection, 64 k, do I can I handle encryption? I I wasn't able to. Right? So everything really depends on what you have, but there are there are things that that you can start looking at. Hey, Erik. John just asked a a very similar question to Tim's. And this is what deploy is there a deployment model you're using for hybrid environments, especially when integrating the legacy PLCs with modern day cloud based analytics platform. So you've been in a lot of verticals in a lot of different environments. Most of them were architected a long time ago without a lot of security thoughts, thinking they're gonna keep IT and OT separate. Now that they are hybrid and there's some on premise touching the cloud, is there a deployment model that you think folks could use as a guide to start, cleaning up their environment or redesigning a poorly architected space? So first, I I love using cloud based analytics, platforms. Even our SOC, we we we send traffic there. Now the way to do it is, again, let's go back to the to the major security zones, minor security zones. Everyone that goes into OT will tell you, well, you have to have separate IT from OT. Right? But then I've seen people that says, like, oh, but I have my let's call it. I just have my SIM in the cloud. I want to send everything there. Right? Or I have my my platform in the cloud, and I need to send every traffic there. Then you start I mean, I've seen people start breaking the rules and then opening ports. Right? And then just start this this filtering of everything, and then everything is out. So I don't like that. I I like to have some even though it's a little bit more expensive, but it's gonna be secure. So Mhmm. You have to have your IT tools that are your IT tools. And whatever you need to bring into the cloud, you have to do it first. You have to build an OTDMZ. Right? So we have done deployment of a lot of, deployments, especially in food and beverage and in and in other critical infrastructures where OT DMZ and then you put your proxies there. Right? So whatever you want to send, please send it first to this DMZ in this proxy. Now depending on your criticality, I was in a nuclear plant in South Korea. So depending on your criticality, you can have, diodes. Right? One you need directional gateways. So there are tools that can make you okay. How do I go from the my OTPMC out in a safe way? So depending on your risk tolerance, you can do it through only filtering on the OTPMC, or you can use tools like unidirectional gateways to go and do it in a safer way with your if you're risk averse. So that's the way. But please don't start sending all the traffic just directly. That that's a no no to me. Well, let me ask you this. Are theories like the Purdue model and ITOT convergence? Is is this is this something that works in practice? Could you follow that kind of level zero to level four model, where you start with your your lower level sensors and you work your way up to the network space? Is the Purdue model submitted viable in your opinion? I we still use it. We still use it. That's that's let's let's think of this way. It frames your mindset into how things should be who should we talking to, how things should be grouped. Right? How should things be solved? Now when you're back to reality, you will say, like, okay. I have a flat network. I was saying the horror story. I have a flat network. What does having a flat network means? They only had a core switch. So if I go back and tell them, hey. You know what, Purdue? I need you to split the network and then buy another core switch and and have your access switches here and split everything. They're gonna say, like, come on, dude. I have to save money. The the the productivity plan has to go up, the cost has to go down. Right? So we have to think of the ways of, okay, Purdue model is a great reference into what things should talk to. Right? What are my policies? What type of filters I have to put in place? And then you go down and say, like, okay. How can I actually implement this? Sometimes we have the flat network, and we have to overlay something like a security network, call it this way, via crypto segmentation, via identity segmentation, via something that you can overlay security in order to to accomplish, what what you want. Right? Yeah. And that and that's fair. Sometimes we can't go undo and redesign the entire environment, especially a large environment that's spread out across the globe in a in a in an easy way. So we we end up layering some security on top of things, and logically separating them versus physically separating them. But I would say every environment's a bit unique. So so, John and Tim, give us a thumbs up in the chat if that even got close to answering your question. If not, we'll take another flag at it. But, Erik, I think one of the things we're asked to do when we step into an environment with that's been running for a while or or an o an OT director that's new to the position is to come and review the space. And we start with a dirty word. The word is assessment. And in cybersecurity, the word assessment gets thrown around a lot. I think it's typically used as a sales tool. Hey. Why don't we do a vulnerability assessment for you, and we'll do it for free? But when we talk about real world assessments, that are actually valuable, what do you think an OT security assessment should actually include? Let me tell you first what I hate about, assessments. Right? And I and I've I've done a a lot of them in in different verticals. The the ones that I start hating is Mhmm. When they are based in a questionnaire only. So they are starting asking you questions. Oh, do you have a firewall? And you answered yes. You never go in-depth into what firewall rules do you have or what was the last time you audit those rules. Right? So they just answered you yes. Oh, do you have an EDR? Yes or no? So those are the first I hate. Right? And and I I've seen those too many times. Usually, when using insurance, right, for cyber incidents, they usually will give you a a a just a questionnaire. And and Sure. So so the insurance company will be based on on whatever you feel. Right? The second ones I don't like is when people go in and and just plug in your Nozomi's, your Cloud T's, your Regus, and then come out and say, like, hey. Here's your ripoffs. Right? And they give you your 10,000 assets with your 4,000 vulnerabilities and some alerts, and and that's it. So Yeah. My problem with that is you get a you get a PDF. You wear a you get a a spreadsheet. Right? Mhmm. And then four months have come through the through the assessment. And then you go to upper levels because you want the budget, blah blah blah. By the by month nine, you're still unsecure with a paper that says, oh, you are unsecure. So that's not scalable or replicable because, again, whoever did that spreadsheet or PDF, what if he left the company? What if you contracted something somewhere and you want to to just go back again to the to the to the assessment, let's say, four months later Yeah. And say, like, okay. I need to make sure we we did something. That's why we use and we like tools like Apptega. Right? I want I want to be able to replicate the assessment, right, to make sure it doesn't matter who is doing the assessment. I I it's gonna get the same information, the same results, and then, okay, I want to feed it back continuously to see how it become my building. Right? Or what what what do you see on your side? You you don't know a lot of this because I know Yeah. We do assessments even for onboarding people on the side. Yeah. So my my previous auditor hat comes back on in some of this, and my my want for people to just get better comes back and and shines through. But I think a real assessment needs to to to do really five things to really see where we're at. It can't just be a tool led assessment or a questionnaire led assessment. We've gotta get definitely gotta get away from spreadsheets, which you hit on and we'll talk about a bit more, soon. But if we really want an OT assessment, I think we've gotta kinda start to mirror the five critical controls. But we talk about incident response is number one. I think we have to we have to start with an incident response tabletop drill, not self led, but third party led from somebody who's actually in the incident response space, like a Cybolt or a GuidePoint or somebody of that nature. But let's actually make sure the incident response plan is well planned and it's actually practiced. That way we know if it's gonna work or not in the environment. Having something on paper is a start, but we've got to practice it to make sure it's gonna work. So that's one aspect of it, I think, a well rounded assessment. The next that people think about sometimes in IT, but don't do often in OT because of the risk of downtime, is an offensive simulation. Now I'm not talking about a vulnerability scan. I'm talking about acting as a threat actor and saying, hey, I'm going to try to break into this OT space and I'm gonna let you know where I get along the way. Now we'll put some guidelines in place, we don't bring things down, but we really need to attack the space before a threat actor tells us where where we get. The third area is SOC monitoring. So I think a lot of folks have an IT SOC these days, and they may have a tool for OT SOC, but making sure that we can see when those paths start to cross from one environment into the other. And then OT and the OT SOC, I think the east to west traffic is as as important, if not, maybe even more important than the north to south fire firewall traffic, but a lot of, environments miss the combination of both. So I think we got IR tabletop drills, offensive simulations or red teaming, pen testing, whatever you wanna call it, SOC monitoring. The fourth you hit on earlier is a tech stack review. Not do you have firewalls, which is quantitative, but qualitatively, how are they working? How are they set up? Are they wired pretty tight for what we see? Are they actually limiting traffic? Have we tested it? So a tech stack review is important, inside of that assessment process. And then finally, the least sexy, the least fun, the most dry is a governance review. Are we following the rules that we put in place for our own organization? Of course, government regulations or regulatory bodies, for our space, but actually going through and say, hey. This is how we said we would manage our space. Are we following those rules? Are we doing our maintenance windows, patching? Are we following SLAs? And then, John, you asked the question right on time. How often are these translating into something actionable that was gonna reduce our risk? And so one of the things I hate about assessments is that they're snapshot in time. They're long, dry technical documents that don't focus around what makes the business move forward. And so that's why they become shelfware. They just get something. Okay. Great. Yeah. I've got some priorities here. They put on the shelf. What we've gotta do is start focusing on a few things at a time and continuously assessing our environment. If I were to hand you a document with 7,000 findings, you can't digest it. But if I could say, hey. Based on the way that your business actually runs, these are the top three priorities to maximize uptime and to prioritize security for the things that make your business move forward. That's when we start to get some action. So 7,000 items, not actionable. Three to five with with well thought through, remediation plans where somebody sits side by side with you and make sure it goes well. I think that's when we start to take the action because it's digestible. So, John, hopefully, I answered your question, but that's what we do at Cybolt really well is we can't just toss you a document. We've gotta stick around and help you start to implement implement those three to five, and that's a shameless plug because I want you guys to get better. One thing that Enrique touched on earlier is that when we get ready to an assessment, people get a bit defensive, and they hold their cards kinda close to their chest. Right, Enrique? Right. If you guys have experienced that, throw a thumbs up in the chat. But people are like, well, you know, I don't want them to uncover what I did or didn't do because I'm gonna get in trouble. And what we say when we start these is is shame off you. We're not worried about what you did or what you didn't do in the past. We're only architecting a plan to go forward, and it's gotta be actionable. It's gotta be three to five things that we can actually do in the next three, six, twelve months, or as you said earlier, let's do it now, let's do it next, or let's do it never. Let's not let's not focus on those. But if you have an assessment with no action items that can actually be realized, we're wasting our time and our and organization's money. So I think those are the things we've gotta do. And then as you said earlier, we need to be able to watch our progress. If I start an assessment, I get some action items and I don't follow-up, I lose out on the opportunity that was in front of me to move my organization forward. So So I've gotta make sure that I'm assessing now, but I'm assessing continuously. So when we take some action, we go back and say, hey. Did that stop the red team or pen testing folks? Did my SOC see that and take a response action to it? And did I follow my governance requirements? If we can measure those things over time, we know we're getting better, we're running stagnant, stagnant, or we're getting worse, and all three of those are important to to measure. And then the other thing that I love with the way that we use Optiva. And if you're if you're somebody who's in leadership or management, you're gonna love this too. But we can actually map your budgetary spend to the ROI from a control to make sure it's applicable, and that's where you should be spending money at. If you've got a really expensive thing that can that handles one piece of of your environment, you're probably missing out on some others. But we need to get objective on our assessments so it's not emotionally I feel like we're doing a great job. I feel like we're ready to go, but it's objectively I know where we suck at because let's face it, there's gonna be some areas we suck at. And I know where we're excelling, so I can start to retune my focus and take an actionable step. Alright. So let's go through those, Enrique. Let's go through those five areas. The a lot of them start with with something more practical, though. I wanna talk about here's an old cliche. Right? You can't protect what you don't see. And everybody's like, yeah. Of course. This is where we start. But let's start with asset management. You touched on it earlier. What are the challenges of asset management in an OT space? Go ahead. So and first of all, we use asset management, tools. And, and and I wanna move I wanna move a little bit, out of that because if I go to any of these tools when you go to OT, they will say like, oh, sure. I'm gonna give you your asset list. Right? So the only thing you have to give me is a poor mirror and give me a stand port, and and I will, through the traffic, build the assets, and then we will start doing asset management. Right? That's what we call asset mode. Now what's what's the the thing with that? Yes. Sometimes it doesn't work, and it doesn't work because there's no infrastructure. You go down there and the switches are again, they're old. They have no when we when I was up in the crane, I was, I was, easy because of the kite. Right? But beyond that, the the switches were not managed switches. They were basically, dumb switches. Right? So what for mirror? What are you talking about? Right? Or inside plans like these products? So taking that into consideration and, and, again, many stories around that is, oh, I need my asset list. Sometimes you have you have to go back to the old good paper and pencil. Really, go back to your pet paper and pencil. And and and and people tell me, like, but what do you do then with that? Okay. So let me give you a story. Again, a customer in Europe had to go through, an, a compliance. It's called TSACS. It's for the automobile, vertical, and they had to show segmentation. Now they had these robots isolated, pen and pencil because there's no other way to get the assets. So what do we do with that information? I put that information into now my asset management tools, my visibility tools, and I build alerting around that. So what I say is I know these assets live there because I've seen them. I taught them. I've put that in my paper and pencil. But then I'm gonna create an alert that says, anything that connects to those assets, alert me. Because, basically, like the story of the robot, if and the black box, if someone connected it, I will know. There will be some type of traffic. That's actually, we we went through the audit, and that was a great way to show, like, okay. So segmentation, it was not only about, oh, yeah. It's segmented because it's isolated. It was like, I'm already prepared if someone goes behind my back. We call it shadow IT and shadow something. Someone connects something, and I will know. Right? So asset management is not only a tool and then, get whatever you want. There are other techniques also, like, you can use agents to get from isolated, networks and that, traffic some some some vendors happen. We also use, active mode. I I know in the OT space, you don't talk about active, but sometimes it's it's what you have. And the and the Yeah. And the speed you get from actually doing it and the value you get is way better if you're doing it in a secure way. Right? So don't don't don't get your people your trainees going, oh, let's do an end map. No. No. No. Please don't do an end map there because you're gonna kill something. But there are ways to do that. Right? Yeah. So, I mean, some of the challenges there in asset management, you you said it. They're not connected to the network. You're not going to discover those devices passively or actively because they truly are isolated, but you still need to know where they are, what they're doing, and what's running on them. So that's huge. And it feeds into the next portion of that, near and dear to all of our IT hearts is vulnerability management. In the IT space, we used to start these long documents that would classify the vulnerability by what? Criticality, the CVSS score, something of that nature. But in the OT space, we're more worried about uptime. Would you would you prefer to start with a business criticality or a business impact analysis first? I I always do. I always do. That's why for us, assessments is is is not like a different job. Like, oh, I'm gonna do assessments or I'm gonna be protected. It's this part of the job. Right? Because, again, tool will tell you you have so many vulnerabilities. Even very good tools, which I love, like like, they will tell you now, next, never. They have this concept around vulnerabilities. Right? So I love it. Clarity will will bring them into priorities. I get again, I love it. But the thing is, at the end of the day, you you grab these vulnerabilities, and then you go back to the to the client manager and say, like, hey. Please do this. Right? Or you're suck. We'll tell them, like, hey. Fix this. That's when they start saying, like, do I have to? Why? Will I bring something? So you have to move all not only from automatic management based on sorting criticality. You have to think of business, and then you have to think of remediation. Okay? What is the actual process to remediate? Because many times, these type of tools or these IT or OT sucks that are actually IT sucks, they stop there. They stop into telling you, oh, you have this. Go fix it. Sure. But then you leave the customers alone. Like, okay. It's it's your vault. It's your dog. You you clean it. Right? So remediation around there, understanding, well, is the vulnerability real critical? Is it something that I have to do now? Yeah. Do I do? What what's my maintenance window to to to do that? Right? Well, and I think that's also where we come back to to we can't stop at one point. Continuous assessment means that we would take some remediation action, and we would come back and go through the process again. I'm seeing a lot of questions today, though, in the chat around architectural issues and redesign. So Enrique, my question is, if you had to start redesigning an OT IT hybrid network, Where do you even start the thought process at, and what is our experience at Cybolt with doing that? Okay. First and then I think this is one of the mistakes people do. When you start, bring both teams together, IT and OT. You have to have the people there because, different priorities, but same goal. The company has to do it has to move on. Right? So so that's the first thing. Many times, IT and the security guys from the IT thing, they have it resolved because they put a a DNS something or they have the umbrella or or and and it's not. Right? There there's these blank spaces. Again, blind spots, biometrics, HVAC, etcetera. Right? So bring both teams together. Understand I I I also tell this many times. Understand that when you want to secure, when you want to secure OT, many of the vendors when you're talking to an actual vendor, they will say like, oh, you have to be the closest to the PLC you can for the asset information, etcetera. Right? For me, that is that is like I always put this example. If I want to to to secure, let's say, my house. Right? Where do you put the fence of the garden? Let's say my critical aspect is in my meeting room. Do you put the fence in the meeting room? That's that's what they're saying. Put the defenses closer to the PLCs. But when phishing ransomware comes from outside, so it's holistic. When you think of protect no. You just have to think protecting it from the starting point, and the starting point, it's outside. Right? That's the way we look at architectures. And, yes, John, we we we use the. We we use Nest, Purdue, 62443. We do use lots of them. We have done, for instance, TSA compliance, consultations for for companies in The US where we use all these frameworks. And I will say every road needs to roam. So if I see these frameworks, if I see zoneings, if I see this Yeah. And then I go back to my five critical controls, everything starts to to start matching. Right? So so we do see them and we choose them. Yeah. And, like I was saying, they're almost always a backdrop for the way we're going to move forward. So we're not gonna follow the theory one by one perfectly in most cases because the environment's been around for longer than than in some case that I've been born, been born. So, but we are gonna modify them to the organization's needs. So we want a good framework as a backdrop. But oftentimes, we have to modify along the way just like you would in this 08/1971 or '53 for the IT side. It some of them aren't even prescriptive necessarily. They're guardrails. So we wanna take those guardrails and start adapting the environment to what the company actually needs and almost and can afford. That's also a limitation we brought into quite often is we we want everything, but we can afford some things, and so we've gotta get that right. Aren't necessarily on the same page. How do you get that alignment between the IT and OT teams? Hey, Erik. Why don't you, sorry to interrupt. Erik, I think you broke up just a little bit. Do you wanna repeat that question? Just to repeat again. Thanks, Erik. Yeah. I think that the the heart of the question is we have CSOs that come up to the IT IT security space, and we've got OT directors that are making sure the vertical's working. How do you get alignment between these two these two personalities when they're not quite there yet? So this is what we've seen. So, again, I'm old enough to know when when when CISOs were IT CISO. Right? And the only thing they care was IT IT IT. And and OT was something that just happened. Right? Now what we've seen lately, what I've seen lately, and there are very good, comments that, it's for CISOs, is that CISOs are actually in charge of IT and OT. So now it's on their lap. Now that is not optional. They have to do it. Right? So I think one of the the huge things that's happening or should happen is CISOs has have to get the the the the vocabulary from from from OT. They need to know the priorities. So we were saying uptime, safety. Right? So if you want to talk risk reduction to the OT director, make sure you know that his goal is uptime and safety. Right? Sure. He doesn't care if your his email goes down. He cares if the plan goes down. So it's your job as a CISO now that OT and IT, it's your is part of your compensation. Right? That's why they pay you. You have to have the vocabulary. And then when you have those shared goals, like, okay. We have that shared goal, and and you understand I mean, you're empathic with the vocabulary and the and the priorities. It's it's a very good road to to walk. Like, every engagement we do, we we even though they fight, they don't like, they want to be indifferent, we try to move away from that and and move into, like, this is for the benefit, and we understand both both works. Right? Yeah. That's perfect. And then I'd say the thing that we're seeing in practice work the best is we use a platform called Apptega who's hosting us today. So thank you, Apptega, for that. But we use the platform to crosswalk these frameworks. So now IT and OT can start to speak that same language. And what happens is we end up getting objective metrics that everybody can see at the same time, and we can also watch each other's progress. So I think you're right. If we're gonna communicate, we have to be speaking the same language. So getting into the governance risk and compliance space together helps us set the table for that. So the Apptega platform lets us crosswalk IT frameworks with OT frameworks to cross correlate controls. It also starts to let us each other as a group see maybe where we're weaker at, where we're stronger at, what our evidence of that might be, where our policies are, and then how we're gonna manage risk together. So when we create a new risk in the platform, everyone can see it. We can see that we've got an enterprise risk matrix together, maybe a third party risk matrix together, but it's all objective. So now we're not having emotionally charged conversations where we're against each other or coming into alignment because we can all see clearly what's going on in the environment. So now we're making we're using ground truth to make data driven objective decisions together. So I've got we've only got a few minutes left together, but I've gotta ask you, Enrique, because everybody's thinking it. Where do you see AI being used, most useful today and most dangerous in the OT space today? Okay. This this is yes. Every every I I don't think I I pass a date with a customer that doesn't ask me about AI. So right now, tools that we use actually use AI for for anomaly behavior, especially. Right? They use it, and it's good. Where Sucks must be using it because under gene and correlation, that that's that's a way to use it. Now, there's a very good, paper also, from Garner. It's it's called, predicts for 2025. And they say that by 2028, for instance, at least one country from the three twenty, group of countries will be prohibiting AI agents, from controlling control, if critical infrastructure. They say by 2029, at least three countries from the g 20, there'll be mandatory security that prohibiting using that. Now when I read this type of papers, and and and they all talk about using AI to control. Right? So it's the topic of identity. Right? I'm using identity to do that. So every time we read this, I feel, again, back to the future when precopy, they were saying, oh, no. We're never gonna use cloud. So Yeah. So, they I mean, there was a question. Right? Like, how do I actually do it safe? Because pre COVID, it wasn't me because they were doing it. It was not explicit. I mean, nobody shared it like that. But now it's a given. Right? Now it's a given. Now how do I do it in a secure way? So when they tell me this is not gonna happen, I'm like, I'm not so sure about it, but make sure you follow-up. And we're doing that in Cybolt. Follow-up, AI in identity. Right? Quick example before, we go is you have John. You fire John. So when you fire John on the IT side, you you clean his back. You limit his access to his email, whatever systems. But John on the LT side, not the Sully, his name is John. On the PLC, it might be admin one two three. Right? Mhmm. So the concept is, how can I use AI to know how many devices John has access to because it's not about the username? Now it's about John and machines. That's the concept that I will leave in the table for for for that. Right? No. That's big. I think there there's this topic and many others that that folks have, they're they're interested in it. We only got to touch the high level today. So what I would like to do, Enrique, because you're one of the leaders in the OT security space is, can you can we drop some of your contact information into the chat? And John here is asking how we get we get started together. So I think this is a great segue into your LinkedIn profile so we can follow you, and Instagram handle if you've got one. And then also, I think what we're providing today for everybody who's joined this webinar as a as a gift for attending is a one hour workshop with myself and Enrique to have these conversations. So, Tarek or Alisa, if you can drop that booking link in the chat, this is our free gift for you guys for attending today to go deeper into some of the conversational points we started at. But, Enrique, we wanna follow you along the way, as you dive deeper into these topics on other webinars, podcasts, or on LinkedIn. So we've got your handle there. So everybody who's attended today, if you have any any questions, feel free to drop them in chat still. We're gonna stick around for the last five minutes, but we wanna say thank you to Apptega for hosting as well, and thank you for all those who attended today. We look forward to hosting a web a workshop with you in the near future. Enrique, anything else? No. I just want to thank everybody as as as Erik puts it, and John was asking. Right? How how to get started? I will just, suggest the following. Go to Timson Robert Lee's paper. Read the suns. That's a very good paper. And once you read it, please, don't hesitate. Get that one hour consultation with us. We can go through it. We can do conversations. We can see where you are in your road map, into securing OT. Maybe you're very advanced. Maybe you're not. Maybe you're very advanced in IT, and OT is it has been the the the the old song that you don't pay much attention to, but, we will be more more more than, interested in in helping you. This is a very small community. The OT community is a small community. We're we are very much into this mindset of you're not securing the email of the people. We are securing the lifestyle of the people. Right? Even though it sounds romantic sometimes, it is true. It is it's the water that gets again to your house. It's the energy, the electricity, the food. So we we really took the take this into our hearts, and it's, it's this community. We really feel we are we are keeping the lifestyle as we know it. Right? Yep. Thanks, Enrique. Alright. Yeah. Thank you both. Really appreciate your time. I found this, very insightful and educational. I hope the audience did as well. Appreciate your time. To our audience, thank you for joining us as well. We will be sending out a recording after the webinar, so, everybody should get, this on demand. If you wanna watch it again or share it with your teams, you will have that. Please reach out if you have any questions. But, thank you everybody for, for your time. And, again, if you wanna book time, with Erik and Enrique, sharing that link, once again in the chat. So thank you everybody for your time. This was great. Thanks, everyone. Thank you.