Work with Aaron: https://protectitallpod.com/work/
The book: https://protectitallpod.com/book/
This episode: https://protectitallpod.com/ep131/
The OT Security Starter Kit: https://protectitallpod.com/starter-kit/
Kevin Kumpf started out strapping steel under gantry cranes, found the crane control systems had never been updated, and has worked in OT security ever since, including leading OT security at a large US utility. He and Aaron spend this episode on the things that do not show up in a tool: safety culture, knowing what good looks like, and walking the floor.
Why an IT data center would never post a "days since last incident" sign, and why OT treats safety as the job. Two engineers at one plant who count 50 and 200 control cabinets. Ten engines on one ship, one running different. Why plants protect the most expensive asset instead of the most critical one, and the five-cent part nobody budgets for.
Then data and AI: a boiler tube failure spreadsheet that decided outage plans without ever being on a critical asset list, why AI without context is just numbers, and why a human who can check the work still matters. Aaron's zip tie that left a core switch failed for months, the only backup server sitting next to a space heater, and how to sell OT security to the business: uptime, reliability and competitive advantage, done securely.
Key takeaways
- Count it yourself. If two people at the same plant give you 50 and 200, you do not have an inventory, and a tool will not settle it.
- Know what good looks like. A baseline of temperatures, flows, RPMs and who talks to whom is what makes the odd one out visible.
- Criticality is not price. Ask what stops production, including the small part and the small site on the same network.
- Walk the floor and ask what the red light means. If nobody knows, find out or remove the light.
- AI needs context and a human who can check its answer.
- Lead with uptime and reliability. Security comes along with it.
Chapters
- 0:00 Intro
- 0:22 Welcome and introduction
- 1:58 From strapping steel to crane controls
- 3:16 Hard hats and safety culture in OT
- 6:08 Days since last incident: IT vs OT
- 6:58 A sticker for every year without an incident
- 8:29 No shortcuts to safety
- 9:54 Teaching IT people the safety mindset
- 13:11 No-judgment zone: who knows their baseline?
- 15:39 50 cabinets or 200: asset counts that disagree
- 17:17 Who controls the plant, and knowing your baseline
- 21:17 You have to know what good looks like
- 22:41 Ten engines, one running different
- 23:49 The most expensive asset is not the most critical
- 25:03 The boiler tube failure spreadsheet
- 28:04 Excel, history and data in context
- 30:57 If the AI says 42
- 33:42 Data versus information
- 36:17 The cloud and trust but verify
- 40:47 Firewalls, passive monitoring, people and process
- 42:41 Enterprise IT tools in a plant, done the OT way
- 44:58 One zip tie and a failed core switch
- 48:03 The backup server next to the space heater
- 50:48 Protecting the device from the human
- 51:15 What Kevin is building
- 53:51 Changing the oil: lessons learned the hard way
- 56:50 Where to find Kevin
- 57:38 Selling uptime, not security
About the guest
Kevin Kumpf has more than 20 years of IT and OT security and governance and compliance experience in energy, communications, the defense industrial base, transportation, manufacturing, healthcare, financial services and other sectors. As Director of OT Security (Iberdrola N.A.) he oversaw the security and regulatory compliance programs for operating companies including NYSEG, RG&E and CMP. Today he is Chief OT Strategist at Kasm Technologies.
Learn more about PrOTect IT All:
Work with Aaron: https://protectitallpod.com/work/
The book: https://protectitallpod.com/book/
This episode: https://protectitallpod.com/ep131/
The OT Security Starter Kit: https://protectitallpod.com/starter-kit/
Support the show: https://protectitallpod.com/go/support/podcast
YouTube: https://www.youtube.com/@PrOTectITAll
Email: info@protectitallpod.com
X: https://twitter.com/protectitall
Facebook: https://facebook.com/protectitallpodcast
To be a guest or suggest a guest or episode, email info@protectitallpod.com.
Please leave us a review on Apple or Spotify:
Apple: https://podcasts.apple.com/us/podcast/protect-it-all/id1727211124
Spotify: https://open.spotify.com/show/1Vvi0euj3rE8xObK0yvYi4
