Unlocking the Secrets of Manufacturing Cybersecurity, with Tanium's Ashley McGlone: täielik transkriptsioon

Tiano: 00:01:18 There's so much technology Luigi Tiano: 00:01:19 that's being integrated Luigi Tiano: 00:01:20 on a day-to-day basis. Luigi Tiano: 00:01:21 I know you're very tactical Luigi Tiano: 00:01:22 in your day-to-day. Luigi Tiano: 00:01:23 Can you define some Luigi Tiano: 00:01:24 of the terms we hear? Luigi Tiano: 00:01:25 Some of the people listening Luigi Tiano: 00:01:26 to the podcast may or may Luigi Tiano: 00:01:27 not know what the terms are. Luigi Tiano: 00:01:29 We talk about IT, we talk about Luigi Tiano: 00:01:31 I o T, we talk about OT, I I Luigi Tiano: 00:01:33 o T, maybe give us an overview Luigi Tiano: 00:01:36 of what all that's about. Ashley McGlone: 00:01:37 There's a lot Ashley McGlone: 00:01:38 of i's and o's and t's in there. Ashley McGlone: 00:01:40 Let's sort 'em out. Ashley McGlone: 00:01:40 So IT, that's what a Ashley McGlone: 00:01:42 lot of us do every day. Ashley McGlone: 00:01:44 That's our typical Ashley McGlone: 00:01:45 corporate infrastructure. Ashley McGlone: 00:01:47 Sometimes they like to separate it Ashley McGlone: 00:01:49 between the carpet and the paint Ashley McGlone: 00:01:50 or the carpet and the concrete. Ashley McGlone: 00:01:51 So the carpet is the Ashley McGlone: 00:01:52 office, that's IT. Ashley McGlone: 00:01:53 The concrete is the OT. Ashley McGlone: 00:01:55 That's your industrial environment. Ashley McGlone: 00:01:57 Operating technology is Ashley McGlone: 00:01:59 what that stands for. Ashley McGlone: 00:02:00 It could be the dials that Ashley McGlone: 00:02:01 turn the chlorine balance Ashley McGlone: 00:02:03 in a water treatment plant. Ashley McGlone: 00:02:05 Those types of industrial Ashley McGlone: 00:02:06 equipment type environments, Ashley McGlone: 00:02:08 that's the operating technology Ashley McGlone: 00:02:10 that makes the physical. Ashley McGlone: 00:02:12 It's a cyber physical interface Ashley McGlone: 00:02:14 between this technology is gonna Ashley McGlone: 00:02:16 control a physical process. Ashley McGlone: 00:02:17 That's the operating technology. Ashley McGlone: 00:02:19 Then IOT is internet Ashley McGlone: 00:02:22 of things, obviously. Ashley McGlone: 00:02:23 That can be anything Ashley McGlone: 00:02:24 from IP cameras to... Ashley McGlone: 00:02:28 At one customer, they had Ashley McGlone: 00:02:30 vulnerable Amazon Firesticks Ashley McGlone: 00:02:33 in their presentation Ashley McGlone: 00:02:35 TVs and conference rooms. Ashley McGlone: 00:02:37 So it could be any internet Ashley McGlone: 00:02:39 connected device that's not Ashley McGlone: 00:02:41 traditionally manageable like that. Ashley McGlone: 00:02:42 Then IoT and a lot of different Ashley McGlone: 00:02:46 verticals, like medical, Ashley McGlone: 00:02:47 have their own IoT flavor. Ashley McGlone: 00:02:50 So industrial IoT then instead

Ashley McGlone: 00:02:53 of IoMT like medical and every Ashley McGlone: 00:02:56 vertical's got their own iot. Ashley McGlone: 00:02:57 An industrial IoT is often Ashley McGlone: 00:03:00 looped in with Industry 4.0, Ashley McGlone: 00:03:03 which is the latest revolution Ashley McGlone: 00:03:05 of plant floor technology, Ashley McGlone: 00:03:08 of which involves things like Ashley McGlone: 00:03:09 5G for wireless connectivity, Ashley McGlone: 00:03:12 especially in more rugged or Ashley McGlone: 00:03:14 network challenged environments. Ashley McGlone: 00:03:16 You've got those same IoT type Ashley McGlone: 00:03:18 technologies, but in the plant Ashley McGlone: 00:03:20 space used for manufacturing Ashley McGlone: 00:03:24 or industrial control purposes. Ashley McGlone: 00:03:26 Often, you'll see as well a gateway Ashley McGlone: 00:03:29 device where now the legacy devices Ashley McGlone: 00:03:32 that were previously not connected Ashley McGlone: 00:03:34 to the internet have a gateway Ashley McGlone: 00:03:35 to get out to cloud services. Ashley McGlone: 00:03:38 It's really a game changer. Ashley McGlone: 00:03:39 It blows my mind. Ashley McGlone: 00:03:40 When you think about mission Ashley McGlone: 00:03:41 critical plant floor systems that Ashley McGlone: 00:03:43 are now connected to the cloud, Ashley McGlone: 00:03:45 taking on that big dependency Ashley McGlone: 00:03:47 for another point of failure. Ashley McGlone: 00:03:49 So there's a lot of concern Ashley McGlone: 00:03:51 for a lot of traditional Ashley McGlone: 00:03:52 manufacturing folks. Ashley McGlone: 00:03:53 Do we go that path or not? Ashley McGlone: 00:03:55 But that's the whole gamut from Ashley McGlone: 00:03:57 IT, OT, Io T there you go. Luigi Tiano: 00:03:59 Okay. Luigi Tiano: 00:04:00 So you really went Luigi Tiano: 00:04:00 deep dive in there. Luigi Tiano: 00:04:01 I appreciate that. Luigi Tiano: 00:04:02 You mentioned Industry 4.0. Luigi Tiano: 00:04:03 Let me just double click on that. Luigi Tiano: 00:04:04 So Industry 4.0, is that a Luigi Tiano: 00:04:06 standard or kind of a terminology Luigi Tiano: 00:04:08 that we're using to augment Luigi Tiano: 00:04:09 or increase the efficiency or Luigi Tiano: 00:04:11 automation in a plant floor? Luigi Tiano: 00:04:12 How do you describe Luigi Tiano: 00:04:13 that specifically? Ashley McGlone: 00:04:14 Personally, Ashley McGlone: 00:04:14 I'm not sure that it's a Ashley McGlone: 00:04:15 standard necessarily, but I Ashley McGlone: 00:04:17 think it's a bucket phrase Ashley McGlone: 00:04:19 that captures a lot of that. Ashley McGlone: 00:04:20 I'm sure there are people Ashley McGlone: 00:04:21 that could go into the Ashley McGlone: 00:04:22 line items and explain why Ashley McGlone: 00:04:24 it's different than 3.0. Ashley McGlone: 00:04:26 That's technology, right? Ashley McGlone: 00:04:27 You got 1, 2, 3, 4. Ashley McGlone: 00:04:29 This is the latest iteration, Ashley McGlone: 00:04:30 which includes cloud connectivity Ashley McGlone: 00:04:33 on the plant floor systems. Luigi Tiano: 00:04:34 You mentioned Luigi Tiano: 00:04:35 something really important there. Luigi Tiano: 00:04:36 The gateway into cloud management. Luigi Tiano: 00:04:38 Traditional PLCs or Luigi Tiano: 00:04:40 traditional plant floor Luigi Tiano: 00:04:43 technology would typically Luigi Tiano: 00:04:44 not have any external access. Luigi Tiano: 00:04:46 And I think that gateway now, Luigi Tiano: 00:04:47 as much as it's creating that Luigi Tiano: 00:04:49 operational efficiency or Luigi Tiano: 00:04:50 automation and that layer of Luigi Tiano: 00:04:52 management, I think that's where, Luigi Tiano: 00:04:53 correct me if I'm wrong, is Luigi Tiano: 00:04:54 that where that gateway brings Luigi Tiano: 00:04:56 in also the security concern? Ashley McGlone: 00:04:57 Yes, if Ashley McGlone: 00:04:58 you're exposing devices to Ashley McGlone: 00:05:00 the internet that are on Ashley McGlone: 00:05:01 a plant floor, obviously Ashley McGlone: 00:05:02 that's gonna be a concern. Ashley McGlone: 00:05:04 These days, everybody knows better Ashley McGlone: 00:05:06 than directly exposing devices Ashley McGlone: 00:05:08 to the internet, I would hope. Ashley McGlone: 00:05:10 But even just typical Windows Ashley McGlone: 00:05:13 and Linux boxes that are sitting Ashley McGlone: 00:05:15 there beside the line controlling Ashley McGlone: 00:05:17 a machine in the assembly process Ashley McGlone: 00:05:19 of manufacturing, for example. Ashley McGlone: 00:05:21 Those machines are still there, Ashley McGlone: 00:05:23 still running old operating Ashley McGlone: 00:05:25 systems and still vulnerable. Luigi Tiano: 00:05:27 That's a good point. Luigi Tiano: 00:05:28 You're right. Luigi Tiano: 00:05:28 We often forget that. Luigi Tiano: 00:05:29 We put the box in the corner, it's Luigi Tiano: 00:05:31 got the same password for the last Luigi Tiano: 00:05:32 12 years, hasn't been updated or Luigi Tiano: 00:05:34 patched or anything like that. Luigi Tiano: 00:05:35 And it's kinda just Luigi Tiano: 00:05:36 running the old system. Luigi Tiano: 00:05:37 Those present obviously big Luigi Tiano: 00:05:38 vulnerabilities in a plant floor. Ashley McGlone: 00:05:40 Some people Ashley McGlone: 00:05:40 call that IT / OT convergence. Ashley McGlone: 00:05:42 Some people say, oh, that Ashley McGlone: 00:05:44 happened years ago, as soon as Ashley McGlone: 00:05:45 we put a PC on the plant floor. Ashley McGlone: 00:05:47 Other people say it's Ashley McGlone: 00:05:48 still converging. Ashley McGlone: 00:05:48 You've got windows and Linux Ashley McGlone: 00:05:50 devices typically usually

on Ashley McGlone: 00:05:52 older flavors of the operating Ashley McGlone: 00:05:54 system, often not up to date, Ashley McGlone: 00:05:56 that are put on the controlling, Ashley McGlone: 00:05:59 mission critical processes, Ashley McGlone: 00:06:00 that are time sensitive and, Ashley McGlone: 00:06:03 sometimes attached to millions Ashley McGlone: 00:06:05 of dollars of pieces of equipment Ashley McGlone: 00:06:07 that are very sensitive. Ashley McGlone: 00:06:09 So it's not your IT Ashley McGlone: 00:06:10 environment at all. Ashley McGlone: 00:06:11 What we hear often is that, if Ashley McGlone: 00:06:13 you try to take IT processes Ashley McGlone: 00:06:15 and just copy paste into the Ashley McGlone: 00:06:17 OT environment, you're gonna Ashley McGlone: 00:06:18 break things right off the bat. Ashley McGlone: 00:06:20 When you think about this Ashley McGlone: 00:06:21 mindset change between IT and OT. Ashley McGlone: 00:06:24 In IT, we're concerned about Ashley McGlone: 00:06:26 confidentiality, integrity, Ashley McGlone: 00:06:28 authenticity, and the CIA triad. Ashley McGlone: 00:06:30 But on the plant floor, the Ashley McGlone: 00:06:31 number one concern is human Ashley McGlone: 00:06:32 safety and that trumps everything. Ashley McGlone: 00:06:35 So it really is a different Ashley McGlone: 00:06:37 place to operate technology. Luigi Tiano: 00:06:39 Absolutely. Luigi Tiano: 00:06:39 I think that's always been Luigi Tiano: 00:06:40 the biggest challenge. Luigi Tiano: 00:06:41 Like you mentioned, merging Luigi Tiano: 00:06:42 those two mindsets together. Luigi Tiano: 00:06:44 The technology is one thing, Luigi Tiano: 00:06:45 but the mindset is really. Luigi Tiano: 00:06:46 And you're right, safety Luigi Tiano: 00:06:47 should never be overlooked, Luigi Tiano: 00:06:48 a hundred percent. Luigi Tiano: 00:06:49 To go back to what you said, Luigi Tiano: 00:06:50 if anyone's ever been on a Luigi Tiano: 00:06:51 plant floor, you've seen that Luigi Tiano: 00:06:52 PC that's got Four inches of Luigi Tiano: 00:06:54 dust on the keyboard and four Luigi Tiano: 00:06:55 inches of dust on the monitor. Luigi Tiano: 00:06:56 And it's never been touched, Luigi Tiano: 00:06:58 never been clean, but it's Luigi Tiano: 00:06:59 just rock solid and working. Luigi Tiano: 00:07:00 So we don't touch it. Luigi Tiano: 00:07:02 Let me double click on Luigi Tiano: 00:07:02 the next question, which Luigi Tiano: 00:07:03 is all about visibility. Luigi Tiano: 00:07:05 We talk about a lot of Luigi Tiano: 00:07:06 manufacturing customers, about Luigi Tiano: 00:07:07 visibility and control of Luigi Tiano: 00:07:08 their OT environments, right? Luigi Tiano: 00:07:09 So what are you hearing as Luigi Tiano: 00:07:11 trends in that specific space? Ashley McGlone: 00:07:14 As much as Ashley McGlone: 00:07:15 we would like to think that Ashley McGlone: 00:07:16 this is the year, 2023 and Ashley McGlone: 00:07:19 everybody's all wired up, digital Ashley McGlone: 00:07:21 transformation's complete. Ashley McGlone: 00:07:23 I talk to a lot of smaller Ashley McGlone: 00:07:26 manufacturers and suppliers who are Ashley McGlone: 00:07:29 literally just now getting started. Ashley McGlone: 00:07:32 I've had even larger manufacturers Ashley McGlone: 00:07:34 tell me; if we had a ransomware Ashley McGlone: 00:07:37 event in the plant, we have Ashley McGlone: 00:07:40 a spreadsheet from five years Ashley McGlone: 00:07:41 ago with our asset inventory. Ashley McGlone: 00:07:44 And we all know that's Ashley McGlone: 00:07:45 just not going to work. Ashley McGlone: 00:07:46 Unfortunately, a lot of people Ashley McGlone: 00:07:48 are still just getting started. Ashley McGlone: 00:07:49 And I think what's happening Ashley McGlone: 00:07:51 is, let's say you work with Ashley McGlone: 00:07:53 automotive and you've got a Ashley McGlone: 00:07:55 top tier automotive company. Ashley McGlone: 00:07:58 That OEM that's supplying the Ashley McGlone: 00:08:00 federal government in the US. Ashley McGlone: 00:08:02 So now there's CMMC Cybersecurity Ashley McGlone: 00:08:05 Maturity Model Certification. Ashley McGlone: 00:08:06 It's now at 2.0 getting Ashley McGlone: 00:08:09 ready to be effective here Ashley McGlone: 00:08:10 within the next couple years. Ashley McGlone: 00:08:12 Then all of a sudden, now you Ashley McGlone: 00:08:13 find yourself maybe you're not a Ashley McGlone: 00:08:15 tier one supplier to that auto. Ashley McGlone: 00:08:17 Maybe you're a tier Ashley McGlone: 00:08:18 two, tier three. Ashley McGlone: 00:08:19 All of a sudden, depending Ashley McGlone: 00:08:20 on how close you are, what Ashley McGlone: 00:08:22 you're supplying, you could Ashley McGlone: 00:08:23 be susceptible to compliance Ashley McGlone: 00:08:26 for US federal government. Ashley McGlone: 00:08:28 Or if you're in Europe, maybe it's Ashley McGlone: 00:08:30 Tisax or NIST two or maybe it's Ashley McGlone: 00:08:33 in US, the White House executive Ashley McGlone: 00:08:35 orders around cybersecurity. Ashley McGlone: 00:08:37 All of a sudden there's Ashley McGlone: 00:08:38 this really big regulatory Ashley McGlone: 00:08:41 compliance landscape. Ashley McGlone: 00:08:42 Now, standards have been around Ashley McGlone: 00:08:44 for years, but it's this regulatory Ashley McGlone: 00:08:46 compliance that's forcing Ashley McGlone: 00:08:47 people to take a look because Ashley McGlone: 00:08:49 manufacturing is, unfortunately Ashley McGlone: 00:08:51 increasingly in the headlines Ashley McGlone: 00:08:53 with ransomware, malware and Ashley McGlone: 00:08:56 ransomware malware targeted Ashley McGlone: 00:08:58 at manufacturing specifically.

Ashley McGlone: 00:09:00 There was a headline a couple Ashley McGlone: 00:09:01 years ago where there was Ashley McGlone: 00:09:03 ransomware that was looking Ashley McGlone: 00:09:06 at over 60 windows executables Ashley McGlone: 00:09:09 running on the line side, and Ashley McGlone: 00:09:12 it would kill those processes Ashley McGlone: 00:09:14 before it ransomed the box. Ashley McGlone: 00:09:15 So it was specifically Ashley McGlone: 00:09:17 targeted manufacturing. Ashley McGlone: 00:09:18 That's got a lot of people Ashley McGlone: 00:09:19 concerned obviously. Ashley McGlone: 00:09:21 A lot of people are just getting Ashley McGlone: 00:09:23 started and they don't have the Ashley McGlone: 00:09:25 basic inventory visibility into Ashley McGlone: 00:09:29 what are my devices, whether Ashley McGlone: 00:09:31 they're Windows, Linux, or those Ashley McGlone: 00:09:32 lower tier PLC sensor type devices. Ashley McGlone: 00:09:36 Visibility really is the Ashley McGlone: 00:09:37 first place to start. Ashley McGlone: 00:09:39 And what I find is a lot Ashley McGlone: 00:09:41 of people are evaluating Ashley McGlone: 00:09:42 software solutions there. Ashley McGlone: 00:09:45 They're looking for things Ashley McGlone: 00:09:47 that can inventory those Ashley McGlone: 00:09:48 devices on the plant floor. Ashley McGlone: 00:09:50 If I started naming vendors because Ashley McGlone: 00:09:52 there are dozens of vendors in Ashley McGlone: 00:09:54 that space now who are helping Ashley McGlone: 00:09:56 to provide that visibility. Ashley McGlone: 00:09:59 At the risk of going too Ashley McGlone: 00:10:00 long on this answer, I'll Ashley McGlone: 00:10:01 also say another big concern Ashley McGlone: 00:10:03 is staffing and skillset. Luigi Tiano: 00:10:05 I was gonna say that. Luigi Tiano: 00:10:06 That's always been a Luigi Tiano: 00:10:07 challenge in manufacturing. Luigi Tiano: 00:10:07 Traditional, non IT environments. Luigi Tiano: 00:10:10 It's about operations, it's Luigi Tiano: 00:10:11 about efficiency, it's about Luigi Tiano: 00:10:12 automation and safety, of Luigi Tiano: 00:10:13 course, but technology's kind Luigi Tiano: 00:10:15 of always taken a backseat, Luigi Tiano: 00:10:16 and correct me if I'm wrong. Ashley McGlone: 00:10:18 There's people Ashley McGlone: 00:10:19 that design these processes and Ashley McGlone: 00:10:21 they've used technology for years, Ashley McGlone: 00:10:24 but security wasn't a concern Ashley McGlone: 00:10:26 because they weren't exposed to Ashley McGlone: 00:10:27 the internet, like they are now. Ashley McGlone: 00:10:30 So you've got skillsets in Ashley McGlone: 00:10:32 traditional industrial environments Ashley McGlone: 00:10:34 that are having to either learn Ashley McGlone: 00:10:36 new skills or you have IT people Ashley McGlone: 00:10:38 coming in telling them what to do. Ashley McGlone: 00:10:40 Then the production Ashley McGlone: 00:10:41 engineering folks are Ashley McGlone: 00:10:42 saying, now, wait a minute. Ashley McGlone: 00:10:42 It doesn't work that way here. Ashley McGlone: 00:10:44 You've got this hybridized Ashley McGlone: 00:10:45 skillset between a cybersecurity Ashley McGlone: 00:10:48 mindset coming into a Ashley McGlone: 00:10:49 manufacturing environment. Ashley McGlone: 00:10:50 So that really is a critical Ashley McGlone: 00:10:54 skillset to have now is having Ashley McGlone: 00:10:56 a security mind and an OT mind, Ashley McGlone: 00:10:59 so you can bring those together Ashley McGlone: 00:11:01 and doing it in a safe way. Luigi Tiano: 00:11:03 Sounds like it's Luigi Tiano: 00:11:04 not an easy skill set to find, Luigi Tiano: 00:11:06 based on what I've just heard. Ashley McGlone: 00:11:08 Yeah. Ashley McGlone: 00:11:09 The cyber field as a whole. Ashley McGlone: 00:11:12 I've heard stats, you get different Ashley McGlone: 00:11:14 numbers, like millions of openings Ashley McGlone: 00:11:15 that'll go unfilled, right? Ashley McGlone: 00:11:17 And then when you get into niche Ashley McGlone: 00:11:19 areas like this, where it's a Ashley McGlone: 00:11:21 hybrid of IT and OT coming together Ashley McGlone: 00:11:24 with cyber in the skillset, Ashley McGlone: 00:11:26 it is a niche skillset area. Ashley McGlone: 00:11:28 What a lot of companies are going Ashley McGlone: 00:11:30 to end up doing because they Ashley McGlone: 00:11:32 can't afford a senior person in Ashley McGlone: 00:11:34 that space, cuz manufacturing Ashley McGlone: 00:11:36 budgets are always tight, Ashley McGlone: 00:11:38 especially when it comes to Ashley McGlone: 00:11:39 staffing for something like this. Ashley McGlone: 00:11:41 A lot of times you're going to Ashley McGlone: 00:11:42 hire people straight out of college Ashley McGlone: 00:11:45 and there's gonna be a lot of O Ashley McGlone: 00:11:47 J T a lot of on-the-job training. Ashley McGlone: 00:11:49 There's some resources Ashley McGlone: 00:11:50 I'll talk about later that Ashley McGlone: 00:11:51 can really help with that. Luigi Tiano: 00:11:52 Yeah, Luigi Tiano: 00:11:53 that's very good. Luigi Tiano: 00:11:54 Before we move on to the next Luigi Tiano: 00:11:55 question, anything else you Luigi Tiano: 00:11:55 wanna say about visibility in Luigi Tiano: 00:11:57 OT environments or you wanna, Luigi Tiano: 00:11:58 we can circle back at the end? Ashley McGlone: 00:12:02 I think Ashley McGlone: 00:12:02 I'm good on there for now. Luigi Tiano: 00:12:03 All right. Luigi Tiano: 00:12:04 All right. Luigi Tiano: 00:12:04 So you mentioned a lot of Luigi Tiano: 00:12:06 companies are just getting started. Luigi Tiano: 00:12:07 So if you've seen this, you've Luigi Tiano: 00:12:09

obviously lived this through Luigi Tiano: 00:12:10 conversations with your clients. Luigi Tiano: 00:12:11 How does a company get started? Luigi Tiano: 00:12:12 If you're a manufacturing Luigi Tiano: 00:12:13 company, just listening to Luigi Tiano: 00:12:14 this podcast at random, how Luigi Tiano: 00:12:16 does the company get started? Luigi Tiano: 00:12:16 Where do they look, Luigi Tiano: 00:12:17 what do they do? Ashley McGlone: 00:12:18 Number one, Ashley McGlone: 00:12:19 you're not alone, especially if Ashley McGlone: 00:12:21 you're in the smaller tier space. Ashley McGlone: 00:12:23 There are a lot of bigger companies Ashley McGlone: 00:12:25 who have already walked this path. Ashley McGlone: 00:12:27 They've crafted best practices. Ashley McGlone: 00:12:29 They put that into guidance. Ashley McGlone: 00:12:30 You may have heard of the Ashley McGlone: 00:12:32 Purdue model for the structuring Ashley McGlone: 00:12:35 of systems in manufacturing Ashley McGlone: 00:12:37 or industrial environment. Ashley McGlone: 00:12:39 You take another layer to the I S Ashley McGlone: 00:12:42 A I E C, more alphabet here, 6 2 Ashley McGlone: 00:12:45 4 43 and we'll have links in the Ashley McGlone: 00:12:48 show notes for folks to this stuff. Ashley McGlone: 00:12:50 But ISA 6 2 4 43 is the Ashley McGlone: 00:12:52 international standard for Ashley McGlone: 00:12:55 cybersecurity practices in Ashley McGlone: 00:12:57 a manufacturing environment. Ashley McGlone: 00:12:59 It's gonna help you Ashley McGlone: 00:13:00 categorize and sort through. Ashley McGlone: 00:13:03 If I'm just staring at I-beams Ashley McGlone: 00:13:05 and network cables and equipment, Ashley McGlone: 00:13:08 how do I make sense of this? Ashley McGlone: 00:13:10 Where do I draw the lines virtually Ashley McGlone: 00:13:12 for, how do I organize this Ashley McGlone: 00:13:14 into an actual cyber strategy Ashley McGlone: 00:13:17 for my industrial environment? Ashley McGlone: 00:13:19 So it's gonna have a five Ashley McGlone: 00:13:21 layer stack that goes from top Ashley McGlone: 00:13:23 traditional kind of IT systems, Ashley McGlone: 00:13:25 running Windows and Linux and Ashley McGlone: 00:13:27 such, all the way down to those Ashley McGlone: 00:13:29 lower tier devices that are Ashley McGlone: 00:13:31 running some type of firmware Ashley McGlone: 00:13:33 maybe that you need to monitor Ashley McGlone: 00:13:34 or maybe it's just a dial that's Ashley McGlone: 00:13:36 controlling something all the way Ashley McGlone: 00:13:38 down the sensors and actuators. Ashley McGlone: 00:13:40 They've carved that out. Ashley McGlone: 00:13:41 They've identified, okay, Ashley McGlone: 00:13:42 here's the vocabulary you Ashley McGlone: 00:13:44 even used to talk about it. Ashley McGlone: 00:13:45 I've got a security level Ashley McGlone: 00:13:47 target that I want to get to. Ashley McGlone: 00:13:49 Here's the security level Ashley McGlone: 00:13:50 capability of what we can do today. Ashley McGlone: 00:13:52 Then that gives us this Ashley McGlone: 00:13:53 gap that we need to close Ashley McGlone: 00:13:55 and zones and conduits. Ashley McGlone: 00:13:57 Here are machines that are Ashley McGlone: 00:13:59 going to be compensating Ashley McGlone: 00:14:01 controls, we can't update them. Ashley McGlone: 00:14:03 So they're gonna get firewalled Ashley McGlone: 00:14:04 or air gaped over here. Ashley McGlone: 00:14:05 That's a zone. Ashley McGlone: 00:14:06 Then a conduit's that network Ashley McGlone: 00:14:08 connection coming in and Ashley McGlone: 00:14:09 out of there for firewall Ashley McGlone: 00:14:11 connections, so to speak. Ashley McGlone: 00:14:12 You've got network segmentation Ashley McGlone: 00:14:14 between the carpet and the cement. Ashley McGlone: 00:14:16 So between IT and OT, making Ashley McGlone: 00:14:18 sure you've got the right Ashley McGlone: 00:14:19 firewalls in place and if Mary Ashley McGlone: 00:14:21 in accounting clicks a phishing Ashley McGlone: 00:14:22 link, it doesn't take down Ashley McGlone: 00:14:24 manufacturing and vice versa. Ashley McGlone: 00:14:26 There's a lot here and Ashley McGlone: 00:14:28 there's a lot of precedent. Ashley McGlone: 00:14:29 If you're just getting started, Ashley McGlone: 00:14:31 there's a lot of resources Ashley McGlone: 00:14:33 available to help you. Ashley McGlone: 00:14:34 There's a deep bench with Ashley McGlone: 00:14:36 consulting practices and providers Ashley McGlone: 00:14:39 like yourself who have done Ashley McGlone: 00:14:40 work in this space, who can Ashley McGlone: 00:14:42 really help people first off Ashley McGlone: 00:14:44 to get oriented and that's what Ashley McGlone: 00:14:46 I've noticed a lot of the calls Ashley McGlone: 00:14:48 that I've had even recently is Ashley McGlone: 00:14:49 just helping people understand Ashley McGlone: 00:14:51 where do I take that first step? Luigi Tiano: 00:14:54 Yeah and Luigi Tiano: 00:14:54 these standards, I'll Luigi Tiano: 00:14:56 just say numbers again. Luigi Tiano: 00:14:56 So ISA i e c 6 2 4 43. Luigi Tiano: 00:14:59 I think these international Luigi Tiano: 00:15:01 standards force both the IT and Luigi Tiano: 00:15:03 the OT folks, so you said process Luigi Tiano: 00:15:04 engineer first to work together Luigi Tiano: 00:15:06 and merge those processes. Luigi Tiano: 00:15:07 As much as they are different, I Luigi Tiano: 00:15:09 think these standards are extremely Luigi Tiano: 00:15:10 important and should be adopted Luigi Tiano: 00:15:12 obviously by these organizations Luigi Tiano: 00:15:14 because if there's a skillset Luigi Tiano: 00:15:15 gap from a process wise, this Luigi Tiano:

00:15:17 forces them to work together. Luigi Tiano: 00:15:18 So we're seeing this Luigi Tiano: 00:15:19 across the board. Luigi Tiano: 00:15:20 I'm glad you brought that up Luigi Tiano: 00:15:21 because I think it's important Luigi Tiano: 00:15:22 that individuals know this. Luigi Tiano: 00:15:23 The standard, obviously Luigi Tiano: 00:15:25 you're well-versed in it. Luigi Tiano: 00:15:26 Is this something you get to Luigi Tiano: 00:15:27 stamp once and then you have Luigi Tiano: 00:15:28 yearly checks or do you know Luigi Tiano: 00:15:30 how long this standard would Luigi Tiano: 00:15:31 last within an organization? Ashley McGlone: 00:15:33 In the realm Ashley McGlone: 00:15:34 of regulations, compliance, Ashley McGlone: 00:15:36 attestations, this is just a Ashley McGlone: 00:15:39 standard that's a recommendation Ashley McGlone: 00:15:42 that you should align to. Ashley McGlone: 00:15:44 I would say that it's not enforced, Ashley McGlone: 00:15:47 but when things like we're seeing Ashley McGlone: 00:15:49 in EMEA right now with the Nist 2 Ashley McGlone: 00:15:52 is actually coming in and putting Ashley McGlone: 00:15:54 teeth to some of this to actually Ashley McGlone: 00:15:56 enforce it and putting penalties Ashley McGlone: 00:15:58 there where there weren't, before. Ashley McGlone: 00:16:01 For the last 20 years, ISA Ashley McGlone: 00:16:03 62443 has just been a standard. Ashley McGlone: 00:16:05 Hey, this is a good Ashley McGlone: 00:16:05 way to think about it. Ashley McGlone: 00:16:07 The design and framework Ashley McGlone: 00:16:08 give the industry a common Ashley McGlone: 00:16:10 vocabulary and put training Ashley McGlone: 00:16:12 and resources behind it. Ashley McGlone: 00:16:14 Yeah it's actually got a little Ashley McGlone: 00:16:16 more legs now, with the headlines Ashley McGlone: 00:16:18 over the last few years. Luigi Tiano: 00:16:19 Just to touch Luigi Tiano: 00:16:20 on that, when we talk about Luigi Tiano: 00:16:20 regulatory compliance for us as an Luigi Tiano: 00:16:22 organization, especially when we're Luigi Tiano: 00:16:23 talking with clients, when you Luigi Tiano: 00:16:25 abide by or conform to a specific Luigi Tiano: 00:16:27 standard, you earn the right to Luigi Tiano: 00:16:29 do business with more partners. Luigi Tiano: 00:16:30 If you don't have the controls Luigi Tiano: 00:16:31 in place, that's fine. Luigi Tiano: 00:16:31 But if you want to continue to Luigi Tiano: 00:16:32 conduct business with certain Luigi Tiano: 00:16:34 entities, you're gonna be required Luigi Tiano: 00:16:36 to show that you actually meet Luigi Tiano: 00:16:37 a certain level of standards. Luigi Tiano: 00:16:38 Whether it's enforced legally Luigi Tiano: 00:16:39 or not, I think more and more Luigi Tiano: 00:16:40 companies are just gonna abide by Luigi Tiano: 00:16:42 a specific standard cause they want Luigi Tiano: 00:16:43 to continue to do business or earn Luigi Tiano: 00:16:45 the right with certain enterprises Luigi Tiano: 00:16:46 that they once could not do that. Ashley McGlone: 00:16:48 You're Ashley McGlone: 00:16:48 describing supply chain risk. Luigi Tiano: 00:16:50 There you go. Ashley McGlone: 00:16:51 And that is top Ashley McGlone: 00:16:52 of mind for everybody right now. Ashley McGlone: 00:16:54 I remember when I used to work Ashley McGlone: 00:16:55 for Toyota, for example, the Ashley McGlone: 00:16:57 automotive seat supplier, the Ashley McGlone: 00:16:59 seats would come in off the semi Ashley McGlone: 00:17:02 truck in the order that cars were Ashley McGlone: 00:17:03 going down the assembly line. Ashley McGlone: 00:17:06 If that seat supplier then had Ashley McGlone: 00:17:08 a cyber breach, even if there's Ashley McGlone: 00:17:10 nothing cyber in the seat itself, Ashley McGlone: 00:17:13 if they were victim to ransomware Ashley McGlone: 00:17:15 and that supply paused, it would Ashley McGlone: 00:17:17 pause the cars going down the line. Ashley McGlone: 00:17:19 Even if you make wiring harnesses Ashley McGlone: 00:17:21 that have no embedded technology. Ashley McGlone: 00:17:24 If you can't supply those Ashley McGlone: 00:17:25 because you've been breached, Ashley McGlone: 00:17:27 you're gonna impact all Ashley McGlone: 00:17:28 your supply chain partners. Ashley McGlone: 00:17:30 So whether or not you think Ashley McGlone: 00:17:32 it applies to you, it does. Luigi Tiano: 00:17:34 Exactly. Luigi Tiano: 00:17:35 Got another question here Luigi Tiano: 00:17:37 about OT environments. Luigi Tiano: 00:17:38 We see such a diverse Luigi Tiano: 00:17:39 mix of devices. Luigi Tiano: 00:17:40 How do you manage all those types Luigi Tiano: 00:17:41 of devices with one solution? Luigi Tiano: 00:17:42 Is it even possible? Ashley McGlone: 00:17:44 It's not, no. Ashley McGlone: 00:17:46 I tell you the more people I talk Ashley McGlone: 00:17:48 to, whether it's partners, other Ashley McGlone: 00:17:50 vendors prospects and customers Ashley McGlone: 00:17:53 in this space, everybody's Ashley McGlone: 00:17:55 looking for a silver bullet. Ashley McGlone: 00:17:57 There is no one software solution Ashley McGlone: 00:17:59 that's gonna give you that Ashley McGlone: 00:18:00 ultimate visibility control Ashley McGlone: 00:18:03 from one end to the other. Ashley McGlone: 00:18:04 Today, it doesn't exist. Ashley McGlone: 00:18:06 What you will find though, Ashley McGlone: 00:18:08 is what I prefer to call Ashley McGlone: 00:18:09 strategic platform partnerships. Ashley McGlone: 00:18:12 Now, don't get me wrong. Ashley McGlone: 00:18:13 There are some companies out there Ashley McGlone: 00:18:14 that say, yeah, we do IT, and OT. Ashley McGlone:

00:18:18 But you've gotta dig a little Ashley McGlone: 00:18:19 deeper below the marketing Ashley McGlone: 00:18:21 messaging and say, okay, what Ashley McGlone: 00:18:22 exactly do you do in IT and OT? Ashley McGlone: 00:18:26 Maybe you only scan for Ashley McGlone: 00:18:27 vulnerabilities and that's it. Ashley McGlone: 00:18:29 It doesn't stop there. Ashley McGlone: 00:18:30 I need to fix those Ashley McGlone: 00:18:31 vulnerabilities, right? Ashley McGlone: 00:18:32 I need to enforce policy Ashley McGlone: 00:18:33 on those works stations. Ashley McGlone: 00:18:35 I got Windows and Linux that Ashley McGlone: 00:18:36 I need to manage firewall and Ashley McGlone: 00:18:38 disc encryption and things Ashley McGlone: 00:18:39 like that, on the plant floor. Ashley McGlone: 00:18:41 It goes beyond just a narrow Ashley McGlone: 00:18:43 feature matrix to actually a broad Ashley McGlone: 00:18:45 set of full manageability for Ashley McGlone: 00:18:47 the plant floor from IT and OT Ashley McGlone: 00:18:50 and where that convergence meets. Ashley McGlone: 00:18:51 What I'm seeing today is as I Ashley McGlone: 00:18:54 talk to people who are in this Ashley McGlone: 00:18:56 starting process, they are actively Ashley McGlone: 00:18:59 investigating vendors that do Ashley McGlone: 00:19:02 like port spanning on the network. Ashley McGlone: 00:19:04 There's dozens of vendors in this Ashley McGlone: 00:19:06 space that'll listen and find those Ashley McGlone: 00:19:08 devices passively on the network. Ashley McGlone: 00:19:11 Then there's need for some Ashley McGlone: 00:19:12 active scanning as well, cuz Ashley McGlone: 00:19:13 some of those devices will never Ashley McGlone: 00:19:14 initiate a network connection. Ashley McGlone: 00:19:17 Then you've got your traditional Ashley McGlone: 00:19:18 distributed control systems Ashley McGlone: 00:19:20 vendors like Siemens and Ashley McGlone: 00:19:21 Rockwell and Honeywell and GE. Ashley McGlone: 00:19:23 I could name those for a while. Ashley McGlone: 00:19:24 You've got all those Ashley McGlone: 00:19:25 vendors who have their own Ashley McGlone: 00:19:27 cybersecurity practices as well. Ashley McGlone: 00:19:29 What I typically recommend, Ashley McGlone: 00:19:31 you know what we do is helping Ashley McGlone: 00:19:33 people with visibility on Ashley McGlone: 00:19:34 the top tier of that model. Ashley McGlone: 00:19:37 So the Windows and Linux Ashley McGlone: 00:19:38 devices, we can give you all Ashley McGlone: 00:19:40 the capability you need there. Ashley McGlone: 00:19:42 Let's take that and use some Ashley McGlone: 00:19:43 common backend like Splunk or Ashley McGlone: 00:19:46 ServiceNow or Microsoft Sentinel. Ashley McGlone: 00:19:48 Some type of sim source Ashley McGlone: 00:19:50 solution, C M D B. Ashley McGlone: 00:19:52 Let's take all that Tanium data, Ashley McGlone: 00:19:53 put it in there, and then take Ashley McGlone: 00:19:55 your other solutions in this space Ashley McGlone: 00:19:58 that most of them are already Ashley McGlone: 00:19:59 pre-wired for ServiceNow or Ashley McGlone: 00:20:02 Splunk, something on the backend. Ashley McGlone: 00:20:04 Then, use that backend for that Ashley McGlone: 00:20:06 end-to-end visibility and control Ashley McGlone: 00:20:08 for your IT OT SOC experience. Luigi Tiano: 00:20:12 Interesting. Luigi Tiano: 00:20:13 So what I heard was, form a Luigi Tiano: 00:20:15 strategic platform of partnerships. Luigi Tiano: 00:20:18 Make sure you've got a bunch Luigi Tiano: 00:20:19 of partners that can then Luigi Tiano: 00:20:20 fill those needs cuz there's Luigi Tiano: 00:20:21 just no silver bullet. Ashley McGlone: 00:20:22 So the benefit Ashley McGlone: 00:20:23 there is, rather than having Ashley McGlone: 00:20:25 a dozen solutions with a dozen Ashley McGlone: 00:20:28 integration points in this matrix Ashley McGlone: 00:20:30 of integrations, you can really Ashley McGlone: 00:20:33 optimize that down to just a Ashley McGlone: 00:20:34 few strategic integrations, Ashley McGlone: 00:20:37 which is gonna make it easier Ashley McGlone: 00:20:38 to maintain in the long term. Luigi Tiano: 00:20:40 Got it. Luigi Tiano: 00:20:41 Very good. Luigi Tiano: 00:20:41 One last question cuz then Luigi Tiano: 00:20:42 I wanna talk a little bit Luigi Tiano: 00:20:43 about what you do and maybe Luigi Tiano: 00:20:44 how your platform could help. Luigi Tiano: 00:20:45 You've mentioned a lot of things Luigi Tiano: 00:20:46 here and obviously I wanna give Luigi Tiano: 00:20:47 you the time to talk about that. Luigi Tiano: 00:20:49 What resources are available Luigi Tiano: 00:20:50 to help companies today? Luigi Tiano: 00:20:51 We talked about how Luigi Tiano: 00:20:51 they get started. Luigi Tiano: 00:20:52 Obviously a bunch of stuff online, Luigi Tiano: 00:20:54 but what would you recommend? Ashley McGlone: 00:20:56 There's Ashley McGlone: 00:20:56 always the free and easy Ashley McGlone: 00:20:57 Wikipedia and YouTube, right? Ashley McGlone: 00:20:58 You can learn anything on Ashley McGlone: 00:21:00 Wikipedia and YouTube and there's Ashley McGlone: 00:21:01 a ton of open, stuff like that. Ashley McGlone: 00:21:03 But if you're willing to invest, Ashley McGlone: 00:21:05 even just looking at the open, Ashley McGlone: 00:21:06 free resources, I would go Ashley McGlone: 00:21:08 straight to the SANS Institute. Ashley McGlone: 00:21:10 SANS has been around for years and Ashley McGlone: 00:21:12 everybody knows them as the source Ashley McGlone: 00:21:14 of trusted security training. Ashley McGlone: 00:21:16 SANS has a whole program for Ashley McGlone: 00:21:17 industrial controls, SANS ICS. Ashley

McGlone: 00:21:21 S A N S I C S. Ashley McGlone: 00:21:23 Just put that in your search Ashley McGlone: 00:21:24 engine and we've got some links Ashley McGlone: 00:21:26 in the show notes here as well. Luigi Tiano: 00:21:27 We're definitely gonna Luigi Tiano: 00:21:28 share a lot of that information. Luigi Tiano: 00:21:29 You sent me some stuff for Luigi Tiano: 00:21:30 the show here, which is great. Ashley McGlone: 00:21:31 Yeah, Ashley McGlone: 00:21:32 they've got an I C S guide. Ashley McGlone: 00:21:34 Industrial controls guide for Ashley McGlone: 00:21:35 recommended controls to start. Ashley McGlone: 00:21:37 Things about having an Ashley McGlone: 00:21:38 incident response plan. Ashley McGlone: 00:21:40 Sure we have one of those for Ashley McGlone: 00:21:41 IT, but do you have it for Ashley McGlone: 00:21:42 your industrial environment? Ashley McGlone: 00:21:44 Just knowing who to call, Ashley McGlone: 00:21:46 where do I get my inventory? Ashley McGlone: 00:21:48 Where are all the firewalls? Ashley McGlone: 00:21:49 And who's controlling those things? Ashley McGlone: 00:21:51 Having that incident response Ashley McGlone: 00:21:53 plan, a defensible architecture, Ashley McGlone: 00:21:54 network visibility monitoring, Ashley McGlone: 00:21:57 secure remote access, and then Ashley McGlone: 00:22:00 even risk based vulnerability Ashley McGlone: 00:22:02 management, which prioritizes Ashley McGlone: 00:22:04 not just saying, here's all the Ashley McGlone: 00:22:05 volumes, but here's the ones that Ashley McGlone: 00:22:07 are prioritized for our equipment Ashley McGlone: 00:22:09 with our environment where we Ashley McGlone: 00:22:11 know that they are exposed. Ashley McGlone: 00:22:12 They have a really good guide Ashley McGlone: 00:22:15 that you can download for Ashley McGlone: 00:22:16 free just to get started. Ashley McGlone: 00:22:17 But they have a whole Ashley McGlone: 00:22:18 suite of courses. Ashley McGlone: 00:22:19 And I'm not compensated for Ashley McGlone: 00:22:21 this either, by the way. Ashley McGlone: 00:22:22 Just I've seen that they have Ashley McGlone: 00:22:23 some fantastic instructors who Ashley McGlone: 00:22:26 are writing, designing, living Ashley McGlone: 00:22:28 this every day, getting real Ashley McGlone: 00:22:30 world training out there to Ashley McGlone: 00:22:31 the people that need it most. Ashley McGlone: 00:22:32 Even if you're taking somebody Ashley McGlone: 00:22:34 off the street without this kind Ashley McGlone: 00:22:36 of background in their portfolio, Ashley McGlone: 00:22:38 you can send them to these Ashley McGlone: 00:22:39 classes, get them some hands Ashley McGlone: 00:22:41 on with this technology and get Ashley McGlone: 00:22:42 'em trained up and ready to go. Luigi Tiano: 00:22:44 Even if you're not Luigi Tiano: 00:22:45 getting compensated, I think you've Luigi Tiano: 00:22:46 obviously demonstrated a wealth Luigi Tiano: 00:22:48 of knowledge in this industry. Luigi Tiano: 00:22:49 So if you're saying SANS ICS Luigi Tiano: 00:22:51 is a good place to start, Luigi Tiano: 00:22:52 that's where I would start. Luigi Tiano: 00:22:53 Thanks for that, Ashley. Luigi Tiano: 00:22:54 Before we wrap, obviously, Luigi Tiano: 00:22:56 you work at Tanium. Luigi Tiano: 00:22:56 I see the background there. Luigi Tiano: 00:22:57 Maybe just tell us a little Luigi Tiano: 00:22:58 bit about how Tanium could Luigi Tiano: 00:22:59 help an organization. Luigi Tiano: 00:23:00 You've shared time with Luigi Tiano: 00:23:01 us and I appreciate that. Luigi Tiano: 00:23:02 So I need to give you some Luigi Tiano: 00:23:03 time to tell us how Tanium Luigi Tiano: 00:23:05 could potentially help. Ashley McGlone: 00:23:06 Sure. Ashley McGlone: 00:23:07 Tanium is a real-time endpoint Ashley McGlone: 00:23:08 management platform for visibility Ashley McGlone: 00:23:11 and control at speed and scale, Ashley McGlone: 00:23:13 all those marketing terms, right? Ashley McGlone: 00:23:15 But basically what that means is Ashley McGlone: 00:23:16 we have a unique architecture that Ashley McGlone: 00:23:19 allows us literally in seconds to Ashley McGlone: 00:23:22 get information from any system. Ashley McGlone: 00:23:25 Windows, Mac, Linux, even Solaris, Ashley McGlone: 00:23:27 and AIX that has an ip, it's Ashley McGlone: 00:23:30 connected, it's on the network. Ashley McGlone: 00:23:31 We can get that real time Ashley McGlone: 00:23:33 visibility of your environment. Ashley McGlone: 00:23:35 If you're wanting to know what are Ashley McGlone: 00:23:37 all the machines in my working from Ashley McGlone: 00:23:39 home, office area, on the plant Ashley McGlone: 00:23:42 floor, as long as it's running one Ashley McGlone: 00:23:44 of those OSs and it's got an ip, Ashley McGlone: 00:23:46 it's got Tanium client installed, Ashley McGlone: 00:23:48 then we can get you the richest Ashley McGlone: 00:23:51 data you've ever seen in real time. Ashley McGlone: 00:23:53 So we can scan for vulnerabilities, Ashley McGlone: 00:23:55 we can patch, we can manage policy, Ashley McGlone: 00:23:57 we can do threat detection and Ashley McGlone: 00:23:59 response, and a whole list of Ashley McGlone: 00:24:02 capabilities that gives you a very Ashley McGlone: 00:24:04 wide feature matrix to manage the Ashley McGlone: 00:24:07 top half of that OT stack, right? Ashley McGlone: 00:24:09 Where you've got windows and Ashley McGlone: 00:24:10 Linux machines out there that are Ashley McGlone: 00:24:12 running what matters most to you. Ashley McGlone: 00:24:15 I've had customers tell us, Ashley McGlone: 00:24:16 when they put traditional Ashley McGlone: 00:24:18 IT tools in there, they need

Ashley McGlone: 00:24:19 multiple tools to do that. Ashley McGlone: 00:24:21 It's a performance hit on Ashley McGlone: 00:24:23 the endpoint, but Tanium's Ashley McGlone: 00:24:25 a single agent that Ashley McGlone: 00:24:26 covers multiple tool sets. Ashley McGlone: 00:24:28 With that platform approach then, Ashley McGlone: 00:24:30 you can reduce the impact on often Ashley McGlone: 00:24:33 under-resourced hardware profiles Ashley McGlone: 00:24:35 on these manufacturing machines. Ashley McGlone: 00:24:38 We've seen some real benefit Ashley McGlone: 00:24:39 there as well as the actual Ashley McGlone: 00:24:40 technology, what we're doing to Ashley McGlone: 00:24:42 manage and secure that environment. Luigi Tiano: 00:24:45 Fantastic. Luigi Tiano: 00:24:46 So it's all about visibility and Luigi Tiano: 00:24:47 knowing what you own, because Luigi Tiano: 00:24:48 you can't really protect if Luigi Tiano: 00:24:49 you don't know you own it. Ashley McGlone: 00:24:50 Exactly. Luigi Tiano: 00:24:50 I know it's Luigi Tiano: 00:24:51 cliche and we say it often, Luigi Tiano: 00:24:52 but it's the fundamental truth. Luigi Tiano: 00:24:53 If you don't know what exists Luigi Tiano: 00:24:54 on your network then, how do Luigi Tiano: 00:24:55 you know how to protect it or Luigi Tiano: 00:24:57 mitigate the risk on those devices. Luigi Tiano: 00:24:59 Ashley, I've learned a ton. Luigi Tiano: 00:25:01 I'm sure the audience Luigi Tiano: 00:25:02 is gonna love this. Luigi Tiano: 00:25:03 We will be sharing a lot of Luigi Tiano: 00:25:04 the links that you've sent us. Luigi Tiano: 00:25:06 Before we go, anything else Luigi Tiano: 00:25:07 you want to add because you've Luigi Tiano: 00:25:08 given us a lot of your time Luigi Tiano: 00:25:09 here and a lot of information. Luigi Tiano: 00:25:11 If you got nothing else, I Luigi Tiano: 00:25:12 just want to thank you and say, Luigi Tiano: 00:25:13 hopefully we can do this again. Luigi Tiano: 00:25:15 I'll close off with that. Ashley McGlone: 00:25:17 Thanks Ashley McGlone: 00:25:17 for the opportunity to Ashley McGlone: 00:25:18 come on the show, Luigi. Ashley McGlone: 00:25:19 I just wanna offer a word Ashley McGlone: 00:25:20 of encouragement because Ashley McGlone: 00:25:22 typically IT and OT are Ashley McGlone: 00:25:23 separate silos in the business. Ashley McGlone: 00:25:26 Only a few places where they're Ashley McGlone: 00:25:27 actually integrated with a Ashley McGlone: 00:25:29 common vision, common governance. Ashley McGlone: 00:25:31 It takes work to get Ashley McGlone: 00:25:33 there and it's worth it. Ashley McGlone: 00:25:35 Your business depends on it. Ashley McGlone: 00:25:36 Your livelihood, your family Ashley McGlone: 00:25:38 that you support with the income Ashley McGlone: 00:25:39 that you make at your employer. Ashley McGlone: 00:25:41 You want to keep that secure for Ashley McGlone: 00:25:42 your own interest, but also for Ashley McGlone: 00:25:44 the business and for all the people Ashley McGlone: 00:25:45 that are served by that business. Ashley McGlone: 00:25:47 It really is worth the effort Ashley McGlone: 00:25:50 to spend the time and to do Ashley McGlone: 00:25:52 the research and to get your Ashley McGlone: 00:25:53 program started, if you don't Ashley McGlone: 00:25:55 have one because security Ashley McGlone: 00:25:56 is not an option here. Luigi Tiano: 00:25:58 Time is now. Luigi Tiano: 00:25:58 You gotta get started. Luigi Tiano: 00:26:00 Ashley, it's been a pleasure. Luigi Tiano: 00:26:01 Thank you very much. Luigi Tiano: 00:26:02 Hope to talk to you again soon. Ashley McGlone: 00:26:04 Take care. Luigi Tiano: 00:26:05 Thank you. Luigi Tiano: 00:26:05 Bye-bye.