The Bad Guy's Different Set of Rules

WEBVTT
00:00:58.859 --> 00:01:04.060
Hi, I'm Jeff Frankie, editorial director of Manufacturing.net and Manufacturing Business Technology.
00:01:04.219 --> 00:01:05.820
Welcome to Security Breach.
00:01:05.980 --> 00:01:19.819
Not to continue to beat our collective heads into the same wall, but by now everyone knows that manufacturing leads the way in targeted cyber attacks, as well as year-over-year increases in areas like ransomware attacks, DDoS shutdowns, and data breaches.
00:01:19.980 --> 00:01:24.939
Yet the industry continues to demonstrate some troubling behaviors in the face of these realities.
00:01:25.180 --> 00:01:32.859
Kiteworks recently found that only 36% of organizations have visibility into where their data is utilized by external partners.
00:01:33.020 --> 00:01:42.060
So thanks supply chains, distributor fulfillment agreements, and technology contractors that have access to your data, but may not be applying the appropriate security strategies.
00:01:42.140 --> 00:01:48.379
This means you could be the victim of an attack but remain in the dark about its origins, enabling the intrusion to happen again and again.
00:01:48.620 --> 00:01:53.740
Fortunately, we do have some good guys working to correct these vulnerabilities, and we'll talk with one of them in this episode.
00:01:53.980 --> 00:02:08.460
Tim Freestone is the chief strategy officer at the aforementioned Kiteworks, and he's here to offer some insight into the missteps manufacturers have taken with AI and other security tools, as well as the strategies that can get those numbers going in the right direction for the industrial sector.
00:02:08.699 --> 00:02:11.980
Thanks for joining us, Tim, and welcome to Security Breach.
00:02:12.300 --> 00:02:15.819
Well, Tim, again, thanks so much for the time and welcome to Security Breach.
00:02:16.060 --> 00:02:17.019
Yeah, thanks, Jeff.
00:02:17.180 --> 00:02:18.060
Appreciate it.
00:02:18.379 --> 00:02:23.819
So one of the big challenges we have in the manufacturing sector is we're adding all this new technology.
00:02:23.980 --> 00:02:29.019
We're putting a lot more stuff out there potentially on the threat landscape or on the OT landscape.
00:02:29.100 --> 00:02:36.699
And as a result, you know, there's some missteps that are going to be taken, whether it's endpoints, credentials, segmentation strategies, whatever it is.
00:02:36.860 --> 00:02:42.620
What are you seeing right now as we do bring more of this connectivity to the OT environment?
00:02:42.780 --> 00:02:45.340
What are some of the biggest missteps that you're seeing right now?
00:02:45.659 --> 00:02:47.100
Yeah, I mean, it's a good question.
00:02:47.180 --> 00:02:53.579
And, you know, it's not uh OT without the T, so that's gonna be a problem that never ends, right?
00:02:54.060 --> 00:02:58.699
Um some of the challenges transcend just OT.
00:02:58.860 --> 00:03:01.899
I mean, one of them is just operating in silos, right?
00:03:01.980 --> 00:03:11.180
So you have teams that are looking towards the requirements, the business requirements or the functional requirements of uh the operations.
00:03:11.339 --> 00:03:20.939
Um, and then you have teams that are looking at the functional requirements of uh the internal IT systems, and then you have teams that are looking at the requirements around security.
00:03:21.180 --> 00:03:37.500
So general siloed uh requirements rolling up to the ultimate business objectives, but as it filters down into the actual operators of all those different silos, you just get uh well siloed.
00:03:37.579 --> 00:03:41.180
Uh and it's it's just generally hard to operate in those scenarios.
00:03:41.339 --> 00:03:51.980
And today, with uh the threat landscape what it is, uh the fast pace of technology being what it is, this is all just getting compounded right now.
00:03:52.220 --> 00:03:52.540
Yeah.
00:03:52.780 --> 00:03:57.740
We talk a ton about silos on the on the program with it's always a problem, it continues to be one.
00:03:57.899 --> 00:04:02.860
I think not just in manufacturing, but in a lot of different industries, a lot of different environments.
00:04:03.100 --> 00:04:04.860
What have you seen has been key there?
00:04:04.939 --> 00:04:10.620
Because it seems like everybody knows this is an issue, but we just we struggle so much to break those down.
00:04:10.780 --> 00:04:12.060
Is it just a paradigm?
00:04:12.220 --> 00:04:19.500
Is it just a legacy dynamic with an organization that they're just so used to having IT and OT separate, they don't know how to bring them together?
00:04:19.660 --> 00:04:21.899
What's been your experience there, I guess?
00:04:22.220 --> 00:04:24.459
Yeah, I think that's that's it.
00:04:24.620 --> 00:04:45.019
Um and then when you get up into the as those teams start to go up the organizational hierarchy, the leadership just becomes so abstracted from the the functions that it's hard to create roadmaps of integration that are actually operationally executable.
00:04:45.259 --> 00:04:50.379
So I I'm I'm I'm a C-level here, right, at the company at Kiteworks.
00:04:50.459 --> 00:04:56.780
Um we're obviously not an OT company, but it's something we struggle with in our day-to-day operations.
00:04:57.019 --> 00:05:03.100
How do we get insight into what actually happens on the ground and mid-level?
00:05:03.259 --> 00:05:07.740
Um, what challenges are they having integrating across functions?
00:05:07.899 --> 00:05:12.220
Uh, and how do we set realistic objectives and manage to those realistic objectives?
00:05:12.300 --> 00:05:13.660
It's the same in OT.
00:05:13.819 --> 00:05:17.900
It's just the stakes are a lot higher for that.
00:05:18.060 --> 00:05:34.140
So I think, and again, especially today, um, leadership, approaches to leadership and organizational operations has to change um and has to cross paradigms within those companies.
00:05:34.379 --> 00:05:53.580
So instead of having you know a CIO and then another functional leader for the operational technologies that maybe have a different objective down lower on that totem pole and even at that level, shared responsibilities and objectives versus siloed responsibilities and objectives?
00:05:53.900 --> 00:05:58.860
Yeah, I think a big, uh really an important part of what you just mentioned there was getting that executive level buy-in.
00:05:59.340 --> 00:06:01.420
Is that just something that is innate?
00:06:01.660 --> 00:06:09.580
It's just organic for some leaders, or is it something that sort of our champions, if you will, on the plant floor or immersed in the OT side of things?
00:06:09.740 --> 00:06:13.900
Are there things they can do to sort of elevate this and get the C-suite more involved?
00:06:13.980 --> 00:06:19.819
Because that seems to be so key in really transitioning the culture and getting everybody on board for what we need.
00:06:20.140 --> 00:06:21.980
Yeah, there has to be champions.
00:06:22.060 --> 00:06:38.699
I've never seen in any organization in my career not come to some sort of realization like this without departmental champions pushing up the needs and the objectives in a way that isn't um posturing for excuses as to why something isn't working, right?
00:06:38.780 --> 00:06:41.580
You don't want to, that's not a champion, that's a complainer.
00:06:42.300 --> 00:06:55.980
So a champion brings challenges to operational effectiveness, comes with potential solutions, and delivers it in a way that's uh understood by the leadership as an impediment to business outcomes.
00:06:56.140 --> 00:06:58.140
So those champions are critical.
00:06:58.220 --> 00:07:12.780
Uh, and then you do actually have to have people in leadership roles that are don't want to just push the narrative uh and get through the next day, they want to be agents of change themselves and find solutions to the difficult problems.
00:07:12.939 --> 00:07:14.620
Those two things have to come together.
00:07:14.939 --> 00:07:21.900
I mean, are there are there tactics that that you know, those that are pushing for a greater cyber investment or awareness or appreciation?
00:07:22.140 --> 00:07:25.660
Have you seen any tactics that they can use to help get that message across?
00:07:26.060 --> 00:07:27.340
Is it ROI?
00:07:27.500 --> 00:07:28.300
That's pretty tough.
00:07:28.460 --> 00:07:30.140
We don't like to scare people too much.
00:07:30.220 --> 00:07:33.500
I mean, are there different ways that we can get that message communicated internally?
00:07:33.819 --> 00:07:36.460
Yeah, ROI is tough because nobody believes it.
00:07:36.699 --> 00:07:37.020
Right?
00:07:37.180 --> 00:07:42.939
It's anybody can create a spreadsheet that says you're gonna get a significant return on investment.
00:07:43.340 --> 00:07:47.819
Um and then to your point, yeah, the scare tactics.
00:07:48.460 --> 00:08:04.460
Um, you know, one of the biggest levers for change happen to be a little bit out of the hands of the internal employees or teams, but to some extent can be uh manipulated by it, and that's external regulators.
00:08:04.699 --> 00:08:18.220
Um, you know, the agents of change that really drive functional changes in organizations tend to be regulators, um, when businesses so need to need to um need to adjust and change how they operate.
00:08:18.379 --> 00:08:32.139
Uh, I do think there are there are ways that um industries as a whole can force regulations and drive um sort of broad-based operational requirements.
00:08:32.299 --> 00:08:40.699
Um there are a lot of examples of of industry packs and things um driving those those um narratives of change through regulators.
00:08:40.939 --> 00:08:48.539
I mean, think about like uh, I mean, this isn't manufacturing, but if in the financial services, it's not even federal, it's um PCI compliance.
00:08:48.699 --> 00:08:55.740
Those are just groups of companies coming together and saying we're not gonna do business with you unless you comply to these security requirements.
00:08:55.980 --> 00:09:05.019
It's not unrealistic to think of other um or uh or other uh industries could do the same, OT being one of them.
00:09:05.500 --> 00:09:06.059
No, absolutely.
00:09:06.139 --> 00:09:16.139
I think it's gonna be interesting to see how some of that CMMC stuff kind of plays out, making folks just be more aware of their landscape, their connection points, all of that type of stuff.
00:09:16.460 --> 00:09:18.860
Yeah, look, this is a really good point.
00:09:19.179 --> 00:09:26.779
We've, you know, I've been working in cybersecurity for nearly 20 years with Kiteworks for almost five.
00:09:26.939 --> 00:09:33.339
It's really been the last five that I've seen pretty dramatic shifts in the impact of regulators.
00:09:33.419 --> 00:09:34.939
And you mentioned CMMC.
00:09:35.019 --> 00:09:42.860
This is probably the biggest one I've seen in years, if not, you know, outside of PCI, which I already mentioned.
00:09:43.099 --> 00:09:52.379
But there were so many gaps in data controls in the manufacturing supply chain that people just had no incentive to fill.
00:09:52.620 --> 00:09:59.019
Uh, and CMMC drove that incentive to fill because they'll lose business if they don't do it, right?
00:09:59.179 --> 00:10:01.419
Uh so I think that's a really good example.
00:10:01.500 --> 00:10:10.539
Uh, and regulators can and regulations can sometimes impede business uh effect efficiencies, but sometimes it's required.
00:10:10.779 --> 00:10:11.179
Yeah.
00:10:11.419 --> 00:10:15.500
Well, there's no bigger efficiency drain than downtime and getting hit with a cyber attack.
00:10:15.579 --> 00:10:16.299
So very true.
00:10:16.379 --> 00:10:18.219
Yeah you can play it, play that card as well.
00:10:18.299 --> 00:10:19.179
It's very interesting.
00:10:19.819 --> 00:10:31.099
So, you know, one of the things that's interesting too here, Tim, is you guys did some research, others have as well, in talking about the level of investment increasing in the industrial sector when it comes to cybersecurity investment.
00:10:31.259 --> 00:10:35.740
But man, we are still getting hammered with attacks and successful attacks.
00:10:36.059 --> 00:10:36.620
What do you think?
00:10:36.699 --> 00:10:38.139
There's such a weird disconnect there.
00:10:38.219 --> 00:10:39.979
Are we not investing in the right things?
00:10:40.139 --> 00:10:42.699
Is it is it still a lot of feeling out?
00:10:42.860 --> 00:10:45.899
Why are we spending more money and still getting hit so hard?
00:10:46.219 --> 00:10:49.979
Yeah, you've asked the hardest question and the most easy answer.
00:10:50.379 --> 00:10:54.860
The short answer, not fully sure um why that's still happening.
00:10:54.939 --> 00:10:57.819
There are a lot of theoretical and philosophical answers to that.
00:10:58.059 --> 00:11:02.939
I mean, one of them is um we we have to play by rules, the bad guys don't.
00:11:03.179 --> 00:11:13.419
Uh, so all of the innovation and all the technical advancements of our day are immediately leveraged by the bad guys uh because they can.
00:11:13.500 --> 00:11:26.299
They don't have bureaucratic um loopholes to jump through, they don't have tiered systems uh that they have to operate within, and making a mistake is totally fine and nobody cares um because what's the downside?
00:11:26.620 --> 00:11:28.860
So that's that's a lot of it.
00:11:29.099 --> 00:11:50.699
Um the other thing is you know, the stakes are much higher, so the resources that people that companies and OT organizations need to put towards these innovations and the spend is a lot higher, and there's obviously a big resource gap uh between the spend, the technology, and the people to use it.
00:11:50.939 --> 00:11:54.860
Um, and that's just not relegated to IT or cyber.
00:11:54.939 --> 00:11:56.939
It's that's just a general problem.
00:11:57.019 --> 00:12:06.699
I think I saw one recent survey uh that 20% of uh only 20% of technology investments are fully uh leveraged.
00:12:06.860 --> 00:12:17.979
Uh I believe it, I believe that absolutely, and the reason for that is just there's not enough human resources to um effectively uh leverage all of these different technologies.
00:12:18.219 --> 00:12:32.939
So it's complexity, it's resources, it's the fact that we have to jump through internal and external um organizational hurdles, all that makes it a lot easier for the bad guys to leverage the same tech faster.
00:12:33.339 --> 00:12:34.299
Yeah, a lot to unpack.
00:12:34.379 --> 00:12:35.979
There's a lot of good points that you made.
00:12:36.059 --> 00:12:37.579
I'll jump the gun here a little bit.
00:12:37.659 --> 00:12:40.939
There's no way we can have this conversation without getting to AI eventually.
00:12:41.259 --> 00:12:50.299
So is this maybe one of the biggest places where artificial intelligence can help the good guys in sort of getting gaining ground on the bad guys?
00:12:50.459 --> 00:12:54.860
We know we're always chasing, but can AI sort of shorten that gap a little bit?
00:12:55.419 --> 00:13:17.419
Yeah, it can, and I think the dynamic is different between what I just said because one really talented technologist or cybersecurity professional in an organization can do what 20 to 30 people at the same level prior to AI could do.
00:13:17.579 --> 00:13:22.219
But it was hard, if not impossible, to find 20 to 30 of the same people.
00:13:22.379 --> 00:13:29.419
You know, it's the old Pareto principle 20% to uh 20% of the people do 100% of the work.
00:13:29.819 --> 00:13:35.579
Um, so you can make those 20% a lot more effective with AI.
00:13:35.740 --> 00:13:44.299
And so I think that that is an edge, and there is a levy level leveling playing field because of that simple dynamic.
00:13:44.539 --> 00:13:51.819
Uh, at the same time, we are still a little bit back towards uh we have to onboard, you have to get approval.
00:13:52.059 --> 00:14:01.819
Um, so the tech is there, you still have to go through all the operational hurdles to get it functioning, whereas you know, the the bad guys don't again don't need to do that.
00:14:01.979 --> 00:14:11.819
But I do think it helps, it does level the playing field quite a bit just because you can extract more value out of an a more capable person than you could before.
00:14:12.139 --> 00:14:12.459
Yeah.
00:14:12.620 --> 00:14:23.419
Well, that kind of goes back to that whole topic of culture and getting the right culture in place so people are empowered to make these decisions, get the technology in use more quickly as opposed to dwelling on the process.
00:14:23.740 --> 00:14:28.539
Yeah, and you look, the other thing is the job descriptions are have got to change and are changing.
00:14:28.779 --> 00:14:38.620
So, you know, organization-wide, if you're putting out a job description that read like it did a year ago, you're putting out the wrong job description.
00:14:38.779 --> 00:14:43.579
Uh, so you have to hire towards that capability set as well.
00:14:44.139 --> 00:14:52.379
Um, you can't, it's very hard to retrofit the that capability set into your current uh organizational structure.
00:14:52.620 --> 00:14:58.939
So job descriptions are changing, responsibilities are changing, levels are flattening, all as a response to AI.
00:14:59.179 --> 00:15:04.059
And the companies that are embracing that are the ones that are going to be more effective at cybersecurity.
00:15:04.379 --> 00:15:05.099
Absolutely.
00:15:05.339 --> 00:15:17.979
You know, sort of staying on this investment uh tone here, our topic, one of the things that we're seeing is just this proliferation of tools and different strategies, different options out there for the manufacturers to use, maybe in abundance.
00:15:18.059 --> 00:15:20.539
You know, I think we see that investment number going up.
00:15:20.779 --> 00:15:30.539
Are folks maybe investing in too many tools or not the right ones, or still trying to figure it out, or could you offer some advice there in terms of tool selection and the right stuff to use?
00:15:30.860 --> 00:15:31.899
Yeah, you're right.
00:15:31.979 --> 00:15:34.379
It is and it is getting worse because of AI.
00:15:34.620 --> 00:15:49.019
There's the whole vibe coding um movement that's happening, or um as more professional engineers like to call it, um, I think they call it agentic engineering, is happening.
00:15:49.500 --> 00:16:00.459
The build of uh the tool set is happening 10, 100 acts faster than it was before, and we already had a problem with too many technologies to filter through.
00:16:00.699 --> 00:16:17.099
You know, you go to any OT trade show or any cybersecurity trade show, and it's a floor of you know 2,000 vendors um representing 200 different technologies.
00:16:17.339 --> 00:16:29.500
So it's just it's massive to begin with, and now we have this uh level of explosion from from vibe coding and and new cybersecurity tools coming out every day and OT systems coming out every day.
00:16:29.819 --> 00:16:32.539
The one I've been thinking about this a lot lately.
00:16:33.019 --> 00:16:45.500
I I think that organizations need to put in in place some sort of department that uses AI as a vetting instrument for systems onboarding.
00:16:45.740 --> 00:16:48.860
So, what technology are we looking at uh procuring?
00:16:49.099 --> 00:16:50.939
Doesn't matter where it comes from.
00:16:51.339 --> 00:17:05.900
Let's have our systems onboarding team or a systems filtering team filter that use AI to come up with recommendations, weigh the pros and cons, um, and kind of use AI to uh manage that whole process.
00:17:06.059 --> 00:17:15.819
I think historically you just had people sort of looking at websites and looking under the hood a little bit at a product demo and trying to figure out what they brought on board.
00:17:15.900 --> 00:17:19.819
They get it on board and 20% of it gets used, 80% of it gets thrown out the window.
00:17:19.980 --> 00:17:22.539
Three years later they replace it because the team left.
00:17:23.660 --> 00:17:27.980
It's just not sustainable in this era of proliferation.
00:17:28.220 --> 00:17:30.620
You have to you have to put that agent layer on it.
00:17:30.700 --> 00:17:38.620
So that one of my recommendations would be look at where you can put AI across your entire um organization.
00:17:38.940 --> 00:17:45.500
And there is a part of your organization's that that is technology onboarding and assessment, probably in the procurement system.
00:17:45.819 --> 00:17:48.539
Use it there too, so you can make better decisions.
00:17:49.180 --> 00:17:50.460
No, it makes a ton of sense.
00:17:50.539 --> 00:17:58.460
I mean, manufacturing is used to digital twins and sort of vetting things out and and running different scenarios that way to see the best efficiencies and the best approaches.
00:17:58.700 --> 00:18:04.860
Taking a similar approach with AI beforehand would seem to be a real cost-effective way of going about things as well.
00:18:05.100 --> 00:18:05.740
Yeah, yeah.
00:18:05.980 --> 00:18:22.460
Matter of fact, I'm I'm gonna maybe I'll start that as an industry and a business and see what hey, in talking about the industry and the business here with Kiteworks, maybe you could tell us a little bit more about the company, what you have out there, and what you're doing to help uh manufacture specifically.
00:18:22.860 --> 00:18:24.220
Yeah, sure, absolutely.
00:18:24.460 --> 00:18:28.779
So our company has been around for about 22, 23 years.
00:18:28.940 --> 00:18:41.019
We went through sort of a transition phase six or seven years ago from sort of a focus on a secure file sharing infrastructure into a more secure data exchange platform approach.
00:18:41.259 --> 00:18:52.539
So if you think about what the point of all cyber is, with the exception of um you know, sabotage uh types of preventative measures, it's about the data layer.
00:18:52.700 --> 00:18:56.620
So protecting the data from going where it shouldn't.
00:18:56.779 --> 00:19:06.860
And that's really what Kiteworks does, is it puts the cybersecurity um technology focus on the data, uh specifically with data in transit.
00:19:06.940 --> 00:19:09.180
So it's a secure data exchange platform.
00:19:09.340 --> 00:19:20.140
Any data moving from point A to point B, if it runs on the Kiteworks platform, it's encrypted, it's controlled with uh what's called ABAC attribute-based access controls.
00:19:20.380 --> 00:19:22.060
You have a full audit trail.
00:19:22.220 --> 00:19:31.100
And so that data layer security um puts us in great in a great position to be supporting organizations that are highly regulated.
00:19:31.259 --> 00:19:36.620
So we're really good at helping customers become uh maintain their data within CMMC.
00:19:36.700 --> 00:19:49.500
We're really good at helping customers maintain their data in HIPAA environments, all those highly regulated industries, they rely on kiteworks to to help control their uh data and maintain uh compliance.
00:19:49.740 --> 00:19:52.380
So that's that's it in a nutshell, I guess.
00:19:53.019 --> 00:19:58.060
Well, you know, one of the biggest issues when you're talking about data is the human element of cybersecurity.
00:19:58.140 --> 00:20:01.019
It's always a big risk, it's potentially the biggest risk.
00:20:01.259 --> 00:20:06.620
Uh what are some tips that you would give to companies in looking to help alleviate some of those concerns?
00:20:06.779 --> 00:20:18.700
It's sort of this weird line we have to walk between scaring people and then they're afraid to share information if they do click on a wrong link, but still providing that training that, you know, it's not just white noise, so it has an impact.
00:20:18.860 --> 00:20:22.060
What have you seen being most effective in in helping those folks out?
00:20:22.380 --> 00:20:32.220
Yeah, so I what isn't that effective is giant brain dump training sessions on all cybersecurity tactics possible.
00:20:32.380 --> 00:20:42.700
You know, you sit there for two hours, um, 50% of the people pay their kids to do this cybersecurity training online, so they don't have to because they've seen it 50 times.
00:20:42.779 --> 00:20:47.500
It's just not you have to do it because it's sort of a checklist um process.
00:20:47.580 --> 00:20:56.060
You know, you can't say you didn't train at all, so you you come up with these really laborious video experiences that you have to take tests at the end.
00:20:56.300 --> 00:21:20.140
Um fine, but there's more of a movement to this concept of uh just in time prevention and training, so micro learnings uh as people go along throughout their day, um, embedding technology that says don't click that link when they try to click it, and then it explains why you shouldn't click the link.
00:21:20.380 --> 00:21:28.140
Human error prevention, if you try to send a sensitive document where it shouldn't, it will recognize that you're not supposed to.
00:21:28.220 --> 00:21:34.140
It's sort of like more advanced DOP, but instead of just blocking it, it'll say, I'm blocking this.
00:21:34.300 --> 00:21:36.539
Here's why, here's something you should learn.
00:21:36.700 --> 00:21:47.580
So these sort of micro learnings um are proving to be a much better way to control the human element than giant brain dumps in animated video form.
00:21:48.140 --> 00:21:49.100
No, it makes sense.
00:21:49.180 --> 00:21:52.380
I mean, people are actually getting vested then in learning more about the situation.
00:21:52.539 --> 00:21:54.779
I think that's one of the biggest things, just in general.
00:21:55.019 --> 00:21:57.660
People do want to be like they're a bigger part of something.
00:21:57.820 --> 00:22:01.660
This is again, like you said, it's not just check the box training, it actually gets them engaged.
00:22:03.340 --> 00:22:03.900
Very good.
00:22:04.220 --> 00:22:09.500
You know, another big topic here we have in the industrial sector, I always like to talk about is secure by design.
00:22:09.820 --> 00:22:20.060
The the premise, I think there's a false uh understanding out there that a lot of the secure by design support comes right from the manufacturer of the technology, the supplier of it.
00:22:20.300 --> 00:22:25.100
And the user sometimes feels like they're covered, like they don't have to do something on their end.
00:22:25.340 --> 00:22:27.580
I think it creates a little bit of confusion.
00:22:27.820 --> 00:22:40.380
What have you seen in terms of advancements in secure by design and maybe the role of just communication between the two entities involved to help with more implementing all these new technologies to make sure they're good from the start?
00:22:40.860 --> 00:22:41.100
Sure.
00:22:41.180 --> 00:22:51.820
So, and just to parrot that back to make sure I get the question right manufacturing company A brings on a new technology from a vendor to support their business operations.
00:22:51.980 --> 00:22:57.100
That vendor says, hey, We've built this technology in a secure by design fashion.
00:22:57.340 --> 00:23:00.460
The manufacturer says, great, deploys it to all their people.
00:23:01.340 --> 00:23:06.060
What's the people's responsibility besides saying, ah, well, it's secure by design, I don't have to do anything, right?
00:23:06.779 --> 00:23:07.180
Exactly.
00:23:07.340 --> 00:23:08.620
Yeah, exactly.
00:23:08.940 --> 00:23:13.100
Well, I mean, it sort of falls back on my previous answer before.
00:23:13.259 --> 00:23:21.019
Um, and I think you're seeing a lot of this, which is those secure by design companies are embedding these micro learnings into their systems.
00:23:21.180 --> 00:23:31.820
I mean, we we actually recently bought a company that was that that did this, a company called Zivir out of the Netherlands that gave those micro learnings in in email security form.
00:23:31.980 --> 00:23:42.380
Definitely a secure by design developed product, um, but didn't leave it in the hands of of the people to understand or operate as such.
00:23:42.539 --> 00:23:47.660
And so those micro learnings were embedded into the human error prevention of the email security.
00:23:47.820 --> 00:23:59.820
So I think that's again, I didn't mean to answer the question with the answer I gave to the previous question, but I think that's that's probably the most effective situ or scenario in that situation.
00:24:00.300 --> 00:24:08.940
Um you know, when someone says is it secure by design, obviously don't just take their word for it, get all of their pen testing.
00:24:09.259 --> 00:24:15.100
What is their the layers of security that they um put into the development process?
00:24:15.259 --> 00:24:23.660
Uh and have they just bolted on that security so they can save secure by design, or did they start with design security principles, then build the product and the technology?
00:24:23.820 --> 00:24:25.259
So it's kind of on both sides.
00:24:25.580 --> 00:24:26.779
No, makes sense.
00:24:27.100 --> 00:24:29.580
Another just throwing some critical issues at you here.
00:24:29.740 --> 00:24:32.620
Response planning is a huge one for manufacturers.
00:24:32.779 --> 00:24:43.100
We've gotten better at sort of detection and understanding the threats, but then when something does break through, the response part is sort of eh, it hasn't been vetted as much.
00:24:43.180 --> 00:24:44.860
So therefore it's it's slower.
00:24:45.019 --> 00:24:47.340
It's uh it's maybe not as thorough as it should be.
00:24:47.500 --> 00:24:53.580
What would be your advice or your insight in terms of developing, implementing, executing those response plans?
00:24:53.900 --> 00:24:54.220
Yeah.
00:24:54.380 --> 00:25:05.180
Well, I mean, look, I have I hate to say this, but the response plans tend to be disjointed and they tend to be at different uh it's almost the same sort of silo problem.
00:25:05.340 --> 00:25:07.660
What happens if our network gets breached?
00:25:07.820 --> 00:25:12.460
What happens if our cloud instance or our Amazon S3 bucket gets breached?
00:25:12.620 --> 00:25:15.259
What happens if our our endpoints get breached?
00:25:15.420 --> 00:25:18.300
What happens if in all these sort of resilience strategies?
00:25:18.620 --> 00:25:40.779
I keep coming back to the sort of the same stance I have that propels the vision of the company, which is create a resilience strategy with what they're all trying to get after in the first place, which is the data, and then work towards the nuances of all of those different layers versus the other way around.
00:25:40.860 --> 00:25:44.300
So what's your someone breaches your endpoints?
00:25:44.620 --> 00:25:45.259
Fine.
00:25:45.900 --> 00:25:49.900
But what data they get, do you understand what data is on the endpoints?
00:25:50.060 --> 00:25:52.940
Can you uh do you have encryption on that data?
00:25:53.180 --> 00:26:06.539
You know, looking at that data layer first and building a resilience plan based on data exfiltration versus uh the particular pathway in which the breach happened is probably the best approach to that.
00:26:06.700 --> 00:26:11.019
Now, having said that, the best approach is still incredibly difficult.
00:26:11.259 --> 00:26:19.340
And I don't envy any of these companies and any of the cybersecurity teams that have to build resilience plans and recovery plans.
00:26:19.500 --> 00:26:24.140
Um, but you know, look look at the big rock, not the little rocks.
00:26:24.460 --> 00:26:25.740
No, makes sense.
00:26:25.980 --> 00:26:27.420
So, Tim, this has been great.
00:26:27.580 --> 00:26:37.019
Really appreciate the insights and just sort of wrapping things up, question I like to throw at everybody who comes on the show is when you start looking forward, what are some of the biggest trends you see coming down the road?
00:26:37.100 --> 00:26:41.019
What are some things that we should be aware of and try to prepare for when it comes to cybersecurity?
00:26:41.420 --> 00:26:41.660
Sure.
00:26:41.820 --> 00:26:46.060
Well, last year or even two years ago, it was just generally AI.
00:26:46.380 --> 00:26:48.700
Um now it's agents.
00:26:49.259 --> 00:27:06.300
Uh and I I was sort of skeptical about the capability of this agent dynamic six months ago, uh, just because I'm a deep, deep user of AI systems, built agents, and and I understand all of that.
00:27:07.019 --> 00:27:28.700
But with what Anthropic has rolled out in terms of a capability set with their Claude Um Opus 4.6, and then today Sonic 4.6 with um OpenAI, um hiring the CEO of, I don't know if you've heard of OpenClaw slash motebot slash claud bot.
00:27:28.940 --> 00:27:43.420
Um, it's it's this big agent development open source platform, and just seeing what the agents can are capable of doing almost with agency, just giving them an objective, and they'll come back in an hour and a half with that objective complete.
00:27:43.660 --> 00:27:49.740
And then you can scale agents to the thousands, tens of thousands, millions based on the compute that you have.
00:27:49.980 --> 00:28:00.460
Uh, I think that is the trend that everybody's going to be looking at harnessing from an IT standpoint and protecting against from a cybersecurity standpoint.
00:28:00.620 --> 00:28:06.460
And we're going to just rinse and repeat all of the same challenges we have, which is the bad guys can move faster than the good guys.
00:28:07.180 --> 00:28:08.700
No, it's cat and mouse for sure.
00:28:08.779 --> 00:28:10.300
It'll be interesting to see how it plays out.
00:28:10.460 --> 00:28:15.019
But good fortunately, we have guys like you who can help guide us and give us some great insight like this.
00:28:15.420 --> 00:28:16.060
Excellent.
00:28:16.300 --> 00:28:16.940
Thanks, Tim.
00:28:17.019 --> 00:28:22.220
And for more information on the company's tactics and processes, you can check them out at kiteworks.com.
00:28:22.380 --> 00:28:24.700
I'd like to thank each and every one of you for joining us today.
00:28:24.779 --> 00:28:31.820
And to catch up on past episodes, you can go to manufacturing.net, Ien.com, or mbtmag.com.
00:28:31.980 --> 00:28:37.420
You can also check out Security Breach wherever you get your podcasts, including Apple, Amazon, and Overcast.
00:28:37.580 --> 00:28:45.019
And if you have a cybersecurity story or topic that you'd like to have us explore on Security Breach, you can reach me at Jeff at IEN.com.
00:28:45.180 --> 00:28:49.340
For Tim Freestone, I'm Jeff Rankey, and this is Security Breach.