Latest / The Decision Advantage / The Decision Advantage: Operational Technology, Ransomware & the Reality of AI Threats

Transcript

The Decision Advantage: Operational Technology, Ransomware & the Reality of AI Threats · The Decision Advantage

• Brian: Welcome to the Decision Advantage, a Fusion Intelligence podcast by Fernand Consulting. I am Brian LeClaire, and today I will be speaking with Dr. Thomas Winston, consultant in cyber and technical intelligence at Fernand Consulting. Tom, welcome to the show. Tom: Thank you, Brian. It's my pleasure to be here. Brian: You're part of the team at Firm and Consulting, helping leaders anticipate and mitigate threats to critical infrastructure, especially across industrial control systems and operational technology. Before we dive into those specific threats, could you tell us a bit about your background, how you entered this field, and what continues to drive your interest in cyber intelligence? Tom: Yeah, that's a great question, Brian. I I entered the field through the United States intelligence community, where I was trained to essentially initially analyze geopolitical threats, but then they realized I had a very heavy technical background. So they moved me into tech ops and technical analysis. So I pretty much spent the rest of my career doing that. So what happened at that time is they moved me out of that spot in in in my in my job and they put me into a spot where I was dealing directly with in not just EIT but really focused on ICS SCADA and operational technology concerns. So that really was the the sort of the introduction for me into that world. going back about 13 years now. and I essentially became the person who was doing that account that essentially nobody else really wanted to deal with at the time at the organization. so I was happy to do it and I it was it all made very good sense to me from a technology standpoint. I could I could very easily integrate some of the challenges, potential challenges that would be faced with you know, my extensive background, 20 years really of enterprise information technologies. And I determined at that point that the operational technology was a little more interesting because we we think of information technology or enterprise information technology, what I'll refer to as EIT. And we think of you know patch Tuesdays. We're going to patch these systems so that we patch the vulnerabilities that occurred over the last seven days. With operational technology, it's a very different situation. The The vulnerabilities can actually cause physical destruction, certainly physical disruption, and deny access to critical services that everybody in the country or any country really relies upon daily. For example, water, electricity, heat. and I had an opportunity during that during my tenure in that spot to sort of investigate some of the more relevant attacks that were occurring, specifically in the Ukraine and in the Middle East. so I I had a very sort of boots on the ground introduction to how all of that worked. and again, from from an engineering standpoint, it made kind of perfect sense to me as the next logical step for understanding better, you know, sort of the larger security picture between enterprise information enterprise information technology and operational technology. Brian: And I guess those things don't wait till Tuesday, right? To Tom: No, they they they really don't. And there the one thing the other thing I would mention that is very important about this, when we talk about traditional cybersecurity, we're talking about a field that's pretty much twenty-five to thirty years old right now. When we talk about operational technology security, we're talking about a field that's probably about twelve years old at this point. because at that time, the the federal government was just realizing that there were There was a whole other section of security they needed to be concerned with. there were several pre several of my predecessors, starting in probably the 2007 timeframe, were were briefing the government regularly on this. But it takes with the government, it typically takes a couple years to sort of recognize and realize the criticality of the threat. And we're seeing this happening right now with with AI in in in the workplace and AI in general. So It's a there's a very similar correlation to it. would I say that operational technology security is a mature field? Absolutely not. there are some companies that have been really pushing hard. I s I had the honor to serve at one of those companies and for two and a half years where I was leading the intelligence cr t teams there. And that that was a very formative sort of a formative experience for what I'm doing today. which is a little bit different from what I was doing back then, but it's it is in a sense still related. Brian: So you you'd mentioned, you know, these attacks on critical infrastructure. Do you it seems like, at least i from the media perspective, that there's more of these happening now than there have been recently. So from the power grid attacks to water treatment facilities, are are we seeing a bigger surge now and and and why is that happening? Tom: So I think I think there's two things happening here. I think that there's definitely more tax. There's no question about that. But I also think that there's more attention to it. A lot of owner operators in let's say the early 2000s, between 2000 and let's say 2013, typically wouldn't report these outages as cyber tax. They'd report the outage or customers would complain that there was an outage for whatever one. Brian: So they may have been happening but not being reported. Tom: It w it wasn't being reported as much. and like I said, there's a couple of companies in the world that are really on the forefront of developing sort of detection and mitigation tools for these type attacks, but these companies are relatively new. When we think about companies that have been doing cybersecurity, they've been around since the late 1990s. These companies were born in the 2017s. So it's it's a it's a different playing field. And as far as more attacks occurring, There's definitely been, well, to put it sort of in context, foreign intelligence services have had their eyes on critical infrastructure for longer than the period of time I mentioned. But some of the some of the operations were were purely focused on information gathering, mapping networks, determining weak points in networks, understanding how the US's critical infrastructure works. And one thing that's a little unique about critical infrastructure protection and operational technology is that there are certain vendors typically associated with certain industries. So if you're thinking, if you're thinking electric, you might be thinking about Schneider Electric. If you're thinking oil and gas, you might be thinking about Omron or another company, ABB. so so there's certain commercial vendors, and the way the the way the attacks sort of evolved was commercial vendors used to in the past put user manuals on online so that the customer base could see them and so that the owner operators could send their engineers and they could configure the equipment properly. It was it was a pretty standard I mean it seemed harmless, right? you know, we're we're gonna help our customers by giving them all the information they need to to sort of make the right configuration decisions on their, you know, on their devices, whether it's a PLC or or an RT or something. and what that became actually though over time was it was a weakness because Brian: Right, 'cause it it opened them up, right? Yeah. Tom: that the information is widely available. and you know, open source intelligence collection is a thing. It's always been a thing. So, you know, the the adversaries, the, you know, the we'll just refer to them as the typical, what we consider to be the typical adversaries, have made a lot of advances in some of these you know, these attack sets, these APTs that they released. so it's It's kind of almost like I watched the progression from the early two thousand teens where where threat actors were enumerating and evaluating networks to the later two thousand teens, we're actually doing attacks on those networks. We're actually going to cause disruptions. We're actually going to you know Create an effect that's tangible enough so that the world sees it. And when one of the companies I was serving at, we we actually had the opportunity to detect a threat capability before it was employed by the threat actor. And that particular instance was amazing to me. It is the only time in my long career where we've ever stopped something before it happened. Most security conversations are reactive, not proactive. Brian: Right. And do you see the type of analysis and work that you're doing might help prevent more of these attacks or? Tom: Yeah, I mean, that's I I think a lot of it is education. It's letting the owner operators know that, you know, you need to understand, you know, there's really five critical areas that you need to understand. And one of them that when I was doing my initial investigations in the government, one of those areas was a lot of owner operators didn't actually realize what assets they had or how those assets were communicating with each other and and those assets were commu communicating with the externally facing enterprise IT systems. And I think that was something for me that was that was a an awakening moment. I'm like, wow, they they really don't know that there's a an open relay here. They really don't know that to access that remote you know monitoring system in let's say Turkmenistan, they're using a modem to do it. Or something that's plain text. I mean, we the a lot of these things you just didn't think about that. And the difference, the the other difference, and I didn't mention this earlier, but I need to mention it now. patching software on Tuesday is relatively easy. replacing controllers, upgrading, updating controllers in in large, you know, geographically disparate operational technology systems is not as easy. That requires boots on the ground, engineers in place. And it's it it's just there there needs to be a lot more planning and time. And typically, you know, organizations and I don't want to make a generalization that that targets any specific vertical in the operational technology space, but a lot of times organizations will say if it's functioning and if we're not having any problems with it, we should just leave it alone. So what I was finding Brian: Right, because the ri there's always risk to upgrading and and such anyway. Tom: Yeah. And there could be risk, there could be risk to upgrading too. And this is so not to put all the blame on the owner operators, but sometimes sometimes the upgrades themselves might have new security flaws that haven't been carefully vetted. So there are a couple organizations that that take care of that. I mean, for example, I I can mention this one because I'd never worked there. Idaho National Labs does a great job vetting equipment, checking hardware, bench testing hardware. software, whatever those those devices are interacting with. So so that that that's an organization that's been proactive about this for a very long time. But most of the world didn't really know that they were doing this sort of thing, right? It was kind of in a lab and you know it's it's one of those situations where somebody else has it. I don't I don't I don't necessarily need to worry about it. Somebody else is taking care of it. But then when you sort of peel back the layers, you realize that wait a minute, there's actually nobody taking care of this. So and even even the organization, the commercial organizations that work in the the ICS OT protective space, they they can they're out there every day essentially saying, hey, listen guys, you need to be careful. There's there's a there's a growing threat. now if we take everything I just said and we throw into a context where there's a hot war occurring, well, hot wars in in situations like that. typically countries will utilize whatever resources they can to affect whatever damage they can to the the the person that's attacking them. So if we're if we're if we want to speak directly to the the the Iranian conflict that's happening right now, there's been a lot of noise in the last couple of weeks, especially. that we're we're coming after your, you know, we have trained threat actors and we're coming after your critical infrastructure. And You know, the reality is the way the electrical grid is designed in this country, to to create a massive, let's say, regional blackout would require, I think, a little more planning that some of the than some of those threat actors have the capability to execute right now. does that mean they're Brian: So are most of the attacks right now happening on smaller municipalities and utilities and that sort thing or? Tom: So it certainly was like that, it's been like that for the last 10 years. that doesn't mean they're any less important. because because remember, I mean, Target was hacked about 10 years ago through an HVAC supplier. So we can't consider any link in the chain an unimportant. They're all very important. but we have to, but the one thing I would say is that because of the way the electrical grid is designed in the United States. and there's really disparate commercial operators and owners of those grids. and they're they're not all they're they're all connected, but there's many stops in between, so to speak. I think it would be difficult to affect a regional change, a regional outage. I'm not saying that it can't happen, but I think I think that requires a lot more time and planning than you know, for example, the Iranians might have. And and this is again, you never underestimate your enemy. we I would never You come on a a you know, to any group of people and say, Hey, you know, the Iranians are ill-prepared, they can't attack. No, they have engineers there. They have engineering schools and programs and they have they have pl plenty of actors that are trained to do these things. and you know, they may even get help from other countries. We you it it there's there's been a long history of sort of friendship between, for example, Russia and Iran. And so you have to take heed because if If there's a friendship and if there's a cooperative agreement in in some space that I don't understand anymore and I don't have access to knowing about anymore, you know, there that would mean that the Iranians could theoretically have access to the Russian toolkit, which that's a different conversation. So and andor the the PRC's many, many, many advanced tools. So it's it it's a it's a tricky situation because you you don't want to tell everybody that the sky is falling. Because the sky isn't falling. But on the other hand, you do want people to be aware, owner operators to be aware that there is an increased risk right now. And it's challenging if you're an owner operator who doesn't have, you know, well-defined zones between IT and OT. It's challenging if the owner operator doesn't know what their assets are, what their assets are capable of doing. And I don't mean that in a bad way. I mean, you know, maybe they have an open communication relay or an open communication port. I can tell you though that if if there are vulnerabilities and weaknesses and that they're and if they're easy to exploit, that's low-hanging fruit for those foreign intelligence service operators. They're gonna they're gonna go straight for that. They're not gonna waste any time. and I saw that happening as you know, as much as 12 years ago, I saw that starting to happen. and very probably I would I would argue that most of the stuff that was happening in the United States, nobody in the United States knew about because it was it it was and is classified. So that's that goes back to the other point you were making earlier about how there's been attacks for a while. I mean technically the first the first cyber attack on an operational technology system was on an oil oil oil natural gas pipeline in Russia in the in the 1980s. Okay, so Brian: So definitely dating back quite a ways. Tom: Yeah. And then there was a an incident in Australia called the Maruchi Dam failure, which was also a cyber attack, which was, you know, a couple of years after that. So so they're there. it's just a lot of times you'll see you'll see an organization report, you know, we had an explosion or we had a critical outage. But then you don't always hear the follow-on. You don't always you don't always hear that, well, it was it was an APT group that actually took the the industry down or took know took some part of their manufacturing down. At least now we do hear more about that. So, you know, for example, the colonial pipeline incident, which I worked personally, and that that was a situation where the IT Brian: What what year was that? Tom: let me think for a minute here. I don't want to miss miss quite it, but it was the spring of 2020, Brian: Put you on the spot. Tom: I think it was the spring of 2021, May actually. Brian: Okay. Tom: yeah, and They you know, that wasn't necessarily an attack on the operational technology system in the organization, but it was an attack on the information technology system that was well connected to the operational technology system. So so Colonial Colonial Pipeline very wisely said, We're shutting it all down until we can figure out what's happening here. but that did cause actual disruptions for people. We couldn't get gas. you know, there's a coup there's about a week and a half there where deliveries were delayed. so So that's the sort of thing that we need to be careful about. And that's why I would never underestimate the power of, you know, somebody coming on a small, let's say a small electrical grid operator in let's say the northeast part of Texas comes online and says, Yeah, we had a cyber attack. That that has to be treated as importantly as anything else. Brian: Could it 'cause it sounds like it could possibly spread to other other places too, right? Yeah. Mm. Tom: And well, that's the thing. We don't know if it could and we don't we don't want to be in a position where you know the government's saying what's happening and everybody's you know wringing their hands and saying, Well, I don't really know. so there's a communication component here too that is very, very important. and you know, like I said, the industry leaders who are protecting these grids now with either with devices or with intelligence or with both, they're they're doing the best they can right now to sort of teach. the world, the public, about the importance of these these industries and how you know, y you might not think much about some manufacturing plant explosion in Ohio. But when I hear that, I'm wondering, okay, what was the act what was the root cause of that that explosion? Was it was it operator failure? Was it was it equipment failure? Or was it f you know, A nefarious adversary. I and in in they don't always tell us that. Brian: Yeah. Are are there are there deeper investigations going on into these things now that, you know, there's more awareness of these cyber threats? Tom: I think there's definitely more attention to it. I as far as as far as whether or not every single one of these things that's been happening is getting the investigative time it requires, I don't know the answer to that. the DHS, the way the authorities work in the United States, the DHS has the capability to investigate, but does not have the capability to compel. So they can investigate, you know, apply let's say water tree water. sanitization plant, for example. They can investigate an incident there, but they can't really say to the owner operator, you must fix this. It gets a little different when the FBI gets involved if there's a known attack, because then the FBI can compel the organization to make the corrective, take the corrective measures to fix it. But there's always been an issue with kind of division of authorities in this country. And obviously that's done to protect the owner operators because I think Foreign operators would be reluctant if they knew that the government could come in at any time and say, We're shutting you down. from from many for many reasons, right? So Brian: Yeah. But it it seems like there's just this giant risk there because of that, right? Tom: Yeah. absolutely. And you know, and and there's other there's other cultural issues too. In a lot of organizations, the operational technology owners, the engineers who work, let's say it's microchip factory or something, they work in the clean rooms with the you know, with the white gloves and the white suits on, they may not have many conversations with enterprise IT about how their securities interlocked or intermeshed and That's that's a cultural thing. And I you know, some years ago I had written a paper about this sort of alluding to the fact that organizations need to have a sit-down, you know, with a whiteboard and they need to go through and I actually had created a a new algorithm for determining risk in an organization. But really they just need to sit down and have a conversation. Whether they use my new algorithm or not is irrelevant. Brian: Right. Tom: the conversation should happen. And it's not clear to me that in every instance it happens as it should. And there are legitimate reasons actually for operational technology to connect to enterprise information technology. For example, the data historian. The data historian records all the transactions that are occurring on all the devices in the environment. And that's typically in the enterprise IT domain because it's used for billing. So, you know, it's kind of like the there's there's legitimate reasons to have these things connected. But there that but then there's other instances where you find you walk into an organization and you just you discover that their you know their chief of engine their chief engineering officer or their chief technology officer is the same person who's doing marketing for the organization because of because of limits of resources. This happens and it's not again, Brian: Yeah, yeah. Yeah. Tom: it's not a dig on on anybody. it's just we have to pay closer attention. And you know, there's there's another thing happened too, and I haven't mentioned this yet. a lot of the technology was digitized. So when they went from traditional hardwired relays to PLCs, programmable logic controllers, that that changed the paradigm a lot. And that happened probably late 1970s, early 1980s. and then they and at the same time, you know, there were organizations creating these programmable logic controllers that were, you know, creating proprietary communications protocols. Which is fine. That makes perfect sense. and n you know, no issue with that. But I think as more and more parts of the factory got digitized, it was happening so fast that the the owner operators weren't keeping up with the pace of what was happening in in sort of the cybersecurity domain. And Brian: Mm-hmm. Tom: it there there's there was a delay for 10, 12, 20 years that you know gave it gave You know, foreign intelligence services, the opportunity to enumerate networks and you know, install APTs surreptitiously all over the world. I mean, the thing I didn't mention about the about the data historian is yes, it's used for billing, but yes, it also knows everything about every transaction that occurs, you know, behind the wall, so to speak, in the factory. so it's a very valuable piece of information for somebody who's trying to enumerate a network. Brian: Right, so it could be an extremely dangerous piece of information, right? Yeah. Tom: Absolutely. And and and I'm not saying that, you know, the attackers are going straight after the data historians. that may or may not be the case. we we we we saw issues with there was a flurry of issues with ransomware happening. I mean certainly the the the colonial pipeline attack was a ransomware issue. So ransomware affects really traditionally enterprise IT, but it can, you know, there's there's secondary and tertiary effects to that. So ransomware has not gone away. It has not decreased or increased its its steady state. it's still happening in lots of instances. Brian: You had a you alluded to a little bit about AI and and how that might be, you know, working its way into things. Tom: Yes, but Brian: But it it it's definitely, it it's top of the mind for everybody, executives and us also in the news a lot and you know, this gloom and doom about AI. So wha what is your take on it? Is it is it making things better or worse, or do we even know yet? Tom: So I think that it's like any new technology. It's it's a little bit overhyped. I think the dangers are overhyped to some degree right now. organizations, the the the drivers in the AI front in the United States, for example, have every reason in the world to let people know they should be afraid of what AI is capable of doing. we saw that this person resigned a couple weeks ago from one of those organizations and said, it's gonna kill us all. I think that's that's over that's that's overstated. I think these actions have political motivations behind them, really complex funding motivations behind them. now does does that mean that AI isn't you know changing the way everything works? It is absolutely changing the way everything works. Is it changing the way operational technology works? Yes, it's going to. It's going to optimize workflows. It's going to improve probably manufacturing and distribution of many things. But here's the problem. It's exactly what happened before. The adoption of the technology far outpaces the understanding of the technology. So little known fact about me, my first tech job was building LLMs in in the late 1990s for a company in Cambridge, Massachusetts. I built, I was doing I was doing speech and language recognition and machine learning then. So I've known about this topic Brian: Okay. Tom: for over 25 years. I've been, you know, I've never lost sort of my interest in it. so you know, is it is it is it you can end the world? Brian: Hmm. Tom: I think nobody really nobody really knows the answer to that. I think it it's kind of like quantum computing because you hear about you hear sometimes about quantum computing. Quantum cryptography, post-quantum cryptography. Until everybody understands better how all these things work together. And this is the problem. Traditional computer scientists have a mathematical background and they're hardcore scientists, but they may not be physicists. And in order to understand some of those technologies, you need to understand physics. But back to the AI question. I think we have to be very critical in how we evaluate what we hear in the media about what's happening. Now, Brian: Mm. Tom: does Agentik AI have the capability to access things that it probably shouldn't? Yes, that's been proven. does it have the ability to, you know, write attacks? Absolutely. And don't think for a minute that our adversaries, we'll just say the big five, haven't thought about this already. They they've been they've been thinking about this for years. And as we enable, so as we enable more things. More workflows, more processes in any in any place with AI, we do have to be mindful of what exposures we're creating for ourselves by doing that. one exposure that people typically don't think of is if they're putting proprietary information into a large language model, that can be that can be subpoenaed, that can be read, that can be publicly displayed. And the Brian: Mm. Tom: companies, you know, the chat GPTs and the anthropics, they have been very clear about this. They have not They'd never said that, you your your information is secure with us. No, they said we're gonna we can we can tell everybody in the world about it. So Brian: Right, it's really easy to use those tools now, so everyone's using them and Tom: It Brian: all that data's getting out there. Tom: it is and I can tell you that software engineering overnight has changed 180 degrees because you can you can divide you can write a program now and you can you can actually say you know you can tell Claude to take your program and test it, run SQA on it, and then you can say, Hey Cloud, I need to add a couple modules and it will do it for you. So but the magic You you always have to take the we'll refer to as the magic cure for everything with you know a little bit of caution. Judicious behavior is required. And the other issue too right now is that the the the the government, it's not just our government, it's really worldwide governments they're they're just starting to catch up to you know what AI is and what ML is. They haven't even started to think about the security, the vulnerabilities and exposures that it it can create. Brian: Yeah, so just Tom: It's Brian: y yet another thing to be worried about, I guess. Yeah. Tom: You should definitely people should definitely be concerned about AI and the potential of of abuse of AI. I I think that with everything, with with any new technology, there's always going to be, you know, a hundred things that is amazing at improving. But then there's gonna be a hundred things that, you know, it's a hundred new vulnerabilities, a hundred new attack surfaces. So you have to kind of look at things, I don't want to say cynically, but Realistically, you have to look at them realistically that way. Because I mean, let's the the potential for how AI will change. I mean, everything from intelligence processing, dissemination, collection, it's gonna change everything. It's gonna change virtually everything we do. I don't want to say it's going to be a crisis of confidence, but there's going to be at some point in the very near future, people are going to say, well, how much of our proprietary information is in that large language model? And I don't think anybody's, I don't think companies are actually Brian: All right. Tom: even really having a conversation about that yet. They're saying, look at this process optimization. Look at how fast we can develop this product or this software. I know that some of the companies I was alluding to earlier that I'm not going to mention my name who are sort of in the forefront of ICS and OT security. I know that they some years ago everybody was very resistant to AI and machine learning. And I've noted that this year, everybody has embraced it. So there's a change there too. And again, Brian: Yeah. Tom: I think I think modeling attack simulations with AI would would be an amazing thing to. offer an organization. Hey, we analyzed your organization. We looked at all the, you know, all the devices, all the interconnections, and and this these were attacks we simulated. This is how you defend yourself. But the problem is if if I can do that, so kind of foreign adversary. And you know they're not gonna they're not gonna help the company. They're gonna they're gonna exploit the attack. So it's it's a catch twenty two. Yeah, it's Brian: Right, they're in the other business. Tom: a catch twenty two. And I don't want to say the sky is falling. I don't I don't believe in hyperbolic assessments like that, especially with new technology. I think I I do think that I you know, I will say this for the podcast record. when we when it comes to AI being run on a quantum computer, we can't do that yet. We we need to understand better. We need five to ten years of using AI as we are not as we are right now to understand better what happens because And and again, quantum computing is is owned by companies right now. It's not it's not a publicly released thing. So the companies are gonna have to look at this first. So the the the Googles, the Amazons, the IBMs of the world, and whatever companies in foreign countries are doing this, which I'm sure there are many, they're gonna have to look at these things first because I would suggest that Plugging an AI like you know, fable or something into a quantum computer would be a disaster. I I I just I would just suggest that straight away because quantum computing rapidly accelerates the rate at which the decisions can be made. And we're human beings, we work, you know, sort of on a very specific clock and we can only see and do so much. So Brian: Yeah, not quite at that scale. Right, right. All right, well maybe that's a good place to s end. Sto stop our conversation. Tom: Yeah, I think I think it I think it definitely I think it definitely is. and again I I do I do urge I d I just want to reiterate, I urge caution. I don't think that you know, AI is gonna turn the lights out tomorrow and shove everybody's water off. But I think we need to be mindful that if it does it somewhere once, we have problem. It needs further investigation. Brian: Hopefully those investigations continue and, you know, people become more aware of what's going on. Tom: I have faith that everybody's making the the best effort they can, but again, with we're working, you know, at our speed. It's it's slower in some ways than it should be. Brian: Right. Right. All right. Well thank you so much for coming on and sharing your expertise. I I think it was a good message. So Tom: Absolutely, Brian. I appreciate the opportunity to talk about these things and I wish you a great day. Brian: Great, well thank you very much. And just a reminder that you can find this podcast and subscribe on Apple Podcast and Spotify and YouTube and all those other major streaming platforms Tom: Yeah. Brian: at podcastferndon.com. This has been the Decision Advantage. Thank Tom: Yeah. Brian: you for joining us.