Latest / Tech Talks With Kinsoft / Thirty Towns Without Water Controls – Minnesota, Rigged PLCs, and the Bug That Can't Be Patched

Transcript

Thirty Towns Without Water Controls – Minnesota, Rigged PLCs, and the Bug That Can't Be Patched · Tech Talks With Kinsoft

• 0:00
  So I want you to imagine, just picture staring
• 0:03
  at the main control screen in your facility's
• 0:07
  nerve center. Right. You're sitting there, you're
• 0:09
  watching all the telemetry roll in, and everything
• 0:11
  looks totally flawless. Like the thermal readings
• 0:15
  are normal, pressure valves are optimal. All
• 0:17
  the dashboards are green. Exactly, all green.
• 0:19
  To anyone in that room, it's just a... perfectly
• 0:22
  quiet tuesday but in reality right outside your
• 0:25
  control room door the heavy machinery is well
• 0:28
  it's spinning completely out of control yeah
• 0:31
  tearing itself apart right it's pushing dangerously
• 0:34
  past its physical safety limits and you looking
• 0:37
  right at your state -of -the -art monitor, have
• 0:40
  absolutely zero way to tell that any of this
• 0:42
  is happening. Which is, I mean, it's the ultimate
• 0:44
  operational blind spot. You are functionally
• 0:47
  deaf and blind to the physical reality of what
• 0:49
  your own systems are doing. All while the screen
• 0:51
  is basically telling you, hey, everything is
• 0:53
  fine. Right. And that terrifying scenario brings
• 0:56
  us to the mission of our deep dive today. We
• 0:58
  are unpacking this really sobering report from
• 1:01
  Tech Talks with Kinsoft. Yeah, it's a fascinating
• 1:03
  document. It really is. It analyzes a coordinated
• 1:07
  cyber attack on Minnesota water utilities back
• 1:10
  in late July of 2026. And usually, you know,
• 1:16
  when a major cyberson hits the news, we're talking
• 1:17
  about like a database breach. Stolen passwords,
• 1:20
  credit cards on the dark web, that sort of thing.
• 1:23
  Exactly. But this scenario is entirely different.
• 1:25
  This is a story about hacking physics. It's about
• 1:28
  seizing control of the actual physical machinery
• 1:30
  that keeps modern society running. It really
• 1:33
  demands a total paradigm shift in how we approach
• 1:36
  network security. Because the Kinsoft report
• 1:39
  gives us this chilling case study based on what
• 1:42
  happened over just 48 hours on the 26th and 27th
• 1:46
  of July. Over just two days. Just two days. And
• 1:49
  in that window, more than 30 different municipal
• 1:51
  communities in Minnesota had their water and
• 1:54
  wastewater operations suddenly disrupted. Wow.
• 1:56
  And we're talking a wide variety of targets here,
• 1:59
  right? Like Ram, Maple Plain. Plymouth, South
• 2:01
  St. Paul. Yeah, a massive spread. But before
• 2:04
  we dig into the actual mechanics of how they
• 2:06
  pulled this off, I think it is crucial to highlight
• 2:09
  the good news right off the bat for everyone
• 2:11
  listening. Nobody was poisoned. The drinking
• 2:13
  water quality itself was never compromised. There
• 2:16
  were no emergency boil water advisories forced
• 2:20
  on the public. So it's important to frame this
• 2:22
  correctly. It was a massive operational disruption,
• 2:25
  but it wasn't a public health disaster. And that
• 2:27
  distinction is the key to this entire analysis,
• 2:29
  really, because of over 30 municipal systems
• 2:32
  were compromised by an advanced attacker in just
• 2:35
  a two day window. How did they avoid a full scale
• 2:39
  public health disaster? So to understand why
• 2:41
  this attack is a huge wake up call for basically
• 2:43
  every physical industry, we first need to look
• 2:46
  at how these towns managed to survive it. Right.
• 2:48
  Let's break down the ground reality of that survival,
• 2:50
  because the disparity in scale here is just wild
• 2:54
  to me. Like Brahm is a really small town. Right.
• 2:57
  Only about 1700 people. Very small. Yeah. But
• 2:59
  then Plymouth is a much larger city of roughly
• 3:01
  80 ,000. Yet the attack effectively crippled
• 3:05
  both of them at the exact same time. Well, the
• 3:07
  thing is, the attackers didn't care about the
• 3:08
  size of the town at all. They didn't. No, because
• 3:11
  they targeted the underlying technology. Right.
• 3:13
  And that technology was fundamentally the same
• 3:15
  in a 1700 person town as it was in a big city.
• 3:18
  Oh, I see. In both of those environments, the
• 3:21
  intruders successfully disabled the computerized
• 3:23
  operating controls. Which, you know, forces the
• 3:27
  automated systems that pump and treat the water
• 3:29
  into an immediate shutdown state. Okay, so it
• 3:32
  sounds akin to, like, someone wirelessly turning
• 3:36
  off the computerized brain of your car while
• 3:38
  you're driving down the highway. That's actually
• 3:40
  a great way to think about it. But instead it's
• 3:42
  crashing into the median. The driver just calmly
• 3:45
  reached down, grabbed a purely mechanical steering
• 3:48
  wheel, and kept navigating. Because the report
• 3:51
  notes that a small town like Braham had their
• 3:53
  systems restored and pumping again in roughly
• 3:55
  two hours. Right. And I'm just trying to wrap
• 3:58
  my head around how a local utility recovers from
• 4:01
  a highly sophisticated cyber attack in just 120
• 4:04
  minutes. Like, how is that even possible? The
• 4:07
  secret to their recovery was just sheer pragmatic
• 4:10
  physical action. I mean, the public works and
• 4:12
  I .T. teams in these towns, they didn't sit in
• 4:15
  an office trying to counter hack the intruders.
• 4:17
  Right. Like in a movie. Exactly. They didn't
• 4:20
  scramble to write a software patch on the fly
• 4:22
  either. They literally drove out to the equipment
• 4:24
  at their remote water towers and lift stations.
• 4:27
  They got in their trucks. Got in their trucks,
• 4:29
  drove out, and physically disconnected the cellular
• 4:32
  connected hardware. They just yanked the cord.
• 4:34
  Just unplugged it. Yeah. And the moment that
• 4:36
  hardware was offline, they immediately reverted
• 4:40
  to their manual fallback procedures. They were
• 4:42
  out there operating the heavy valves and pumps
• 4:45
  by hand. So they bypassed the compromised digital
• 4:48
  layer entirely and went straight to the physical
• 4:50
  layer. Exactly. And that highlights a vital distinction
• 4:53
  between IT and OT. Information technology versus
• 4:57
  operational technology. Right. In traditional
• 5:00
  IT, like, say, a ransomware attack, your digital
• 5:03
  data is encrypted. You are basically paralyzed
• 5:06
  until you buy the decryption key or restore from
• 5:09
  backups. But OT governs the physical world. It
• 5:12
  controls the motors, the centrifuges, the flow
• 5:15
  valves. The actual moving parts. Right. So when
• 5:18
  the digital brain of an OT system gets compromised,
• 5:21
  the ultimate defense mechanism is just human
• 5:24
  hands taking manual control of the physical object.
• 5:27
  OK, that makes sense. But if the recovery was
• 5:30
  really that straightforward, like if it honestly
• 5:32
  just came down to unplugging a router and. manually
• 5:35
  turning a valve. Why does the Kinsoft report
• 5:38
  treat this incident like a five alarm fire? That's
• 5:41
  the real question. Yeah. Like what made this
• 5:43
  attack uniquely terrifying if they could just
• 5:45
  go analog to fix it? Well, the terror lies in
• 5:48
  the specific mechanism the attackers use, which,
• 5:51
  interestingly enough, was foreshadowed by CISA
• 5:53
  just four days before the Minnesota attacks.
• 5:55
  That's the U .S. Cybersecurity and Infrastructure
• 5:57
  Security Agency. Right. On July 22nd, CISA released
• 6:01
  this urgent update warning critical infrastructure
• 6:03
  operators that attackers were actively targeting
• 6:06
  PLCs. OK, let's pause and define that for everyone
• 6:08
  listening. PLCs, programmable logic controllers.
• 6:12
  Yes. Think of PLCs as the ruggedized blue -collar
• 6:15
  computers of the industrial world. They are the
• 6:18
  local brains that actually execute physical processes
• 6:20
  on the floor. So they are the ones opening and
• 6:22
  closing things. Right. They are programmed to
• 6:25
  open a valve when a tank is full, start a water
• 6:28
  pump, monitor pressure inside a heavy pipe. And
• 6:31
  crucially, their main job is to shut things down
• 6:34
  when those readings slip out of a safe range.
• 6:37
  And these things aren't just in water utilities,
• 6:39
  right? They're everywhere. Oh, they're literally
• 6:41
  everywhere you look. Automotive manufacturing
• 6:43
  lines, commercial refrigeration, pharmaceutical
• 6:46
  blending, massive pumping stations. So basically,
• 6:50
  if a physical object is moving automatically
• 6:52
  in a commercial setting. A PLC is telling it
• 6:55
  to move. And CISA noted that attackers were targeting
• 6:58
  PLCs made by major vendors like Rockwell Automation,
• 7:02
  Schneider Electric, and Siemens. It basically
• 7:04
  covers the vast majority of the industrial automation
• 7:08
  market globally. Wow. So this brings us back
• 7:11
  to that control room scenario we started with.
• 7:13
  Because the Kinsoft report details a really chilling
• 7:16
  methodology here. Yeah, it's incredibly precise.
• 7:18
  Yeah, right. These attackers didn't just smash
• 7:21
  through the firewall and break things randomly.
• 7:23
  They operated with incredible precision. They
• 7:26
  exfiltrated the PLC project files, which means
• 7:29
  they downloaded the actual logic program that
• 7:32
  dictates how the water plant behaves. Right.
• 7:34
  And then they manipulated something called add
• 7:37
  -on instructions. And that is the most insidious
• 7:40
  part of this whole event. See, in operational
• 7:42
  technology, the visible control program that
• 7:45
  engineers look at, the thing they check to understand
• 7:47
  how the system is behaving is called ladder logic.
• 7:50
  Ladder logic. It's basically the master blueprint.
• 7:53
  Now, the attackers left that main blueprint completely
• 7:55
  intact. So if a local plant engineer audited
• 7:58
  the core code, it looked perfectly normal and
• 8:01
  safe. Not meant to see here. Exactly. But the
• 8:03
  attackers inserted modified add -on instructions.
• 8:06
  You can think of an add -on instruction like
• 8:08
  a prepackaged subroutine or basically a black
• 8:11
  box of code. Okay. So it's sort of like a recipe
• 8:14
  where the main instructions are totally fine,
• 8:16
  but someone poisoned the prepackaged sauce packet.
• 8:19
  And the chef never even thought to check the
• 8:21
  ingredients inside the packet. That is a great
• 8:23
  way to visualize it. By manipulating that specific
• 8:26
  subroutine, they effectively disabled the system's
• 8:29
  safety shutdowns. And they silenced the alarm
• 8:32
  triggers. All while the master blueprint looked
• 8:35
  untouched. Untouched. But they didn't stop there.
• 8:37
  Which is wild. They also manipulated the operator
• 8:40
  display screens. They compromised the HMI, the
• 8:43
  human machine interface, and the overarching
• 8:46
  SCADA readouts. Which is the worst case scenario.
• 8:49
  Yeah. For those listening, SCADA is essentially
• 8:51
  the master dashboard that pulls data from all
• 8:55
  these individual PLCs into one centralized monitoring
• 8:58
  system. Right. That nerve center. Right. So if
• 9:01
  I'm the human operator sitting in that room.
• 9:03
  relying on my SCADA system to tell me the truth.
• 9:05
  I am being actively gaslit by my own facility.
• 9:08
  Like the safety interlocks are secretly disabled.
• 9:11
  The pressure could be building to a catastrophic
• 9:12
  level. But my screen is feeding me spoof data
• 9:15
  saying, hey, everything is green. You're kept
• 9:17
  completely blind to the impending danger. And,
• 9:21
  you know, that psychological component is incredibly
• 9:23
  jarring for a modern business leader because
• 9:27
  we are fundamentally conditioned to trust our
• 9:29
  telemetry. We trust our screens. You really do.
• 9:32
  Yeah. I mean, most corporate leaders have a mental
• 9:35
  model of cyber threats based entirely on data
• 9:38
  privacy, right? Protecting intellectual property,
• 9:40
  preventing wire fraud, stopping data leaks. The
• 9:43
  classic IT stuff. Exactly. So the concept of
• 9:46
  an attacker hijacking a screen specifically to
• 9:48
  hide the fact that a machine is physically tearing
• 9:51
  itself apart, that is entirely alien to them.
• 9:54
  It's this invisible phantom malfunction, which
• 9:57
  really... Force is a pretty urgent question,
• 9:59
  I think. How are these attackers gaining access
• 10:02
  to these critical physical machines in the first
• 10:04
  place? Yeah. And this brings us to a massive
• 10:06
  architectural flaw coupled with, frankly, our
• 10:09
  moderate obsession with convenience. The vulnerability
• 10:12
  at the center of this, the one detailed in that
• 10:14
  CISA advisory. is a severe authentication bypass
• 10:18
  in Rockwell's Logix controllers. Now, in the
• 10:21
  cybersecurity world, vulnerabilities are scored
• 10:24
  on a scale out of 10. This specific flaw holds
• 10:27
  a severity rating of 9 .8. 9 .8. It is near the
• 10:30
  absolute maximum level of critical hair -on -fire
• 10:33
  danger. So a 9 .8 implies the house is literally
• 10:37
  burning down and the fire extinguishers are locked
• 10:39
  inside. Pretty much. But according to the report,
• 10:42
  this vulnerability was originally disclosed in
• 10:45
  February of 2021. That was five years before
• 10:48
  the Minnesota attacks. Which brings us to the
• 10:51
  painful reality of IT versus OT life cycles.
• 10:55
  I mean, people naturally wonder, why didn't an
• 10:57
  engineer just push a patch to fix it five years
• 10:59
  ago? Right, just update it. But the problem is,
• 11:02
  Rockwell explicitly stated that this flaw cannot
• 11:05
  be fully mitigated by a simple software patch.
• 11:07
  Why can't? No, it is a fundamental architectural
• 11:10
  problem within the device itself. See, in an
• 11:12
  IT environment, if a vendor finds a flaw in Windows
• 11:15
  or whatever, They push out a patch over the weekend,
• 11:18
  your laptop reboots, and the risk is closed.
• 11:20
  In OT, it is never that simple. Why is it an
• 11:23
  architectural problem, though? Is it baked into
• 11:25
  the hardware? Essentially, yes. It's often related
• 11:28
  to how the fundamental firmware handles network
• 11:30
  authentication at a very, very low level. Updating
• 11:33
  it might require a complete firmware flash. And
• 11:36
  that's risky. Oh, incredibly risky. Flashing
• 11:39
  firmware on a critical industrial device carries
• 11:41
  the very real risk of bricking it, turning it
• 11:44
  into a useless piece of silicon. And furthermore,
• 11:47
  these PLCs are designed with a 20 -year service
• 11:51
  life in mind. Wow, 20 years? Yeah. You can't
• 11:54
  just reboot a municipal water pump or halt an
• 11:57
  automotive assembly line on a random Tuesday
• 11:59
  afternoon because a software patch came out.
• 12:00
  So you have this unpatchable 9 .8 severity flaw
• 12:04
  just sitting there on machinery. that is deemed
• 12:07
  too critical to turn off or modify. And that
• 12:09
  tension right there is what creates the opening
• 12:11
  for the attackers. It's like spending $10 million
• 12:15
  to build an impenetrable fortress wall around
• 12:18
  your facility, right? But then realizing one
• 12:20
  of the guards standing inside the wall has a
• 12:22
  personal, unsecured walkie -talkie that connects
• 12:25
  directly to the outside world. That's exactly
• 12:27
  it. Anyone can just tune into his frequency and
• 12:29
  bypass the wall entirely. So how many of these
• 12:33
  walkie -talkies are out there in the real world?
• 12:35
  Well, a group called Senses ran a global scan
• 12:38
  in April of 2026, and they found over 5 ,200
• 12:42
  Internet -exposed hosts that identified themselves
• 12:45
  as Walkwell or Allen -Bradley devices. 5 ,200.
• 12:48
  And nearly 75 % of those exposed controllers
• 12:51
  were located in the United States. So over 5
• 12:54
  ,000 unpatchable controllers just sitting on
• 12:56
  the open Internet. Yeah. But the Kinsoft report
• 12:59
  notes this really terrifying twist about how
• 13:01
  they're exposed. These devices aren't typically
• 13:04
  exposed through a corporate network error, are
• 13:06
  they? No, they aren't. They're disproportionately
• 13:08
  sitting on cellular carrier networks. Why on
• 13:11
  earth would a utility run critical infrastructure
• 13:14
  off a 4G cell signal? I mean, it comes down to
• 13:17
  basic municipal economics. Think about our small
• 13:19
  town of Broome. If they build a new water tower
• 13:21
  on the rural edge of town, they need that tower's
• 13:24
  PLC to communicate with the central control room.
• 13:27
  Sure. But digging up miles of county roads to
• 13:30
  trench a secure, hardwired fiber optic cable
• 13:33
  that could cost hundreds of thousands of dollars.
• 13:35
  Ah, so it's a budget thing. Entirely. Alternatively,
• 13:39
  a contractor can just install a cheap 4G cellular
• 13:42
  router on the tower for like a few hundred bucks.
• 13:45
  And it works immediately. Right. It's fast. It's
• 13:48
  cheap. Establishes a connection right away. But
• 13:50
  by using a 4G modem, they are entirely circumventing
• 13:53
  their own security perimeter. They bypass every
• 13:57
  sophisticated firewall and intrusion detection
• 13:59
  system the corporate IT department has carefully
• 14:02
  configured. The moment you power on that 4G router,
• 14:05
  the unpatchable industrial controller gets a
• 14:08
  public IP address from the cellular carrier.
• 14:11
  Meaning it is directly exposed to the open Internet.
• 14:13
  Exactly. And in most cases, nobody actively made
• 14:17
  a malicious decision to expose their infrastructure
• 14:19
  to hackers. The exposure just came completely
• 14:22
  free with the convenience of a 4G connection.
• 14:24
  The convenience creates the blind spot. Yep.
• 14:27
  Okay, so with thousands of these cellular backdoors
• 14:30
  scattered across the country, we really have
• 14:32
  to address who is actively exploiting them. Now,
• 14:35
  the report discusses the origins of the Minnesota
• 14:38
  attacks, and I want us to navigate this very
• 14:40
  carefully. The Kinsoft report notes that security
• 14:43
  researchers have aligned the tactics used in
• 14:45
  Minnesota with Iranian -affiliated activity that
• 14:48
  was mentioned in that original CISA advisory.
• 14:51
  Right. And it's an important point to bring up,
• 14:53
  but it's equally important to stress that the
• 14:55
  U .S. government has not made any official formal
• 14:57
  attribution regarding the Minnesota attacks.
• 15:00
  Right. The investigation is ongoing, and formally,
• 15:03
  they are still considered unknown actors. And
• 15:06
  we are going to maintain strict neutrality here
• 15:09
  for you listening. We are analyzing the mechanics
• 15:11
  outlined in the Kinsoff findings. We are not
• 15:14
  endorsing any geopolitical theories. Because
• 15:18
  for our purposes, honestly, the who matters significantly
• 15:22
  less than the how. I totally agree. The geopolitical
• 15:25
  origin is honestly way less relevant than the
• 15:27
  global ripple effect of this methodology. Which
• 15:29
  brings us to why a water utility attack in the
• 15:32
  American Midwest should matter to a listener
• 15:34
  working in, say, finance or retail or logistics
• 15:36
  halfway across the world. Right. Why should they
• 15:39
  care? Because the international community understood
• 15:41
  the severity immediately. The very next day,
• 15:45
  July 28th, the Australian Signals Directorate,
• 15:48
  the ASD, issued this unprecedented technical
• 15:51
  guidance to critical infrastructure operators.
• 15:54
  They instructed them to prepare for up to three
• 15:56
  months of disconnected manual operations. Wait,
• 16:00
  three months? I want you to imagine trying to
• 16:02
  run a modern business with zero digital controls
• 16:06
  for a quarter of a year. That is wild. It's an
• 16:10
  almost unthinkable scenario for most businesses.
• 16:13
  And we need to broaden our definition of critical
• 16:15
  infrastructure here. Because it's not just power
• 16:17
  plants. Right. Under regulations like Australia's
• 16:19
  Security of Critical Infrastructure Act, it isn't
• 16:22
  just power grids and dams. It includes food and
• 16:24
  grocery supply chains, data storage processing
• 16:27
  centers, private health care networks, and commercial
• 16:30
  transport. It essentially encompasses the entire
• 16:32
  supply chain of modern society. Yes. Think about
• 16:35
  an ordinary commercial building with an automated
• 16:38
  management system regulating its HVAC, or a regional
• 16:42
  food processing plant, a logistics warehouse
• 16:44
  using heavy compressors for cold storage, or
• 16:47
  a large -scale solar array with network -connected
• 16:51
  inverters. All of those systems rely heavily
• 16:54
  on PLCs. And very frequently, those PLCs were
• 16:58
  installed by a third -party vendor or a contractor
• 17:01
  who just slapped an undocumented cellular modem
• 17:05
  on it just to make their own maintenance easier.
• 17:06
  Exactly, so they could monitor it remotely. That
• 17:09
  hidden modem has likely never once appeared on
• 17:13
  the building owner's official IT asset register.
• 17:15
  Meaning? There's a very high probability that
• 17:18
  you listening right now have one of these cellular
• 17:20
  walkie -talkies hidden in your facility and your
• 17:22
  IT security team is entirely unaware it even
• 17:25
  exists. It's highly probable. So knowing that
• 17:27
  this threat is pervasive and that the underlying
• 17:29
  hardware is fundamentally unpatchable, we can't
• 17:32
  afford to just be paralyzed by the scope of it.
• 17:34
  We have to look at solutions. Right. Actionable
• 17:36
  steps. And the Kinsoff Report outlines a very
• 17:38
  practical playbook for survival. And I want to
• 17:41
  weave those steps into how an organization actually
• 17:44
  builds resilience. Because first off, you obviously
• 17:47
  can't protect what you can't see. Which is why
• 17:49
  the very first action must be a physical audit
• 17:52
  of your connections. You cannot rely on the network
• 17:55
  diagrams drawn up by IT five years ago. They
• 17:58
  are out of date. Because they won't show the
• 18:00
  random 4G modem the contractor added. Exactly.
• 18:03
  You have to send someone to physically walk the
• 18:05
  floor and look for hidden antennas. Facility
• 18:08
  managers need to interrogate their equipment.
• 18:11
  They need to ask, does this chiller or this pump
• 18:14
  or this solar inverter have its own independent...
• 18:18
  mobile data connection. And if you find one and
• 18:21
  you know the equipment attached to it can't be
• 18:23
  software patched, I guess the only variable you
• 18:25
  can actually control is who has access to the
• 18:27
  device. Yeah. So you have to sever that public
• 18:29
  internet connection. That is the core of network
• 18:31
  segmentation. Industrial control systems should
• 18:34
  never, under any circumstances, sit on the same
• 18:37
  network as your corporate email servers or file
• 18:40
  shares. Makes sense. And they certainly shouldn't
• 18:42
  have a direct path to the open internet. If a
• 18:45
  vendor absolutely requires remote access, For
• 18:47
  maintenance, it must be routed through a heavily
• 18:50
  authenticated, strictly monitored choke point.
• 18:52
  So no more cheap, direct 4G modems just bypassing
• 18:56
  the firewall. No more of that. Which leads us
• 18:58
  to the human element of resilience, the manual
• 19:00
  fallback procedures. Because Brams survived.
• 19:04
  Because their public work staff knew exactly
• 19:07
  how to physically run the plant in an emergency.
• 19:10
  Right. And this forces a really tough question
• 19:12
  for business leaders. Has anyone in your organization
• 19:15
  actually attempted to run your core physical
• 19:18
  processes without the aid of a control system
• 19:21
  any time in the last decade? It's a critical
• 19:24
  stress test. You really have to write down your
• 19:26
  manual procedures. And more importantly, you
• 19:28
  have to physically practice them. And that brings
• 19:30
  us to... Honestly, my favorite realization from
• 19:33
  this entire report, because when they discuss
• 19:36
  how to defend against these phantom malfunctions
• 19:38
  where the screen is actively lying to the operator,
• 19:41
  the report states that you simply cannot trust
• 19:43
  the screen. You really can't. There's a real
• 19:45
  elegance to the idea that in an era of advanced
• 19:48
  artificial intelligence, machine learning, military
• 19:51
  -grade cryptography, the ultimate firewall against
• 19:55
  a sophisticated cyber weapon is just an analog
• 19:57
  pressure gauge. It really is a profound engineering
• 20:01
  reality because in the realm of OT security,
• 20:05
  out -of -band sensors, independent telemetry,
• 20:08
  physical analog gauges, They are not antiquated
• 20:13
  relics of the past. They're not just old junk.
• 20:15
  No, they are legitimate, critical security controls.
• 20:18
  Because if your digital control system is compromised
• 20:21
  and that system is the only source of truth telling
• 20:24
  you the plant is safe, you have zero independent
• 20:26
  verification. You're completely blind. Right.
• 20:29
  But a mechanical analog backup gauge provides
• 20:32
  absolute truth because it is physically unhackable
• 20:35
  from a keyboard in another country. It is brilliant
• 20:38
  in its simplicity. A mechanical dial doesn't
• 20:41
  have an IP address. Exactly. And that reliance
• 20:43
  on the physical world brings us to the human
• 20:45
  margin, which I really view as the ultimate takeaway
• 20:47
  from the Kinsoft analysis. Yeah, the human margin
• 20:50
  is everything here. Because the only reason the
• 20:52
  Minnesota attacks were recorded as a two -hour
• 20:54
  operational inconvenience rather than a devastating
• 20:56
  public health emergency was because the human
• 20:59
  beings on the ground possessed the institutional
• 21:01
  knowledge required to operate the machinery without
• 21:03
  a computer guiding them. But the report ends
• 21:05
  with a very stark warning. regarding that exact
• 21:09
  human margin because that manual analog knowledge
• 21:13
  is quietly disappearing from our workforce. It's
• 21:16
  vanishing. Right. Every time a veteran employee
• 21:19
  retires, like the engineer who has been walking
• 21:22
  the floor for 30 years and remembers how to manually
• 21:25
  crank the heavy valves, and they're replaced
• 21:27
  by a newer operator who has only ever known how
• 21:30
  to click a mouse on a digital SCADA screen, that
• 21:33
  organization loses its last, most vital line
• 21:36
  of defense. we are basically witnessing a silent
• 21:39
  brain drain across industrial sectors we are
• 21:42
  actively trading robust physical knowledge for
• 21:44
  digital convenience and it is leaving our critical
• 21:47
  infrastructure incredibly fragile absolutely
• 21:49
  when the digital layer inevitably fails or is
• 21:52
  compromised the physical knowledge required to
• 21:55
  catch the fall simply isn't there anymore Sitting
• 21:57
  in a control room staring at a screen that assures
• 21:59
  you everything is perfect while the machine tears
• 22:01
  itself apart is such a terrifying prospect. So
• 22:04
  I want to leave you with a final lingering thought
• 22:06
  to ponder long after this deep dive ends. If
• 22:08
  all the smart systems, the automated screens,
• 22:11
  and the digital controls in your own workplace
• 22:13
  went completely dark tomorrow morning, what critical
• 22:16
  tasks do you no longer know how to perform manually?
• 22:19
  We're all relying far too much on the screen
• 22:21
  to tell us the truth.