Latest / Cyber Go-To-Market Talk: The Cybersecurity Podcast About Cyber Sales, Marketing & Revenue Growth / 137: Ian Bramson, Global Head of Industrial Cybersecurity at ABS Group, talks about the 3 shifts coming in industrial and operational tech security

Transcript

137: Ian Bramson, Global Head of Industrial Cybersecurity at ABS Group, talks about the 3 shifts coming in industrial and operational tech security · Cyber Go-To-Market Talk: The Cybersecurity Podcast About Cyber Sales, Marketing & Revenue Growth

• 0:32
  SPEAKER_01: Cybersecurity for operational technology and industrial systems is a hot topic right now.
• 0:39
  SPEAKER_01: The security of these systems is important to the critical revenue generation parts of companies and also to governments and whole countries.
• 0:48
  SPEAKER_01: Global head of industrial cybersecurity at ABS Group, Ian Bramson, is talking at RSA about three shifts he sees coming in this space.
• 0:58
  SPEAKER_01: Get a sneak peek of his talk in this episode.
• 1:12
  SPEAKER_01: Welcome to the Sales Bluebird podcast, which exists because at B2B startups, it's hard to get consistent traction and scale the sales team.
• 1:21
  SPEAKER_01: Sales Bluebird gives you tips, tricks, experiences, examples, inspiration, and ideas from people who've lived in the cybersecurity world and know a thing or 10 about selling and building startups.
• 1:32
  SPEAKER_01: I am your host, Andrew Monahan.
• 1:34
  SPEAKER_01: Our guest today is Ian Bramson, the global head of industrial cybersecurity at ABS Group.
• 1:41
  SPEAKER_01: Ian, welcome to Sales Blue Bird.
• 1:43
  SPEAKER_01: Thank you for having me.
• 1:44
  SPEAKER_01: I'm looking forward to this, Ian, because you're speaking at RSA in a couple of weeks' time.
• 1:49
  SPEAKER_01: And we're going to get a bit of a sneak preview into what the topic is.
• 1:53
  SPEAKER_01: And I think right now, at this time in the world we're at, things about cybersecurity that earned traditional enterprise IT cybersecurity are fascinating and very timely.
• 2:02
  SPEAKER_01: So I'm looking forward to our conversation.
• 2:04
  SPEAKER_01: But before we get to the business end of this, let's get to know the real Ian a little bit.
• 2:09
  SPEAKER_01: I've got 15 questions on my list here, Ian.
• 2:12
  SPEAKER_01: And I'm going to ask you to randomly pick a number between one and 15.
• 2:15
  SPEAKER_01: All right, how about three?
• 2:17
  SPEAKER_01: Three.
• 2:18
  SPEAKER_01: Do you prefer a tricked-out Jeep or a German car with all the gadgets?
• 2:23
  SPEAKER_00: German car with all the gadgets.
• 2:25
  SPEAKER_00: Do you have one right now?
• 2:26
  SPEAKER_00: I have a German car with a lot of gadgets, yeah.
• 2:29
  SPEAKER_00: Good.
• 2:30
  SPEAKER_00: I'm a cyber guy.
• 2:31
  SPEAKER_00: I'm a digital guy.
• 2:32
  SPEAKER_00: We like the gadgets.
• 2:33
  SPEAKER_00: For sure.
• 2:33
  SPEAKER_00: Next number.
• 2:34
  SPEAKER_01: 11.
• 2:35
  SPEAKER_01: 11.
• 2:36
  SPEAKER_01: One event in the world that you haven't been to, but you would love to attend.
• 2:41
  SPEAKER_01: Winter Olympics.
• 2:42
  SPEAKER_01: Oh, where's the next one?
• 2:43
  SPEAKER_01: We just had one, right?
• 2:44
  SPEAKER_01: So where's the next one?
• 2:45
  SPEAKER_01: Do you know?
• 2:45
  SPEAKER_00: Yeah, I don't know where the next one is.
• 2:47
  SPEAKER_00: The last one was, I believe, China, so I'm not sure where the next one is, but it was on a bucket list for my wife, and I thought, you know what?
• 2:53
  SPEAKER_00: That'd be super cool to go to.
• 2:54
  SPEAKER_01: It would be, wouldn't it?
• 2:55
  SPEAKER_01: Yeah, I live in Colorado, so we get the World Cup here every year.
• 2:59
  SPEAKER_01: Yeah, I live in Denver.
• 3:00
  SPEAKER_01: Oh, you're in Denver as well.
• 3:00
  SPEAKER_01: I'm on the Seth side, so we should catch up afterwards.
• 3:03
  SPEAKER_01: There you go.
• 3:03
  SPEAKER_01: We should absolutely catch up afterwards.
• 3:05
  SPEAKER_01: Another number of team one in 15.
• 3:07
  SPEAKER_01: Seven.
• 3:08
  SPEAKER_01: Seven is what's a great airport you've been to?
• 3:10
  SPEAKER_00: Actually, I do like Denver Airport a lot, but I will say also I like the Heathrow.
• 3:17
  SPEAKER_00: It's big, but there's a lot of stuff when you're stuck there, you can go do.
• 3:21
  SPEAKER_01: Yeah, I have a love-hate relationship with Heathrow.
• 3:23
  SPEAKER_01: Being a Brit, I've been through that airport more times than I care to admit.
• 3:26
  SPEAKER_00: Yeah.
• 3:27
  SPEAKER_00: Well, there's also direct flight here, so maybe I'm a little partial.
• 3:31
  SPEAKER_00: It's one of the few places I can get a direct flight from Europe in, so I might have ulterior motives.
• 3:36
  SPEAKER_00: Yeah, you can get BA and United into Heathrow now, I think.
• 3:39
  SPEAKER_01: So all right, so that's a little bit about you, but let's move on to the business side of this.
• 3:43
  SPEAKER_01: The starting point for our conversation is your talk at RSA is on the big area of operational technology, cybersecurity.
• 3:52
  SPEAKER_01: For those of us that have kind of heard the phrase but perhaps don't understand exactly what it means, what the heck is operational technology?
• 3:59
  SPEAKER_00: It's a fair question to ask because it is something that is really emerging in a lot of markets or at least a lot of minds of executives.
• 4:07
  SPEAKER_00: It's always been around, but it's been something that's been picking up a lot more momentum.
• 4:11
  SPEAKER_00: The simplest way to talk about it is really compare it to IT.
• 4:16
  SPEAKER_00: IT is all the stuff that we know, your computers, your systems, regular systems, what we're working on now, your phones, all the stuff that makes the enterprise part of the business go.
• 4:25
  SPEAKER_00: OTs, when you cross over that precipice and in an industrial environment, all those machines, all those devices that either generate power at the manufacturing floor or even in maritime, the engines of makes things go, all those devices and equipment, they're all connected.
• 4:43
  SPEAKER_00: And that's what we call OT, the operational technology.
• 4:46
  SPEAKER_00: It's in that technology environment, in that area that the industry is actually operated.
• 4:52
  SPEAKER_00: And it's an emerging area of both vulnerability and all sorts of other kinds of sales activity and et cetera.
• 4:59
  SPEAKER_00: So it's emerging in the cyber universe as a pretty significant area of focus.
• 5:03
  SPEAKER_01: Me looking in from the outside has an impression that in enterprise IT, things are fluid and move a run.
• 5:11
  SPEAKER_01: There's moves to clouds, and there's mobile technology and there's virtual technology and all this stuff going on.
• 5:16
  SPEAKER_01: And in comparison, on the operational side, it seems to me I've been a bit more stable.
• 5:22
  SPEAKER_01: Is that a fair assessment?
• 5:23
  SPEAKER_00: Actually, I would say in some ways it's almost the opposite, in the sense that an OT environment is really different than the IT in a few fundamental ways.
• 5:33
  SPEAKER_00: One is an IT environment, you usually change out the equipment every five years or so.
• 5:38
  SPEAKER_00: In an industrial environment, you can have a turbine in there for 50 years.
• 5:41
  SPEAKER_00: And so you've got a lot of legacy and old technology in there.
• 5:45
  SPEAKER_00: And then they've laced a bunch of stuff on top of that.
• 5:48
  SPEAKER_00: And then they've started connecting everything with digitalization.
• 5:51
  SPEAKER_00: So they have even more modern stuff.
• 5:53
  SPEAKER_00: So things that were never meant to be connected are now being connected.
• 5:57
  SPEAKER_00: You've got a big push in digitalization and automation and autonomy and remote control of all this stuff to stay ahead of the market.
• 6:04
  SPEAKER_00: So all that stuff is getting connected more and more and more.
• 6:07
  SPEAKER_00: And then they're putting other kinds of equipment.
• 6:09
  SPEAKER_00: But it's this environment that is really this heterogeneous between old and new and all that kind of sort of chaos in that that you can put in an environment, you don't get the same kind of traffic, right?
• 6:20
  SPEAKER_00: You're not getting actual content of stuff, but you're getting a lot of machine-to-machine discussion and talking and a lot of connectivity in that environment that can be exposed.
• 6:30
  SPEAKER_00: And the other thing is the maturity level is way different than IT.
• 6:33
  SPEAKER_00: IT is way ahead of what is.
• 6:36
  SPEAKER_00: I came from the IT background, but you get into OT and some of the very basic questions cannot be answered there that would just be natural for the IT side.
• 6:45
  SPEAKER_01: You said you came from IT before.
• 6:47
  SPEAKER_01: What is your experience on both sides?
• 6:49
  SPEAKER_00: So before I was working in companies that specifically targeted the IT universe, like Booz Allen Hamilton and some other companies, some of my own, that focused on helping places like large banks help in healthcare industry, help in construction, some other industries really understand and assess what they're doing and then build their programs to match.
• 7:10
  SPEAKER_00: And then, well, about five, six years ago, I was brought into Siemens Power and Energy to head up their sales and their strategy for their OT environment, the industrial offering.
• 7:22
  SPEAKER_00: So I've been doing the OT side for probably about six, six and a half years, which oddly makes me an old man in that market.
• 7:30
  SPEAKER_00: Yeah, it's still emerging for people who are knowing what to do with it.
• 7:33
  SPEAKER_00: So we went from there then to ABS group to lead that group and to bring our managed services to market.
• 7:38
  SPEAKER_00: But the whole point on that is crossing from one to the other, there was a learning curve about how different those are.
• 7:45
  SPEAKER_00: If you're in an OT environment, the deeper you go into that, those networks, the less things look like computers and the more things look like equipment and devices and valves.
• 7:56
  SPEAKER_00: So the farther you go in, the less like a computer it looks like.
• 8:00
  SPEAKER_00: So if you're in an IT environment or used to that, it's kind of a shock to get in there and going, okay, this does not the same.
• 8:06
  SPEAKER_01: No, not at all.
• 8:07
  SPEAKER_01: And right now, we're recording this in May 2022.
• 8:11
  SPEAKER_01: What are things going on in the world right now in Ukraine and places like that?
• 8:15
  SPEAKER_01: And I'm wondering how if that's have any increasing awareness in uh industrial cybersecurity and critical infrastructure security.
• 8:23
  SPEAKER_00: Yeah, you can see it over even the last year.
• 8:25
  SPEAKER_00: I mean, it's always been around and go back to attacks in 2010 on a thing called Stuxnet that was at an Iranian nuclear facility.
• 8:33
  SPEAKER_00: But if you look even just over the last year, you can see the frequency and the potency and that market developing and accelerating.
• 8:41
  SPEAKER_00: And what I mean by that is if you look at things like colonial pipeline.
• 8:44
  SPEAKER_00: Now, colonial pipeline was an IT attack, but it had an OT consequence.
• 8:48
  SPEAKER_00: And what we mean by that is you shut the pipeline down for a week.
• 8:51
  SPEAKER_00: And in OT environment, you're not just talking about stealing data, you're talking about having kinetic or real events.
• 8:57
  SPEAKER_00: So I often will tell my customers is in OT, they want to shut stuff down, they want to blow stuff up.
• 9:02
  SPEAKER_00: It's a little more subtle than that, but I get the point across that it's kinetic and physical, cyber physical events they want to cause.
• 9:09
  SPEAKER_00: Colonial pipeline kicked off, or was around that time that a lot more infrastructure attacks started happening because people have realized, hey, wait a second, I can have these actual physical events.
• 9:18
  SPEAKER_00: I mean, I can shut a pipeline down for a week.
• 9:20
  SPEAKER_00: And even though we called it bleed, it was on the IT side, it had an OT consequence.
• 9:24
  SPEAKER_00: You started seeing more exposures come out of this thing called Log4J at the end of last year that hit SISA's CISA, their like 10 out of 10 risk rating.
• 9:33
  SPEAKER_00: That's both on the IT and the OT side.
• 9:35
  SPEAKER_00: So all these vulnerabilities were coming out, it's because people were looking for them.
• 9:38
  SPEAKER_00: You've got Pipe Dream now that you've got this recently came out.
• 9:42
  SPEAKER_00: That's an attack package specifically for OT.
• 9:46
  SPEAKER_00: So you're seeing these kinds of attacks happening, and then they're learning.
• 9:50
  SPEAKER_00: Like the bad guys are learning the environment.
• 9:52
  SPEAKER_00: And then you get something like the Ukrainian conflict, and you're just pouring gasoline on that.
• 9:56
  SPEAKER_00: Why?
• 9:57
  SPEAKER_00: Because you can see that in those attacks, they were attacks on critical infrastructure that happened weeks before any boots on the ground came in.
• 10:04
  SPEAKER_00: And then once the conflict started, what it triggered was what I call a multi-it's now a multiplayer game.
• 10:10
  SPEAKER_00: And what I mean by that is not just two countries going at it.
• 10:12
  SPEAKER_00: You had all these other groups in cyberspace jumping in.
• 10:15
  SPEAKER_00: You had anonymous declaring war on the Russian government.
• 10:18
  SPEAKER_00: I mean, that's crazy.
• 10:19
  SPEAKER_00: And so you have all these different groups jumping into this sort of cyber fight and then retaliation against other nations coming in on their political views that they're retaliating now, you know, through cyberspace all around this conflict.
• 10:31
  SPEAKER_00: And you have false flag stuff.
• 10:33
  SPEAKER_00: So it's sort of accelerating all these kinds of attacks.
• 10:36
  SPEAKER_00: And so what you're seeing in the area is not only the attacks on critical infrastructure going up, but people getting smarter about how to attack the OT side.
• 10:44
  SPEAKER_00: And then you throw a key conflict in, and it's really starting to expedite what this space is about, and not only the awareness on the good guys side, but on the bad guys side, what's happening?
• 10:54
  SPEAKER_00: I always say that the um colonial pipeline was a warning bell for the good guys, but it was a dinner bell for the bad guys.
• 11:03
  SPEAKER_00: So yeah.
• 11:03
  SPEAKER_00: Warning bell for the good guys, dinner bell for the bad guys.
• 11:07
  SPEAKER_00: I like that.
• 11:07
  SPEAKER_00: Yeah.
• 11:08
  SPEAKER_00: So that's sort of kicked off a lot of activity in the area.
• 11:11
  SPEAKER_00: And then you're you'll see it keep going.
• 11:13
  SPEAKER_00: I mean, the risks aren't going down, right?
• 11:15
  SPEAKER_00: The OT environment, the industrial environment, it's not getting less connected, it's not getting less automated, it's not getting less digital.
• 11:21
  SPEAKER_00: It's getting much more that way.
• 11:22
  SPEAKER_00: And the maturity level is still relatively low, it's still lagging.
• 11:26
  SPEAKER_00: And now bad guys are learning how to get in there.
• 11:27
  SPEAKER_00: I mean, I you don't have to be great insight to understand that risk goes up and up and up over time.
• 11:32
  SPEAKER_01: Yeah.
• 11:32
  SPEAKER_01: Well, in your talk at RSA, I wonder if that comment is related to the first point that you make.
• 11:38
  SPEAKER_01: You know, I'll read this out and I'll let you comment on it.
• 11:40
  SPEAKER_01: So it says here that uh OT cyber will overtake IT as the priority for companies.
• 11:45
  SPEAKER_01: IT-focused companies will need to offer OT services, and CISO roles need to evolve to fully address OT since it will become the gateway to funding.
• 11:55
  SPEAKER_00: Yeah.
• 11:55
  SPEAKER_00: What does that mean?
• 11:56
  SPEAKER_00: So what we're saying, and again, this is with industrial focus.
• 11:59
  SPEAKER_00: Obviously, you have no industrial basis and not necessarily relevant.
• 12:03
  SPEAKER_00: But what we're seeing directly in the market is OT protects the crown jewels.
• 12:07
  SPEAKER_00: Like that is your industrial operations.
• 12:09
  SPEAKER_00: If you're a pipeline company, you want to protect your ability to run the pipeline.
• 12:14
  SPEAKER_00: If you're an energy company, your ability to produce and transport energy.
• 12:18
  SPEAKER_00: If you're whatever, right?
• 12:19
  SPEAKER_00: If you're a manufacturing company, that floor that makes whatever you're making is the key part of how you generate revenue.
• 12:26
  SPEAKER_00: And so as that gets more exposed, and as they realize that they have to protect customers realize they have to protect that, the focus is not only expanding from the IT side, which is usually a fairly small portion with budgets decreasing, to the operational side that is really critical to how they generate revenue.
• 12:46
  SPEAKER_00: A customer generates revenue.
• 12:47
  SPEAKER_00: So what happens is that focus also from the boards of directors, and these are typically now top three to five priorities for them, as you're going in there and looking at this, they're realizing that that's what they care about because they know about risk.
• 13:01
  SPEAKER_00: They understand risk at the senior level and they want to put that focus and emphasis on there.
• 13:06
  SPEAKER_00: And if you're not catching up with that game, if you're just an IT shop that doesn't do OT, or if you're a CISO who doesn't really want to get into that, it's hard to deal with that.
• 13:14
  SPEAKER_00: Your life is going to be really, really hard coming up because the focus is shifting from one side to the other.
• 13:19
  SPEAKER_00: In fact, I've got customers looking at us, the rare OT specialists, saying, Hey, listen, if you're already, you know, protecting my turbine and all the critical stuff that I do, can you just go ahead and cover the IT side?
• 13:31
  SPEAKER_00: Can you just go ahead and do that?
• 13:32
  SPEAKER_00: Because I just want one throat to choke.
• 13:33
  SPEAKER_00: I just want one group to do it, and you're covering the crown jewels.
• 13:37
  SPEAKER_00: Can you just go ahead and just do that?
• 13:38
  SPEAKER_00: And the answer is yes, we can, but it's just an indicator and market that focus, you can see it shifting over and you can understand why.
• 13:47
  SPEAKER_00: So give a few more attacks, give a few more regulatory environments, give a few a little more tipping point.
• 13:52
  SPEAKER_00: And you seeing that sea change going over.
• 13:54
  SPEAKER_00: And if you're not in that OT game, you are gonna be on the outside of this.
• 13:58
  SPEAKER_00: And that's what I mean.
• 13:59
  SPEAKER_00: They they call it an OTIT convergence.
• 14:01
  SPEAKER_00: It's not a convergence, it's a hostile takeover.
• 14:04
  SPEAKER_00: And OT's gonna take it in those environments.
• 14:06
  SPEAKER_00: Obviously, if you don't have an OT environment, it's not relevant.
• 14:08
  SPEAKER_00: But if you have an industrial base, yeah, that's gonna be the name of the game.
• 14:11
  SPEAKER_01: Well, I think it was interesting what you said at the board understanding risk.
• 14:15
  SPEAKER_01: I would imagine in most of these companies, they know that if the manufacturing line is not manufacturing what the cost per minute or hour of downtime is.
• 14:23
  SPEAKER_01: Whereas often on the enterprise IT side, it's not quite as clear as that, right?
• 14:27
  SPEAKER_01: They're thinking about ephemeral things such as brand risk and things like that.
• 14:31
  SPEAKER_00: Right.
• 14:31
  SPEAKER_00: And it's also safety.
• 14:32
  SPEAKER_00: I mean, you hit the sort of bingo of safety on the operational side.
• 14:35
  SPEAKER_00: You can hit site safety, environmental safety, public safety, sometimes in all the same attack, right?
• 14:41
  SPEAKER_00: You're uh oil tanker and someone runs your oil tanker into another oil tanker and it all spills everywhere.
• 14:47
  SPEAKER_00: You just hit every single one of those risk things, aspects of safety.
• 14:50
  SPEAKER_00: So it's operational risk and it's safety.
• 14:52
  SPEAKER_00: And these are core.
• 14:53
  SPEAKER_00: Nothing gets you in the front of, in a bad way, of what the New York Times and something like that.
• 14:58
  SPEAKER_00: And so you've now got the valuation.
• 15:00
  SPEAKER_00: So these things hit the risk sort of Yahtzee of up and down of what they care about.
• 15:05
  SPEAKER_00: And if it goes wrong, you're gonna be able to tell because uptime is everything in OT.
• 15:11
  SPEAKER_00: There's no patch Tuesday, there's nothing because they don't want to take things down for even a second because they've measured to the second of how much things are worth, which makes it a challenge, obviously, to operate and monitor that environment.
• 15:22
  SPEAKER_00: But it also shows the importance of what they're talking about.
• 15:25
  SPEAKER_00: And back to your point, they can tell when something goes sideways in OT and ain't subtle.
• 15:31
  SPEAKER_00: So they'll go figure it out.
• 15:32
  SPEAKER_00: So they understand the risk profile of that, a customer.
• 15:36
  SPEAKER_00: Then yes, that's what they're gonna be able to do.
• 15:38
  SPEAKER_00: And that's why that focus is gonna be high.
• 15:40
  SPEAKER_01: And on your second point for your talk, I wonder how different this is in IT.
• 15:45
  SPEAKER_01: But uh, what you say is companies will buy services, not technologies.
• 15:49
  SPEAKER_01: Too many solutions confuse customers, and the need is shifting to manage services with OT taking the main priority.
• 15:57
  SPEAKER_01: I think, you know, my commentary is that wherever you look in cybersecurity, there are way too many solutions that do way too much confusing.
• 16:04
  SPEAKER_01: And it sounds like that's the same on the IT side side as on the OT side.
• 16:08
  SPEAKER_00: Well, what happened on the OT side is everyone said, oh boy, we need a technology solution.
• 16:13
  SPEAKER_00: We need great technology to monitor stuff.
• 16:14
  SPEAKER_00: We need to know what's happening.
• 16:15
  SPEAKER_00: Give me good technology.
• 16:16
  SPEAKER_00: So people ran out and got technology.
• 16:18
  SPEAKER_00: And from a business model, it makes sense.
• 16:20
  SPEAKER_00: It's scalable, et cetera, so on and so forth.
• 16:22
  SPEAKER_00: And customers said, sure, sure, let me go buy that.
• 16:24
  SPEAKER_00: The issue is they're realizing now that having a really good technology, and there's some really cool ones out there, is not nearly enough.
• 16:32
  SPEAKER_00: Why?
• 16:33
  SPEAKER_00: Because you can have the best monitoring system on the planet.
• 16:35
  SPEAKER_00: If nobody knows what that means, it is what I've heard customers call it's a glorified paperweight, and then they don't use it anymore.
• 16:43
  SPEAKER_00: And if they try to give that output of that monitoring to the IT shop, they've got no idea what that is.
• 16:49
  SPEAKER_00: You have to have what we call domain expertise.
• 16:51
  SPEAKER_00: You have to be coming from operations to no operations.
• 16:54
  SPEAKER_00: You have to know how those attacks happen.
• 16:56
  SPEAKER_00: How do they go?
• 16:57
  SPEAKER_00: What does it look like?
• 16:58
  SPEAKER_00: Where does it go?
• 16:59
  SPEAKER_00: And that's the part they're missing, that service, that taking that raw data and turning it into finished intelligence.
• 17:04
  SPEAKER_00: And finished intelligence in our world is tell me what it means and what you're supposed to do.
• 17:09
  SPEAKER_00: So, what's happening in the market is they're getting overloaded by lots and lots of technology, and then they don't know how to use the technology.
• 17:15
  SPEAKER_00: So there's a lot of confusion.
• 17:16
  SPEAKER_00: So, what customers are starting to move towards is away from the technology and into what we call a full solution.
• 17:22
  SPEAKER_00: So, give me someone who can help me select the technology, help me install it, help me rework it, and then most importantly, help me interpret what the heck it means so I can do something with it.
• 17:32
  SPEAKER_00: And if I can get one throat the choke on that, I get one group that can help me all the way through, you got my attention because the rest of this is getting to be a whole heck of a lot of noise.
• 17:41
  SPEAKER_00: And that's what we mean by that service layer, that service provider, that trusted partner that can walk them all the way through, including that critical part of interpretation.
• 17:50
  SPEAKER_00: And so that's what they are looking for now.
• 17:52
  SPEAKER_00: That's what that will start flipping from the initial gee it's a technology solution.
• 17:56
  SPEAKER_00: Now it's like, mm-mm, it's a full solution that you need, the services and the technology bundled, led by that service, because that's what the customer just needs, that trusted partner.
• 18:05
  SPEAKER_01: If I was to compare that to my experience on the IT side for managed services, is that so a lot of companies on the IT side, I would say play at managed services.
• 18:15
  SPEAKER_01: They're very good at monitoring and you know, putting their sensors out there and deploying some tools, but that layer of intelligence to know, you know, what does this really mean is something that I think many, many miss.
• 18:26
  SPEAKER_01: But it seems like the key ingredient for you on the OT side.
• 18:30
  SPEAKER_00: Yeah, it's it's a huge part because we're also seeing IT shops going, we can install that stuff in your site and pull it.
• 18:37
  SPEAKER_00: We already have a sock, we'll just pull it into our security operations center, no problem.
• 18:40
  SPEAKER_00: The problem is when alert comes in, I've had this, I've sat at an actual customer site and they're like, well, and our IT shop can handle it.
• 18:46
  SPEAKER_00: I'm like, okay, what do they do when an alert happens?
• 18:48
  SPEAKER_00: Well, they call the site.
• 18:49
  SPEAKER_00: They call the and say, hey, I have something.
• 18:52
  SPEAKER_00: But they have no idea what it is.
• 18:53
  SPEAKER_00: So they're asking the plant manager, hey, is this something?
• 18:57
  SPEAKER_00: Could this be important?
• 18:58
  SPEAKER_00: Well, you don't even need the IT shop for that.
• 19:00
  SPEAKER_00: The technologies have raised alerts themselves.
• 19:03
  SPEAKER_00: What you need, I said, well, do you want to have that, the person calling your plant?
• 19:07
  SPEAKER_00: You might be under attack asking you might what is happening?
• 19:10
  SPEAKER_00: Or do you want the person who's calling in saying, okay, here's the situation.
• 19:13
  SPEAKER_00: This is what's happening.
• 19:14
  SPEAKER_00: It's at this severity.
• 19:15
  SPEAKER_00: We've already kicked this into gear, and this is what you need to do now, and this is what you need to do next.
• 19:19
  SPEAKER_00: You're under attack now.
• 19:21
  SPEAKER_00: Who do you want calling?
• 19:22
  SPEAKER_00: All right.
• 19:23
  SPEAKER_00: So that's the difference between those areas of people who can kind of just slap stuff on and say that they're doing.
• 19:28
  SPEAKER_00: And as this goes on, that's going to be more of those, those kind of fake, like I can do it myself, whether it be internal or external, say, Oh, yeah, I can do that.
• 19:35
  SPEAKER_00: Can you?
• 19:36
  SPEAKER_00: Right.
• 19:36
  SPEAKER_00: And so you have to be selective about the people who are born and bred in OT who understand it, because if you don't have that interpretation layer, that understanding, that guidance, then you don't have anything.
• 19:47
  SPEAKER_01: Yeah.
• 19:47
  SPEAKER_01: And I'm sure that drives a premium as well in terms of what you can provide to and charge for the services.
• 19:54
  SPEAKER_00: Yeah, it makes the whole area obviously a custom and premium area, but you also want to be price conscious because these are operations.
• 20:01
  SPEAKER_00: And so there are people in the market now that will charge extraordinary amounts for that because they feel that they can.
• 20:07
  SPEAKER_00: The problem is that makes it out of reach for most.
• 20:10
  SPEAKER_00: So you have to have a solution that does actually fit the business ends.
• 20:13
  SPEAKER_00: One of the reasons why you don't want to take it internally, because to build all that, it's such a small group of people who can do it and do it well.
• 20:20
  SPEAKER_00: Even finding them is going to be hard, but what you're going to put in there for cost is incredible.
• 20:25
  SPEAKER_00: So that's why A, a managed service works anyway, because you can do it at an affordable rate.
• 20:30
  SPEAKER_00: But even in that arena, you want to be able to have a solution that fits.
• 20:34
  SPEAKER_00: I mean, that's what happened with a lot of the service side on managed services that came in from either, you know, traditional consulting shops or OEMs, and they're breathtakingly expensive.
• 20:44
  SPEAKER_00: So it's not feasible either.
• 20:45
  SPEAKER_00: So you have to hit that right part of saying high value, like you know what you're doing, you can get the job done, but you've built your model so that people can actually, you know, afford it, because otherwise it doesn't fit.
• 20:56
  SPEAKER_00: If you can't afford it, then it's not a solution.
• 20:58
  SPEAKER_01: Your third point on your talk kind of caught my eye because I think it's for me, it was a little bit counterintuitive and different, certainly, I think, to my experience on the IT side.
• 21:07
  SPEAKER_01: And I'll I'll tell everyone what it is.
• 21:09
  SPEAKER_01: You say that market drivers will be more important than regulations.
• 21:13
  SPEAKER_01: Compliance motivates you to do the least, competition motivates you to do the most.
• 21:18
  SPEAKER_01: And an industrial cyber hygiene will be a competitive advantage and be included in RFPs.
• 21:23
  SPEAKER_01: Why do you say that?
• 21:25
  SPEAKER_00: So, as this starts evolving, so obviously we had the uh lots of attacks here, and we have right now a lot more regulatory environment coming or on its way, executive orders, and then they're expanding what they mean by industrial cybersecurity.
• 21:39
  SPEAKER_00: So everyone tends to look at the government and say, okay, what are you gonna do about it?
• 21:43
  SPEAKER_00: But compliance is by its nature a lowest common denominator game, meaning they have to apply it to everyone.
• 21:50
  SPEAKER_00: So usually it's what's the least amount of things that you can do?
• 21:53
  SPEAKER_00: You have to report, you have to do this.
• 21:55
  SPEAKER_00: But there's a big difference between being compliant and being secure.
• 21:59
  SPEAKER_00: Huge difference.
• 22:00
  SPEAKER_00: Plenty of companies out there that were fully compliant and not very secure.
• 22:04
  SPEAKER_00: And what happens with this is it's almost a false sense of security.
• 22:07
  SPEAKER_00: Oh, I checked all the boxes for the government.
• 22:09
  SPEAKER_00: So I'm cool, I'm set, I'm secure.
• 22:11
  SPEAKER_00: And you're not, because usually those things are what we call binary.
• 22:15
  SPEAKER_00: Do you do this or do you not?
• 22:16
  SPEAKER_00: Do you meet this compliance control or do you not?
• 22:19
  SPEAKER_00: Not how well you should be, not your target state, not a maturity assessment, not saying training of my people, for example, right?
• 22:25
  SPEAKER_00: It's yes, no, do I do it?
• 22:27
  SPEAKER_00: Well, I do, I send out a PowerPoint once a year, and nobody remembers it and doesn't do anything.
• 22:31
  SPEAKER_00: Check the Box though.
• 22:32
  SPEAKER_00: But what you really need is, you know, a role-based with reinforcement, part of your safety culture, you know, all these types of things that you need to do to make it effective.
• 22:41
  SPEAKER_00: But you're not measured on that.
• 22:42
  SPEAKER_00: And neither can the government do that because it's really at the end of the day, this battle is being fought in the networks, in the operations of the customer, right?
• 22:51
  SPEAKER_00: Of these industries, of these factories.
• 22:53
  SPEAKER_00: That's where the actual stuff is taking place.
• 22:56
  SPEAKER_00: And when I say market drivers will do it, when you have, and I've been there, when an RFP comes in and you can't bid on it because a key factor is they're going to evaluate how good your cyber because they're part of your supply chain and they're eating your risk if you're not good and they put it part of that.
• 23:13
  SPEAKER_00: I've been in the room where the head of operations and the head of sales come crashing in the room, going, oh my God, we need to really increase our cybersecurity because we can't make this bid.
• 23:22
  SPEAKER_00: Well, if you start losing on your top line or you start having a no bid, I promise you that becomes the number one priority of the whole company to get that and to go beat out the other guy.
• 23:33
  SPEAKER_00: So going responding to the government, it's the least I can do.
• 23:36
  SPEAKER_00: Beating out my competition to go be able to bring food in, that's where you start getting serious about what you're going to do.
• 23:42
  SPEAKER_00: And so when companies start requiring from their suppliers or their bidders and they read and make that real, that's going to happen.
• 23:49
  SPEAKER_00: When valuations come in, if there's like a Moody's rating or a credit rating for your cybersecurity and your valuation starts going down because you didn't have clean cyber or your insurance isn't covering you, these are all the kinds of business drivers that the board of directors take very, very seriously.
• 24:06
  SPEAKER_00: And since it's directly related to revenue generation, what you're doing every day, those market drivers are going to be more and more apparent because companies don't want to again inherit the risk from somebody else, or they want to be able to require it, or they want to be able to show a customer, hey, we have it, so they go get and so they win it.
• 24:24
  SPEAKER_00: A lot of companies saying, hey, we're the most digital and coolest advanced organization.
• 24:28
  SPEAKER_00: Well, you better show that you have that and put it on the table.
• 24:31
  SPEAKER_00: That's your reputation, that's your valuation, that's your ability to succeed in market.
• 24:35
  SPEAKER_00: And as soon as those market drivers going in, if you can really kick those in, that's when it goes.
• 24:39
  SPEAKER_00: It's not to say that regulations aren't worth anything.
• 24:42
  SPEAKER_00: They get people talking about it, they get the discussion, they get some people who are waiting to spend money justified to at least start down the road, but it won't cover everything, right?
• 24:50
  SPEAKER_00: Because it can't, by definition.
• 24:52
  SPEAKER_00: It just won't.
• 24:53
  SPEAKER_00: It has to at some point take this market driver's.
• 24:56
  SPEAKER_00: And when it comes in, and you're going to learn the lesson one way or the other, meaning going to have enough really horrible attacks that people say, oh, yeah, I should put that in my market driver.
• 25:05
  SPEAKER_00: Or the smart ones, early adopters, are going to go in and start taking market advantage.
• 25:08
  SPEAKER_00: One way or another, those market drivers are much more effective than just pure regulatory drivers.
• 25:13
  SPEAKER_01: I like that actually.
• 25:14
  SPEAKER_01: And in fact, now that I hear you talk about it, it's different to what I had in my mind when I read the paragraph, first of all.
• 25:19
  SPEAKER_01: So it does make perfect sense.
• 25:20
  SPEAKER_01: And I see that on the IT side as well to a certain extent, right?
• 25:23
  SPEAKER_01: Where they have to fill in these third-party assessments and they have to attest to various things as part of RFPs, that you can't flub your answers, right?
• 25:31
  SPEAKER_01: There's actually consequences if you don't get it right.
• 25:33
  SPEAKER_01: One of the things that uh, as I heard you talking through this, you know, was coming back to your first point about the hostile takeover of IT by OT.
• 25:42
  SPEAKER_01: Putting this in the context of our audience, which is sellers and sales leaders at cybersecurity companies, should we be getting a lot more aware and knowledgeable about OT, even though we're all working pretty much in IT security right now?
• 25:57
  SPEAKER_00: I absolutely think you should.
• 25:58
  SPEAKER_00: And let me put it in a sales context, right?
• 26:00
  SPEAKER_00: This is an emerging market, which means there's emerging opportunity.
• 26:03
  SPEAKER_00: This is a top three, sometimes top one priority of senior executives.
• 26:08
  SPEAKER_00: So you want to up your profile, you want to sell at something at a much more enterprise level, you want to get the attention and be the more of the consultative approach and that strategic partner.
• 26:19
  SPEAKER_00: Cyber's your wedge for that.
• 26:20
  SPEAKER_00: If you want to start getting into new areas that people are not, OT, industrial cyber, that's your avenue to get those conversations.
• 26:27
  SPEAKER_00: IT is a tough spot right now because A, there's a lot of people in it.
• 26:32
  SPEAKER_00: B, it's not directly related to their core identity and revenue of a company, meaning it's not getting the kind of attention at the C level that you would think that you will get at an OT.
• 26:42
  SPEAKER_00: The problem right now at the senior levels is sometimes they confuse IT and OT, but that's not gonna last forever.
• 26:47
  SPEAKER_00: You're gonna get more and more savvy board members and you wanna be at the forefront of that.
• 26:51
  SPEAKER_00: And as these things happen, they haven't hit the full tipping point yet.
• 26:55
  SPEAKER_00: This market is still forming.
• 26:57
  SPEAKER_00: And whether that be from regulatory environment, market drivers, or God forbid, some major attacks, it's gonna run.
• 27:03
  SPEAKER_00: And it's gonna run in hard on OT.
• 27:05
  SPEAKER_00: You want to be there now and you wanna be able to talk about it.
• 27:08
  SPEAKER_00: And even today, if you can show a complete solution, proper complete solution, you can really talk OT, you're gonna get a lot more traction at senior levels than you would ever have just with IT.
• 27:19
  SPEAKER_01: And if I'm sitting there as a seller in a team somewhere, I'm in my home office basement in the middle of Ohio somewhere, my company's not training me and all this stuff.
• 27:27
  SPEAKER_01: How do I go and learn?
• 27:28
  SPEAKER_01: Where do I go?
• 27:29
  SPEAKER_00: That's a great question because there's not one perfect way.
• 27:32
  SPEAKER_00: Even when they ask me, well, to whom do you sell?
• 27:34
  SPEAKER_00: Like, so who do you go to?
• 27:35
  SPEAKER_00: Who's buying this?
• 27:36
  SPEAKER_00: Right.
• 27:37
  SPEAKER_00: And first question from a salesperson, right?
• 27:39
  SPEAKER_00: Who do I target?
• 27:40
  SPEAKER_00: A lot of times it's the IT and the CISO that got the rose pinned on them, but then they go to the operations and the operations guys are like, who are these IT guys?
• 27:48
  SPEAKER_00: And so you're ending up navigating.
• 27:50
  SPEAKER_00: There's no like role that says, OT cyber director, man, I'm gonna go after that person.
• 27:54
  SPEAKER_00: And so even the sales techniques, you're gonna have to learn more.
• 27:57
  SPEAKER_00: I mean, you wanna go and understand.
• 27:59
  SPEAKER_00: You don't need to know every bit and bite.
• 28:01
  SPEAKER_00: In fact, you wanna be able to translate this all into business terms.
• 28:04
  SPEAKER_00: That's lesson number one.
• 28:05
  SPEAKER_00: Put this in business terms and business context, because the people who are buying this are business people, not the technical people.
• 28:11
  SPEAKER_00: Okay.
• 28:11
  SPEAKER_00: But what you really wanna be able to do is learn enough about the area in OT.
• 28:16
  SPEAKER_00: And there's SANS Institute, there's other places that will give you some basic learning, right, on what you need to get so you can at least talk the talk, right?
• 28:24
  SPEAKER_00: You can understand what's going on.
• 28:26
  SPEAKER_00: And then you need to get into some of the organizations and companies and get close to them about who understand OT and learn from them.
• 28:33
  SPEAKER_00: That's when you start applying to your sales part, your sales techniques, because the sales techniques at the end of the day of a proper consultative selling technique.
• 28:41
  SPEAKER_00: This is not a dial by numbers, this is dealing with senior executives, solving a risk problem.
• 28:45
  SPEAKER_00: And the more you can understand how to talk risk at a senior level, translate this into business terms and understand some of the foundational elements of OT cyber and why it's different than IT, the better you'll be off talking about.
• 28:57
  SPEAKER_01: Well, that's great advice, Ian.
• 28:59
  SPEAKER_01: Thanks so much for that.
• 29:00
  SPEAKER_01: If anyone wants to get hold of you and uh further the conversation, what's the best way to do that?
• 29:05
  SPEAKER_00: Well, you can find me on LinkedIn.
• 29:07
  SPEAKER_00: So Ian Bramson should be right there, ABS group.
• 29:10
  SPEAKER_00: And you can just get me at ibramson at eagle.org or LinkedIn.
• 29:14
  SPEAKER_00: Oh, come see me at RSA.
• 29:16
  SPEAKER_01: See RSA, yeah.
• 29:17
  SPEAKER_01: So Ian Bramson with an M for mother, not an N for anything else, right?
• 29:21
  SPEAKER_01: So Ian Brams.
• 29:22
  SPEAKER_00: Sadly, the N would have made me a billionaire, but you know.
• 29:25
  SPEAKER_00: Is that how it works?
• 29:26
  SPEAKER_00: I wish.
• 29:27
  SPEAKER_00: I would have changed it long ago.
• 29:28
  SPEAKER_01: Well, listen, I really enjoyed the conversation.
• 29:30
  SPEAKER_01: Thanks for all the insight.
• 29:31
  SPEAKER_01: This is uh a fascinating world.
• 29:32
  SPEAKER_01: I think, as you say, we'll hear more and more about it, and I think the sellers will be challenged more and more to understand and take part in going forward.
• 29:40
  SPEAKER_01: So these are great ways to dip our toes in, and and maybe some of us will go a bit further than that.
• 29:44
  SPEAKER_01: So thanks so much for joining us today.
• 29:45
  SPEAKER_00: Well, thank you very much for having me.
• 29:47
  SPEAKER_01: Well, I really enjoyed that conversation with Ian.
• 29:50
  SPEAKER_01: He clearly has been in this space for a little bit and understands the dynamics and the pressures and what's going on there.
• 29:55
  SPEAKER_01: And it was really interesting, you know, that was a follow-on.
• 29:57
  SPEAKER_01: We had our interview with Dave Hatchell in this similar area just a few episodes ago.
• 30:03
  SPEAKER_01: So go back and listen to that one as well to give some more context.
• 30:06
  SPEAKER_01: But you know, my takeaways from this conversation with Ian, first of all, he made the comment that operational technology security is doing a hostile takeover of traditional enterprise IT security.
• 30:17
  SPEAKER_01: You know, due to the importance of the operational side to the revenue generation, the operating of companies, it's getting the attention at the board level and therefore funding as well.
• 30:28
  SPEAKER_01: The second takeaway I had was the real role of a proper MSSP in operational technology.
• 30:34
  SPEAKER_01: As Ian said, you know, just getting some alerts and reports from your MSSP is one thing, but actually having someone with the knowledge and the general context about what's going on to be able to make sense of those and prioritize the right ones to then take action or remediation action is super important.
• 30:52
  SPEAKER_01: And it sounds like that's uh even more important in the OT spaces, is in the IT space.
• 30:57
  SPEAKER_01: And finally, I liked what he was saying about competition is going to be the driver for people to take this seriously in operational technology side, not just compliance.
• 31:05
  SPEAKER_01: You know, we know on the IT side that compliance does not equal secure, and it seems the same on the OT side.
• 31:11
  SPEAKER_01: And what he was talking about in this episode was actually, you know, can you win business?
• 31:15
  SPEAKER_01: Can you win RFPs if you haven't got the right controls in place on the OT side, not just the IT side?
• 31:22
  SPEAKER_01: So love what he talked about, made a lot of sense to me.
• 31:24
  SPEAKER_01: And you know, it's an area that many of us on the IT side have kind of heard about, but maybe haven't fasted the time to go learn about.
• 31:30
  SPEAKER_01: Hopefully these episodes are helping you out and you can take some actions to go and learn some more.