Latest / The Identity Blueprint / How to Govern 40 Isolated OT Tenants Centrally

Transcript

How to Govern 40 Isolated OT Tenants Centrally · The Identity Blueprint

• 0:00
  SPEAKER_00: Welcome back to the Identity Blueprint, Beyond the Domain.
• 0:03
  SPEAKER_00: I'm Ernie with Jose.
• 0:06
  SPEAKER_00: This episode is about the environments where a normal security tool can actually break the plant it's supposed to protect.
• 0:13
  SPEAKER_00: Where running an antivirus scan can crash a valve controller and endanger lives.
• 0:18
  SPEAKER_00: We trace how a Chinese state-sponsored group gets into critical infrastructure without ever touching malware, why a DevOps engineer's home media server once became the way into a corporate vault, and how you govern 40 isolated OT tenants from one central point without ever opening an inbound connection to any of them.
• 0:38
  SPEAKER_00: We also cover the 2AM problem, how break glass access works when an engineer needs in immediately, and how every keystroke still gets recorded.
• 0:48
  SPEAKER_00: Let's get into it.
• 0:49
  SPEAKER_01: So picture this.
• 0:57
  SPEAKER_00: Right, down in Florida.
• 0:58
  SPEAKER_01: Yeah, exactly, Florida.
• 0:59
  SPEAKER_01: And he's just sitting there, and suddenly he watches his mouse cursor start moving across the screen on its own.
• 1:06
  SPEAKER_00: Which is terrifying.
• 1:07
  SPEAKER_00: I mean, that's the ultimate nightmare scenario for an operator.
• 1:10
  SPEAKER_01: Literally, he is not touching the mouse and he watches this cursor navigate through the plant's supervisory control software.
• 1:18
  SPEAKER_01: It opens the controls for the sodium hydroxide systems.
• 1:21
  SPEAKER_01: That's lie, right?
• 1:22
  SPEAKER_01: Yes, lie.
• 1:23
  SPEAKER_01: It alters the chemical levels from 100 parts per million to 11,100 parts per million.
• 1:28
  SPEAKER_00: Wow.
• 1:29
  SPEAKER_01: Yeah, that is a highly lethal concentration of lie, just being prepared to get pushed directly into a municipal water supply.
• 1:35
  SPEAKER_01: Trevor Burrus, Jr.
• 1:36
  SPEAKER_00: And this is exactly why we're doing this deep dive today.
• 1:38
  SPEAKER_01: Right.
• 1:39
  SPEAKER_01: Thankfully, the operator manually intervened.
• 1:41
  SPEAKER_01: He reversed the change and caught the attack before the water actually left the plant.
• 1:45
  SPEAKER_01: But it really sets the stage.
• 1:47
  SPEAKER_01: Welcome to our deep dive.
• 1:48
  SPEAKER_00: Glad to be here.
• 1:49
  SPEAKER_01: Today we are exploring the high-stakes world of operational technology or OT and cyber physical systems.
• 1:56
  SPEAKER_00: And we're really digging into some heavy source material here: synthesizing SISA guidelines, zero trust reference architectures, and deep dive technical post-incident reports.
• 2:06
  SPEAKER_01: Right.
• 2:07
  SPEAKER_01: Because we want to answer one massive critical question for now today.
• 2:11
  SPEAKER_01: How do organizations with strictly segmented, heavily regulated OT environments centralize human identity governance?
• 2:18
  SPEAKER_00: And crucially, how do they do that without breaking the isolation that keeps these physical systems safe?
• 2:24
  SPEAKER_01: Aaron Powell Exactly.
• 2:25
  SPEAKER_01: Because we are talking about stolen credit cards here.
• 2:28
  SPEAKER_01: We're talking about securing the systems that control power grids, water supplies, and manufacturing plants from advanced nation-state threats.
• 2:35
  SPEAKER_00: Aaron Powell The gravity of this cannot be overstated.
• 2:37
  SPEAKER_00: I mean the Oldsmar incident perfectly frames the reality of the attack surface today.
• 2:41
  SPEAKER_01: Aaron Powell Yeah, because you'd think an attack like that would be some crazy, highly sophisticated malware, right?
• 2:46
  SPEAKER_00: Right.
• 2:46
  SPEAKER_00: We always envision these nation-state attacks on infrastructure requiring, you know, incredibly complex, custom-built tools targeting obscure scatter vulnerabilities.
• 2:57
  SPEAKER_01: But the post-incident report on Oldsmart revealed something way more mundane.
• 3:02
  SPEAKER_00: And way more mundane.
• 3:03
  SPEAKER_00: The attacker just gained access through a dormant installation of TeamViewer.
• 3:07
  SPEAKER_01: Just standard TeamViewer.
• 3:09
  SPEAKER_00: Standard, everyday third-party remote access tool.
• 3:12
  SPEAKER_00: And they used a compromised password.
• 3:14
  SPEAKER_01: That's it.
• 3:15
  SPEAKER_01: One remote access credential and an unsecured desktop sharing tool.
• 3:19
  SPEAKER_00: That was the entire attack path to potentially poisoning an entire city's water supply.
• 3:24
  SPEAKER_00: Just one identity failure.
• 3:26
  SPEAKER_01: Wow.
• 3:26
  SPEAKER_01: But before we can even talk about fixing that security, we really have to understand how the adversaries are breaking in.
• 3:32
  SPEAKER_01: And honestly, why traditional IT security simply doesn't work in this environment.
• 3:37
  SPEAKER_00: Right.
• 3:37
  SPEAKER_00: Because you can't look at that dormant team viewer installation as just an IT oversight.
• 3:42
  SPEAKER_00: It's not just someone forgetting to uninstall a program.
• 3:45
  SPEAKER_01: So what is it then?
• 3:46
  SPEAKER_00: It was there because the business demanded it.
• 3:49
  SPEAKER_00: For the past decade, there's been this massive push from the C-suite for IT and OT convergence.
• 3:56
  SPEAKER_01: The buzzword convergence.
• 3:57
  SPEAKER_00: Exactly.
• 3:58
  SPEAKER_00: Executives, you know, they want real-time production metrics flowing straight into their corporate data lakes.
• 4:03
  SPEAKER_01: They want the dashboards.
• 4:04
  SPEAKER_00: They want the dashboards.
• 4:06
  SPEAKER_00: They want predictive maintenance algorithms analyzing pump vibrations in the cloud.
• 4:11
  SPEAKER_00: And they want third-party vendors to troubleshoot a programmable logic controller, a PLC remotely.
• 4:18
  SPEAKER_01: Right.
• 4:18
  SPEAKER_01: Instead of flying an engineer out to a physical plant at three in the morning, which makes business sense.
• 4:24
  SPEAKER_00: It makes total business sense.
• 4:25
  SPEAKER_00: Efficiency is king.
• 4:27
  SPEAKER_00: But that demand for efficiency has systematically dismantled the traditional air gap.
• 4:33
  SPEAKER_01: Okay, let's define that for a second.
• 4:34
  SPEAKER_01: The air gap.
• 4:35
  SPEAKER_01: Because for decades that was the gold standard, right?
• 4:38
  SPEAKER_00: It was the only standard, really.
• 4:39
  SPEAKER_00: The foundational security control for industrial environments was physical and logical isolation.
• 4:44
  SPEAKER_01: Aaron Powell Literally a gap of air between the internet and the plant.
• 4:48
  SPEAKER_00: Yes.
• 4:48
  SPEAKER_00: The network running the manufacturing floor had zero routing capability to the corporate IT environment.
• 4:54
  SPEAKER_00: None.
• 4:54
  SPEAKER_01: Aaron Powell So to change a set point on a pipeline valve, an engineer had to, what, physically walk up to it?
• 5:00
  SPEAKER_00: They had to physically stand in front of the terminal on the plant floor.
• 5:04
  SPEAKER_00: But the moment you connect that historian database to the corporate network to pull those efficiency metrics you wanted.
• 5:09
  SPEAKER_01: Or the moment you install TeamViewer so a vendor can manage a remote PLC.
• 5:14
  SPEAKER_00: Aaron Powell Exactly.
• 5:15
  SPEAKER_00: You bridge that gap.
• 5:16
  SPEAKER_00: You've essentially built a hundred invisible bridges over the moat you thought was protecting your castle.
• 5:21
  SPEAKER_01: Aaron Powell And the consequences shift dramatically when you do that.
• 5:24
  SPEAKER_00: Aaron Powell You do too.
• 5:24
  SPEAKER_00: In traditional enterprise networks, if credentials get compromised, what happens?
• 5:28
  SPEAKER_01: You get data exfiltration or ransomware encrypts your billing servers.
• 5:33
  SPEAKER_01: It's bad, it's expensive, but it's digital.
• 5:35
  SPEAKER_00: Right.
• 5:36
  SPEAKER_00: But in the converged OT environment, those same compromised credentials allow an attacker to alter the physical laws of the facility.
• 5:44
  SPEAKER_01: Aaron Powell Like pressure, temperature, flow rates, like we saw with the lie in the water.
• 5:48
  SPEAKER_00: Aaron Powell Exactly.
• 5:48
  SPEAKER_00: You're risking catastrophic equipment damage, environmental disasters, or actual loss of life.
• 5:54
  SPEAKER_01: Aaron Powell So the natural assumption for an IT security architect looking at this is well, if the boundary is porous now, just lock down the endpoints.
• 6:01
  SPEAKER_00: Just treat it like IT.
• 6:03
  SPEAKER_01: Yeah.
• 6:03
  SPEAKER_01: Deploy CrowdStrike or Defender.
• 6:05
  SPEAKER_01: Run continuous vulnerability scans.
• 6:07
  SPEAKER_01: Why can't we just do that?
• 6:08
  SPEAKER_00: Aaron Powell Because the friction of security in these environments makes active defense mathematically and operationally impossible.
• 6:15
  SPEAKER_01: Mathematically impossible.
• 6:17
  SPEAKER_00: Yes.
• 6:17
  SPEAKER_00: It starts with a fundamental inversion of priorities.
• 6:20
  SPEAKER_00: In enterprise security, we build everything around the CIA triad.
• 6:24
  SPEAKER_01: Confidentiality, integrity, and availability.
• 6:27
  SPEAKER_00: Right.
• 6:28
  SPEAKER_00: And confidentiality is always top of mind.
• 6:31
  SPEAKER_00: If a threat actor is detected exfiltrating data from a corporate server, the automated IT response is to sever the connection.
• 6:38
  SPEAKER_01: Quarantine the server, stop the leak.
• 6:40
  SPEAKER_00: Right.
• 6:41
  SPEAKER_00: Confidentiality dictates shutting the system down.
• 6:43
  SPEAKER_00: But in the industrial world, that triad completely flips to AIC.
• 6:48
  SPEAKER_01: Availability, integrity, and confidentiality is last.
• 6:51
  SPEAKER_00: A distant third.
• 6:53
  SPEAKER_00: Availability and integrity are absolute non-negotiable mandates.
• 7:00
  SPEAKER_00: You really can't.
• 7:01
  SPEAKER_00: If you apply an automated IT response to a high-pressure gas pipeline controller, say quarantining the PLC because you detected a behavioral anomaly, you don't just lose data.
• 7:11
  SPEAKER_01: The valves lock.
• 7:12
  SPEAKER_00: The valves lock in their current state.
• 7:14
  SPEAKER_00: The pressure builds within the pipe, the mechanical failsafes get overwhelmed.
• 7:18
  SPEAKER_01: And you cause a kinetic explosion.
• 7:19
  SPEAKER_00: Exactly.
• 7:20
  SPEAKER_00: You cannot quarantine a cyberphysical system to prevent data exfiltration.
• 7:25
  SPEAKER_00: The physical safety of the facility supersedes every single cybersecurity policy.
• 7:31
  SPEAKER_01: Okay, so that's the policy side.
• 7:32
  SPEAKER_01: But you mentioned it's mathematically impossible.
• 7:34
  SPEAKER_01: That sounds like a hardware problem.
• 7:35
  SPEAKER_00: It is a massive hardware problem.
• 7:37
  SPEAKER_00: Legacy OT equipment is incredibly fragile by modern IT standards.
• 7:41
  SPEAKER_01: So we can't run an endpoint detection and response agent and EDR on a PLC.
• 7:46
  SPEAKER_00: Not at all.
• 7:47
  SPEAKER_00: And it's not just an OS compatibility issue like trying to run Windows software on Linux.
• 7:52
  SPEAKER_00: It's a fundamental timing issue.
• 7:54
  SPEAKER_01: How so?
• 7:55
  SPEAKER_00: Industrial controllers operate on real-time operating systems, RTOS.
• 7:59
  SPEAKER_00: They are tuned to execute specific repetitive logic within strict microsecond execution windows.
• 8:05
  SPEAKER_01: Microseconds.
• 8:06
  SPEAKER_00: Yes.
• 8:06
  SPEAKER_00: The polling cycle of a physical valve relies on absolute determinism.
• 8:10
  SPEAKER_00: So if you install an EDR agent that periodically runs background memory scans, like it would on a normal laptop.
• 8:17
  SPEAKER_00: Right.
• 8:17
  SPEAKER_00: Or if it intercepts system calls to analyze behavior for malicious patterns, you introduce latency.
• 8:22
  SPEAKER_01: Oh, I see where this is going.
• 8:23
  SPEAKER_00: Yeah.
• 8:24
  SPEAKER_00: If that background memory scan causes the controller's CPU to spike and it misses its microsecond execution window by even a fraction of a second.
• 8:33
  SPEAKER_01: The physical valve it controls might stay open 10 milliseconds too long.
• 8:37
  SPEAKER_00: Exactly.
• 8:37
  SPEAKER_00: And in a high-speed chemical mixing process, that 10 millisecond delay throws the entire batch out of tolerance.
• 8:44
  SPEAKER_00: Or worse, it creates a dangerous physical state.
• 8:48
  SPEAKER_01: Okay, so EDR is out because it literally breaks the timing of the engine.
• 8:52
  SPEAKER_01: What about active vulnerability scanning?
• 8:54
  SPEAKER_01: Just sending network pings to see what's vulnerable?
• 8:57
  SPEAKER_00: Aaron Powell That creates a similar disaster, but usually through network stack exhaustion rather than CPU latency.
• 9:02
  SPEAKER_01: Aaron Powell Because IT scanners are aggressive, right?
• 9:04
  SPEAKER_00: Yeah, very standard IT scanners like Nessus or Nmap are designed to aggressively probe IP addresses.
• 9:11
  SPEAKER_00: They send malformed packets, test open ports, banner grab to identify vulnerabilities.
• 9:15
  SPEAKER_01: Aaron Powell And I'm guessing a PLC from 1998 doesn't handle that well.
• 9:19
  SPEAKER_00: Not at all.
• 9:20
  SPEAKER_00: The network interfaces on those legacy devices were never designed to handle a modern TCP SYN flood or a barrage of complex queries.
• 9:27
  SPEAKER_01: What happens when they get hit with one?
• 9:29
  SPEAKER_00: Well, they were engineered with these microscopic memory buffers.
• 9:32
  SPEAKER_00: They're only meant to listen for highly specific, lightweight proprietary commands.
• 9:37
  SPEAKER_00: Right.
• 9:37
  SPEAKER_00: So when an active IT scanner hits a legacy OT device with a standard vulnerability sweep, it overflows those tiny memory buffers.
• 9:45
  SPEAKER_01: It just drops the packet.
• 9:46
  SPEAKER_00: Worse.
• 9:47
  SPEAKER_00: It physically locks up.
• 9:49
  SPEAKER_00: The network interface crashes entirely, severing the supervisory control from the physical machinery.
• 9:54
  SPEAKER_01: Which means the operators are totally flying blind.
• 9:57
  SPEAKER_00: Completely blind.
• 9:58
  SPEAKER_00: And the only way to fix it is a hard physical reboot on the plant floor.
• 10:02
  SPEAKER_01: Man, applying IT security tools to an industrial control system really is like trying to install a modern anti-theft computer in a vintage steam locomotive.
• 10:12
  SPEAKER_00: That is a perfect analogy.
• 10:13
  SPEAKER_01: You aren't going to secure it, you're just going to break the engine.
• 10:15
  SPEAKER_00: You're just going to break it.
• 10:16
  SPEAKER_00: And to compound the issue, the communication protocols themselves provide zero native defense.
• 10:22
  SPEAKER_01: You mean things like Modbus and DMP3?
• 10:24
  SPEAKER_00: Exactly.
• 10:25
  SPEAKER_00: Modbus, TCP, DNP3.
• 10:27
  SPEAKER_00: These industrial protocols were designed decades ago under the assumption of a fully isolated, trusted network.
• 10:34
  SPEAKER_01: Right, back when the air gap was real.
• 10:36
  SPEAKER_00: Exactly.
• 10:36
  SPEAKER_00: So they lack native authentication headers.
• 10:39
  SPEAKER_00: They don't utilize encryption.
• 10:41
  SPEAKER_00: They operate on blind trust.
• 10:43
  SPEAKER_01: Wait, really?
• 10:44
  SPEAKER_01: So if a packet just shows up, it assumes it's allowed?
• 10:47
  SPEAKER_00: Yes.
• 10:47
  SPEAKER_00: If a packet arrives at a controller containing the hexadecimal command to open a valve, the controller executes the command.
• 10:54
  SPEAKER_01: Regardless of who sent it.
• 10:56
  SPEAKER_00: It doesn't matter if it originated from the legitimate engineering workstation or an attacker who is pivoted into the network.
• 11:02
  SPEAKER_00: It just blindly obeys.
• 11:04
  SPEAKER_01: That's terrifying.
• 11:05
  SPEAKER_01: So who is actively looking for these invisible bridges we built, and what are they doing when they cross them?
• 11:11
  SPEAKER_00: Well, this specific combination of factors, the impossibility of active defense, the fragile endpoints, the inherent trust of the protocols, is exactly what advanced threat actors exploit.
• 11:21
  SPEAKER_01: Like Volt Typhoon.
• 11:23
  SPEAKER_00: Exactly.
• 11:24
  SPEAKER_00: The size of Microsoft Intelligence reports on Volt Typhoon really highlight how nation-state adversaries adapt to these exact environments.
• 11:31
  SPEAKER_01: Now, Volt Typhoon is a Chinese state-sponsored threat actor, right?
• 11:35
  SPEAKER_00: Yeah.
• 11:35
  SPEAKER_00: Right.
• 11:35
  SPEAKER_00: And their objective is not financial extortion.
• 11:38
  SPEAKER_00: This isn't a ransomware gang trying to get a quick payout.
• 11:40
  SPEAKER_01: So what's the motive?
• 11:42
  SPEAKER_00: It is strategic military prepositioning.
• 11:45
  SPEAKER_00: They are seeking persistent deep access within U.S.
• 11:49
  SPEAKER_00: critical infrastructure.
• 11:51
  SPEAKER_01: To do what exactly?
• 11:52
  SPEAKER_00: To disrupt operations during a broader geopolitical conflict.
• 11:56
  SPEAKER_00: They want the ability to turn off the lights or shut down the water if things get hot globally.
• 12:01
  SPEAKER_01: Aaron Powell So because they know active EDR and continuous scanning can't be deployed on the OT side, how do they get in without being caught?
• 12:08
  SPEAKER_00: Aaron Powell Their evasion strategy focuses heavily on the ITOT boundary and they don't drop custom malware.
• 12:14
  SPEAKER_01: Aaron Powell Why not?
• 12:15
  SPEAKER_01: Wouldn't custom malware be more effective?
• 12:17
  SPEAKER_00: No, because malware generates signatures.
• 12:20
  SPEAKER_00: It creates a digital trail that threat hunters will eventually find.
• 12:23
  SPEAKER_01: Aaron Powell Oh, I see.
• 12:24
  SPEAKER_01: So what do they do instead?
• 12:25
  SPEAKER_00: They rely heavily on what we call living off the land techniques or LOT.
• 12:30
  SPEAKER_01: Living off the land, meaning using what's already there.
• 12:32
  SPEAKER_00: Aaron Powell Exactly.
• 12:33
  SPEAKER_00: The LOTO methodology is about perfectly mimicking authorized administrative behavior.
• 12:37
  SPEAKER_01: Aaron Powell So they don't hack the PLC, they hack the person who controls the PLC.
• 12:41
  SPEAKER_00: Aaron Powell You nailed it.
• 12:43
  SPEAKER_00: Volt Typhoon compromises a valid human IT credential, often targeting engineers or administrators who already have remote access privileges.
• 12:52
  SPEAKER_01: Aaron Powell And once they have that valid identity, they pivot.
• 12:54
  SPEAKER_00: They move through the enterprise network and move laterally into the engineering workstations or the historian databases.
• 13:00
  SPEAKER_01: Which sit right on that ITOT boundary we talked about.
• 13:03
  SPEAKER_00: Exactly.
• 13:04
  SPEAKER_00: And from there, they utilize the native tools already built into the Windows environment.
• 13:08
  SPEAKER_01: Things like PowerShell.
• 13:09
  SPEAKER_00: PowerShell, Windows Management, Instrumentation WMI, and even the proprietary vendor programming software used to manage the PLCs.
• 13:18
  SPEAKER_01: So if I'm looking at a monitoring tool, how on earth do I even begin to spot the anomaly?
• 13:23
  SPEAKER_01: It's literally the system's own trusted management software logging in with a valid credential.
• 13:29
  SPEAKER_00: That's the terrifying part.
• 13:30
  SPEAKER_00: To the limited monitoring tools that might exist, the traffic looks entirely legitimate.
• 13:36
  SPEAKER_01: It just looks like Bob doing his job.
• 13:38
  SPEAKER_00: It's the authorized engineering account, executing standard WMI queries from the designated engineering workstation.
• 13:44
  SPEAKER_00: The adversary has completely cloaked themselves in the operational baseline.
• 13:48
  SPEAKER_01: That makes me think of the LastPass breach case study.
• 13:51
  SPEAKER_00: Oh, that is highly relevant here.
• 13:53
  SPEAKER_01: Right.
• 13:53
  SPEAKER_01: Not because LastPass is OT, obviously, but because it shows the insane patience and lateral thinking these adversaries apply to get those human identities.
• 14:03
  SPEAKER_00: Yes.
• 14:04
  SPEAKER_00: They will go to incredible lengths to acquire those highly privileged identities before they ever even touch the corporate perimeter.
• 14:11
  SPEAKER_01: Like walk us through that LastPass example because it's wild.
• 14:15
  SPEAKER_00: It really is.
• 14:16
  SPEAKER_00: It's a prime example of bypassing hardened enterprise defenses by targeting the human element operating outside the corporate firewall.
• 14:24
  SPEAKER_01: Right.
• 14:24
  SPEAKER_01: So the threat actors needed the master password of a specific DevOps engineer.
• 14:29
  SPEAKER_01: Right.
• 14:29
  SPEAKER_01: Trevor Burrus, Jr.
• 14:30
  SPEAKER_00: An engineer who possessed the decryption keys for the corporate vault.
• 14:33
  SPEAKER_00: But they understood the corporate network was heavily monitored.
• 14:36
  SPEAKER_01: They knew they couldn't just brute force the front door.
• 14:39
  SPEAKER_00: Exactly.
• 14:39
  SPEAKER_00: So they mapped the engineer's personal attack surface, and they discovered he was running a Plex Media Server on his home network.
• 14:47
  SPEAKER_01: Like for watching movies at home?
• 14:49
  SPEAKER_00: Yep.
• 14:49
  SPEAKER_00: And that specific version of Plex had a publicly known vulnerability, CVE 2020 5741, which allowed remote code execution.
• 14:59
  SPEAKER_01: So they exploited a media server in this guy's living room.
• 15:03
  SPEAKER_00: They did.
• 15:03
  SPEAKER_00: They used it to install a key logger on his personal workstation.
• 15:06
  SPEAKER_00: And here's where the patience comes in.
• 15:09
  SPEAKER_00: The timing is the critical factor.
• 15:10
  SPEAKER_01: Aaron Powell They didn't try to steal a password immediately, did they?
• 15:13
  SPEAKER_00: No.
• 15:13
  SPEAKER_00: They waited for the engineer to authenticate to the corporate environment naturally.
• 15:17
  SPEAKER_00: They let him clear the multifactor authentication challenge.
• 15:20
  SPEAKER_01: Aaron Powell The biometric check, the hardware token, all of it.
• 15:23
  SPEAKER_00: All of it.
• 15:24
  SPEAKER_00: The key logger captured the keystrokes of the master password after the MFA challenge was totally satisfied.
• 15:29
  SPEAKER_01: Wow.
• 15:30
  SPEAKER_01: So they bypassed the entire zero trust corporate perimeter by compromising the human identity at its most vulnerable point.
• 15:36
  SPEAKER_00: Aaron Powell Exactly.
• 15:37
  SPEAKER_00: And when you apply that level of targeting to an OT environment, you realize the sheer magnitude of the problem.
• 15:44
  SPEAKER_01: Because if an adversary compromises an engineer's identity with that level of sophistication, and then they utilize living off-the-land techniques to pivot through the network using native protocols.
• 15:54
  SPEAKER_01: And we already established we can't run EBR or active scanners to detect them.
• 15:59
  SPEAKER_00: Right.
• 16:00
  SPEAKER_00: The architectural options for defense narrow drastically.
• 16:02
  SPEAKER_00: You can't use your normal IT toolkit.
• 16:05
  SPEAKER_01: So what do we do?
• 16:06
  SPEAKER_01: If active defense is mathematically impossible without crashing the plant, how do we establish visibility and control?
• 16:14
  SPEAKER_00: The only option left is passive architecture.
• 16:16
  SPEAKER_00: The security strategy has to shift entirely to network visibility and extreme identity segmentation.
• 16:22
  SPEAKER_01: Aaron Powell Okay, let's break that down, starting with visibility.
• 16:24
  SPEAKER_01: Since we can't touch the endpoints, how do we see what's happening?
• 16:27
  SPEAKER_00: Aaron Powell We have to tap the network without interacting with the endpoints.
• 16:31
  SPEAKER_00: This relies heavily on configuring span ports on the industrial network switches.
• 16:36
  SPEAKER_01: Span ports?
• 16:37
  SPEAKER_01: What does that stand for?
• 16:38
  SPEAKER_00: Switch port analyzer.
• 16:39
  SPEAKER_00: It's a configuration that allows the switch to basically mirror a copy of all passing network traffic and send it to an out-of-band monitoring interface.
• 16:47
  SPEAKER_01: So it's like a wiretap.
• 16:49
  SPEAKER_00: Exactly like a wiretap.
• 16:50
  SPEAKER_00: The monitoring tool passively ingests the traffic without ever transmitting a single packet back onto the operational network.
• 16:56
  SPEAKER_01: Aaron Powell So it's purely listen-only, zero physical disruption to the PLCs.
• 17:01
  SPEAKER_00: Zero.
• 17:02
  SPEAKER_00: But standard IT network traffic analyzers are useless here.
• 17:05
  SPEAKER_01: Why?
• 17:05
  SPEAKER_01: If they're just listening.
• 17:07
  SPEAKER_00: Because they don't understand the payload of industrial protocols.
• 17:09
  SPEAKER_00: They just see gibberish.
• 17:11
  SPEAKER_00: This necessitates specific parser engines.
• 17:14
  SPEAKER_01: Oh, like translators.
• 17:15
  SPEAKER_00: Right.
• 17:16
  SPEAKER_00: The CISA guidelines point to open source CM solutions like Malcolm.
• 17:21
  SPEAKER_00: Malcolm heavily utilizes Zeke parsers.
• 17:24
  SPEAKER_01: Zeke parsers?
• 17:25
  SPEAKER_00: Yeah, they are custom built to decode proprietary OT protocols down to the absolute command level.
• 17:31
  SPEAKER_01: So what does that actually look like for the security team?
• 17:34
  SPEAKER_00: It can take a raw Modbus TCP packet, decode the payload, and literally tell the team this specific IP address just sent a command to change the set point on the boiler from X to Y.
• 17:45
  SPEAKER_01: Oh wow.
• 17:46
  SPEAKER_01: So you get complete behavioral baselines for the physical processes without touching the fragile endpoints?
• 17:51
  SPEAKER_00: Exactly.
• 17:51
  SPEAKER_00: You get the visibility.
• 17:52
  SPEAKER_01: Yeah.
• 17:52
  SPEAKER_00: But once you have that passive visibility, you have to enforce boundaries to contain lateral movement.
• 17:57
  SPEAKER_01: Right, because if they get in, you need to stop them from moving around.
• 17:59
  SPEAKER_00: Aaron Powell And the foundational framework for this segmentation is the Purdue Enterprise Reference Architecture.
• 18:06
  SPEAKER_00: You should just call the Purdue model.
• 18:07
  SPEAKER_01: The Purdue model.
• 18:08
  SPEAKER_01: I've heard this tossed around a lot.
• 18:09
  SPEAKER_01: How does it actually work?
• 18:11
  SPEAKER_00: It characterizes the industrial environment into a strict hierarchy of five distinct levels to establish logical boundaries.
• 18:18
  SPEAKER_01: Aaron Powell Okay, what are the levels?
• 18:19
  SPEAKER_00: Level zero encompasses the physical processes, the actual mechanical pumps, valves, and sensors.
• 18:25
  SPEAKER_01: The metal and the liquid.
• 18:26
  SPEAKER_00: Right.
• 18:27
  SPEAKER_00: Level one contains the basic control devices like the PLCs that read those sensors and actuate the valves.
• 18:32
  SPEAKER_01: Got it.
• 18:33
  SPEAKER_00: Level two is the supervisory control, the localized human-machine interfaces or HMIs on the plant floor.
• 18:40
  SPEAKER_01: Where the operator was sitting during the old Zamar attack.
• 18:43
  SPEAKER_00: Exactly.
• 18:44
  SPEAKER_00: Then level three is site operations that houses the engineering workstations and historian databases.
• 18:49
  SPEAKER_01: The boundary layer.
• 18:50
  SPEAKER_00: Yes.
• 18:50
  SPEAKER_00: And finally, levels four and five represent the corporate IT enterprise networks.
• 18:55
  SPEAKER_01: Aaron Powell So applying zero trust to this Purdue model, what does that actually look like in practice?
• 19:01
  SPEAKER_00: Aaron Powell It means instituting mandatory identity checkpoints between every single one of those levels.
• 19:06
  SPEAKER_01: Aaron Powell So you can't just jump from level four straight down to level two.
• 19:09
  SPEAKER_00: Absolutely not.
• 19:10
  SPEAKER_00: Direct, uninspected lateral movement is blocked.
• 19:13
  SPEAKER_00: The default routing stance at every single layer must be deny all permit by exception.
• 19:19
  SPEAKER_01: Aaron Powell And this isn't just a theoretical best practice, is it?
• 19:22
  SPEAKER_00: No, it's heavily codified in regulatory frameworks.
• 19:25
  SPEAKER_00: NRC CIP, for example, dictates strict physical and electronic security perimeters for electric utilities.
• 19:31
  SPEAKER_01: And IEC 62443 for industrial automation, right?
• 19:35
  SPEAKER_00: Exactly.
• 19:36
  SPEAKER_00: IEC 62443 mandates the establishment of defined security zones and conduits.
• 19:42
  SPEAKER_00: These frameworks force organizations to physically and logically isolate these environments.
• 19:47
  SPEAKER_01: But wait, if we segment the network this aggressively and require multiple identity checkpoints, doesn't this create a massive headache for identity governance?
• 19:55
  SPEAKER_00: It creates an immense architectural puzzle.
• 19:57
  SPEAKER_01: Yeah, I'm thinking about a massive energy conglomerate.
• 20:00
  SPEAKER_01: Say they're operating 40 different high-pressure gas pipelines across the continent.
• 20:04
  SPEAKER_00: Right.
• 20:05
  SPEAKER_00: Very common scenario.
• 20:06
  SPEAKER_01: Each of those 40 pipeline facilities must be strictly segmented according to the Purdue model and EEC 624443, right?
• 20:14
  SPEAKER_01: Correct.
• 20:14
  SPEAKER_01: So if the central IT team attempts to manage the human identities for the engineers working on all 40 pipelines, and they connect them back to a single unified active directory forest at corporate headquarters.
• 20:27
  SPEAKER_00: They have fundamentally violated the isolation mandate.
• 20:30
  SPEAKER_01: Because connecting 40 isolated OT environments to one centralized identity provider builds 40 invisible bridges directly into the most critical infrastructure.
• 20:40
  SPEAKER_00: You're creating a master key.
• 20:42
  SPEAKER_00: If an adversary compromises that central identity tenant, they instantly gain lateral pathways into every single pipeline facility.
• 20:48
  SPEAKER_01: The centralized efficiency mechanism literally becomes a single point of catastrophic failure.
• 20:53
  SPEAKER_00: Exactly.
• 20:54
  SPEAKER_00: So to solve this, the architecture mandates what we call the 40-tenant silo model.
• 20:59
  SPEAKER_01: The silo model.
• 20:59
  SPEAKER_01: How does that compare to standard cloud identity setups?
• 21:02
  SPEAKER_00: Aaron Powell Well, when evaluating multi-tenancy and cloud identity architectures like Entra ID, there are generally three models.
• 21:08
  SPEAKER_00: Yeah.
• 21:08
  SPEAKER_00: The pool model, the bridge model, and the silo model.
• 21:11
  SPEAKER_01: Okay.
• 21:11
  SPEAKER_01: Break this down.
• 21:12
  SPEAKER_00: The pool model shares resources openly.
• 21:14
  SPEAKER_00: It's basically one big happy family.
• 21:16
  SPEAKER_00: The bridge model connects disparate environments with trust relationships.
• 21:20
  SPEAKER_01: Aaron Powell But in regulated OT environments, we can't use either of those.
• 21:24
  SPEAKER_00: No.
• 21:25
  SPEAKER_00: We demand the absolute isolation of the silo model.
• 21:28
  SPEAKER_00: The organization must deploy 40 distinct, entirely separate IG tenants, one for each physical pipeline facility.
• 21:37
  SPEAKER_01: Wow.
• 21:37
  SPEAKER_01: So 40 different identity environments?
• 21:40
  SPEAKER_01: Does that mean no forest trusts?
• 21:42
  SPEAKER_00: Zero forest trusts.
• 21:43
  SPEAKER_00: In a standard enterprise merger, you might establish a trust relationship between two different Active Directory environments so users can seamlessly access resources across both.
• 21:52
  SPEAKER_00: Aaron Ross Powell Right.
• 21:53
  SPEAKER_01: Makes it easy for Bob to log into the new company's intranet.
• 21:55
  SPEAKER_00: Aaron Powell But in OT, those trusts are mathematically forbidden between the silent.
• 22:00
  SPEAKER_01: So even if they're owned by the same company.
• 22:01
  SPEAKER_00: Doesn't matter.
• 22:02
  SPEAKER_00: If an attacker compromises the identity tenant for pipeline A, the mathematical isolation of the silo model guarantees they cannot use that compromised identity to pivot into the tenant for pipeline B.
• 22:14
  SPEAKER_01: Okay, that isolation absolutely protects the macro environment.
• 22:18
  SPEAKER_01: But doesn't it introduce a crazy localized dependency problem?
• 22:22
  SPEAKER_00: It does, and this is a crucial point.
• 22:23
  SPEAKER_01: Because if we are relying on cloud-based identity tenants to authenticate engineers at the plant level, aren't we risking tying the physical operation of the facility to the uptime of an internet connection?
• 22:37
  SPEAKER_00: Yes.
• 22:37
  SPEAKER_00: And that requires a deliberate decoupling of the identity plane from the operational data plane.
• 22:42
  SPEAKER_01: The plant must run if the internet dies.
• 22:44
  SPEAKER_00: The plant must run.
• 22:45
  SPEAKER_00: If a backhoe cuts the fiber optic cable outside the facility, or if the cloud provider experiences a massive regional outage, the engineers physically standing in the control room cannot be locked out of the level two HMIs.
• 22:58
  SPEAKER_01: Because the physical processes are continuing, the pressures are still fluctuating.
• 23:02
  SPEAKER_00: The operators need localized authority to manage the machinery right then and there.
• 23:06
  SPEAKER_01: So how does the architecture account for that decoupling?
• 23:09
  SPEAKER_00: It ensures the operational data plane, which is the localized network traffic that actually controls the valves and processes the sensor data, continues to function entirely independently of the external connection.
• 23:20
  SPEAKER_01: Meaning they don't need to reach the cloud to authenticate.
• 23:23
  SPEAKER_00: Right.
• 23:24
  SPEAKER_00: The local systems maintain localized fallback credentials that are synchronized and cached securely on premises.
• 23:31
  SPEAKER_01: So what does the cloud identity plane actually do then?
• 23:35
  SPEAKER_00: The identity plane in the cloud manages the macro governance, the remote access policies, and the provisioning lifecycle.
• 23:43
  SPEAKER_00: But it does not sit in the critical path for the localized physical operation of the facility.
• 23:49
  SPEAKER_01: I see.
• 23:49
  SPEAKER_01: But wait, if we have 40 completely isolated siloed tenants and they are legally required to restrict inbound traffic to maintain that electronic security perimeter, how does the central headquarters actually manage the human identity lifecycle?
• 24:03
  SPEAKER_01: The governance team can't manually log into 40 different systems every time they need to provision an account for a new engineer or reset a password.
• 24:11
  SPEAKER_00: No, that would be a nightmare.
• 24:12
  SPEAKER_00: This requires highly constrained cloud synchronization mechanisms designed specifically for isolated networks.
• 24:19
  SPEAKER_01: How do you synchronize without opening a hole in the firewall?
• 24:22
  SPEAKER_00: Organizations deploy lightweight, stateless sync agents within the localized level three OT network.
• 24:28
  SPEAKER_00: And the critical security feature of these agents is that they do not listen for incoming connections.
• 24:33
  SPEAKER_01: At all.
• 24:33
  SPEAKER_00: Not at all.
• 24:34
  SPEAKER_00: They initiate outbound-only connections.
• 24:36
  SPEAKER_01: Ah.
• 24:37
  SPEAKER_01: Which satisfies the regulatory firewall requirements.
• 24:40
  SPEAKER_00: Precisely.
• 24:40
  SPEAKER_00: The OT firewall rules strictly deny all inbound traffic originating from the internet or the corporate network.
• 24:48
  SPEAKER_00: Nothing gets in.
• 24:48
  SPEAKER_01: But the sync agent initiates an outbound connection.
• 24:51
  SPEAKER_00: Right, using TLS 1.2 or 1.3, making a secure call to an Azure Service Bus on Standard Port 443.
• 24:58
  SPEAKER_01: So the firewall statefully inspects the traffic and allows the return communication, but only because the connection originated from the inside.
• 25:05
  SPEAKER_00: Exactly.
• 25:06
  SPEAKER_00: The cloud never reaches in.
• 25:07
  SPEAKER_00: The silo reaches out.
• 25:08
  SPEAKER_01: That's brilliant.
• 25:09
  SPEAKER_01: But what if that local agent crashes?
• 25:11
  SPEAKER_00: To ensure high availability and prevent the sync agent from becoming a single point of failure, these agents are deployed in an active configuration within the localized OT network.
• 25:21
  SPEAKER_01: Okay, so redundancy is built in.
• 25:24
  SPEAKER_01: What about the actual passwords?
• 25:26
  SPEAKER_01: Sending credentials over the internet, even outbound, sounds risky.
• 25:29
  SPEAKER_00: The cryptography handling the password synchronization is incredibly rigorous.
• 25:33
  SPEAKER_00: When an organization utilizes password hash think through these outbound agents, they are never transmitting plain text passwords across the TLS tunnel.
• 25:42
  SPEAKER_00: Never.
• 25:43
  SPEAKER_00: Never.
• 25:44
  SPEAKER_00: The local agent intercepts the hash, applies unique SALT, and runs it through 1,000 iterations of the PBKDF2 key derivation function.
• 25:54
  SPEAKER_01: That's heavy.
• 25:54
  SPEAKER_00: Very heavy.
• 25:55
  SPEAKER_00: The computational expense of 1,000 PBKDF2 iterations provides massive cryptographic resistance against brute force attacks, even if the TLS kernel were somehow compromised.
• 26:05
  SPEAKER_01: So the plaintext password never leaves the on-premises network.
• 26:08
  SPEAKER_00: It stays right there.
• 26:09
  SPEAKER_00: The cloud identity tenant only receives and stores the heavily salted mathematically transformed hash.
• 26:14
  SPEAKER_00: That allows headquarters to manage the identity lifecycle centrally without exposing the core credential.
• 26:20
  SPEAKER_01: Okay, so let's recap where we are.
• 26:21
  SPEAKER_01: We have the architecture established.
• 26:23
  SPEAKER_01: Passive visibility via span ports, check.
• 26:27
  SPEAKER_01: Purdue model segmentation, check.
• 26:30
  SPEAKER_01: The 40-tenant silo model with no forest trusts, check.
• 26:34
  SPEAKER_00: Decoupling of the operational plane and outbound only TLS synchronization.
• 26:38
  SPEAKER_00: All check.
• 26:39
  SPEAKER_01: But the actual human access, like how a vendor remotely connects to fix a system, that must be heavily governed to prevent another Oldsmar attack, right?
• 26:48
  SPEAKER_00: It has to be.
• 26:49
  SPEAKER_00: The dependency on standing access is the absolute root cause of these breaches.
• 26:53
  SPEAKER_00: When you look at the forensic reports, the team viewer installation at Oldsmar was dormant, but the credential was permanently valid.
• 27:00
  SPEAKER_01: The door was always unlocked, even if no one was walking through it.
• 27:02
  SPEAKER_00: Exactly.
• 27:03
  SPEAKER_00: So in a properly governed OT environment, there are zero standing privileges.
• 27:07
  SPEAKER_01: Zero.
• 27:07
  SPEAKER_00: Zero.
• 27:08
  SPEAKER_00: No human identity, whether it belongs to the plant manager, the lead engineer, or a third-party vendor, possesses permanent 247 administrative access to the control systems.
• 27:17
  SPEAKER_01: So if an HVAC vendor needs to remotely troubleshoot a controller, how do they get in?
• 27:23
  SPEAKER_00: The governance architecture shifts entirely to just in time access, JIT.
• 27:28
  SPEAKER_00: The access is tied strictly to a defined scheduled maintenance window.
• 27:33
  SPEAKER_01: So the authentication flow for that JIT access must be pretty intense.
• 27:37
  SPEAKER_00: It's heavily contextual.
• 27:38
  SPEAKER_00: When the maintenance window opens, the vendor authenticates through the enterprise identity provider.
• 27:43
  SPEAKER_01: With MFA, obviously.
• 27:45
  SPEAKER_00: Strong multi-factor authentication, yes.
• 27:48
  SPEAKER_00: But it also evaluates conditional access policies.
• 27:50
  SPEAKER_00: It checks the geolocation of the IP address, the time of day against the approved maintenance window, the source network.
• 27:57
  SPEAKER_01: And even the security posture of the endpoint device requesting access, right?
• 28:01
  SPEAKER_01: Like making sure their laptop isn't infected.
• 28:03
  SPEAKER_00: Exactly.
• 28:04
  SPEAKER_00: And even if all that context is validated, the architecture still does not grant the vendor direct routing access to the OT network.
• 28:10
  SPEAKER_01: Wait, really?
• 28:11
  SPEAKER_01: Where do they go then?
• 28:12
  SPEAKER_00: They are provisioned temporary credentials and ride it through a secure jump server.
• 28:16
  SPEAKER_00: They perform the necessary maintenance, and the moment the schedule window closes.
• 28:21
  SPEAKER_01: Bam, they're kicked out.
• 28:22
  SPEAKER_00: The governance system automatically revokes the temporary credentials and actively terminates the session.
• 28:27
  SPEAKER_00: The attack surface physically ceases to exist outside of the approved window.
• 28:32
  SPEAKER_01: The invisible bridge just retracts.
• 28:35
  SPEAKER_01: But maintaining that state of least privilege across 40 isolated tenants, that requires serious automated oversight.
• 28:42
  SPEAKER_00: It does.
• 28:42
  SPEAKER_00: This is where tenant governance architectures implement cloud infrastructure entitlement management tools, or CIM.
• 28:49
  SPEAKER_01: CIM tools.
• 28:50
  SPEAKER_01: What do they actually do in this context?
• 28:52
  SPEAKER_00: They constantly monitor the isolated tenants against predefined JSON baselines.
• 28:57
  SPEAKER_01: Okay, so the JSON file basically says here is the exact required security posture of this specific tenant.
• 29:05
  SPEAKER_00: Programmatically, yes.
• 29:06
  SPEAKER_00: It defines which accounts have JG access, what the conditional access policies are, and the exact configuration of the sync agents.
• 29:13
  SPEAKER_01: So we are basically monitoring for configuration drift.
• 29:16
  SPEAKER_00: Precisely.
• 29:17
  SPEAKER_00: If a local administrator inside the plant manually changes a permission, say, granting a vendor standing access instead of GIT access to bypass the approval workflow because they're in a hurry.
• 29:26
  SPEAKER_01: The environment drifts from the codified JSON baseline.
• 29:30
  SPEAKER_00: Right.
• 29:30
  SPEAKER_00: And the central headquarters needs to know instantly without having a permanent inbound connection to check.
• 29:35
  SPEAKER_01: Which brings us back to the outbound agents.
• 29:37
  SPEAKER_00: Right.
• 29:38
  SPEAKER_00: Through cross-tenant access settings, the architecture establishes delegated governance.
• 29:44
  SPEAKER_00: The moment that local change is made, the isolated tenant fires an event-driven webhook outward to headquarters.
• 29:51
  SPEAKER_01: Instantly.
• 29:52
  SPEAKER_00: Instantly.
• 29:53
  SPEAKER_00: The CIM tool receives the webhook, identifies the exact deviation from the JSON baseline, and triggers an auto-remediation workflow.
• 30:01
  SPEAKER_01: So it fixes it on its own.
• 30:03
  SPEAKER_00: Within seconds, headquarters sends the command back down to the established outbound connection to overwrite the manual change and roll the entitlements back to the secure compliance state.
• 30:12
  SPEAKER_01: So the principle of zero standing privileges is enforced programmatically.
• 30:15
  SPEAKER_01: You can't even manually mess it up if you try.
• 30:18
  SPEAKER_01: But that rigid enforcement of lease privilege leads us directly to the most critical operational reality we have to address: the high stakes, hypothetical.
• 30:26
  SPEAKER_01: Trevor Burrus, Jr.
• 30:27
  SPEAKER_00: The 2.0 AM emergency.
• 30:29
  SPEAKER_01: Exactly.
• 30:30
  SPEAKER_01: Because this all sounds great for scheduled maintenance.
• 30:32
  SPEAKER_01: But what happens if it's 2.0 a.m.
• 30:35
  SPEAKER_01: on a Sunday, a pipeline pressure valve is failing, alarms are going off, and a localized engineer needs immediate access.
• 30:41
  SPEAKER_01: Aaron Powell Right.
• 30:42
  SPEAKER_00: They can't wait an hour for a governance workflow to approve a JIT access ticket.
• 30:46
  SPEAKER_01: Trevor Burrus No.
• 30:47
  SPEAKER_01: They need privileged access to the HMI right that second to avert a catastrophic physical disaster.
• 30:54
  SPEAKER_01: The architecture has to account for that.
• 30:55
  SPEAKER_01: Trevor Burrus, Jr.
• 30:55
  SPEAKER_00: It absolutely does.
• 30:56
  SPEAKER_00: We established earlier that the physical safety of the facility supersedes the cybersecurity policy.
• 31:02
  SPEAKER_00: Trevor Burrus, Jr.
• 31:02
  SPEAKER_01: Right.
• 31:02
  SPEAKER_01: An engineer attempting to bypass standard MFA prompts to stabilize a critical physical process in the middle of the night is not an adversary.
• 31:10
  SPEAKER_00: Aaron Powell They are not a threat actor.
• 31:11
  SPEAKER_00: They are doing their jobs.
• 31:12
  SPEAKER_00: They are fulfilling the primary mandate of the AIC triad, maintaining the physical integrity of the facility.
• 31:19
  SPEAKER_01: If the CIM tool auto-remediates their access during an emergency because they bypassed a ticket queue.
• 31:25
  SPEAKER_00: The security architecture has directly caused a physical disaster.
• 31:29
  SPEAKER_01: So how do you solve that tension?
• 31:30
  SPEAKER_01: You can't just leave the administrative accounts unlocked just in case.
• 31:34
  SPEAKER_01: But you also can't lock down the system so tightly that the engineers can't save the plant.
• 31:38
  SPEAKER_00: The solution is engineering pre-authorized break glass workflows into the governance design.
• 31:43
  SPEAKER_01: Break glass, like a physical fire alarm.
• 31:46
  SPEAKER_00: Exactly like a physical fire alarm.
• 31:48
  SPEAKER_00: The glass barrier deters casual misuse.
• 31:51
  SPEAKER_00: You don't just pull it to test it.
• 31:53
  SPEAKER_00: But during an actual fire, the mechanism is readily available to anyone who needs it without requiring prior authorization from a manager.
• 32:01
  SPEAKER_01: So in the identity architecture, how does that actually work?
• 32:04
  SPEAKER_00: These break glass accounts are pre-provisioned with highly elevated privileges.
• 32:08
  SPEAKER_00: They bypass the standard just-in-time approval cues completely.
• 32:12
  SPEAKER_01: Do they bypass MFA approval or specific IP range restrictions?
• 32:21
  SPEAKER_01: Wait, really?
• 32:21
  SPEAKER_01: Isn't that dangerous?
• 32:23
  SPEAKER_00: It's necessary.
• 32:24
  SPEAKER_00: Because a severe physical emergency is often accompanied by a complex network outage.
• 32:29
  SPEAKER_00: If the MFA provider is unreachable because a switch went down, the brain glass account must still function locally.
• 32:36
  SPEAKER_01: Oh, that makes perfect sense.
• 32:37
  SPEAKER_01: Okay.
• 32:37
  SPEAKER_01: So when an engineer triggers that workflow, they break the glass and gain immediate, unrestricted access to the supervisory control systems.
• 32:45
  SPEAKER_00: Yes.
• 32:46
  SPEAKER_00: But that bypass of the standard security controls requires an absolute unshakable secondary control to ensure accountability.
• 32:55
  SPEAKER_01: Aaron Powell Because we have to know, beyond a shadow of a doubt, that the break glass mechanism was used legitimately by an engineer.
• 33:02
  SPEAKER_00: Aaron Powell Right.
• 33:03
  SPEAKER_00: And not abused by an insider threat or an attacker who somehow managed to trigger it.
• 33:08
  SPEAKER_01: So what is that secondary control?
• 33:09
  SPEAKER_00: Aaron Powell That secondary control is the privileged session manager.
• 33:13
  SPEAKER_01: Aaron Powell The PSM.
• 33:14
  SPEAKER_00: Yes.
• 33:15
  SPEAKER_00: The governance design dictates that when a break glass account is activated, the resulting elevated session is forcibly routed through a secure proxy.
• 33:22
  SPEAKER_01: Aaron Powell So the engineer has the access they need to save the plant, but they are operating through a heavily monitored bottleneck.
• 33:28
  SPEAKER_00: Aaron Powell Exactly, a non-bipassable bottleneck.
• 33:31
  SPEAKER_00: The privileged session manager initiates immediate immutable session logging.
• 33:35
  SPEAKER_01: Immutable meaning it cannot be changed.
• 33:37
  SPEAKER_00: Cannot be changed, cannot be deleted.
• 33:39
  SPEAKER_00: From the millisecond that break glass session begins, every single keystroke the engineer types is recorded.
• 33:45
  SPEAKER_01: Every mouse movement.
• 33:46
  SPEAKER_00: Every mouse movement across the HMI screen is tracked.
• 33:49
  SPEAKER_00: Every proprietary command sent to the PLC is logged in an immutable, tamper-proof format.
• 33:56
  SPEAKER_01: So even the elevated break glass account itself can't go back and delete the logs to cover its tracks.
• 34:02
  SPEAKER_00: Nope.
• 34:02
  SPEAKER_00: Furthermore, the entire graphical session is actually video recorded and securely vaulted.
• 34:06
  SPEAKER_01: Video recorded?
• 34:07
  SPEAKER_01: That is incredible.
• 34:08
  SPEAKER_01: It perfectly resolves that tension we've been talking about.
• 34:11
  SPEAKER_00: It really does.
• 34:12
  SPEAKER_00: The engineers granted the absolute operational speed necessary to stabilize the physical facility, which satisfies the demands of the OT environment.
• 34:21
  SPEAKER_01: While simultaneously providing the security and compliance teams with a totally tamper-proof, undeniable forensic audit trail of exactly what transpired, which satisfies the rigorous governance requirements of the IT organization.
• 34:33
  SPEAKER_00: Securing highly segmented, regulation-driven OT environments requires decoupling the operational data plane from the identity plane, utilizing outbound-only stateless agents for centralized synchronization, and enforcing zero standing privileges through continuous JSON baseline monitoring.
• 34:50
  SPEAKER_01: Furthermore, it demands that physical safety and operational availability are preserved through pre-authorized break glass workflows that maintain strict accountability via immutable session logging.
• 35:02
  SPEAKER_00: That's a wrap on how to govern 40 isolated OT tenants centrally.
• 35:06
  SPEAKER_00: We closed on the balance that makes this whole model work.
• 35:10
  SPEAKER_00: Zero standing privilege.
• 35:24
  SPEAKER_00: Next episode, we go back to the desktop and tackle the part of every AD migration nobody plans for correctly.
• 35:32
  SPEAKER_00: What actually breaks when you migrate GPOs.
• 35:35
  SPEAKER_00: Connect with Ernie on LinkedIn.
• 35:37
  SPEAKER_00: The link's in the episode description.
• 35:38
  SPEAKER_00: Subscribe if this is useful.
• 35:40
  SPEAKER_00: Until next time.