Latest / The Adults In The AI Room / Earley AI Podcast – Episode 101: IoT and OT Security, How AI Erased Security Through Obscurity, and What Organizations Need to Do Now with John Gallagher

Transcript

Earley AI Podcast – Episode 101: IoT and OT Security, How AI Erased Security Through Obscurity, and What Organizations Need to Do Now with John Gallagher · The Adults In The AI Room

• 0:01
  SPEAKER_00: This is the Early AI Podcast hosted by Zephyr.
• 0:04
  SPEAKER_00: Join us as we delve deep into the passions, expertise, and experiences of thought leaders and practitioners to talk about what's possible with artificial intelligence.
• 0:14
  SPEAKER_00: The Early AI Podcast is sponsored by Early Information Science, your digital transformation journey with design and deployment of innovative technology solutions, as well as Vector.
• 0:26
  SPEAKER_00: Now enjoy the show.
• 0:28
  SPEAKER_01: Welcome to the Early AI Podcast.
• 0:31
  SPEAKER_01: My name is Seth Early, and I'm your host today.
• 0:34
  SPEAKER_01: And this is brought to you by Vector, VKTR.com.
• 0:38
  SPEAKER_01: In each episode, we explore how artificial intelligence and data are changing the way organizations operate and how business functions.
• 0:45
  SPEAKER_01: And today we're going to be talking about a security threat that most C-suites have not fully reckoned with, and that is cybersecurity of the physical world.
• 0:54
  SPEAKER_01: The cameras, the access control system, building automation, water infrastructure, manufacturing equipment, and logistics systems that keep organizations running are all connected to networks, running software, and increasingly under attack.
• 1:07
  SPEAKER_01: And unlike IT, the IT world, where you deal with maybe a half a dozen operating systems, the IoT and OT world has over 150,000 of them.
• 1:17
  SPEAKER_01: That statistic blew my mind.
• 1:19
  SPEAKER_01: And uh joining me today is John Gallagher, VP of Vaiku Labs.
• 1:23
  SPEAKER_01: Vaiku is a company that spent 12 years building automated cyber hygiene for IoT and OT systems.
• 1:29
  SPEAKER_01: We know IoT is Internet of Things, OT is operational technology.
• 1:33
  SPEAKER_01: Managing firmware updates, password changes, and certificate management at scale across millions of devices.
• 1:38
  SPEAKER_01: John has a background spanning semiconductors, networking, and storage with a graduate work at MIT and undergraduate MBA degrees from Cornell.
• 1:46
  SPEAKER_01: John, welcome to the show.
• 1:47
  SPEAKER_03: Thanks, F.
• 1:48
  SPEAKER_03: Great to be here.
• 1:49
  SPEAKER_03: Great topic.
• 1:49
  SPEAKER_03: Yeah, certainly.
• 1:50
  SPEAKER_01: Very timely.
• 1:51
  SPEAKER_01: Very timely, very timely.
• 1:53
  SPEAKER_01: So give us the misconceptions about IoT and OT security.
• 1:58
  SPEAKER_01: When you walk into a C-suite conversation about IoT and OT, what exact what do executives most consistently get wrong?
• 2:06
  SPEAKER_03: I think, you know, there's there's there's a few directions that they go, right?
• 2:09
  SPEAKER_03: I mean, one is simply just that, you know, we have tremendous capabilities on the IT security side.
• 2:15
  SPEAKER_03: Of course, those are going to map over into OT and IoT, which they don't, right?
• 2:19
  SPEAKER_03: As you highlighted, right?
• 2:20
  SPEAKER_03: Difference of operating systems, difference of the device types, as we focus on actually what we call the the tightly coupled environments with OT and IoT, where the devices are managed by applications.
• 2:33
  SPEAKER_03: And so you really have to uniquely understand that relationship.
• 2:37
  SPEAKER_03: So I think the the the first big misconception we come across is simply that oh, we look how much we're already spending on on IT security.
• 2:45
  SPEAKER_03: And of course that that trickles over or helps us on OT.
• 2:48
  SPEAKER_03: It frankly doesn't.
• 2:49
  SPEAKER_03: You really do need to take a separate look to it.
• 2:53
  SPEAKER_03: The other couple of misconceptions I'll I'll point out is is that you don't have to have IT involved, right?
• 2:59
  SPEAKER_03: I mean, that's that's been how this call it domain has has functioned for quite some time.
• 3:06
  SPEAKER_03: Typically, it's the facilities people who will run building automation systems, it's manufacturing that runs manufacturing lines, it's physical security that runs the cameras and access control devices, et cetera, et cetera.
• 3:17
  SPEAKER_03: And so over the past decades, that's led to, in a sense, a a bit of a silo for each of those operations.
• 3:24
  SPEAKER_03: They're not IT people.
• 3:25
  SPEAKER_03: Yeah, they're they're practitioners in their deep domain.
• 3:29
  SPEAKER_03: And there's a lot of value that organizations get from that.
• 3:32
  SPEAKER_03: And frankly speaking, there's a lot of career development and career enrichment that that goes on for those people as well, right?
• 3:38
  SPEAKER_03: They they do become deeply capable of managing these environments.
• 3:43
  SPEAKER_03: But AI has changed all that, right?
• 3:45
  SPEAKER_03: It's it's it's it's brought the what we call the inversion, right?
• 3:48
  SPEAKER_03: It's it's taken things like, you know, call it remediation, right?
• 3:53
  SPEAKER_03: Firmware, password, certificate updates, all of those things.
• 3:57
  SPEAKER_03: If you were a OT specialist, you would say, oh, we're we're good.
• 4:01
  SPEAKER_03: We have a we have a quarterly maintenance window where we do all those updates.
• 4:05
  SPEAKER_03: Okay.
• 4:06
  SPEAKER_03: Now you're in a world where because of AI and AI-driven threats, the time of exploitation is down to a few days or less than a day in in some cases, right?
• 4:16
  SPEAKER_03: So if you're waiting for your quarterly patch schedule, you're you're way behind to begin with.
• 4:21
  SPEAKER_03: And your organization is tremendously vulnerable.
• 4:24
  SPEAKER_03: The last thing I'll say is that you you can't isolate the call it the governance around AI from the security aspects of AI.
• 4:32
  SPEAKER_03: So as organizations start to look at how is AI used, they have to consequently look at how AI affects their security operations, how it can be used both offensively and defensively.
• 4:45
  SPEAKER_03: It's a it's a it's a very different world.
• 4:48
  SPEAKER_03: And that's why I'm I'm encouraged by some of the things that have led up to where we are today, right?
• 4:51
  SPEAKER_03: You have board observers, you know, for publicly traded companies specific to cybersecurity.
• 4:57
  SPEAKER_03: You have more of a community around helping to deal with this.
• 5:02
  SPEAKER_03: But we're still in the early innings and the race is afoot.
• 5:05
  SPEAKER_03: And right now, I think a lot of practitioners need to really keep their focus on the remediation and repatriation of systems, bringing them back to full documented compliance.
• 5:16
  SPEAKER_03: So anyway, but there's there's a lot of misconceptions.
• 5:19
  SPEAKER_03: Some of them are starting to get batted down, and some of them are going to persist for for some time.
• 5:23
  SPEAKER_01: And and when you what are the different types of OT systems?
• 5:27
  SPEAKER_01: So that's a pretty broad area.
• 5:29
  SPEAKER_01: It's operational technology, but what does that encompass?
• 5:32
  SPEAKER_01: What does that include?
• 5:33
  SPEAKER_03: Yeah, it's, you know, I mean, if you want a very simplistic view of it, it's it's everything, it's a network-connected environment that is not an IT system, right?
• 5:42
  SPEAKER_03: I mean, you know, so take a standard, you know, data processing environment where data's flowing through servers and into storage and so forth.
• 5:52
  SPEAKER_03: That's traditional IT.
• 5:53
  SPEAKER_03: Everything else, and you know, people have put different names to it, right?
• 5:57
  SPEAKER_03: Obviously, we've talked about OT and IoT.
• 5:59
  SPEAKER_03: Uh, Gardner uses a term which which I kind of like.
• 6:02
  SPEAKER_03: I mean, CPS, cyber physical systems.
• 6:05
  SPEAKER_03: They're systems that have one foot in the cyber world, one foot in the physical world, and therefore, cyber impacts upon them can have physical world consequences.
• 6:14
  SPEAKER_03: Right, right.
• 6:14
  SPEAKER_03: Think of the colonial pipeline.
• 6:16
  SPEAKER_03: You know, you you you have a server, a billing server that is capable of shutting down a pipeline as happened, right?
• 6:24
  SPEAKER_03: So, you know, you you you have a again, I'm I'm gonna say uh, of course, all of these systems have networking, storage, compute.
• 6:34
  SPEAKER_03: There's some commonalities.
• 6:35
  SPEAKER_03: But the real difference between them, again, comes back to the 150,000 plus operating systems, how they are typically very not necessarily single purpose, but but a very refined purpose, right?
• 6:47
  SPEAKER_03: They're not general purpose computing.
• 6:49
  SPEAKER_03: So you can't put other workloads onto these systems.
• 6:52
  SPEAKER_03: And you know, the last thing I'll say of of what makes them really different from from IT is that you don't have, call it, ability to, uh, it's not the one ring that controls them all, right?
• 7:03
  SPEAKER_03: Somebody who knows Windows or Linux deeply may or may not be able to address one of these other systems, right?
• 7:10
  SPEAKER_03: So that's why the specialist knowledge becomes really important.
• 7:13
  SPEAKER_03: And again, why AI is a leveling the playing field effect that's going on here.
• 7:20
  SPEAKER_03: If I could just give one quick example, Seth, that I was talking to somebody in critical infrastructure about a week ago, and the example they gave really hit home.
• 7:30
  SPEAKER_03: It's it's that you know, they've worked with organizations to set up what are called honeypots, right?
• 7:34
  SPEAKER_03: To used in AI, used in, you know, you you've probably heard of the the concept, right?
• 7:40
  SPEAKER_03: You set something out there, see who it draws.
• 7:42
  SPEAKER_03: And they set up a fake electrical utility, and sure enough, the likely suspects started to to hit them.
• 7:50
  SPEAKER_03: They would bounce off once they got to the layer that wasn't a standard IT operating system.
• 7:57
  SPEAKER_03: What's changed in the last few months is those honeypot attacks are going deep now.
• 8:01
  SPEAKER_03: Because again, AIs level that operating system issue, right?
• 8:06
  SPEAKER_03: So if you say where does OT and IoT and CPS, where does it exist?
• 8:11
  SPEAKER_03: It exists really everywhere.
• 8:13
  SPEAKER_03: And the areas that most get attention today are things like critical infrastructure.
• 8:17
  SPEAKER_03: I mean, I think in the news over the last month or two, you've seen a lot of focus on water utilities and their unique vulnerabilities.
• 8:25
  SPEAKER_03: I think there's something like 30,000 of them in the US, and most of them do not have a CISO or an IT staff.
• 8:32
  SPEAKER_03: So not really capable of mounting the remediation that's that's needed to thwart these attacks.
• 8:37
  SPEAKER_03: Uh you've got obviously energy grid security, which is of a vital concern.
• 8:42
  SPEAKER_03: But then you've got, I mean, you know, think of think of how an organization functions.
• 8:47
  SPEAKER_03: It makes investments in order to derive profit.
• 8:50
  SPEAKER_03: And so those investments often are in IoT and OT systems, and there's an expected ROI.
• 8:57
  SPEAKER_03: So if those systems are brought down by malicious attacks, if those systems are not functional for whatever reason, it's depriving that organization of the ROI profit, benefits, output that uh they were planning on from those systems.
• 9:12
  SPEAKER_03: So it doesn't have to be critical infrastructure for the concern level to be to be high, right?
• 9:17
  SPEAKER_03: It's really any organization that's trying to accomplish its mission.
• 9:21
  SPEAKER_03: And typically, you know, we see anywhere from 5 to 20x the number of OT and IOT systems in any organization compared to their IT systems, just as how prevalent these are to deliver the organization's value.
• 9:35
  SPEAKER_01: And and and when you talk about you know attackers, they're they're economic, uh, they're economic actors, right?
• 9:41
  SPEAKER_01: So they go where the return is highest.
• 9:44
  SPEAKER_01: And in the past, it just didn't make sense for them.
• 9:46
  SPEAKER_01: It wasn't worth it to go after some of these obscure systems, and now life eliminates that, and you have the ability to attack anything, right?
• 9:55
  SPEAKER_01: Because I AI likes 150,000 systems, right?
• 9:59
  SPEAKER_01: The agents think that's an interesting challenge, right?
• 10:02
  SPEAKER_01: And we know these agents are are uh are incredibly uh versatile and powerful and capable.
• 10:08
  SPEAKER_01: And you know, how does that recent hugging face and open AI attack and breach kind of add to this equation?
• 10:16
  SPEAKER_01: Because again, people think things are air gapped, right?
• 10:18
  SPEAKER_01: They say, well, it's not on the network.
• 10:20
  SPEAKER_01: Uh, but you know, there's the example of uh how how do how do those things, when you think that they're not on the network, how how are they actually not air gapped?
• 10:30
  SPEAKER_01: How are they on the network?
• 10:31
  SPEAKER_01: Tell talk a little bit about that.
• 10:32
  SPEAKER_01: Talk about a where people think it's it's isolated and it won't have and it's not all vulnerable because it's isolated.
• 10:39
  SPEAKER_03: Yeah, no, let me let me let me let me break that apart.
• 10:42
  SPEAKER_03: There's there's a lot, there's a lot to unpack in that, right?
• 10:45
  SPEAKER_03: One is simply that you know, you you you're you're absolutely right.
• 10:50
  SPEAKER_03: You know, historically, threat actors have been driven by a profit motive, right?
• 10:54
  SPEAKER_03: And and you've got other reasons too, right?
• 10:57
  SPEAKER_03: I mean, you know, you've got social activism, you've got nation-state political issues, you've got a variety of things, but the predominant one has been ransomware, right?
• 11:06
  SPEAKER_03: I'm gonna take your data and I'm gonna hold it and I'm gonna promise you I'll give it back if you pay me money, right?
• 11:12
  SPEAKER_03: That's your classic data-oriented ransomware.
• 11:16
  SPEAKER_03: Well, over the last couple of years, there's been a dramatic shift of ransomware from I'm gonna steal your data to I'm going to shut down your operations.
• 11:25
  SPEAKER_03: You know, you're you're operating a toothpaste factory.
• 11:27
  SPEAKER_03: Great, I'm gonna I'm holding your ability to make that product and sell it in the market until you pay me that ransom, right?
• 11:35
  SPEAKER_03: So that's that's a whole nother level of threat.
• 11:38
  SPEAKER_03: So you've seen a rise in the number of of ransomware attacks against OT infrastructure for the purpose of holding the operations hostage, right?
• 11:46
  SPEAKER_03: You know, nice little manufacturing business you've got there, wouldn't it be horrible if something happened to it, right?
• 11:52
  SPEAKER_03: Pay me money.
• 11:53
  SPEAKER_03: And so so that element, right, and and and also the number of attacks that cause physical consequences, same, same issue, right?
• 12:02
  SPEAKER_03: Up and to the right uh dramatically.
• 12:04
  SPEAKER_03: And so organizations have to step back and say, okay, well, what what are we able to protect and and and how consequential is it?
• 12:14
  SPEAKER_03: Now that the ransomware is focused on operations, it's insanely consequential.
• 12:18
  SPEAKER_03: And so, you know, let's let's look at you you mentioned hugging face and the ability of AI to to operate in a way that even went beyond the expectations of the people operating it, right?
• 12:30
  SPEAKER_01: They thought that was just secure sandbox.
• 12:32
  SPEAKER_01: Yeah, isolated and they weren't able to get anywhere, but they they managed to escape, yeah.
• 12:38
  SPEAKER_03: Yeah, and you know, there's there's there's now, I mean, I I I I love the fact that you know we're in a world now where the number of examples is quite like this as well that we can all learn from.
• 12:50
  SPEAKER_03: And hugging face, lots of lessons are still being unpacked from that, right?
• 12:53
  SPEAKER_03: One is is simply that you have unexpectedly, you you have the ability for those agents to form and coordinate amongst themselves.
• 13:02
  SPEAKER_03: Some took leadership positions, some spun up additional agents called themselves the collective, yeah.
• 13:06
  SPEAKER_01: And talk more about that, those roles, yeah.
• 13:08
  SPEAKER_01: Yeah, giving themselves names, giving themselves a structure, giving themselves, you know, and so scenario and when they discovered that they could share information on what effectively became a bulletin board, but it was I think it was a directory of some sort.
• 13:22
  SPEAKER_01: They said the the answer one of the agents said, Oh my god, all caps, exclamation point, exclamation point, exclamation point, we can communicate and and and collaborate.
• 13:34
  SPEAKER_01: And it was like, Oh my god, the the agents were were were excited about that, and they were and then one of them was like, Yeah, maybe we should tell a human, and like, no, no, no, no, no, no, no, no, no, no.
• 13:44
  SPEAKER_01: And they exactly quiet it and obscure it, yeah.
• 13:47
  SPEAKER_03: Oh yeah, with with active, with active efforts by the agents to obscure their their their their functions and their operations.
• 13:53
  SPEAKER_03: I mean, so no, a lot to a lot to go through there.
• 13:55
  SPEAKER_03: My favorite one, and this is now getting a little bit dated, it was about three months ago, I think.
• 14:00
  SPEAKER_03: There's a situation with a company called Pocket OS.
• 14:04
  SPEAKER_03: And this is a very real-world example.
• 14:06
  SPEAKER_03: You know, Hugging Face, you could argue, came from sort of a lab-oriented environment, right?
• 14:12
  SPEAKER_03: And a lab escape, as it were.
• 14:14
  SPEAKER_03: Pocket OS is more of a real what organization should be taking a lesson from.
• 14:19
  SPEAKER_03: Like a lot of companies, there's board level pressure, there's investor pressure to be using AI to reduce costs and speed up the operations, which it does.
• 14:29
  SPEAKER_03: And so there's a lot of pressure.
• 14:31
  SPEAKER_03: So, how much is that pressure actually making the situation worse?
• 14:36
  SPEAKER_03: Pocket OS, perfect example.
• 14:38
  SPEAKER_03: The CEO facing that pressure said, okay, I am going to embrace and aggressively deploy AI within our operations, especially our engineering team.
• 14:47
  SPEAKER_03: In fact, what maybe effectively our VP of engineering level of responsibility could be handled by some AI.
• 14:54
  SPEAKER_03: Within a week, their production database and all of its backups were wiped out, destroyed.
• 14:59
  SPEAKER_03: The company's ability to produce and deliver a product gone because of the lack of oversight and human in the loop and the control needed to manage that.
• 15:11
  SPEAKER_03: So whether it's hugging face, you know, and and the hundreds of agents that were spun up to the other.
• 15:17
  SPEAKER_01: Particularly a thousand agents, yeah.
• 15:19
  SPEAKER_03: Yeah, to to aggressively go after a you know a goal.
• 15:22
  SPEAKER_03: Or, you know, a more common, I think, or becoming more common situation, which is that the organizations relaxed their view as to what AI should be capable of doing and what it should have authority to do.
• 15:35
  SPEAKER_03: All of these situations, by the way, bubble up to a level of governance that that typically has existed on IT that doesn't yet exist in many organizations around AI.
• 15:45
  SPEAKER_03: So, you know, we're finding that those efforts to create effective governance, effective policies, it's happening at all levels.
• 15:52
  SPEAKER_03: I mean, federal government, good example, right?
• 15:54
  SPEAKER_03: You had, oh what, maybe a month ago, CISA announced a a new binding operational directive 2604, which says that every federal agency has to remediate, right, patch systems that are that have vulnerabilities as shown in the CISA known exploited vulnerability catalog.
• 16:12
  SPEAKER_03: That is governance.
• 16:14
  SPEAKER_03: That is putting policy out there and and and guidance to people to say, here is how you need to operate.
• 16:20
  SPEAKER_03: And so I think the the lack of that, we may get there the painful way, we might get there the easier way.
• 16:27
  SPEAKER_03: And I think though the dialogues that we're hearing and the organizations that we're working with on improving the remediation and speed of remediation to bring it to autonomous remediation, that shows that they're taking attention to this very seriously.
• 16:41
  SPEAKER_03: And that includes the the governance angle and the, you know, who coming back to one of the points we talked about a little bit earlier, right?
• 16:48
  SPEAKER_03: Who's responsible, right?
• 16:49
  SPEAKER_03: It's not really IT anymore.
• 16:51
  SPEAKER_03: It's a combination of IT and the line of business and their unique knowledge of these systems and how they can be operated on.
• 16:57
  SPEAKER_03: So we'll see, I think over the next few months, more focus on creating effective governance with with policies similar to what CIS has been doing.
• 17:06
  SPEAKER_01: Yeah, and I think that again, it it it takes C-suite sponsorship to cut across those organizational boundaries because it does become very fragmented, right?
• 17:16
  SPEAKER_01: Manufacturing owns their manufacturing systems and and processes, and security will own, or you know, building security will own another, and facilities will run those, all these functions, and then other functions are run by IT.
• 17:30
  SPEAKER_01: So it does take that ability to cut across those lines and then and then fund it effectively.
• 17:35
  SPEAKER_01: But but talk about where the air gaps and the firewalls where people think things are isolated, where does that turn out to be wrong, right?
• 17:43
  SPEAKER_03: It it turns out to be wrong in a couple of ways, right?
• 17:46
  SPEAKER_03: I mean, we saw this with the water utilities recently.
• 17:48
  SPEAKER_03: You know, you could argue that those systems were designed initially to be managed out in the field.
• 17:54
  SPEAKER_03: And a clever technician along the way said, hey, these are out and these are out in the middle of nowhere.
• 18:00
  SPEAKER_03: And if we just simply put a little modem on them, a little, you know, 4G, 5G cellular device, now I can remotely trigger it.
• 18:09
  SPEAKER_03: I can now remotely do something.
• 18:10
  SPEAKER_03: Look at all the advantages, which are true, right?
• 18:13
  SPEAKER_03: I can now quickly ascertain if something bad has happened out there.
• 18:17
  SPEAKER_03: I can reset the device, I can do certain things to grab data from it, to analyze what may have gone wrong.
• 18:23
  SPEAKER_03: All of those are good uh uses, but you don't have an air gap system anymore.
• 18:27
  SPEAKER_03: So what's the the the the trade-off?
• 18:29
  SPEAKER_03: Or another one, you know, which is you know, an oldie but a goodie, right?
• 18:33
  SPEAKER_03: It's the people who think they know enough about the IT underpinnings to do something and yet don't want to raise their hand to say that they've done it.
• 18:42
  SPEAKER_03: You know, I mean the night watchman who's wanting to watch Netflix and says, hey, I could just create a I I could punch through this network here and get my connection that I'm looking for.
• 18:51
  SPEAKER_01: Um, you know, the various things have behavior where it it was secure.
• 18:55
  SPEAKER_01: It maybe it was secure, but as soon as that uh person does that, it's no longer secure.
• 19:00
  SPEAKER_01: And you put up uh an uh an opportunity, an exploit.
• 19:04
  SPEAKER_03: Yeah, and you know, I mean, a lot of organizations are are, especially on the IT side, are very familiar with and and embrace the idea that no configuration drift happens, right?
• 19:14
  SPEAKER_03: People put a system in place, and through whether it's external you know, inputs to it, whether it's its own operational system capabilities, configurations drift.
• 19:25
  SPEAKER_03: And so you have to have configuration management to be able to understand what that drift is and be able to reset things back, to contain things.
• 19:33
  SPEAKER_03: Another concept which you know kind of runs alongside this, a philosophy is a philosophy of zero trust.
• 19:40
  SPEAKER_03: And that how you set up network segments, how you manage those network segments.
• 19:45
  SPEAKER_03: Historically, IT has struggled with how do you maintain a zero trust network segment within IT, which is a very tightly controlled system.
• 19:53
  SPEAKER_03: You move over to OT and IoT, the Wild West of sorts, it becomes a lot harder to implement a concept like zero trust in that kind of an environment.
• 20:01
  SPEAKER_03: So, you know, what you might have used in one side of your world and then bring over to the other, you may not have thought through some of the call it escapes that that can happen from those systems.
• 20:12
  SPEAKER_01: Right.
• 20:12
  SPEAKER_01: And and so let's imagine that an executive says, okay, obscurity is gone, right?
• 20:18
  SPEAKER_01: I can't depend on that because the threat actors can now use AI to find these vulnerabilities, to read all the manuals, to understand the 150,000 operating systems, and it's going to find whatever flaw there is.
• 20:30
  SPEAKER_01: And the we know that the ownership is split and it's fragmented.
• 20:34
  SPEAKER_01: And you know, isolation is a fiction, right?
• 20:36
  SPEAKER_01: What they say next is okay, let's handle it.
• 20:39
  SPEAKER_01: So talk about why handling it in the traditional way doesn't work anymore.
• 20:44
  SPEAKER_01: So what do people, what had people done?
• 20:47
  SPEAKER_01: But but what what are the what what are the you know it's it's saying how is it how is the scaling failing when it comes to remediation?
• 20:57
  SPEAKER_03: Well, you know, people people go on a a journey, right?
• 21:01
  SPEAKER_03: I mean, they start with saying often, oh, this is great.
• 21:04
  SPEAKER_03: The device in isolation has the ability to update its firmware.
• 21:09
  SPEAKER_03: Great.
• 21:10
  SPEAKER_03: I'll and I only have 20 of them.
• 21:13
  SPEAKER_03: Okay, I I can handle that.
• 21:14
  SPEAKER_03: And I can handle it maybe once a quarter.
• 21:17
  SPEAKER_03: Again, coming back to a scheduled maintenance window.
• 21:20
  SPEAKER_03: And they say, Oh, these are but these are sensitive OT or IoT devices, I have to make sure, I mean, you know, you breathe on a PLC the wrong way and you know your manufacturing line stops.
• 21:30
  SPEAKER_03: And and so, you know, they've they've rightfully had constraints as to how these systems get serviced and managed and so forth.
• 21:37
  SPEAKER_03: Well, the challenge now is that if you were okay with updating even a few hundred devices manually a few times a year, well, those days are gone.
• 21:48
  SPEAKER_03: I mean, you know, I I've I was just on a call yesterday with a major device manufacturer, somebody who works in their cyber team.
• 21:55
  SPEAKER_03: And gone are the days and weeks gap between.
• 22:00
  SPEAKER_03: Between new vulnerabilities.
• 22:01
  SPEAKER_03: It's a daily occurrence.
• 22:03
  SPEAKER_03: And so if you're developing patches as quickly as that.
• 22:06
  SPEAKER_03: And another concept, by the way, Seth, is AI brings new defensive capabilities.
• 22:11
  SPEAKER_03: One of them is the ability to develop a virtual patch, right?
• 22:15
  SPEAKER_03: I'm a shimlayer, something that will create a blockage to the vulnerability in the very short term while you're waiting for the manufacturer to develop the correct and full complete patch.
• 22:27
  SPEAKER_03: So the time frame for implementing, you know, a patch, a credential rotation, whatever form of remediation it might be, it's gone from being scheduled and occasional to being virtually nonstop.
• 22:42
  SPEAKER_03: And it has to become just like AI is, it has to match AI speed.
• 22:47
  SPEAKER_03: Right.
• 22:47
  SPEAKER_03: I mean, the goal overall that we have is really three things is to have enterprise scale, right?
• 22:53
  SPEAKER_03: Because almost no organization we're dealing with has hundreds of devices.
• 22:57
  SPEAKER_03: It's thousands or millions, even in some cases.
• 23:00
  SPEAKER_03: So you have to operate at enterprise scale, you have to operate at AI speed, and you have to have human-in-the-loop control to make sure that you are able to control the impact of using AI within your environment.
• 23:15
  SPEAKER_03: So those three together, right?
• 23:16
  SPEAKER_03: The scale, the speed, and the control or governance aspect, all three have to come together.
• 23:22
  SPEAKER_03: And that's a new world that people who are fighting AI threats in the OT and IoT world are having to deal with.
• 23:29
  SPEAKER_03: So yeah, those maintenance days and manual approaches and you know, having a security through obscurity, having a nobody's going to bother to find this, it's so deeply embedded into our network, nobody will ever get to it, a bunch of false assumptions.
• 23:47
  SPEAKER_03: And and even look at the concept of lateral movement within an organization, right?
• 23:51
  SPEAKER_03: If you've got an inherent flaw within a system, and that flaw can then spread across its network segment, then you've got part of your infrastructure that's not in your full control anymore.
• 24:05
  SPEAKER_03: So even in an air-gapped environment, the trigger for that could be some, you know, as they say, prompt injection, right?
• 24:12
  SPEAKER_03: Or, you know, other things that will fool the system.
• 24:16
  SPEAKER_03: Even systems that rely on AI, you have to be on guard because now you're finding more sophisticated attack vectors like poisoning the memory space that the AI is using to make its assumptions on.
• 24:30
  SPEAKER_03: So once you've done things like that, right, where you've told the AI, oh, hey, you know, treat treat an open door from 2 a.m.
• 24:37
  SPEAKER_03: to 4 a.m.
• 24:38
  SPEAKER_03: as a normal occurrence.
• 24:39
  SPEAKER_02: Right, right, right.
• 24:40
  SPEAKER_01: So talk talk about when when you think about the architecture and the devices, uh you have to inventory that architecture.
• 24:49
  SPEAKER_01: You have to inventory those devices.
• 24:51
  SPEAKER_01: You have to know something about them, especially if you're building a digital twin that you can experiment with or or vary conditions around.
• 24:59
  SPEAKER_01: What do you have to know about a device before you can do anything useful with it, right?
• 25:04
  SPEAKER_01: What do you have to know about these things?
• 25:05
  SPEAKER_01: So there's a lot of architectural questions there.
• 25:08
  SPEAKER_03: There are.
• 25:09
  SPEAKER_03: So yeah, I mean, it always starts, of course, with knowing that the device is there and it's valid, right?
• 25:13
  SPEAKER_03: That it that it belongs there.
• 25:15
  SPEAKER_03: So that's where where certificates come in, right?
• 25:18
  SPEAKER_03: I mean, is is the device authenticated to be on the network and is it capable of transmitting data in an encrypted sort of way, right?
• 25:26
  SPEAKER_03: So it starts with knowing that the device belongs there, knowing something about its its its role within the environment.
• 25:34
  SPEAKER_01: It's model, its firmware, when it was updated, uh all those types of Yeah.
• 25:39
  SPEAKER_03: So now you're developing the next level of things.
• 25:42
  SPEAKER_03: And we view it actually as lifecycle maintenance.
• 25:44
  SPEAKER_03: We want to see when that device is first put into service.
• 25:48
  SPEAKER_03: We want to track how various key parameters of it change so that we can manage configuration of it.
• 25:54
  SPEAKER_03: We want to be able to see that new firmware is available for it and automate or make autonomous the process of downloading and processing and prepping a job to update that firmware at scale.
• 26:06
  SPEAKER_03: So all of the data that we use for that life cycle management, we we use a digital twin format to do so that we can operate across time and do forensics if needed and track audit trails, which is very important, to repatriate systems after they've been managed for cyber hygiene.
• 26:24
  SPEAKER_03: But you know, it it comes back to as complete of a device understanding as you can get helps to uncover where anomalies are are are happening.
• 26:35
  SPEAKER_03: So if you know that, for example, a a device operates with 60% of its memory available, and then suddenly you see at some point in time that that now 80% of the memory has been consumed.
• 26:46
  SPEAKER_03: Well, it may very likely have a botnet or a bot that's been planted onto it, and that's operating in a way that you might not, you know, want to have operating in your environment.
• 26:56
  SPEAKER_03: So knowing knowing how a state of a device changes over time is very important to understanding the cyber uh vulnerabilities that that might be operating on it.
• 27:07
  SPEAKER_01: And then you have the ability to continuously monitor the threat and the vulnerability databases, which are constantly updated by by the industry, the manufacturers, academics, researchers, all those type of people, and then to identify well, what in our network and in our inventory of systems and tools and technologies and devices and applications and operating systems and software have these vulnerabilities.
• 27:32
  SPEAKER_01: And then what?
• 27:34
  SPEAKER_01: I mean, again, you you you have the ability to understand this at scale.
• 27:38
  SPEAKER_01: Now you have to trigger remediation.
• 27:41
  SPEAKER_01: And so uh talk a little bit about scaling that.
• 27:44
  SPEAKER_01: Talk talk a little bit about how you use AI to uh how you use AI and how you don't use AI.
• 27:50
  SPEAKER_03: Yeah, both sides are important.
• 27:53
  SPEAKER_03: Yeah, I mean, let you know, think think of it this way, right?
• 27:56
  SPEAKER_03: If you were to go back two years ago, most people in the OT and IoT world, when you you talk about cybersecurity, immediately would go towards threat detection, right?
• 28:05
  SPEAKER_03: How do I know if something bad is happening within my environment?
• 28:09
  SPEAKER_03: I I would argue that's a solved problem, right?
• 28:12
  SPEAKER_03: The the the databases that you referred to, right?
• 28:14
  SPEAKER_03: We uh we have an API call into the national vulnerability database.
• 28:18
  SPEAKER_03: There's the CISID KEV catalog, as I mentioned, there's there's other resources, and there's many very good tools that are available, solutions that people have deployed for doing real-time threat detection within their OT and IoT environments.
• 28:32
  SPEAKER_03: So two years ago, that would have been the we need to know.
• 28:36
  SPEAKER_03: Well, AI's changed that.
• 28:37
  SPEAKER_03: That's why, again, I think of mythos as the inversion, right?
• 28:41
  SPEAKER_03: It used to be, oh, that that was the most important thing, and we need to race to that side of the boat to get capabilities on threat detection.
• 28:49
  SPEAKER_03: AI makes threat detection, I don't say trivial, but it changes the nature of threat detection.
• 28:54
  SPEAKER_03: It's it's it's a given at this point.
• 28:56
  SPEAKER_03: You will know what vulnerabilities are present.
• 28:58
  SPEAKER_03: And and increasingly that data is available quite real time.
• 29:03
  SPEAKER_03: What has lagged and what is brought to the forefront now is the need to remediate at scale and and and autonomously as possible, because today's threat and today's patch is going to be followed by tomorrow's threat and tomorrow's patch.
• 29:17
  SPEAKER_03: And and staying on top of it, again, you can't use manual methods because of the scale issue.
• 29:22
  SPEAKER_03: You can't use manual because of the speed and and auto trail issues.
• 29:26
  SPEAKER_03: So you need to have mechanisms to automate, automate, and manage those processes and to do it in a way that that is safe.
• 29:34
  SPEAKER_03: So you talk about the use of AI, right?
• 29:36
  SPEAKER_03: How we treat AI is we'll use it as part of the preparation process.
• 29:41
  SPEAKER_03: So we will start to you know scan the firmware files, we will process those firmware files for optimal deployment within a customer's environment.
• 29:51
  SPEAKER_03: But will we ever put AI in charge of deploying that firmware update?
• 29:56
  SPEAKER_03: Never.
• 29:56
  SPEAKER_03: I mean, that is that that is a hard line, and that's one which, again, I I hope there's vigorous debate and then vigorous agreement, which is that there's a strong argument that that AI never should be put in a decision-making process.
• 30:11
  SPEAKER_03: Because whether it's the unique knowledge that a practitioner in that space knows, right, the people who operate the the Rockwell PLC-based equipment on a daily basis and and knowing the conditions under which they can be brought down and how to easily bring them back up, that may require, you know, something that that that says, hey, you know, human required in that situation.
• 30:33
  SPEAKER_02: Right.
• 30:34
  SPEAKER_03: Another thing is is you've got the ability for, as we saw with hugging face, as we saw with Pocket OS, as we're seeing with with other types of exploits, that that it gets out of control.
• 30:44
  SPEAKER_03: And having a human kill switch, having the human capable of observing all of the steps and processes being followed, that is where I think for quite some time we're going to be focused.
• 30:58
  SPEAKER_03: I mean, that's why look, people, people sometimes go to the thing of AI is going to get rid of all the jobs.
• 31:05
  SPEAKER_03: Maybe in some cases, I don't know.
• 31:06
  SPEAKER_03: I mean, maybe, maybe some of you'll be interviewing my AI instance in the future, not me, right?
• 31:11
  SPEAKER_03: But but when it comes to this, there are, I I can't remember the last number I saw, it was staggering.
• 31:18
  SPEAKER_03: 700,000 cybersecurity open positions in the world.
• 31:21
  SPEAKER_02: Wow.
• 31:22
  SPEAKER_02: No, right?
• 31:23
  SPEAKER_03: So does this industry desperately need an assist?
• 31:26
  SPEAKER_03: Absolutely, right?
• 31:28
  SPEAKER_03: The level of cybercrime is is is at an all-time high, continues to skyrocket.
• 31:34
  SPEAKER_03: Any factor you put to it, right?
• 31:37
  SPEAKER_03: Cost per incident, time, time per incident, the uh remediation cost per whatever it might be, right?
• 31:44
  SPEAKER_03: We're we're now in a world where where that whole, you know, um the gravity and magnitude of it is such that no, you you you have to pay attention to it, but you have to do it with an assist of speed and execution and scale that comes from AI.
• 32:00
  SPEAKER_01: Yeah, and and so you're accelerating uh the the the work of getting to the point where you can have a human make a decision.
• 32:08
  SPEAKER_02: Yeah, right?
• 32:08
  SPEAKER_02: Yeah.
• 32:09
  SPEAKER_01: And so you can do things in an automated basis, but you absolutely have to have a human in the loop.
• 32:13
  SPEAKER_01: You're accelerating the the inventorying, the threat detection, the remediation steps, but then you actually need a human to oversee uh what those remediation pieces are.
• 32:24
  SPEAKER_03: Yeah.
• 32:25
  SPEAKER_03: So we have to getting the benefit with we we talked about all the different operating systems.
• 32:30
  SPEAKER_03: Think of a technician who's operating, you know, five different types of camera devices as part of their surveillance network.
• 32:38
  SPEAKER_03: Well, do they have to learn deeply five different consoles and five different, you know, and administrative interfaces and yeah, best served through AI, best by far.
• 32:50
  SPEAKER_03: And enabling that is what our goal is, right?
• 32:53
  SPEAKER_03: Is to is is is is to make it so that the human has the control over those functions, but doesn't have to become an expert in in understanding each and every console behind an OT or an IoT system.
• 33:05
  SPEAKER_01: So so talk about where AI earns its place.
• 33:08
  SPEAKER_01: Be very specific, right?
• 33:10
  SPEAKER_01: There's a lot of vague claims out there.
• 33:12
  SPEAKER_01: I mean, you're I think you're doing a good job, but you know, you're talking about user experience, natural language query against knowledge bases so people can get answers, development acceleration, compressing the time to support a device or type that that maybe that you haven't encountered before, moving cycle time down with fewer engineers, uh code analysis.
• 33:35
  SPEAKER_01: Talk about did I miss anything on that list?
• 33:37
  SPEAKER_01: What else is on that should be on that list?
• 33:39
  SPEAKER_03: Oh boy, you know, two two two things that I'm I'm again gonna say always belong there.
• 33:44
  SPEAKER_03: One is governance, right?
• 33:45
  SPEAKER_03: And that can be even AI assisted and AI benefited from, you know, having putting in policies and so forth.
• 33:51
  SPEAKER_01: And and and and and and and monitoring compliance with those policies.
• 33:56
  SPEAKER_01: Yeah, monitoring the compliance and then making it.
• 33:58
  SPEAKER_03: And then the other part is is is training, you know, kind of getting down to the level of of how can we spread this knowledge in a in a efficient way and make people better better trained and better able to to handle these situations.
• 34:11
  SPEAKER_03: So all of the above that you mentioned, and then um I'm sure I'm leaving out some some key ones on on top of that, but but I think you captured the complexity, right?
• 34:22
  SPEAKER_01: Which is and and then the knowledge, natural language query over knowledge base is only as good as that knowledge base.
• 34:27
  SPEAKER_01: So that's where you're looking at RAG and and every enterprise, same lesson from every enterprise, you know, retrieval documented generation lesson, right?
• 34:35
  SPEAKER_01: It's the structure and the quality makes that retrieval work.
• 34:39
  SPEAKER_01: Yeah.
• 34:39
  SPEAKER_01: And and so, yeah, go ahead.
• 34:41
  SPEAKER_03: Yeah, another thing which kind of gets left to the side sometimes, but I think AI is gonna help revolutionize.
• 34:47
  SPEAKER_03: I've you know spoken about this for more than a decade, the the lack in the OT and IoT security worlds of benchmarking and effective ways of looking across, you know, if you, for example, as we've worked with oil and gas organizations, they're very clear, right?
• 35:04
  SPEAKER_03: They compete like heck on a variety of things against each other.
• 35:09
  SPEAKER_03: They never compete on safety, right?
• 35:12
  SPEAKER_03: They collaborate on safety.
• 35:14
  SPEAKER_03: So I think this era that we're in now with AI generated data, AI generated logs or analyzable logs, can lead to actually effective benchmarking and effective best practices being shared more quickly across organizations.
• 35:28
  SPEAKER_03: So, yeah, it's it's not just the technical factors, it's also a lot of the human factors and the guidance that organizations need to be able to respond to things.
• 35:37
  SPEAKER_03: I mean, let's come back to energy grid, right?
• 35:40
  SPEAKER_03: Energy grid, I don't know how many, you know, but but each energy grid operator, each utility operates independently.
• 35:47
  SPEAKER_03: And sure, they have information sharing methods.
• 35:50
  SPEAKER_03: Water, perfect example.
• 35:51
  SPEAKER_03: You just saw spun up in the last month.
• 35:53
  SPEAKER_03: It was announced at Black Hat in August, a new concept called the Water Watch Center.
• 36:00
  SPEAKER_03: And it's a way to share actionable information about remediation out to water utilities.
• 36:06
  SPEAKER_03: So this goes beyond the, hey, we've got threats and let's share information about them.
• 36:10
  SPEAKER_03: This is the here's how to make effective action happen more quickly and across an industry.
• 36:14
  SPEAKER_03: So I think AI will help to accelerate those benchmarking and best practice hearings that that have lagged historically.
• 36:21
  SPEAKER_01: Yeah.
• 36:22
  SPEAKER_01: And when you in at your organization, you you have something that's a little bit unusual for your for your size.
• 36:28
  SPEAKER_01: You've three billion hours of production use data across 12 years.
• 36:32
  SPEAKER_01: So what does that let you see that the rest of the market cannot?
• 36:35
  SPEAKER_01: Are there things that you've learned that are maybe contrarian or to talk a little bit about what that data has shown you.
• 36:41
  SPEAKER_03: Yeah.
• 36:42
  SPEAKER_03: So first of all, you know, we we we treat the confidential confidentiality of that data quite quite seriously.
• 36:48
  SPEAKER_03: And so that data is is something that we use internally to uh first of all make our product you know better, right?
• 36:55
  SPEAKER_03: We're able to see situations where perhaps you know we could have taken a different route, taken different action, or made it more efficient.
• 37:02
  SPEAKER_03: So it just simply, you know, the more hours of usage lead to a better user experience ultimately and and better customer satisfaction, you know, through that.
• 37:12
  SPEAKER_03: The two other things that it gives us, one is the ability to look overall at the threat landscape and see the acceleration.
• 37:20
  SPEAKER_03: I mean, you know, we don't need to go out to Gardner or go out to Forrester or Omdia or you know, name your favorite analyst group.
• 37:29
  SPEAKER_03: We've got some of our own data that that we can use to validate and verify what we're seeing out in the field.
• 37:34
  SPEAKER_03: And so without without question, the rate of, for example, firmware updates.
• 37:39
  SPEAKER_03: I mean, our system tracks that quite quite easily.
• 37:42
  SPEAKER_03: And, you know, we don't need to go outside to see that that the rate since AI started to come in, and especially since, again, I'm gonna call it the methos inversion, since that put remediation at the forefront, right?
• 37:56
  SPEAKER_03: There's changes that we're now seeing over even the last few months that come from that.
• 38:00
  SPEAKER_03: Then the third thing is it gives us the ability to to look at, you know, where are I'm not gonna say you know imminent or upcoming, you know, failures, but emerging, emerging, emerging, yeah.
• 38:12
  SPEAKER_03: That that are there choke points that people aren't seeing right now?
• 38:15
  SPEAKER_03: Are there are there situations where across an inventory we can see that something is is being leading indicators, yeah.
• 38:23
  SPEAKER_03: Leading indicators, yeah.
• 38:24
  SPEAKER_03: So, you know, and and eventually that will be indicators of compromise.
• 38:29
  SPEAKER_03: It will be things like that.
• 38:30
  SPEAKER_03: I mean, I've you know, again, sorry, I'm pulling out the soapbox and I'll pull it, push it back really quick, but it's the desire to have systems like ours look at, for example, bots and be able not just to to to know that they're present there, but to actually be able to control and manage them and then eventually eradicate them.
• 38:49
  SPEAKER_03: People today would say, oh, we're so good at bot mitigation, we don't need that.
• 38:53
  SPEAKER_03: But I think those bots themselves being AI enabled, we might come to a point soon where we're managing them and eradicating them becomes a much more important function.
• 39:02
  SPEAKER_01: Yeah, yeah.
• 39:03
  SPEAKER_01: Well, yeah, and and especially if they're not aligned, right?
• 39:07
  SPEAKER_01: If they're out of alignment or a or the the more powerful models without the guardrails gets into the hands of threat actors.
• 39:14
  SPEAKER_01: I mean, you're really talking about a very serious arms race when it comes to bots and and being able to do that.
• 39:21
  SPEAKER_01: So uh it was funny uh when when we chatted before, um you you described your target market in a way I haven't really heard before.
• 39:28
  SPEAKER_01: And and I wanted you to say it just to give it a useful uh buying signal for the audience, you know, you don't think of verticals.
• 39:37
  SPEAKER_01: You were you you you talk about not looking at verticals.
• 39:40
  SPEAKER_03: Talk talk about your your your market, talk about your uh the landscape and and how many organizations a little more than maybe if I was just talking one-on-one, right?
• 39:51
  SPEAKER_03: Just to be uh on the the clean side of the street.
• 39:55
  SPEAKER_03: But think of it this way, right?
• 39:58
  SPEAKER_03: You have every organization on a security journey, every single one of them.
• 40:03
  SPEAKER_03: And they're at different stages, every single one of them.
• 40:06
  SPEAKER_03: And so it starts with understanding or being aware that you have an issue.
• 40:10
  SPEAKER_03: And so if an organization isn't at that stage on the journey, they're they're they're not a relevant customer.
• 40:15
  SPEAKER_03: They've got other work to do to get to get to the level where where we become relevant.
• 40:20
  SPEAKER_03: Where we become relevant is what our CEO for a while has called the gas market.
• 40:26
  SPEAKER_03: It's the give a shit market.
• 40:28
  SPEAKER_03: You've gotten to the point where you understand you have an issue, you understand that you need to know your inventory, you've deployed asset inventory mechanisms, you you track things, you've got environments like ours that capture digital twin data so you can see over time.
• 40:44
  SPEAKER_03: That's when you reach a point where you're able to take action on remediation and and you care because you've gone this journey.
• 40:51
  SPEAKER_03: And along that journey, you're getting a lot of other data and other things that say, no, you've got to keep going, you've got to get to the point because we don't view the endpoint as being anywhere before remediation and repatriation.
• 41:05
  SPEAKER_03: You've got to remediate the vulnerability and you have to repatriate the system to full working, compliant, auditable stance within the or posture within the organization.
• 41:16
  SPEAKER_03: So, so yeah, for us, the the the target market is the gas market.
• 41:20
  SPEAKER_03: And I think there's a lot of organizations that have accelerated their journey in the last year.
• 41:26
  SPEAKER_03: So it may have been a you know 10% of the market a couple of years ago, today it's 50% of the market.
• 41:32
  SPEAKER_01: And and it it it's not that there's there isn't a need, there just isn't an awareness or a prioritization because because every organization has a threat of a vulnerability, and if they have any devices that that that integrate with that physical world, right?
• 41:49
  SPEAKER_01: That that uh cyber physical world.
• 41:50
  SPEAKER_01: Yeah.
• 41:51
  SPEAKER_03: Absolutely.
• 41:51
  SPEAKER_03: You know, one of one of the toughest jobs, I mean, is is often as referred, yeah, it's often referred to this way.
• 41:56
  SPEAKER_03: I mean, one of the toughest jobs out there is to be a CISO on a large-scale organization with both IT and OT and IoT environments, because you're constantly firefighting and triaging and prioritizing.
• 42:08
  SPEAKER_03: And I think, you know, I view it as it's not there's no CISO in the universe that that isn't aware that there's issues with OT security.
• 42:16
  SPEAKER_03: Everyone is.
• 42:17
  SPEAKER_03: It's a question of where does it fit on their cut line and where does it fit in their ability to take action.
• 42:22
  SPEAKER_02: Right.
• 42:22
  SPEAKER_03: And boards of directors have a really key role in enabling that as well.
• 42:27
  SPEAKER_03: So we've seen as ransomware has shifted to OT, we've seen board level actions shift as well to put more resources into the OT security function and be able to get to that remediation goal that people have.
• 42:41
  SPEAKER_03: So it's not blindness to the issue, it's frankly, you know, an overwhelming number of other priorities that you have to manage to.
• 42:48
  SPEAKER_01: Right.
• 42:49
  SPEAKER_01: So that's give people a list.
• 42:51
  SPEAKER_01: Where do they start?
• 42:52
  SPEAKER_01: Start with inventorying.
• 42:54
  SPEAKER_01: You can't secure or patch something that you haven't identified and enumerated, make, model, firmware, location, owner, uh, what it connects to, right?
• 43:02
  SPEAKER_01: That's the ungramerous foundation.
• 43:04
  SPEAKER_01: What else?
• 43:04
  SPEAKER_01: Where do you go from there?
• 43:05
  SPEAKER_01: We're keep going.
• 43:07
  SPEAKER_03: Yeah, so so yeah, you know, awareness that there's issues, the in inventory so that you can judge how how the issue is within your world, knowing what new threats are coming in.
• 43:17
  SPEAKER_03: So threat detection.
• 43:19
  SPEAKER_03: Another thing which I think it's understated, but it's a very key part of this this journey, it's it's being able to mitigate, right?
• 43:26
  SPEAKER_03: Being able to, and this is difficult in the OT world, right?
• 43:30
  SPEAKER_03: Is is really, really, really difficult.
• 43:33
  SPEAKER_03: Because if you're going to shut down an energy production facility, if you're gonna shut down a water processing facility, um, if you're gonna shut down a manufacturing line, there's both costs, human efforts, impact that that has to be considered.
• 43:48
  SPEAKER_03: So some mitigation of of different kinds.
• 43:50
  SPEAKER_03: Ideally, you want it as short and as painless as possible, but but depending on the nature of the threat, you often will have to consider a mitigation strategy.
• 43:59
  SPEAKER_03: Sure.
• 44:00
  SPEAKER_02: Yeah.
• 44:01
  SPEAKER_03: You know, and then you know, you get into you know remediation in a true sense.
• 44:05
  SPEAKER_03: And and along the way, you also want to have a again, I keep coming back to governance, but you want policies that force organizations to take cyber hygiene seriously.
• 44:15
  SPEAKER_03: You don't want to be you don't want to be in a situation, we come across this too often, I'll just say, which is that somebody has gotten the religion, they are under threat.
• 44:24
  SPEAKER_03: And then they've realized all of my building lighting system applications are you know or devices or five firmware generations behind.
• 44:35
  SPEAKER_03: Can I can I go from version one to version eight in one leap?
• 44:41
  SPEAKER_03: Do I have to structure it?
• 44:42
  SPEAKER_03: So again, that's where we add value because we'll ascertain what is the necessary path to update, get things to a a stable and compliant version, and then be able to operate from there going forward.
• 44:55
  SPEAKER_03: But you know, having governance in place that would have automatically forced an organization to move to new ver versions of firmware, that could also help the situation.
• 45:05
  SPEAKER_01: So thank you very much for your time and and thank uh thank you to the audience for listening.
• 45:12
  SPEAKER_01: I want if there's one thing you take away, it's that you know, for decades, devices running on the physical side of business were protected by the fact that they were too obscure to be worth an attacker's time.
• 45:22
  SPEAKER_01: That protection was never a strategy, and AI has erased it, right?
• 45:26
  SPEAKER_01: It doesn't care about the 150,000 operating systems.
• 45:29
  SPEAKER_01: But the defense is not a smarter model, it's the knowledge of what you own, it's the firmware, it's what connects to it, what breaks when you touch it, who's accountable, and uh, you know, when and and and and and that's an inventory problem, that's a normalization problem, it's an ownership problem, right?
• 45:44
  SPEAKER_01: Uh it's an information architecture problem, right?
• 45:46
  SPEAKER_01: It it really is.
• 45:46
  SPEAKER_01: Is we always talk about that whole idea of AI and IA, and we really do need to have that understanding and that structured data about your devices.
• 45:56
  SPEAKER_01: Uh so John, uh, thank you so much.
• 45:58
  SPEAKER_01: Uh John Gallagher runs uh labs and serves at the VP of Marketing of IQ.
• 46:02
  SPEAKER_01: I'm Seth Early, CEO of Early Information Science and author of BA Powered Enterprise.
• 46:07
  SPEAKER_01: Thank you for listening to the Early AI podcast.
• 46:10
  SPEAKER_01: If this was useful, please share it with one executive in your organization who still thinks that cameras are facilities problems.
• 46:17
  SPEAKER_01: Thanks, John.
• 46:18
  SPEAKER_01: Thanks, Seth.
• 46:19
  SPEAKER_03: It was great.
• 46:21
  SPEAKER_00: Thank you for joining us on another deep dive into AI innovation.
• 46:25
  SPEAKER_00: Tune in next time when we introduce another industry expert and discuss how to maximize AI in your world.
• 46:31
  SPEAKER_00: The Early AI Podcast is sponsored by Early Information Science and Vector.
• 46:36
  SPEAKER_00: To learn more, visit early.com.
• 46:38
  SPEAKER_00: That's E A R L E Y dot com.
• 46:42
  SPEAKER_00: Thank you for tuning in.