Transcript 0:02 Yeah. So if we, if we think about it, right, um, centralizing the security data from IT and OT systems consolidate the view across IIoT, IT and OT device types. 0:12 You know, a lot of these organizations treat these environments as separate, right? 0:16 They're very siloed, and because of that, the SOC team doesn't have visibility or the knowledge of the devices that are connecting to their network. 0:24 [upbeat music] Welcome back to The Peggy Smedley Show, the podcasting voice of IoT and digital transformation. Hello, listeners, and welcome back to The Peggy Smedley Show. 0:42 I'm your host, Peggy Smedley. My next guest is an advocate for customers. She is focused on their use of technology to enable them to simplify work. 0:52 She is at her best when bridging the gap between sophisticated software products and the benefits of... that customers can expect. Please welcome Cynthia Gonzalez, Product Marketing Manager for Exabeam. 1:05 Cynthia, welcome to the show. Hi. Thanks. Uh, happy to be here. So, Cynthia, I'm really excited. 1:11 You know, there's a lot going on these days, and I, I have to tell you, we have to protect all of our devices, and it's kind of interesting because that's something that is getting harder and harder. 1:22 And one of the things that I've noticed is we've seen this rise of state-sponsored, I think, infrastructure attacks. 1:30 I think even in the past year, I don't know if it's just with COVID or even before COVID, but we've seen just-- they just, you know, the bad guys, I always like to say that we are seeing threat attacks, you know, these anomalies or, or whatever is going on, they just keep seeming to rise. 1:48 What's your take on all of that? Yeah. 1:52 So when speaking about, uh, critical infrastructure specifically, right, these attacks ha- were happening even before COVID, and a big piece of that is, um, that the infrastructure is now more accessible than it used to be, right? 2:05 So one of the main reasons we're seeing these, uh, this... we're seeing this increase in attacks of critical infrastructure is because of the growing interconnectedness of critical infrastructure. 2:15 So in the past, most of these systems were designed to be air-gapped, right? They were closed environments, um, this meant that the attacker had to physically be on site to introduce malware. 2:25 However, more and more critical infrastructure is being connected to the internet, uh, whether it's to enable centralized command and control or remote access, right? 2:33 But once these systems are exposed to the internet, you're expanding their threat landscape, uh, right? So they become expe-exposed to the same threats that are attacking corporate networks. 2:45 And speaking of recent, recent examples, right, in the past year, we've seen threats specifically target Israel's water system. 2:51 Hackers gained access to s- some of Israel's water treatment systems and tried altering water chlorine levels. 2:57 You know, fortunately, the-- they were detected, and they were stopped, but if they hadn't, these attacks could have caused mild poisoning in local populations, right? 3:06 Uh, we also saw- Did, did we just- A high number- I- I'm sorry. I didn't mean to interrupt, but isn't that kinda what we saw just recently in Florida where they tried to put some lye poisoning in, in the water? 3:18 I mean, I feel like they caught that, but is, is that what we're talking about as well, you know, when, you know, those kinda... they try to orchestrate some incident in some way? 3:29 Is that really what you're referencing as well? Um, yeah. Yeah. We're, we're, you know, we're referencing that. We're also-- It's like in, in Iran, right? 3:38 We-- There's a high number of reported accidents and explosions detected across their critical infrastructure, right? 3:44 Whether that's petrochemical plants, nuclear fuel enrichment centers, power plants, ports, and health clinics. And ultimately, these, you know, these attacks, um, resulted in deaths, right? And injuries. Uh, 3:58 s- so they're- So- Go ahead... I gue- I guess what I'm trying to understand here is, you know, we have a failing infrastructure in this country. I mean, we're, we're gonna get, and we've just seen the ASCE report is out. 4:10 It talks about the failing infrastructure, and we know we have to invest in our failing infrastructure. 4:18 And if we're talking about that attackers can set up these tactics to go after them, if they can remotely access sensors or whatever they can or, or water or, or energy, and we have these archaic systems, is, is that what we're talking about? 4:37 That they can go after the most vulnerable environments? Is that what you're indicating? Yes. Yes. And that's because... So as you're, as you're mentioning, right, these are archaic systems. 4:47 These are legacy critical infrastructure systems, so they weren't built, built thinking security, right? They weren't built with security in mind. They're built for a process. They, they were built to accomplish a task. 5:00 And so when you start to open them up to, to the internet, right, with the, the interconnectedness, whether it's bringing in IIoT to, to improve your processes for remote access, you know, they're, they're vulnerable. 5:12 They're, they're, they're not prepared, um, they're not prepared for the, for the new day attacks that we're seeing. So with that in mind, I mean, w- we have governments that understand this. 5:26 I mean, we have governments that say, "You know, we're, we're focusing our money on all the wrong things." So are we-- are-- should we be overly concerned? 5:34 I say this all the time that we have to be worried about what is going to be orchestrated as the worst incident response that right now we've lost fifty lives, a hundred lives. 5:49 I mean, here in the United States, we just talked about a half a million lives being lost because of COVID, and we all are worried about that. 5:57 But we're gonna see maybe some catastrophic, and I don't wanna be an alarmist here, but if somebody attacks an energy grid or somebody attacks our water system-Five hundred thousand lives lost to COVID is gonna seem like nothing if that happens. 6:17 That's gonna be a small-- detecting a small anomaly if that's what happens. And we, we've been talking about this for years. Uh, are, am I correct or am I wrong? Yeah. 6:30 I, I mean, I, I would, um, I would agree with you there, right? The, these, the possibility of the attacks like these, um... The possibility of these attacks, y- they have grave repercussions. 6:43 Uh, so they need to be, they need to be detected, and they need to be secured, uh, to avoid catastrophic events. We've seen, you know, we've seen it in the past. It's nothing new. 6:52 We've seen, uh, you know, power grid lines down because of, because of these attacks. So it's, it's definitely something that, that is possible hap- to happen here. So what's the, the biggest challenge? 7:06 I mean, these threats. We-we've, we've just talked about these environments, but what do we have to do? We have to look to secure them right now? Do we have to take a greater step? I mean, we know this. 7:17 We have the technology. We have a lot of smart people. I mean, you guys are one that know what the challenges are. What do you think companies need to be doing with their IT, their OT, their, their SOCs? 7:31 What, what do they have to be doing? What does everybody need to be doing to prevent what we know might be inevitable if we don't step it up right now? Yeah. 7:43 So I think one of the things that we can start doing is, uh, aligning the SOC to secure IT, OT, and IoT, uh, right? 7:52 Th-that could be either centralizing the security data from IT and OT systems, monitoring in an, in an unintrusive way, using behavior, uh, analytics to find threats, right? 8:03 Um, and then just, uh, collaborating between, between those two teams. Is that- So if we- Um, I'm sorry. Go ahead. Go ahead. Yeah. So if we, if we think about it, right? 8:14 Um, centralizing the security data from IT and OT systems consolidate the view across IIoT, IT, and OT device types. You know, a lot of these organizations treat these environments as separate, right? 8:26 They're very siloed. And because of that, the SOC team doesn't have visibility or the knowledge of the devices that are connecting to their network. And is that something... 8:38 'cause we've done siloing for years, and we've always said that's the biggest challenge that's happened in manufacturing and other industries. We've always worked in these islands of automation. 8:51 Is that what's made us most vulnerable up to this point? Yeah. I think, I think that's a big, a big piece of it, right? Because, um, y-you know, the, uh, m-m... the people that are securing the OT environments, 9:07 they have different objective... Sorry, excuse me. I have to cough. You know, the pe- the people that are securing these OT environments, they have different objectives than somebody in a SOC, right? 9:20 Somebody securing IT. Um, their objectives are availability. They want to make sure that their processes are running, you know, that they're, they're available, they're ready to go, right? They don't want any downtime. 9:35 And, and that's why a lot of times they won't patch, right? Because, because that's not their top priority. Their top priority is making sure that these systems, um, are, are running. 9:45 Uh, so it just means that they're a bit more prone to neglect, um, and they're, they're enabling a few more entry points, uh, f- uh, uh, vulnerabilities opening up a few more entry points, uh, for an attack. 9:59 So looking at your thoughts on this, what can organizations actually do to minimize any of these challenges? And, and what, what's the threat intelligence? 10:08 You know, how, how can threat intelligence and security an-analytics help here? Because I think that's the key to what you're just describing in some of this. Yeah. So, um, in order... So as, as I'm mentioning, right? 10:21 In order to minimize these challenges, organizations can centralize security data. 10:26 Um, and, and part of that is, you know, using a third-party device monitoring solution or monitoring devices by network activity through something like a network traffic analysis and integrating the solutions with a modern SIEM management platform that has analytics and has response automation, right? 10:44 So this is a way that they can merge the OT and IT security operations and extend their IT security practices to OT environments, right? And that, that includes IIoT devices, industrial IoT devices. 10:58 Um, and they, you know, by using maybe a third-party device monitoring solution or monitoring devices by network, um, activity, you know, they... 11:09 They're, they're, they're able to do this, uh, without disrupting the OT systems or processes, right? And 11:17 another thing, right, that's important is to have an accurate inventory of the assets that are connecting to your network. 11:22 You know, because these teams are, are separate, a lot of times, um, IT is blind to the, to the devices, right? But once, once you know what, what's in your network, right? 11:33 You, you know what devices are in your environment, you can use behavioral analytics to build those models and understand behavior. 11:39 And if you understand normal behavior, you can detect when an asset is acting anomalously, right? Like, is this asset communicating with a new, new device? Is that normal? 11:49 A lot of times for, for these devices, because they have a very specific function, it's not, right? 11:54 It's not like a, an employee that, you know, is a bit more sporadic or, you know, behaves, uh, you know, doesn't have a certain behavior every day. These devices do. 12:04 So, so being able to have, um, to being able to build those models and understand their beha- uh, normal behavior helps you detect when one asset is acting anomalously and is potentially compromised.It, does it matter now that we have s- uh, you know, dispersed workforces? 12:23 Does it make it more challenging, and we have smaller workforces today, to be able to accomplish so many things that are going on in our, in our businesses today, to be able to monitor, manage, and oversee all the things that you just described? 12:43 Do you mind repeating the question? We have very dispersed workforces today. You know, we don't- Sure... we're not all in one place. 12:50 You know, we, we talked about IT/OT working separately, but we don't have multiple people overseeing these things. 12:57 So the challenge in some places is we don't have as many eyes as maybe that we need looking on the things that are happening and monitoring from a security perspective. 13:08 Does it compromise or make things a little bit more complicated to, to really keep eyes to make sure we don't have attackers doing things that we're not aware of that, that threat detection, so to speak, from a, from an oversight perspective? 13:26 Yeah. So, so the fact that you're, um, you know, the fact that the workforce is dispersed m- means that it's even more, um, important to, to have behavioral analytics, right? To be able to, um, 13:40 to, to be able to, you know, build those models and understand what their normal behavior is, and finding those, um, those anomalous actions. 13:48 So, you know, you can leverage tools like a, you know, like a SIM that has, you know, automated investigations, uses machine learning or AI to help s- you know, supplement the fact that, you know, you don't have those eyes all over the place, right? 14:03 So you, you use machine learning to, to help with that. So, and today we're really looking at that's where we're gonna see the future. 14:10 We, we can, uh, complement our teams with AI and machine learning to really kind of fend off some of these attackers and some of these, uh, incidents that are occurring. 14:21 Well, I have to tell you, Cynthia Gonzalez, Product Marketing Manager for Exabeam, it's really been a delight to have you talk about some of these things. 14:29 Where can our listeners go right now to understand, as we continue to see so much happening in the critical infrastructure to kind of protect it, where can we learn about what you guys are doing and to help us, you know, continue to be safe in, in our environments? 14:43 Yeah, you can go to e- exabeam.com and get a bit more information about, uh, about what we're doing at Exabeam and how we can help organizations. Great. All right, listeners, that's all the time we have t- for today. 14:54 Remember, we are broadcast live every Tuesday at 12:00 PM Central. Check out our website at connecttheworld.com or our show website at thepeggysmadleyshow.com. But most importantly, tweet at us at connectedwmag. 15:05 All right. This is The Peggy Smiley Show, the podcasting voice of IoT and digital transformation. And remember, with great technology comes great responsibility. Have a great week. Stay safe. [upbeat music]
