As demonstrated by the recent CrowdStrike and Microsoft Windows outage, and the shocking revelation that Australians are losing $3 billion a year from cyber scams, the implications of insecure networks are vast and far-reaching – preventing humanity from boarding a flight, buying lunch and logging onto a laptop.
Kevin Isaac, chief revenue officer at Nozomi Networks – a leader in operational technology (OT) and cybersecurity – is witnessing a general public disengagement towards the importance of cybersecurity, in addition to a clash of priorities at numerous companies desperate to combat cyber attacks.
Facility managers, chief information security officers (CISOs) and directors, respectively, walk the tightrope towards cybersecurity meltdowns by failing to harness the possibilities of intersectoral collaboration in pursuing visible systems.
An incident at an unnamed North American casino could take the cake for the scariest thing to happen inside a fish tank in recent memory. In 2017, cyber attackers were able to send 10 gigabytes of data to a device in Finland by hacking into a casino fish tank through its thermometer.
The fish tank had sensors connected to a PC that allowed an operator to remotely clean the tank, automate feedings and adjust the temperature and salinity. Hackers capitalised on this remote connection by locating the high-roller database and pulling it back across the network and then out into the thermostat and the cloud. Threat intelligence experts Darktrace were left speechless at the subtlety and ingenuity of this Twilight Zone-esque episode of data theft.
Isaac says cyber attacks will become more common and difficult to prevent if there is not more interdisciplinary collaboration between board directors, plant and facility managers and CISOs to guarantee systems are visible. He argues that sitting tight for cataclysmic events to galvanise cybersecurity preventative measures into action is very risky.
“Why does it have to be something negative that happens for us to realise that we need to do something? Why can’t we be proactive?” postulates Isaac, the former CRO at Forcepoint and senior vice president at Symantec and Sophos.
Nozomi Networks chief revenue officer Kevin Issac
Maturity curve in cybersecurity management
Over the last decade, Isaac has observed many governments realising the importance of strong critical national infrastructure.
However, he says cybersecurity management at companies is currently at a fork in the road regarding roles and responsibilities – a fork in the road that brings opportunity for interdisciplinary cooperation between facility managers, CISOs and a board of directors.
“The facility and plant managers operate the systems, the board of directors are asking for more visibility so they can manage risk and the CISOs who are on the carpet for understanding and managing the risk in their environment,” says Isaac.
A lengthy question-and-answer game ensues, wherein the board of directors interrogate the efficacy and resilience of systems. They compare and contrast the business to other businesses and industries.
However, Isaac wants to see industries veer towards intersectoral collaboration within a company, particularly by having CISOs work with plant and faculty managers to anticipate the impact of “risk postures”.
“I think what we’re seeing is this maturity curve in business where the facility manager is no longer the person that’s solely responsible, but it’s also the CISO’s responsibility to be able to quantify risk,” he says.
‘Us and them’ complex in company cybersecurity management
Although intersectoral collaboration in company cybersecurity management is largely positive, Isaac has observed the three bodies being plagued by a slight ‘us and them’ complex and a clash of priorities.
“There’s generally a bit of an ‘us and them’ discussion,” he says. For example, Isaac speculates facility managers may want to operate independently without board interference. “I think a plant manager doesn’t want to fight with people. They want to be appreciated by headquarters, however, they also want to be left alone,” says Isaac.
Isaac also anticipates an evolution in the roles and responsibilities of CISOs. People in such positions would have traditionally busied themselves with discussing data privacy, the risk regarding confidential information and the latest outages, however, CISO obligations have increased in sophistication and complexity. “The chief security officers have a bunch of mitigation tactics to learn in OT and internet of things (IoT),” says Isaac.
He attributes a clash of methodologies and thinking systems to both a difference in expertise and a lack of constant communication between the facility managers, the CISOs and the board, all set against a volatile and unpredictable landscape where hackers roam wild.
“The board is forcing things down, the CISOs are trying to change the behaviour of the systems and the plant manager is maintaining productivity, resilience and safety,” says Isaac.
When proposing solutions to this clash of priorities, Isaac emphasises the importance of ensuring all parties understand the vision. “Once you’ve got everyone at the table, you can start to build strategies. The first thing is visibility,” he says.
You can’t protect what you can’t see
Isaac says the biggest cybersecurity challenge faced by companies is securing visibility. “There’s a saying – you can’t protect what you can’t see and you can’t manage what you can’t see,” he says.
Companies that persist with ineffective cyber security methods will find themselves unable to adequately front a mere first line of defence for cyber attacks. Isaac references an experience universal to offices, schools, hospitals and even beauty salons, to demonstrate the cunning capabilities of cyber attackers.
“If there’s a problem with the air conditioning at a facility, a technician will most likely plug their laptop in and connect to headquarters to get the latest patches for the process controller,” explains Isaac. “Once you start doing that, immediately you’re opening up another vector of attack.”
Isaac says companies that work with any form of IT and OT would be wise to be proactive. Damage is inevitable if companies do not have visibility of their systems. “Unless you have control and you can see and manage what you have, you’re at risk,” he says.
Even facilities fitted with thousands of cameras are at risk if cybersecurity measures are not subject to ongoing assessment and review. “If one camera is not patched to the right level, there is potential for someone to exploit that camera and get into the rest of the network,” says Isaac.
From elevators to badge access systems
Nozomi Networks prides itself on providing companies and industries with a remedy to the visibility issue in OT and IoT cybersecurity from its Vantage cloud management platform that unifies security monitor and risk management across sites, regional and teams to Guardian Air – a wireless security sensor specifically designed to extend the visibility of OT and IoT environments.
“Guardian Air can monitor radio waves as well – the need for boards and CISOs to have this visibility and awareness is vital,” says Isaac.
He underscores the importance of a facility ensuring all technology is visible, from the Apple TV in meeting rooms, the elevators, the security cameras, and the badge access, alarm and air conditioning systems.
“Once you have visibility, you can start making rational decisions about how to protect it,” says Isaac. This protection involves reforming outdated processes, investing in innovative technology, evaluating the efficacy of partnerships and implementing countermeasures.
“I think the important thing is for CISOs, plant managers and boards to understand their environment and work with companies who can provide a maturity curve,” says Isaac.
However, Issac advises caution against hastily pursuing visibility without a five-year risk management and regulation management plan.
“A lot of companies are trying to get visibility without thinking about what to do next,” he says. “You definitely have to have a three- to five-year strategy. My advice is to start with visibility but with a view to the future.”
Waiting until the first attack to respond is problematic
Isaac fervently maintains that waiting until after a cyberattack to act is hazardous.
He recalls worrying discussions with titans in the banking world who were seemingly content with waiting until trouble arrived at their doors. “I was at an event in London and talking to some large banks and inquiring as to what they have done for general data protection and they admitted to doing nothing,” says Isaac.
“They said it would cost them millions, so they’re waiting for the first fine and then they’ll move.” However, Isaac attempted to emphasise that even one blunder can derail production during crucial hours.
“All it takes is one of these things to go wrong and you have broken the chain of efficacy.”
He believes CISOs and facility managers should be mandating the adoption of simple yet effective measures such as two-factor authentication and password management – describing such measures as “basic hygiene” in cybersecurity.
Isaac laments Australia’s occasional nonchalance towards cybersecurity. “Hopefully it’s not going to take an incident in Australia for the market to wake up,” he says.
Concerning bouts of deja vu
When addressing the elephant in the cybersecurity room – the CrowdStrike and Microsoft outage – Isaac says he has sympathy, but it isn’t his first rodeo. “I don’t think it will be the last. I think all of us have a duty of care to make sure it doesn’t happen, but sometimes it does.”
Isaac is fearful of history repeating itself when inserting IT systems into OT systems, however, he is hopeful that a collective willingness to be proactive will prevail.
“I watched it from the early 2000s and the late nineties as we built the IT security space. It’s almost deja vu right now in terms of OT,” he says. “I just hope that we can do this faster.”
He addresses the perils of inserting IT systems into OT technology by likening the consequences of this manoeuvre as similar to packing luggage into a Formula One car. Risk management and assessment is a case of mitigation and impact.
“Putting IT technology into OT can cause massive issues,” he says. “We have to understand IT and OT are different and to not use IT assets in an OT environment because the implications are binary, such as loss of human life.”
Budget restrictions are major obstacles
Inevitably the discussions Isaac conducts with companies and organisations can grind to a halt when the budget is addressed. When companies procrastinate reshuffling room in the budget to accommodate cybersecurity costs, Isaac is understanding and patient, yet offers a simple suggestion.
“People will say to me, ‘We don’t have the budget right now. Can you come back in 2025?’ And I get it, but are you going to tell the hackers to come back then as well?”
Isaac argues specialists such as Nozomi Networks should be willing to provide security investment return and risk assessment guidance to companies eager to tighten cybersecurity measures.
Nozomi Networks hosts a free quarterly web series called ‘Nozomi Hour’ to help companies and organisations develop risk management plans. “We pull together all of the current threats and present it as a factual analytic study,” explains Isaac. “It’s amazing for customers as they can provide their board with market-related risk data.”
Supporting industries whose priorities lie elsewhere
Isaac understandably encounters people who label cybersecurity discussions as fatalistic and reminiscent of Doomsday-esque fear-mongering. When confronted with these attitudes, he points to industries and sectors that require help and assistance in cybersecurity as their purposes lie elsewhere, such as front-line emergency workers.
“If you have ever been in a hospital, you’ll realise that people are much more interested in saving lives than they are in the PCs,” he says.
Isaac says the hierarchy of priorities unique to a hospital or even a fire station produces a relaxed approach to cybersecurity and therefore creates peak susceptibility for attacks – evident via the sobering trend of Ransomware targeting hospitals.
“There’s this unfortunate situation where people who are trying to do the best they can are probably more at risk because they’re not paying attention to the basics. You’ll see passwords on Post-It notes in hospitals because they’re more interested in the health of the people inside the hospital than dealing with risk,” says Isaac.
“I know situations where ambulances have been backed up because there’s been a system issue and people can’t be unloaded out of ambulances.
“It’s our job to make sure we protect those people – it’s not only about us, it’s about the people who depend on us. We put processes in place so they learn and we put systems in place that protect them, and shame us if we don’t do that.”
Photography supplied by Nozomi Networks.
‘Plan for today’: cybersecurity essentials for operational technology.
