Episodes
-
In this episode, we dive into the challenges of managing legacy operational technology (OT) systems. Join host Ken Kully, Systems Support Lead at Verve Industrial, and his guests Tyler Bergman, Doug Artze, Dylan Stencil, and Andrew Wintermeyer, as they discuss the complexities of legacy systems, spare parts ("grey") markets, and the importance of security in maintaining older technologies. They explore real-world stories, the economics of keeping legacy systems running, and offer insights into potential solutions.
Key Takeaways
Legacy OT equipment can have extremely long lifespans, often much longer than typical IT hardware. This leads to challenges in finding support and spare parts as the equipment ages. There is a thriving market for reconditioned and resold legacy OT equipment, but the chain of custody and security vetting of these devices can be unclear. Maintaining documentation and access to legacy software/configuration tools is critical for supporting and troubleshooting older OT systems, which can be difficult as vendors discontinue support. The economic and operational costs of upgrading legacy OT systems can be prohibitive, leading many facilities to try to keep them running as long as possible through creative means like sourcing spare parts. Planned obsolescence by vendors and the lack of right-to-repair policies can exacerbate the challenges of maintaining legacy OT equipment over time. Visibility into the OT asset inventory and having a plan for securing legacy systems are important for managing cybersecurity risks in these environments.Timestamps
00:00 – Introduction and sound check 02:00 – Ken’s story: Decommissioning PDP-11/84 systems 04:50 – Challenges with legacy equipment and backup solutions 09:00 – The aftermarket for OT equipment and security risks 14:00 – Securing legacy OT systems and ensuring safety standards 27:00 – Real-world experiences with aging OT infrastructure 39:00 – How cybersecurity standards affect legacy systems 50:00 – Solutions for managing legacy equipment
Guest Information
Tyler Bergman: Experienced in utilities and OT security with over 20 years in the industry.
Dylan Stencil: Research team member with a background in technology and controls work.
Doug Artze: Operations team member with experience in nuclear power and wastewater treatment.
Drew Wintermeyer: Research team member and overseer of Verve’s internal labs of OT devices.
Subscribe
Follow and Subscribe
Get in Touch
LinkedIn | YouTube | Twitter/X | Contact Verve
-
In this episode, we explore the concept of Calculated Risk Rating (CRR) and its importance in OT cybersecurity. Join host Ken Kully, Systems Support Lead at Verve Industrial, and his guests – Zachary Woltjer, Cyber Data Analyst at Verve, and Lance Lamont – as they discuss how to prioritize and address vulnerabilities in industrial environments.
Key Takeaways
Calculated Risk Rating helps tailor cybersecurity solutions to specific industrial environments CRR considers both the impact and likelihood of vulnerabilities being exploited The approach helps organizations prioritize their limited resources for maximum security benefit Trust between cybersecurity providers and industrial operators is crucial for effective risk management Active asset inventory solutions provide richer data for more effective risk mitigation strategiesTimestamps
00:00 – Introduction and sound check
01:00 – Introduction of guest Zachary Woltjer
02:50 – Explanation of Calculated Risk Rating (CRR)
06:21 – Importance of contextualizing vulnerability information
09:47 – Discussion on EPSS (Exploit Prediction Scoring System)
12:43 – Identifying “crown jewels” in industrial environments
18:48 – Process of assigning criticality and likelihood ratings
26:50 – Importance of defense in depth strategies
31:01 – How Verve’s teams work together to implement CRR
35:56 – Benefits of active asset inventory solutions
42:35 – Conclusion and outtro
Guest Information
Zachary Woltjer: Cyber Data Analyst on the Customer Success team at Verve Industrial
Lance Lamont: Creator and Explorer at Verve Industrial Protection, leading the research team in exploring OT devices and their security.
Subscribe
Follow and Subscribe
Get in Touch
LinkedIn | YouTube | Twitter/X | Contact Verve
-
Missing episodes?
-
In this episode, we explore the challenges and benefits of active detection in OT security environments. Join host Ken Kully, Systems Support Lead at Verve Industrial, and his guests Rick Kaun and Sally Mellinger as they discuss the limitations of passive detection and the importance of comprehensive asset inventory in industrial cybersecurity.
Key Takeaways
Passive detection, while useful, has significant limitations in providing a comprehensive view of OT environments Active detection, including the use of agents, can provide more detailed and actionable information about assets Many operators have valid concerns about touching OT systems, but these fears can be addressed with proper expertise and non-disruptive solutions A comprehensive asset inventory is crucial for understanding and managing cybersecurity risks in OT environments The industry needs to overcome the fear of touching OT devices to achieve better security outcomesTimestamps
00:00 – Introduction and sound check
01:21 – Introduction of Sally Mellinger and Ken Kully
04:54 – Discussion on passive detection and its limitations
10:51 – Analogy comparing passive detection to traffic monitoring
24:56 – The importance of comprehensive asset inventory
31:17 – Examples of hidden vulnerabilities in OT environments
36:22 – The need to overcome vendor restrictions on security tools
39:26 – Addressing the root of OT security fears
45:49 – The importance of educating the market on active detection solutions
Guest Information
Rick Kaun: Expert in OT security with over 23 years of experience in the industry
Sally Mellinger: Senior Manager of Content Marketing at Verve Industrial, with over 10 years of experience in B2B and technical content marketing
Subscribe
Follow and Subscribe
Get in Touch
LinkedIn | YouTube | Twitter/X | Contact Verve
-
In this episode, we explore the implications of the recent Crowdstrike incident for OT cybersecurity. Join host Ken Kully, Systems Support Lead at Verve Industrial, and his guests Tyler Bergman and Ryan Zahn as they discuss the impact of IT security tools on OT environments, the importance of staged rollouts, and the delicate balance between automated updates and manual controls.
Key Takeaways:
The Crowdstrike incident highlights the risks of using IT-focused security tools in OT environments
Staged rollouts and thorough testing are crucial for minimizing risks in critical infrastructure
OT environments require a different approach to updates and security compared to IT systems
The incident underscores the need for better collaboration between IT and OT teams
Kernel-level access in security software presents both benefits and risks that must be carefully managed
Timestamps:
00:00 – Introduction and discussion of recent events
03:08 – Overview of the Crowdstrike incident and its impact
05:50 – Discussing the differences between IT and OT security approaches
14:57 – Exploration of staged rollouts and testing processes
23:43 – The importance of human safety in OT environments
28:36 – The need for OT-specific considerations in security tool deployment
35:36 – Discussion on the risks associated with kernel-level access
43:18 – Reflecting on the broader implications for cybersecurity and critical infrastructure
48:06 – Closing thoughts and wrap-up
Guest Information:
Tyler Bergman: Utility engineering expert with 20 years of experience, focusing on cybersecurity efforts for the past five years.
Ryan Zahn: Customer Success professional at Verve Industrial with over 11 years of experience and a background in OT as a state engineer for a Midwest power utility.
Subscribe:
Follow and Subscribe
Get in Touch:
LinkedIn | YouTube | Twitter/X | Contact Verve
-
In this episode, we explore the importance of treating OT security as a comprehensive program rather than a collection of individual functions. Join host Ken Kully, Cyber Tech Lead at Verve Industrial, and his guest Rick Kaun, VP of Sales at Verve Industrial, as they discuss the challenges of implementing OT security, the differences between IT and OT approaches, and the need for a holistic view of security in industrial environments.
Key Takeaways:
OT security requires a programmatic approach that integrates multiple disciplines and functions, rather than treating them as isolated tasks. Context is crucial in OT environments, as the same device can have different implications depending on its role in the process. Implementing individual security functions separately in OT can lead to inefficiencies, increased costs, and potential risks. OT security requires collaboration between IT and OT teams, with a deep understanding of the unique challenges and requirements of industrial systems. A centralized approach to OT security can significantly reduce time, effort, and potential errors in managing industrial cybersecurity.Timestamps:
00:00 – Introduction and topic overview
01:03 – Guest introduction: Rick Kaun, VP of Sales at Verve Industrial
01:18 – Rick's background and experience in OT security
04:57 – The importance of treating security as a program in OT
07:05 – Challenges of implementing individual security functions in OT
11:03 – The role of context in OT security decisions
15:26 – Examples of OT-specific security considerations
22:01 – The impact of IT approaches on OT environments
25:19 – The need for collaboration between IT and OT teams
28:51 – Real-world impacts of OT security failures
32:40 – The importance of skill sets and resources in OT security
33:50 – Concluding thoughts and contact information
Guest Information:
Rick Kaun: VP of Sales at Verve Industrial, with over 23 years of experience in OT security, helping clients build comprehensive security programs across various industries globally.
Subscribe
Follow and Subscribe
Get in Touch
LinkedIn | YouTube | Twitter/X | Contact Verve
-
In our second episode, we ask the question: “what is OT?”, and attempt to provide an answer. Join host Ken Kully, Cyber Tech Lead at Verve Industrial, and his guests and colleagues Lance Lamont, Tyler Bergman, Doug Artze, and Drew Wintermyer as they discuss what characterizes an OT environment and OT equipment, the impact of IT/OT convergence on distinguishing one realm from the other, and how a device’s usage is often the deciding factor as to whether it is an IT device…or an OT device.
Key Takeaways:
OT is the collection of hardware and software that is principally concerned with process availability: monitoring the process, providing safety oversight, and the automation, supervision, and control of the core processes for any industry. The same device can be both an IT device and an OT device, depending on usage. OT systems are often – though not always – characterized by device isolation, and can also be spread over a large geographic area. There are some industries – healthcare is an example – where the distinction between IT and OT becomes very blurred.Timestamps:
00:00 – Introduction and sound check
00:35 – Welcome to OT After Hours
00:43 – Host introductions and background
03:40 – What is OT?
04:32 – Parallel terms: IT and OT
05:56 – Other terms: DCS, SCADA, etc.
11:43 – Hardware differences between IT and OT
14:20 – The role of context in defining OT devices
17:34 – The evolution and convergence of OT and IT
19:52 – The CIA triad and its different priorities in IT and OT
22:36 – The timeliness element in OT systems
23:30 – Engineering workstations and their classification
32:36 – The criticality of availability in OT environments
34:30 – The sensitivity of OT control systems
37:41 – Examples of OT in non-industrial settings
44:27 – The importance of physical access in OT security
46:55 – The unique challenges of healthcare OT
50:59 – Concluding thoughts on defining OT
Guest Information:
Lance Lamont: Creator and Explorer at Verve Industrial Protection, leading the research team in exploring OT devices and their security.
Tyler Bergman: Experienced in utilities and OT security with over 20 years in the industry.
Doug Artze: Operations team lead with experience in nuclear power and wastewater treatment.
Drew Wintermyer: Research team member and overseer of Verve’s internal labs of OT devices.
Subscribe
Follow and Subscribe
Get in Touch
LinkedIn | YouTube | Twitter/X | Contact Verve
-
In our pilot episode, we dive into the crucial world of OT security. Join host Ken Kully, Cyber Tech Lead at Verve Industrial, and his guests and colleagues Lance Lamont, Tyler Bergman, and Dylan Stencil as they discuss the importance of industrial cybersecurity, the unique challenges it presents, and why it truly matters. From understanding OT environments to real-world incidents like Stuxnet, this episode is packed with insights and practical advice for navigating the complexities of OT security.
Key Takeaways:
OT security is critical due to the unique challenges and vulnerabilities in industrial environments. Real-world incidents like Stuxnet highlight the importance of securing OT systems. Maintaining availability and integrity in OT environments is essential to prevent costly downtimes and disruptions. Effective communication with management about OT security needs is crucial for obtaining necessary support and resources.Timestamps:
00:00 – Introduction and sound check
00:40 – Welcome to OT After Hours
01:33 – Host introductions and backgrounds
06:57 – Why industrial cybersecurity matters
08:23 – Stuxnet: A brief overview
15:00 – Vulnerabilities in OT environments
20:08 – Examples of OT device failures
25:19 – The importance of availability in OT systems
40:11 – Conversations about OT security with management
50:33 – Closing thoughts
Guest Information:
Lance Lamont: Creator and Explorer at Verve Industrial Protection, leading the research team in exploring OT devices and their security.
Tyler Bergman: Experienced in utilities and OT security with over 20 years in the industry.
Dylan Stencil: Research team member with a background in technology and controls work.
Subscribe
Follow and Subscribe
Get in Touch
LinkedIn | YouTube | Twitter/X | Contact Verve
-
The trailer for "OT After Hours": unfiltered stories and advice from the front lines of industrial cybersecurity.
Subscribe
Follow and Subscribe
Get in Touch
LinkedIn | YouTube | Twitter/X | Contact Verve
