Kristin Demoranville

be like putting someone was like oh you're putting a cape on every day and like a superhero and i was like i don't know if i want to go that far but um if it helps you with the visualization of what i do that's fine but i don't want to put myself on that level this isn't a pedestal moment because we are a team like ot works as a team we really believe that we are in supporting each other

and be curious start asking questions like oh really is that ot like i wasn't going to actually ask me that like oh do you think that's ot i'm like yeah it's connected to the internet and whatever it's you know and i want that question be curious to the point of annoyance we don't mind we really don't and we want you to ask questions and we also want to ask questions that's what we do because we are constantly evaluating everything it was funny um when crowd strike hit as an example first of all my heart went out to anybody with it obviously but

but it didn't surprise neither myself or my fiance because both of us are in security. So in OT specifically, and it was just one of those like, you know, like this is not good. However, hopefully it's a lesson learned moment where you can't just have one thing holding the pillar up out of all of it. You need to actually have a better look at it.

And I hope that the people that were affected are taking a long hungered look of what they have in their environment. Now, what else could be critical and concerning?

It's crazy.

It's people and process. Exactly. It really is. And actually, when the event happened, I messaged a good friend of mine, my best friend, actually, who works in a cheese company in Wisconsin. Insert laughter. But I asked, I said, I know you guys have CrowdStrike. Like, are you guys all right? He goes, well, actually, we happened overnight. We were able to pull some backup systems.

We're able to roll it back. So it didn't affect our production. It just affected like a sanitation shift. Thankfully, the food industry was okay, which is good from the small sampling I did in my life. But I was glad to hear that they focused on resilience more than recovery. And I was like, yes, like we're getting there slowly. I don't care if it was five people I knew, but it was good.

But as OT professionals, I can't even tell you when you read an article or have a conversation with somebody and they're like, oh yeah, it's about legacy systems that aren't patched. Is it? I mean, what? There are systems inside some of these factories that I've worked in, I know you've seen this too, that are probably like 40 years old, probably running a 98 second edition rocking it, right?

98 second edition is a solid operating system if it's still up. I'm sorry. We all know you don't touch the dust. You don't touch anything on it because it's probably holding it up by a thread, which isn't good because you don't want that either. But there's ways around dealing with that that you don't have to operate.

because upgrading a system like that is probably running one process that comes up once a quarter. It's gonna be millions of dollars. Probably the entire budget for a year for a company, right? The trick is, it's just making sure that you segment it and you know it exists. And making sure you watch it, like just watch it. It doesn't have to be anything more than that.

It doesn't have to be the big fancy, everything around it and all these bells and whistles. I mean, if you could afford all that, that's cool. But do you need all that? Somebody once said on a podcast of mine, not that long back, do you actually need that tech? Are you okay without that tech? Specifically talking about farming.

And I was like, that's a really great question because you actually need it. If everything's working okay and you're okay and everything else around it is okay, why do you need to bring that in? And he goes, isn't that just another risk attack factor? And I was like, this is a brilliant conversation. I love this. Because it's true.

That's how I think about it in a lot of these industrial environments. Do you actually need that? Do you need to be able to sit on your couch at night and monitor the temperature of your vat? I mean, if you do, tell me. That's fine. But do you really need it? Because you have a 24 by 7 plant. if it's got a practical reuse, that's brilliant. We'll do it.

But if it's anything crazy, let's rethink it. I think we need to have that conversation more in the industry, especially in food. Cause we automate, we add all these really cool things and we do all this stuff and it's awesome. And now we have like Chick-fil-A mobile delivery units in Georgia. I don't know if you've seen them. They're kind of creepy. It's

it's literally like a little bike that drives up to your house and it's all automated and it's insane wow and and i'm just like i don't know i don't know if we've gone too far yeah like maybe we should roll that back

Oh, okay.

See, this is why you got to go back and talk to the people because...

they'll find the exploits for you you know and they'll tell you and he didn't do anything inherently wrong no it just it seems a little shady of course when you describe it you're like oh my goodness but um but at the same time like first of all good on them for exploiting a system like was causing a problem for them and also if you don't work with the environment you're in it's never going to work i remember i didn't this is something i learned on the job did you know that wi-fi signal does not go through bags of flour

Yeah, it does. But I never made the connection because I've dealt with it before. And I found a maintenance manager who had no cybersecurity background or IT background on a scissor lift moving an access point because they couldn't get signal to pick the orders on their little forklifts.

So he was up there and I just happened to be in the factory that day walking to the floor to get to the production area. And I caught him and we had a fight right on the floor, not physically, just, you know, verbal altercation of you're an idiot, you're an idiot kind of thing and back and forth.