OT After Hours

In this episode, we delve into the pressing challenges and exciting opportunities in OT cybersecurity as we look toward 2025. Join host Ken Kully, Systems Support Lead at Verve Industrial, and his guests Natalie Kalinowski, Tyler Bergman, and Zach Woltjer as they share insights on industry trends, compliance requirements, and the evolving role of AI in securing operational environments.

Key Takeaways

• Hybrid Workforces and Device Risks: Personal and work devices in operational environments pose security risks, requiring stronger BYOD policies.
• Regulatory Compliance: Evolving regulations, like NIST and NIS2, drive cybersecurity adoption but lag in addressing sectors like water infrastructure.
• AI in Cybersecurity: AI enhances detection, patching, and gap analysis, but foundational security issues must be addressed first.
• Dynamic Detection: AI and machine learning are replacing outdated static rules for real-time anomaly detection.
• Zero Trust Architecture: The shift to identity- and access-based security is accelerating, especially in hybrid workforce scenarios.
• Legacy Device Security: Secure proxies and similar tools help protect aging OT devices, but challenges with latency persist.
• Monitoring Approaches: Continuous monitoring offers immediate insights but increases network load, while scheduled checks provide stability but risk delays.
• Third-Party Risks: Organizations are diversifying security tools and assessing vendor practices to reduce supply chain vulnerabilities.

Timestamps

0:00 – Introduction 02:15 – Guest introductions 06:10 – The water industry as a critical infrastructure concern 12:36 – Predictions for OT cybersecurity trends in 2025 20:17 – AI in OT cybersecurity: workforce gaps and anomaly detection 30:12 – The shift from static rules to advanced detection techniques 33:01 – Zero trust architecture: buzzword or paradigm shift? 47:39 – Continuous vs. scheduled monitoring in OT environments 55:03 – Protecting legacy devices in operational technology 1:08:08 – Final thoughts: hybrid work risks, compliance, and AI in 2025

Guest Information

Natalie Kalinowski: Cyber Technology Consultant at Rockwell Automation and Verve, with a background as a network engineer working in diverse operational environments, from food and beverage to natural gas.

Tyler Bergman: Cyber Operations Manager at Verve, bringing over 20 years of experience in utility and energy industries with a focus on IT/OT integration.

Zach Woltjer: Cyber Data Analyst at Verve with a passion for simplifying complex cybersecurity challenges for industrial clients.

Subscribe

Follow and Subscribe

Get in Touch

LinkedIn | YouTube | Twitter/X | Contact Verve

In this episode, we explore the evolving challenges of cybersecurity maturity in operational technology (OT) environments. Join host Ken Kully, Systems Support Lead at Verve Industrial, and his guests Lauren Blocker, Industrial Cybersecurity Consulting Partner at Rockwell Automation; Drew Wintermyer from Verve's OT Research Lab; Zachary Woltjer from the Customer Success Team; Tyler Bergman, Operations Manager; and Rick Herzing from Verve Systems Support as they discuss the importance of assessing cyber maturity, bridging IT/OT security gaps, and implementing effective strategies for resilience.

Key Takeaways

• Cyber maturity is not a one-size-fits-all process; it requires tailoring to specific organizational risks and priorities.
• IT/OT convergence brings unique challenges, necessitating a deep understanding of industrial environments.
• Frameworks like NIST CSF and ISA/IEC 62443 provide actionable pathways for improving OT cybersecurity maturity.
• Overcoming resource and talent shortages is critical to achieving sustainable cyber maturity.
• Collaboration across leadership, operators, and external partners is essential for effective implementation.

Timestamps

00:00 – Introduction and sound check

01:26 – Welcome and episode overview

02:05 – Guest introductions and background

06:45 – What does "cybersecurity maturity" mean in an OT context?

15:20 – The challenges of IT/OT convergence

22:10 – Building and executing a cybersecurity maturity roadmap

30:55 – Real-world success stories and common pitfalls

40:30 – The future of OT cybersecurity and emerging technologies

50:10 – Closing thoughts

Guest Information

Lauren Blocker: Industrial Cybersecurity Consulting Partner at Rockwell Automation. Lauren specializes in assessing and enhancing cybersecurity maturity, helping enterprises implement globally consistent, standards-based strategies.

Drew Wintermyer: Research Lead at Verve's OT Research Lab, focusing on OT-specific vulnerabilities and resilience strategies.

Zachary Woltjer Customer Success Specialist at Verve Industrial, with expertise in helping organizations implement OT cybersecurity solutions.

Tyler Bergman: Operations Manager, providing insights into the practical challenges of cybersecurity in industrial environments.

Rick Herzing: Verve Systems Support analyst, and former industrial controls engineer.

Subscribe

Follow and Subscribe

Get in Touch

LinkedIn | YouTube | Twitter/X | Contact Verve

In this episode, we dive into the challenges of managing legacy operational technology (OT) systems. Join host Ken Kully, Systems Support Lead at Verve Industrial, and his guests Tyler Bergman, Doug Artze, Dylan Stencil, and Andrew Wintermeyer, as they discuss the complexities of legacy systems, spare parts ("grey") markets, and the importance of security in maintaining older technologies. They explore real-world stories, the economics of keeping legacy systems running, and offer insights into potential solutions.

Key Takeaways

• Legacy OT equipment can have extremely long lifespans, often much longer than typical IT hardware. This leads to challenges in finding support and spare parts as the equipment ages.
• There is a thriving market for reconditioned and resold legacy OT equipment, but the chain of custody and security vetting of these devices can be unclear.
• Maintaining documentation and access to legacy software/configuration tools is critical for supporting and troubleshooting older OT systems, which can be difficult as vendors discontinue support.
• The economic and operational costs of upgrading legacy OT systems can be prohibitive, leading many facilities to try to keep them running as long as possible through creative means like sourcing spare parts.
• Planned obsolescence by vendors and the lack of right-to-repair policies can exacerbate the challenges of maintaining legacy OT equipment over time.
• Visibility into the OT asset inventory and having a plan for securing legacy systems are important for managing cybersecurity risks in these environments.

Timestamps

00:00 – Introduction and sound check 02:00 – Ken's story: Decommissioning PDP-11/84 systems 04:50 – Challenges with legacy equipment and backup solutions 09:00 – The aftermarket for OT equipment and security risks 14:00 – Securing legacy OT systems and ensuring safety standards 27:00 – Real-world experiences with aging OT infrastructure 39:00 – How cybersecurity standards affect legacy systems 50:00 – Solutions for managing legacy equipment

Guest Information

Tyler Bergman: Experienced in utilities and OT security with over 20 years in the industry.

Dylan Stencil: Research team member with a background in technology and controls work.

Doug Artze: Operations team member with experience in nuclear power and wastewater treatment.

Drew Wintermeyer: Research team member and overseer of Verve's internal labs of OT devices.

Subscribe

Follow and Subscribe

Get in Touch

LinkedIn | YouTube | Twitter/X | Contact Verve

In this episode, we explore the concept of Calculated Risk Rating (CRR) and its importance in OT cybersecurity. Join host Ken Kully, Systems Support Lead at Verve Industrial, and his guests – Zachary Woltjer, Cyber Data Analyst at Verve, and Lance Lamont – as they discuss how to prioritize and address vulnerabilities in industrial environments.

Key Takeaways

• Calculated Risk Rating helps tailor cybersecurity solutions to specific industrial environments
• CRR considers both the impact and likelihood of vulnerabilities being exploited
• The approach helps organizations prioritize their limited resources for maximum security benefit
• Trust between cybersecurity providers and industrial operators is crucial for effective risk management
• Active asset inventory solutions provide richer data for more effective risk mitigation strategies

Timestamps

00:00 – Introduction and sound check

01:00 – Introduction of guest Zachary Woltjer

02:50 – Explanation of Calculated Risk Rating (CRR)

06:21 – Importance of contextualizing vulnerability information

09:47 – Discussion on EPSS (Exploit Prediction Scoring System)

12:43 – Identifying "crown jewels" in industrial environments

18:48 – Process of assigning criticality and likelihood ratings

26:50 – Importance of defense in depth strategies

31:01 – How Verve's teams work together to implement CRR

35:56 – Benefits of active asset inventory solutions

42:35 – Conclusion and outtro

Guest Information

Zachary Woltjer: Cyber Data Analyst on the Customer Success team at Verve Industrial

Lance Lamont: Creator and Explorer at Verve Industrial Protection, leading the research team in exploring OT devices and their security.

Subscribe

Follow and Subscribe

Get in Touch

LinkedIn | YouTube | Twitter/X | Contact Verve

In this episode, we explore the challenges and benefits of active detection in OT security environments. Join host Ken Kully, Systems Support Lead at Verve Industrial, and his guests Rick Kaun and Sally Mellinger as they discuss the limitations of passive detection and the importance of comprehensive asset inventory in industrial cybersecurity.

Key Takeaways

• Passive detection, while useful, has significant limitations in providing a comprehensive view of OT environments
• Active detection, including the use of agents, can provide more detailed and actionable information about assets
• Many operators have valid concerns about touching OT systems, but these fears can be addressed with proper expertise and non-disruptive solutions
• A comprehensive asset inventory is crucial for understanding and managing cybersecurity risks in OT environments
• The industry needs to overcome the fear of touching OT devices to achieve better security outcomes

Timestamps

00:00 – Introduction and sound check

01:21 – Introduction of Sally Mellinger and Ken Kully

04:54 – Discussion on passive detection and its limitations

10:51 – Analogy comparing passive detection to traffic monitoring

24:56 – The importance of comprehensive asset inventory

31:17 – Examples of hidden vulnerabilities in OT environments

36:22 – The need to overcome vendor restrictions on security tools

39:26 – Addressing the root of OT security fears

45:49 – The importance of educating the market on active detection solutions

Guest Information

Rick Kaun: Expert in OT security with over 23 years of experience in the industry

Sally Mellinger: Senior Manager of Content Marketing at Verve Industrial, with over 10 years of experience in B2B and technical content marketing

Subscribe

Follow and Subscribe

Get in Touch

LinkedIn | YouTube | Twitter/X | Contact Verve

In this episode, we explore the implications of the recent Crowdstrike incident for OT cybersecurity. Join host Ken Kully, Systems Support Lead at Verve Industrial, and his guests Tyler Bergman and Ryan Zahn as they discuss the impact of IT security tools on OT environments, the importance of staged rollouts, and the delicate balance between automated updates and manual controls.

Key Takeaways:

The Crowdstrike incident highlights the risks of using IT-focused security tools in OT environments

Staged rollouts and thorough testing are crucial for minimizing risks in critical infrastructure

OT environments require a different approach to updates and security compared to IT systems

The incident underscores the need for better collaboration between IT and OT teams

Kernel-level access in security software presents both benefits and risks that must be carefully managed

Timestamps:

00:00 – Introduction and discussion of recent events

03:08 – Overview of the Crowdstrike incident and its impact

05:50 – Discussing the differences between IT and OT security approaches

14:57 – Exploration of staged rollouts and testing processes

23:43 – The importance of human safety in OT environments

28:36 – The need for OT-specific considerations in security tool deployment

35:36 – Discussion on the risks associated with kernel-level access

43:18 – Reflecting on the broader implications for cybersecurity and critical infrastructure

48:06 – Closing thoughts and wrap-up

Guest Information:

Tyler Bergman: Utility engineering expert with 20 years of experience, focusing on cybersecurity efforts for the past five years.

Ryan Zahn: Customer Success professional at Verve Industrial with over 11 years of experience and a background in OT as a state engineer for a Midwest power utility.

Subscribe:

Follow and Subscribe

Get in Touch:

LinkedIn | YouTube | Twitter/X | Contact Verve

In this episode, we explore the importance of treating OT security as a comprehensive program rather than a collection of individual functions. Join host Ken Kully, Cyber Tech Lead at Verve Industrial, and his guest Rick Kaun, VP of Sales at Verve Industrial, as they discuss the challenges of implementing OT security, the differences between IT and OT approaches, and the need for a holistic view of security in industrial environments.

Key Takeaways:

• OT security requires a programmatic approach that integrates multiple disciplines and functions, rather than treating them as isolated tasks.
• Context is crucial in OT environments, as the same device can have different implications depending on its role in the process.
• Implementing individual security functions separately in OT can lead to inefficiencies, increased costs, and potential risks.
• OT security requires collaboration between IT and OT teams, with a deep understanding of the unique challenges and requirements of industrial systems.
• A centralized approach to OT security can significantly reduce time, effort, and potential errors in managing industrial cybersecurity.

Timestamps:

00:00 – Introduction and topic overview

01:03 – Guest introduction: Rick Kaun, VP of Sales at Verve Industrial

01:18 – Rick's background and experience in OT security

04:57 – The importance of treating security as a program in OT

07:05 – Challenges of implementing individual security functions in OT

11:03 – The role of context in OT security decisions

15:26 – Examples of OT-specific security considerations

22:01 – The impact of IT approaches on OT environments

25:19 – The need for collaboration between IT and OT teams

28:51 – Real-world impacts of OT security failures

32:40 – The importance of skill sets and resources in OT security

33:50 – Concluding thoughts and contact information

Guest Information:

Rick Kaun: VP of Sales at Verve Industrial, with over 23 years of experience in OT security, helping clients build comprehensive security programs across various industries globally.

Subscribe

Follow and Subscribe

Get in Touch

LinkedIn | YouTube | Twitter/X | Contact Verve

In our second episode, we ask the question: "what is OT?", and attempt to provide an answer. Join host Ken Kully, Cyber Tech Lead at Verve Industrial, and his guests and colleagues Lance Lamont, Tyler Bergman, Doug Artze, and Drew Wintermyer as they discuss what characterizes an OT environment and OT equipment, the impact of IT/OT convergence on distinguishing one realm from the other, and how a device's usage is often the deciding factor as to whether it is an IT device…or an OT device.

Key Takeaways:

• OT is the collection of hardware and software that is principally concerned with process availability: monitoring the process, providing safety oversight, and the automation, supervision, and control of the core processes for any industry.
• The same device can be both an IT device and an OT device, depending on usage.
• OT systems are often – though not always – characterized by device isolation, and can also be spread over a large geographic area.
• There are some industries – healthcare is an example – where the distinction between IT and OT becomes very blurred.

Timestamps:

00:00 – Introduction and sound check

00:35 – Welcome to OT After Hours

00:43 – Host introductions and background

03:40 – What is OT?

04:32 – Parallel terms: IT and OT

05:56 – Other terms: DCS, SCADA, etc.

11:43 – Hardware differences between IT and OT

14:20 – The role of context in defining OT devices

17:34 – The evolution and convergence of OT and IT

19:52 – The CIA triad and its different priorities in IT and OT

22:36 – The timeliness element in OT systems

23:30 – Engineering workstations and their classification

32:36 – The criticality of availability in OT environments

34:30 – The sensitivity of OT control systems

37:41 – Examples of OT in non-industrial settings

44:27 – The importance of physical access in OT security

46:55 – The unique challenges of healthcare OT

50:59 – Concluding thoughts on defining OT

Guest Information:

Lance Lamont: Creator and Explorer at Verve Industrial Protection, leading the research team in exploring OT devices and their security.

Tyler Bergman: Experienced in utilities and OT security with over 20 years in the industry.

Doug Artze: Operations team lead with experience in nuclear power and wastewater treatment.

Drew Wintermyer: Research team member and overseer of Verve's internal labs of OT devices.

Subscribe

Follow and Subscribe

Get in Touch

LinkedIn | YouTube | Twitter/X | Contact Verve

In our pilot episode, we dive into the crucial world of OT security. Join host Ken Kully, Cyber Tech Lead at Verve Industrial, and his guests and colleagues Lance Lamont, Tyler Bergman, and Dylan Stencil as they discuss the importance of industrial cybersecurity, the unique challenges it presents, and why it truly matters. From understanding OT environments to real-world incidents like Stuxnet, this episode is packed with insights and practical advice for navigating the complexities of OT security.

Key Takeaways:

• OT security is critical due to the unique challenges and vulnerabilities in industrial environments.
• Real-world incidents like Stuxnet highlight the importance of securing OT systems.
• Maintaining availability and integrity in OT environments is essential to prevent costly downtimes and disruptions.
• Effective communication with management about OT security needs is crucial for obtaining necessary support and resources.

Timestamps:

00:00 – Introduction and sound check

00:40 – Welcome to OT After Hours

01:33 – Host introductions and backgrounds

06:57 – Why industrial cybersecurity matters

08:23 – Stuxnet: A brief overview

15:00 – Vulnerabilities in OT environments

20:08 – Examples of OT device failures

25:19 – The importance of availability in OT systems

40:11 – Conversations about OT security with management

50:33 – Closing thoughts

Guest Information:

Lance Lamont: Creator and Explorer at Verve Industrial Protection, leading the research team in exploring OT devices and their security.

Tyler Bergman: Experienced in utilities and OT security with over 20 years in the industry.

Dylan Stencil: Research team member with a background in technology and controls work.

Subscribe

Follow and Subscribe

Get in Touch

LinkedIn | YouTube | Twitter/X | Contact Verve

The trailer for "OT After Hours": unfiltered stories and advice from the front lines of industrial cybersecurity.

Subscribe

Follow and Subscribe

Get in Touch

LinkedIn | YouTube | Twitter/X | Contact Verve