MillerKnoll’s Al Imran Husain on Securing IT and OT in Manufacturing

We're trying to make sure that our legacy assets, which are probably the most critical ones within the manufacturing plant, are protected. And so legacy can be any type of server system which is so many years old, but it's just simply not supported anymore by their respective company. Right. Or proprietary services. So that is becoming an issue. The issue is because the fact that these types of systems still need to run, they are still an integral part of the operational technology environment. So how do you secure those types of systems?

Welcome to the Ahead of the Breach podcast where we are dedicated to empowering security experts and practitioners with the knowledge, insights and actionable strategies to lead the future of cybersecurity. Here's your host, Casey Camilleri, CEO and founder of Sprocket Security. Now let's dive into today's episode.

Welcome to the Head of the Breach podcast. We're here to talk about everything offensive security with industry experts. I'm your host, Case Camilleri, and today we're talking with Imran Hussain, a CISO at a manufacturing company. Imran, thanks for joining us.

Thanks for having me, Casey. Yeah.

So could you start off by maybe just sharing your journey of how you became a CISO?

Yeah. So, boy, this was over 20 years ago when people didn't really use the word cyber. They would call it information security. But I pretty much as an analyst out of grad school for Michigan State. And I started off really just working from an external web development application, but more as an analyst. And then slowly but surely, I started to find my way onto the security side. And my boss at that time told me, why don't you get a certification in firewall? And I didn't know what that was, but I was like, okay. And one thing led me to another went down the rabbit hole. And I really invested my time into cybersecurity and got involved with other companies, more Fortune 100, consulted for Allstate for a number of years, worked at a security consulting firm by the name of Trustwave, and then got into manufacturing through Grainger, another big name. And that kind of took me into the path of manufacturing. And so the combination of cybersecurity manufacturing was really, I think, my calling. So after some time, I basically made my way up to chief information security officer at a chemical manufacturing company. And a few years later, here I am at Miller.

No, I'm sure there's some specific challenges with the manufacturing industry. Could you share the challenges that you experience as a CSO in manufacturing?

Yeah. So manufacturing is a very interesting type of industry. Number one, there is a transition from the old to the new, where you're using older machinery, older type of components and controls that obviously aren't very technology friendly. Right. And that was just how the industry was built upon. So you've got older types of levers and other types of, again, components that simply did not translate over into some type of digital or electronic controller feature. Well, that's starting to change now where you are starting to see more or less these types of machinery, shop floor devices which are now becoming online so you can control their function, their speed, their volume, the efficiency of it, everything online. But here's the catch. Cybersecurity never caught up to all that online processing. And so what you see now in many manufacturing companies are areas within their operational technology that are simply not secure. Right. In this operational technology, it communicates to the information technology side of things. It's called convergence. And when you see that, you're starting to understand exactly why there are no security controls there, simply because of the fact that the operational technology environment was not necessarily meant for cybersecurity controls. Back in 1992, there was a model which came out called the Purdue model. Right. Named after Purdue University. And it basically has different layers of operational technology. Well, it doesn't equivocate apples to apples with the informational technology environment. So cyber is now starting to make its presence within manufacturing. It's slow, but it's certainly progressing. And it needs to be because you're now starting to see a lot more issues from a cyber perspective in terms of hacking within the manufacturing realm.

Yeah. You know, many times we call it 1990s hacking with the IOT and things that were never meant to be plugged into the Internet, that are now plugged into the Internet manufacturer? I can see that happening quite a bit. And what are some of the ways that you're defending and protecting those systems?

Yeah, so we're trying to make sure that our legacy assets, which are probably the most critical ones within the manufacturing plant, are protected. And so legacy can be any type of server system which is so many years old, but it's just simply not supported anymore by their respective company. Right. Or proprietary services. So that is becoming an issue. The issue is because the fact that these types of systems still need to run, they are still an integral part of the operational technology environment. So how do you secure those types of systems? How do you make sure, especially with those externally type of devices, externally facing devices within the manufacturing realm, how are they being protected from things such as ransomware and ransomware and other types of cyber Attacks are now becoming a very big issue within the manufacturing industry. I discussed a little bit while ago in terms of wanting to bring up this story down in Miramar, Florida, where a water plant was compromised to the point where someone broke in and they were basically trying to increase the levels of sodium hydroxide in the water treatment. Now, if anybody understands water treatment, sodium hydroxide is a vital component to making sure that the water is purified. Okay. But the problem is, is that you cannot increase that type of dosage by triple the amount. That's what this individual did. They tried to increase the levers on that volume of liquid by triple the amount. If it wasn't for some kid working there, pretty much the graveyard shift at the plant, nobody would have known about the increase in sodium hydroxide. And the repercussions of that would have been, and I can say this very easily and fairly, people would have died. Because if you drink that water with so much sodium hydroxide in it, you're basically looking at death. So the point that I'm trying to make here is manufacturing and the way we try and protect, not just what we're trying to produce from a, you know, a process perspective in terms of chairs and steel and cars and all that, but it even goes down to something where water and even food products can be compromised through these types of hacking. And it has a severe result in societies.

Yeah, life's are on the line. Right. Like we know that, you know, with car manufacturers, right. You're just, you know, and us being the proactive offensive security team, you know, we know that, hey, software has bugs easily. So you're kind of, you know, one bug away from killing someone, which is kind of really scary to think.

Right. So we try to take the approach of making sure that we've got appropriate security measures that we're placing within our plants. Right. It could be as simple as internal firewalls. You can go ahead and network segment off your respective OT environment. You can make things very restrictive, which I think a lot of plants need to do. And again, the changes over time. Now you're seeing a lot of externally facing systems within that operational technology environment, which means they are going outside of your company, it's going outside of your network environment. Well, guess what? People are coming in the other way as well. And I think that's really where the challenge is. How do you prevent hackers from getting into an environment which is only recently trying to understand about cybersecurity. Yeah.

And the challenges of, you know, you want to kind of find and get ahead of these, you know, areas of weaknesses. Right. And vulnerabilities in these systems. But many times they weren't originally built to be on the Internet. Right. And so when you scan and when you proactively try to identify these things, they could be somewhat fragile. And I remember a buddy of mine that was telling me how he was on a pen test and they actually hit some OT thing which happened to be a crane at a shipyard, dropped the crane or dropped the payload, and you know, if someone was standing underneath there, someone would have died. Right. So what do you do to kind of proactively identify vulnerabilities in the OT network when you kind of have to be careful? Right, right.

Well, it's pretty much the same type of application we use within the information technology realm. Right. You want to go ahead and make sure you've got endpoint scanning. You want to make sure that you are scanning for vulnerabilities. Right. And so having a good vulnerability management tool is important. Having a good endpoint security tool is very important. Those are the first two things I would recommend. Anyone within the manufacturing realm or just about any other industry which is kind of coming up to speed with cyber, they really need to lay down that foundation. Other things which are important are user access control. Right. Who actually has access to your respective systems within manufacturing? I think that's very key because again, compromising someone's admin privileges or even user privileges can really be a jeopardy to your environment. And so making sure that you've got an appropriate access controls list for only specific individuals to get in to that respective environment is also key. And if there's other systems within there that are say ERP systems or databases which need to really be protected, have multi factor authentication, all of these different types of ingredients can be again from the IT can easily be passable over into the ot and that's how you really kind of secure your security posture within that manufacturing environment. Yeah.

And how are you thinking about using automation in vulnerability management as well?

Yeah. So artificial intelligence, AI as we know it's, you know, the new trend nowadays. We are starting to hear about how companies are using it in various facets. So you know that they're using it in marketing, they're using it in finance for their own respective areas. Cybersecurity also has certainly a footprint within that realm of artificial intelligence. By combining artificial intelligence with your threat hunting type of modules and solutions, you're getting a very comprehensive type of tool that can start to look at advanced threats. And I think that's what's very important. Right. We know about ATP, which is advanced threat protection. Now add on artificial intelligence, because I can tell you honestly, those folks on the other side, those hackers, they're certainly using AI to their ability in terms of scanning respective environments and figuring out through AI and the use of it, where are those opportunities to exploit those systems. So I think that combination is going to be very helpful for a lot of companies that are really trying to go ahead and improve their security posture within their environments.

Oh yeah, that's really great because AI is totally changing the game. Right. Like as attackers, we're using IT to get really specific. Right. With our targets and make it match the role that they're in, the industry that they're in, you know, and you as a ciso, it's your job to, you know, stay a step ahead of that. Right. And on the defense side as well, to protect against that. In manufacturing, is there anything specific that, you know, specific struggles that you need to overcome with kind of the security awareness training side of things and the whole social engineering threat?

Yeah. So security awareness is going to be very important in general. Right. From our IT usage as well as our ot, I think the biggest challenge there is, again, security awareness, especially with social engineering nowadays, is becoming a hot area of concern. And the reason why is because you're starting to see more mobile attacks as well. Right. So people are sending phishing links through texts, people are sending phishing links through, even voicemail, which is very bizarre. But you're starting to get a more prescriptive type of attack which is much more complex than your ordinary email phishing. Now, that isn't to say email through or phishing links through email aren't important. You shouldn't be preventing those. But I'm looking at new opportunities to see what we can do to improve our security awareness program by adding some of these social engineering tactics that we are starting to see. You know, we see anything from emulating or pretending that there is a call or text message coming in from somebody high up in your leadership chain, which is really bizarre. But people do that and it's very scary. If I can kind of indulge you with quick anecdote here. There was, I believe she was a chief operating officer in San Jose that I was reading about how she was looking. She just recently moved to San Jose. She's going to be working in Silicon Valley. She was looking to go ahead and purchase a home. She did purchase it. And then she got a link through a text that asked her to go ahead and provide the remaining funds for that home. And when she opened up that link, she transferred the money, not only just the down payment, but good chunk of that payment for that home through this link. And guess what? It was not the realtor. It was not her attorney. It was no one. It was just basically someone pretending. And so again, these types of incidents are becoming more frequent, more regular in terms of just everyday type of threats that we're seeing in the office.

Yeah, that's crazy, right? One click away from like sending your funds to some sort of malicious actor.

Yeah, absolutely. And I think the more we become aware of those things and just kind of cutting back to artificial intelligence, those are the types of things that we need to go ahead and use AI for. The way that I make the distinction is that five, six years ago, when advanced threat protection really started to make a name for itself, ATP was more about predictive behavior. I think the advantage of artificial intelligence is that it can go ahead and find unpredictive behavior, which is even more that wild card you really want to identify before things get really bad.

Yeah, let's jam on that a little bit. You know, beyond that, what are some other things that you anticipate? You know, the role of the cisos changing and things they have to think about in the coming years?

Yeah, you know, I think because of the different facets of new ways of your network and your environment to be compromised, it's very important to understand the entire gamut of what a CISO needs to do in order to be responsible. And I think there's a couple of things that people, especially, you know, your younger audience, should probably recognize. One being that it's not just about learning cybersecurity and the solutions and tools, all those kind of cool gadgets. It's more about understanding the pillars of what you need to recognize when it comes to becoming a very good cybersecurity practitioner. Number one, understanding networking. That is the key towards anybody's gateway to getting into the cybersecurity market. If you don't understand how firewalls and switchers and routers, all those old school type of devices work and how they communicate to one another and what they do from a topology perspective, then you're doing yourself a disservice. So I would say networking really needs to be a part of your portfolio. The second part is infrastructure. Right. So when we talk about things such as assets and servers, how do they work, how do they communicate with one another, how do you update them from a configuration perspective? So that's going to be very important in terms of understanding how infrastructure has a huge, huge impact to cyber. And not only just endpoint and assets, we're talking about disaster recovery, we're talking about databases, we're talking about the cloud, which is also a very, very big landscape of different types of ways of setting up systems and assets. So all of that really needs to be understood before you can even get into cyber, because cyber is that top layer, all these other ones are on the bottom. But as a whole, it really needs to be digested and dissected very well for you to understand on how to become a successful cyber practitioner.

Very wise words. Because it's all starts on basics, right? So much of that, you know, you probably apply within the organization, right? You got to have good basics and understandings of the fundamentals before you can actually be that ninja. Right?

Then the other thing I'd probably tell you there, Kasey, is that one thing which is very important is that a lot of. And again, I'm talking to your younger audience here. A lot of them simply want to start playing again with those, you know, fun toys, those Trendy toys like EDRs and MDRs, all those detecting and monitoring type of solutions and gateways. But what people don't recognize is that fundamentals are very important in terms of laying out your cyber laws, so to speak, within your organization. So have multifactor authentication, make sure you have a password policy in place. Right. Make sure you are providing the hygiene that you need in order to go ahead and keep your organization clean. Right. So doing the basics is so important. People just don't go ahead and embrace that. They will think that some solution, some system will go ahead and handle it. You know, you can have stack decks of security and that'll go ahead and take care of everything. But again, it's very easy to lose what's in the weed. I think that's what people really need to understand what's in those trenches. Right? You need to be in those trenches before you can go up. And I think that's what especially people going into cybersecurity really need to get a hold of. Yeah, yeah.

That's the fundamentals again. Right? And learning and experience takes time too. So you want to shortcut that with like, hey, learn the newest, hottest defense evasion tactic, but yet you really don't understand how the network works or how software works. It's not going to get you very far. So that's good advice. Yeah, I was just gonna say, you know, manufacturing, I've done a lot of penetration tests against manufacturing. And you know, passwords tend to be, I'd say, the most hilarious across any industry.

Yeah.

Especially if you have the factory, the floor. Right. You know, or individuals that just don't work with it stuff all day long. But you have to set up this password from 4 or 5 years ago or maybe even 10 years ago. You get a hold of those passwords, you crack them and you have some good chuckles. Now you mentioned MFA and passwords. You know, in manufacturing, is there anything specific you're thinking about when it comes to authentication and passwords and mfa?

Yeah, you know, I think when you look at manufacturing, you're looking at your most critical systems and anything which is now starting to become online. Right. So if there are certain types of shop floor devices as an example, which are going to be online or that's a strategy that your organization is looking to do, I would recommend bringing in that security and those types of controls immediately. Whether it comes to identity access management. Right. Which is extremely important whether it comes to asset inventory because now you can go ahead and keep tabs on your assets or a CMDB which is configuration management database. So you're keeping tab on those respective assets and making sure that they're staying updated. I think those are really going to be the keys in terms of making sure that you are doing what you need to in order to sustain a healthy security cybersecurity presence. That's the first part. I think the second part really would be externally facing systems within your manufacturing really need to have some type of buffer within their respective organization. So that could be anything again from next gen firewalls to protective routers, switches, anything which can go ahead and provide some type of security to prevent easy access or backdoors to your respective either software or systems within manufacturing.

Yeah. Is there anything that you're doing, you know, with the attack surface management as things, you know, as there's a little bit of cloud, you have some on prem, you have some legacy things and ot like how are you thinking about the attack surface?

Well, the attack surface is interesting because we are looking at it from a holistic perspective and we're trying to figure out the ways that we are noticing on how hackers would really want to come in. Right. So if we know as a simple example, open ports on your systems. Right. Those have to be locked down and that is a respective attack vector. Right. Another one again would be how do we make sure that your users and your passwords which are being applied within your IT don't necessarily cross over because a Lot of times people don't lock down their systems, right? They don't harden those servers, they don't harden those applications. So what happens is that it's easy access or a backdoor into those systems and applications. So again, we need to make sure that we are doing whatever we can in order to provide safeguards against those systems and assets so that it limits that risk or that exposure from getting compromised.

So would you say, like in manufacturing, you have to probably play the segmentation game a little bit more often than other industries just because you're dealing with that legacy stuff?

That's a great point, Kasey. So network segmentation or even port segmentation is a game changer when it comes to your legacy systems. And again, I said this earlier in our conversation. Legacy systems are so prevalent within manufacturing, right? And again, you're not going to get that type of security update on those legacy systems because they're outdated. So what do we do? Network segmentation really provides that safeguard to make sure that your legacy systems are behind some type of buffer line that is not going to be accessible by anyone, right? And then on top of that you're making sure that you're limiting admin access to those assets and, and limiting that opportunity for exposure by anyone else within that respective organization. Like, forget ot. Also we're talking about the IT or even cloud. And cloud is another area, right? So as more manufacturing companies want to get into the cloud, right, by providing those services out there, whether through SaaS or PaaS, whatever it might be. Again you've got to take those approach in terms of safeguarding your respective environments by making sure you're doing the key foundation practices of again, segmenting off of your networks or your legacy assets against the regular environment.

And hey, you can't segment properly if you don't have the basic understanding of networking.

And that is key. And I think, you know, people have their own interpretation of segmentation. I don't want to get involved in that because there are different ways of doing it, you know, and I'm not going to say one is better than the other, but certainly there's got to be some type of, Again, I'm repeating myself here, but there's got to be that buffer which provides appropriate user access and authentication into those systems for only those people that need to administer those systems. And then also making sure that outside access is very limited, shutting down your ports, limiting that type of transmission from the inside and the outside so that you've got a very, very locked down environment.

Yeah, great, great advice. And Rob, before we wrap up, is there anything else that you know, manufacturing CISOs should know about or be thinking about?

You know, I would really say because of the fact that we're starting to make some headway and starting to take cyber seriously within manufacturing. Talk to your leadership, right? I mean your leadership should be aware of all the issues and concerns that could be facing your operational technology manufacturing area. And it's not just manufacturing. I would include supply chain in there as well because of the fact that they're not on the radar as they would be with an information technology. And when I say radar, those assets within those environments. So it's important to go ahead and make sure that your board meetings or your leadership with your C level people make sure that they recognize how important this is. Because manufacturing is your bread and butter. That is what is generating the revenues. You do not want in any way to have that compromise by someone, especially some 16 year old punk who wants to just go ahead and have fun.

Right?

Allow them to go ahead and create all this havoc and kill your revenue, kill your dollar stream because that would be the worst thing for any C to encounter.

Yeah, you don't want poisoning the water hole like that that story employ.

There you go. You don't want that.

Well Avron, it's been a great chat. If people want to follow you and your work, where can they find you?

More than happy to find me on LinkedIn with my name. I'm sure you'll be able to put that out there. But yeah, Imran Hussain, you'll find me. CSO for Miller Null.

Hey Imran, thanks for the chat. I really appreciate it and we'll talk again shortly.

Appreciate it Casey. Thanks a lot.

Thank you for listening to another episode of the Ahead of the Breach podcast. If you enjoyed today's episode, please leave us a review on Apple Podcasts or Spotify. If you're interested in exploring how Sprocket is shaping the future of offensive security, be sure to check out our website at sprocketsecurity. Com. Thank you again for joining us. See you on the next episode.