GA 499 | OT Cybersecurity in Manufacturing with Jeff Reinke

We need to know when somebody's in our system. We need to pay attention to what may seem like a small glitch in terms of like a, you know, a spike in temperature or a little bit different shift in the pressures, readings or something like that that you may think is just, well, it was there and it was gone. That could be a hacker probing your system.

Today I'm excited to welcome Jeff Reinke to the show. Now today's a super interesting episode and it's a slightly different twist than our normal sort of lean, you know, convers or continuous improvement conversation. So Jeff is an expert in, well, in manufacturing, but also in the whole cybersecurity world. And in particular he really has put a lot of emphasis and focus on what is called OT cybersecurity. So this is sort of more cybersecurity for folks that might be more in a manufacturing environment or something like that. So like hackers might be trying to penetrate a company through some equipment or whatever. So really interesting conversation just on this whole idea of cyber security and what folks that, you know, any of us, you know, that work in any kind of company, but definitely manufacturing, that sort of thing. What can we do? And what are some tactics to basically be safe. Jeff has also got a lot of insight into just manufacturing overall. So towards the end of the podcast we sort of shift gears a little bit and just talk about manufacturing in general and some of the trends that, that, that he's seeing and how things like a playing a role. And then the last question that I asked Jeff was, you know, so a bunch of continuous improvement people listening to this podcast, so what role do we play? And things like cybersecurity. And he had a really good answer for that. So that's towards the end. So, hey, so this is episode 499, one more. And we're at 500. So we do have a fun podcast plan for episode 500. It's going to be a little bit different, but I'm really excited for that one to come out. And yeah, thanks everyone for listening. I really do appreciate you. Be sort of scroll down and check out all the, the links for Jeff and, and he's got a couple some podcast work that he does as well. So we can go check Jeff out there and then as always, thank you to everybody who's left a five star review. It really means a lot to me personally. And so if you don't mind, keep scrolling down on that app that you're listening on and you'll see eventually you'll come to The. To the review section, and you could leave us a review.

That's.

That's really appreciated. Okay, enough for me. Let's get to the show. Jeff, welcome to the show. How are you?

Real good. Thanks for having me, Ron.

All right, where are you calling in from?

We are in lovely Madison, Wisconsin, here. That's where we're based out of and actually enjoying some, actually very nice late fall weather here. Yeah, it's a good day.

Yeah. I was just talking to a buddy, he lives in Michigan, and he was like, yeah, this is the best time of year. I said, yeah, I'll holler at you in two months, you know?

Yeah, I was explaining. My brother was actually up from Arizona a couple weeks ago and kind of explain. We live for the fall and the spring. We sort of, you know, embrace the summer, and we survive the winter.

Yeah, yeah, exactly. I'm from Ohio, man. I grew up in Ohio, so I'm all about it. I know exactly what you're dealing with. And I'm in Texas now, so my. My blood is thinned out a little bit, so. So it's hard for me to go back up north in the winter. You know, I can't lie.

Right.

Anyhow. Well, hey, Jeff, I appreciate you coming on. We do like to get things rolling right out of the gate with our guests sharing a quote. So what do you got?

So I couldn't find who exactly this originated with. One of the quotes, whether it was personal or professional walks I've always leaned on is the one that says, you know, life is a hard teacher. It gives the test first and the lesson later. And that's always, I think, applied in so many different ways and very true, but also something that's kind of helped me embrace things for what they are in the moment.

Oh, my gosh, it's so true. Yeah. I was telling a colleague this morning, like, I've got, you know, teenagers and young, young adult children, which bring their own challenges. And then I've got an elderly parrot, which brings its own challenges. So I'm like, I feel like I'm being sandwiched with, like, life right now, both ends of it. And I'm like, oh, gosh. Yeah. So, man, I totally get it. Well, hey, tell us a little bit about yourself, Jeff. I mean, we.

We're.

We don't use the video for the podcast, but I'm looking, and you got a beautiful background, so it looks like you've done this podcasting thing before. So tell us a little bit about your background and what you're up to. These days.

So I've been in business to business media publishing for the last 20 plus years. Been very fortunate there to be hooked up with a great group of people. And we've actually gone sort of from company to company and for the last 15 or so been involved in the industrial sector and manufacturing. Here with industrial media, we do a couple of different podcasts. We do the Today in Manufacturing podcast, sort of recapping the big stories. Then also just with some trends that have come up over the last couple of years. We started a cybersecurity podcast as well called Security Breach, focused on a lot of things that are going on in the industrial sector. Everybody knows about Colonial Pipeline, but there's a lot of other stuff that's been going on there as well in terms of protecting data and operational assets. So that's a lot of things we're doing now here with industrial media. Couple different brands, manufacturing.net, industrial equipment news, manufacturing, business technology. And it's been going great. It's been a lot of fun. This is a sector that's always evolving with new technologies and new challenges that we can talk about.

What's your, and we'll touch on this a little bit later on. But what's your experience in the sort of continuous improvement space or, you know, just in manufacturing, whether it's lean or anything like that?

Yeah, so like I said, as editorial director, I've been covering the industry, been immersed with it, talking to the stakeholders for the better part of the last 20 years. So I've learned a lot just in getting into the plant floor and talking to these folks and seeing the evolution from, you know, initially it was a lot more Toyota production system type stuff and how that's progressed and really embraced a lot of the IoT technologies. And now we're backtracking a little bit when we look at things like the just in time manufacturing model and how people have adjusted based on that due to things with supply chain and the pandemic and everything else. So it's, it's been interesting to see sort of this convergence of kind of going back to my initial quote, they're learning some of these lessons along the way and, and then applying them retrospectively.

Yeah.

Yeah.

Cool. Well, I'm, I'm really excited for today's topic because, man, you know, I'm not sure we've really explored this. Well, we've kind of touched on it a few times, but not many. So we're going to sort of really dive into the, the, the human elements of OT cybersecurity So let's straight out of the gate, what is ot cybersecurity for us lean folks who may not.

Know well, and I think it's something that's going to become a bigger part of everyday, day to day. When we look at operational technology and a lot of the cybersecurity elements of that we're looking, when we bring in a lot of these new technologies and inte integrating them into production models, there's a lot of connection points. And every one of those connection points is important because it helps hook up a lot of times legacy equipment with new technology to help us improve productivity. But that's also a potential soft spot from hackers who want to get in, shut down your systems, steal some intellectual property, whatever they can do to help either ransomware you or anything else. So it's just another level of security within a plant that's getting a lot more attention and really deserves it.

Got it. Okay, so what do you think is driving this increased emphasis on, on industrial cybersecurity? I mean, you know, many of us, you know, it's my biggest nightmare, honestly is coming into work and some message on my, my monitor from some bad person, you know, like, what do you think's going on in the world there?

Well, I mean, everybody knew about Colonial Pipeline. I think that was the biggest eye opener. The reality is things were going on far before that, but that was the one that got so many everybody's attention. And after that, the other thing is pandemic. Hackers realized there's a lot of businesses shut down, manufacturing is still going strong and there's a lot of data, there's a lot of vulnerabilities, There's a lot of therefore opportunities for the bad guys to do what they do best in exploiting some of these security soft spots and making money. I mean, that's what they want to do. At the end of the day. Manufacturing over the last couple of years has overtaken financial institutions, insurance, medical facilities in terms of the most targeted entity for hackers, especially when it comes to ransomware. The ransomware payments are going up. So it's become a huge priority because not only is it the shutdowns, the denial of service and everything else, or the loss of data, it's that they're paying extremely heavily in terms of real dollars that they didn't have to talk about on quarterly calls, financial reports, end of year annual reports and all that. And it not only hurts in the moment, but it has a long term impact as well. So more and more enterprises are Realizing we need to put resources and time into shoring up our security shortcomings.

Yeah. When you're dealing with these ransomware situations, is it. I'm under the assumption there's not a whole lot you can do. Like once they got you, they got you, don't they? Or is there a way to sort of wiggle out once the damage is done?

Yeah, it's not a one size fits all, you know, in a lot of situations. And what we've seen early on is a lot of manufacturers paying the ransom because you can't have, you just can't handle the downtime. You know, when we talk about continuous improvement strategies and all that, it's about eliminating that downtime or any other types of snags in the production process. So when they take you offline, people are paying just so they can get back up and running. The key there is if that is the route that you have to take, because there are no other options to learn from it so it doesn't happen again. One of the biggest things is improving visibility within the operational technology landscape, if you will, or the battlefield, and understanding we need to know when somebody's in our system. We need to pay attention to what may seem like a small glitch in terms of like a, you know, a spike in temperature or a little bit different shift in the pressures, readings or something like that that you may think is just, well, it was there and it was gone. That could be a hacker probing your system. So it's paying attention to a lot of those things to improve your defensive post year, but then also being ready to respond in case you are hit, having a plan in place.

Okay, so when you say the phrase the human elements of this OT cybersecurity, what are we talking about? Is it just being aware or is there more specific stuff that you're talking about?

Yeah, you know, over the course of time I've had the ability to manage some folks and even my current peers. I'm sure they get sick and tired of me talking about blocking and tackling. But that's what a lot of it is when it comes to cybersecurity. It's making the hacker's job as difficult as possible. And some of that is as simple as your passwords, your login credentials getting when someone leaves a company. Make sure that those credentials are no longer active and plausible. Making sure that you don't have your passwords written down on a post it note by your computer that someone can snag or whatever. So it comes down to a Lot of things from terms of logins, remote access, making sure all of that is secure. And a lot of the human element is that part. Training people to understand this may seem like a very small thing, but it's not. It's a huge deal. If somebody can get into your computer just with login credentials, which is what happened with Colonial Pipeline, they can get into a network and it just. It goes from there and it spirals. The other big part of it, we talk a lot about phishing schemes. When it comes to email links and not clicking on nefarious things or opening suspect emails, there's a lot of different elements there. And now we're even hearing about people using, you know, SMS phishing schemes, you know, sending text messages and things like that. And as we get into this more highly connected enterprise, all of these different devices, all of these different avenues give hackers a way to potentially get into first your personal elements, your personal devices, and then it goes from there and it gets into the enterprise network and can create all sorts of problems. So in a lot of cases, though, it starts with the individual just being a little bit more diligent in how they're protecting their assets.

Right, Right. Yeah. I mean, back in the day, I was very famous and infamous, or however you want to call it, with this real stupid, simple passwords. And my business partner Kevin would be like, stop it.

You know, like.

And so now I got these ridiculous passwords and all the rest of it, and. But yeah, it's.

And you're not alone, Ron. I mean, there's a lot of folks that still do that. And again, I think it's just reinforcing. Hey, this is a big deal, and we do need to take the extra time and attention to make sure your passwords are a little more difficult. You know, a lot of the folks that I have on the Security Breach podcast always say hackers would rather log in than break in. So if you let them log in, that's what they're going to do.

Yeah. Well, what was the one. The more. The recent one there? Was it in Vegas or somewhere like that, where they pretended to be an employee, wasn't it? They called the help desk and they said, hey, I'm Jeff, you know, and I can't get in, you know, and somehow or another they gave him the information. Was that.

Yeah, with the MGM stuff. Yeah, it was. It was crazy. And it was. It was a very simple. Simple in premise. But then once they got some of that sort of very basic information, they were able to exploit a lot of different vulnerabilities within that network and really create some havoc and steal a lot of personal data. It's really frightening when you look at this, what they call kind of credential harvesting because a lot of folks will take that, they'll either sell it to another ransomware group or another hacker group. They all have their own sort of specific functionality, if you will, and sharing that. And then they put it posted on the dark web, basically for sale. So there's a lot that can go on just, just being careful with every single piece of data. Someone, you know, maybe get a random email that looks like it's from a supplier or somebody else like that talking about, hey, you know Ron, where did you go to high school? Again, that type of personal data can be attached to different passwords, phrases that might be part of security settings for any number of things. So it's just being so diligent with all of that stuff.

Yeah, we actually went through kind of a corporate training deal, you know, with some videos and whatnot to all the various attacks. And the one that I had never really heard of was, and I guess it sort of applies to me as a leader here again by academy is like what was it whaling or whatever, where they kind of go after the, the top leadership in a very specific way. And gosh, man, that's so scary.

You know, we've seen some instances, you know, whaling, spearfishing, whatever the case may be. Either that where they go after the high level individ and they'll fool them into, you know, transferring funds to a different, different area, or they'll try to replicate that executive's email tone, signature, all that and send it to somebody else saying yeah, we, you know, this is who I am, I'm Ron, the president of Gemba Academy or whatever the case may be, saying you have to pay this particular invoice and people not being diligent enough and looking at the, the email domain or some other things, they get fooled and end up sending money in the wrong place and people have lost their jobs over it.

So yeah, oh my gosh. So I mean any sort of procedural stuff, you know, when talking about human behavior, you know, it's difficult, right, because we humans are fickle and we like to, we like to just do what we do and don't want to have to do anything different. So how do we work to get more buy in at the enterprise level for folks to sort of cooperate and to have more discipline when it comes to things like passwords and whatnot? You know, are there strategies or tactics that folks that are listening can start thinking about.

Are you ready to take the next step in your lean journey? Now you can. During one of our premier in person Gemba Academy workshops held at our training center in Keller, Texas, our certified instructors guide you through the process of taking your lean knowledge and applying directly to your industry with real actionable steps that will benefit you and your organization. Whether you're a seasoned lean practitioner looking for inspiration or just starting out, we have the perfect workshop for you. Sign up@gemba events.com that's gemba events.com are.

There strategies or tactics that folks that are listening can can start thinking about?

Well, the thing, and you know this as well as I do, Ron, the thing that's always been very impressive throughout the industrial sector is once you educate folks, they do respond to it, they do understand and appreciate it. It's one thing when you come in, just say, hey, make your password better. What does that mean? That you're just telling me something else I need to do? Or we try to implement a double factor authentication, which everybody just is a huge pain in the butt, right, to have to log in and then enter a code and everything else. But I think when we educate people and say, this is why this is what we're trying to avoid, we're not looking to terrify people or scare them into doing things. But in my experience, when we've educated individuals and made them aware of, hey, look, when you're on the plant floor and you're logging into that hmi, you have to take these extra precautions because we can't just have somebody walking in here and messing with our stuff, you know, and screwing up production. That's going to impact not just your workflow, the entire enterprise. And then the other thing the hackers have gotten so smart about is they understand how supply chains work. So if they shut down one facility that's critical to the supply of a bigger product, then you've got a much bigger issue on your hands and more pressure on that particular victim in terms of being the ransomware responding to the hacker. So it's really just helping people understand the big picture, I think.

Have there been situations to where companies just don't pay and then 100% and what do you do then? Like just start over, like, like turn everything off and build it all new again or what?

That has been the case, absolutely. Folks have refused to pay and I think a lot of that goes to their credit in terms of having plans in place and understanding if we get hit this is what we're going to do. In some instances, they had backups in place, they were able to recover enough information and move forward, even if it wasn't all of it. They maybe had enough that they could move forward without paying the hacker. And the big part there is that's great. You didn't have to pay them and you were able to recover a certain amount. But then you also need to take that extra step in understanding how do we make sure this doesn't happen again? Are they completely out of our system? One of the things I was talking with some folks at Rockwell and they were talking about a big issue being these dwelling attacks where companies are getting hit, and then they think they've settled everything, whether they paid the ransom or recovered data or whatever the case is, six months later they get hit again because that hacker never really left the system. So that's where that whole term of greater asset visibility really comes into play.

Yeah.

Wow.

Oh, gosh. Okay, well, hey, while I got you on, because I know we've spent a lot of time by cyber security, but obviously you're very in tune with the whole manufacturing world, so I'm just curious to get your perception. We got a lot of folks listening on the way, you know, right now who are, you know, not always just in manufacturing, but we've got a lot of folks in manufacturing. But like, what are you seeing? What's some sort of just general trends are you seeing in. In our manufacturing world?

I mean, the, the big one, and everybody's talking about artificial intelligence. I mean, that is a more very prominent topic right now. It definitely gets into cyber security in terms of how we can use AI to write better, you know, malware prevention strategies. We can, we can do things, AI to simulate attacks and understand vulner vulnerabilities, but we're also seeing it on the plant floor in terms of this, the use of digital twins and putting those forward so we can do better assimilations and understand the best way forward for implementing a lot of this new IoT technology. AI has come a long way in helping us with machine learning and other things like that that just feed into greater productivity and greater efficiency throughout the enterprise. So I think AI is a big one. Supply chain disruptions are still a thing. I think people are still adjusting to a sort of. I kind of get sick of the cliche, but the new normal. But that is really what we're dealing with in terms of availability and inventory models. So I think those are two of the bigger ones that we're still seeing. Skills gap is still a big problem. Labor issues persist in terms of finding good qualified people to fill a lot of these positions and then sort of embracing. Do we then lean away from this and invest in more automation and robotics, or are we looking to more just find the right people, train the people internally to fill some of these roles that involve so much more technology than ever before?

You know, and I don't. I think it's penetrating manufacturing as well. But, you know, we hear about this whole sort of quiet quitting and people are just sort of really super unengaged in their work and going through the motions, looking for the next best thing. I got to imagine it's also the case in manufacturing. Are we seeing that as well?

I think that quiet quitting is less of an issue just because there is a. People have embraced the fact that there is more cobots, robotics coming in, more automation that's shifting the nature of their work. Ideally, it's not eliminating jobs, it's about transitioning them away from more difficult, more dirty, more physically demanding jobs to use people for what they're best at. Just solving problems, quality control, things of that nature. So I think we've seen a shift there, but it just. The challenge continues to be how do we retain these folks because we have to pay them more, because now Starbucks is paying 20 to 25 bucks an hour as well. So how do we keep these folks here and retain them? It's also walking that line between, do we find new people, do we train the individuals we have for some of these new roles? How do we go about transitioning the workforce a little bit and also appealing to a younger generation of workers that are looking for different things. You know, it's not just about money. It's that, that sense of belonging. It's being part of a team and understanding, you know, again, kind of going back to that bigger picture of what, what we do when we come to work every day. Right. I think that's something manufacturing is still working through and trying to figure out.

What are some of the best practices that you're seeing out there for the, for the manufacturing companies that are just really, really getting it done and really having a lot of success. What are you seeing them do that might be different from some of the other companies that aren't winning?

Yeah, you know, it sounds really simple, but it's just, it's more communication, it's talking more to employees and helping them understand. You know, when I first got into manufacturing, we talked a lot about KPIs in making sure visualization was a bigger thing on the plant floor. So people can see, look, our goal is to get 300 units out the door. We're at 295. What do we need to do to step it up? And everybody can have really have a sense of pride in that. I think it's going a step further now and understanding, here's what getting those 300 units out the door really means. That means we make this type of revenue. That means we can grow the facility or the enterprise in this way. That means you can be advanced in this way to make more money or play a bigger part in the overall success of the organization. Emphasizing those things is, I think, becoming more and more important to attracting new employees and retaining the ones you have as well as when you look at those good employees you have internally, giving them new challenges, offering them new opportunities to up train at your facility as opposed to them finding it on their own and then leaving and going someplace else.

I love that. I really appreciate, I know all the lean folks out there appreciate you mentioning just the whole idea of visual management and just, are we winning or are we losing? Because people generally just, if they got to show up, they want to win, you know, but if you're not keeping score, you don't even know if you're winning or you're losing. Right. And so something is straightforward as an hour by hour board. This hour, we're supposed to make 10 widgets, plan 10, actual nine didn't win. So next month, next hour, it's 11 instead of 10, you know, and, but it just gives people something to aim for. And, you know, I think there's just a lot of human behavioral triggers that are happening there to, to, you know, this benefit. And then that employee leaves that day, hopefully feeling good that they won and the company feels good because the customer got what they wanted. Right?

No, I agree 100%. Especially when we look at the Gen Z and Millennials and understanding. I know people are kind of sick of some of those terms because they do bring about some negative stereotypes too do. But at the end of the day, it's really the same dynamics. It's just communicating it in an updated way.

Yeah, yeah. Yep. Very good, man. Well, hey, Jeff, this has been a lot of fun. I appreciate the, the, the security perspective. And I think that's something that I, I know as a leader here at YEM Academy, I'm, I'm constantly thinking about is making sure because, gosh, you know, without your infrastructure, you've got no company. Right? I don't care how Good. You are at lean or, you know, continuous improvement. I mean, maybe that is like, where do you see us continuous improvement folks playing a role in just obviously, we know in manufacturing that's kind of common sense, but what about on that security side of it? Is there a role that we can play that. That we can shine in a little bit?

Thousand percent? Absolutely. I mean, embedding cybersecurity into continuous improvement programs has got to be a big part of where the industrial enterprise goes moving forward. It has to be embedded into everything we do, just like it is when we talk about investments in new technology, the security element discussed there as well, because somebody will have the solution. One of the bigger issues we face too, on a security front is we don't have OT cybersecurity experts at the level that we need them. Okay. There's some folks out there, but sometimes it kind of falls on somebody else on the operations side to just sort of handle along with everything else they're dealing with. And it can get shoved to the bottom in terms of their list of, you know, priorities that needs to shift. And I think all of the organic knowledge, all the embedded information and subject matter expertise that a lot of those in the continuous and operations element of an enterprise have, they can bring that in and share that with the IT folks or any of the security folks, that's just going to make the whole enterprise that much better.

Yeah. I mean, if you bring a lean professional in or Six Sigma, whoever it is, and you say, here's the problem, here's the data, here's the problem, and here's where we'd like to be. Let's go. That's what we do. Right. So doesn't have to be productivity, you know, I mean, that can be one of them. But maybe there's some security type metrics or some things that we can measure intangibly. Understand, are we winning, are we losing?

And yeah, yeah, a denial of service attack is a definite production bottleneck. We definitely want to avoid both.

Yeah, right. That's the ultimate herbie, as they say, right?

Yeah.

Very, very good. All right. Hey, Jeff, if folks want to connect with you personally, what's the best way?

I mean, simple thing. I know I'm on twitter. Jeff. Jeffrey Mfg. You can also email me to jeff@ien that's I industriale equipment news.com I.com. that's the easy way to hit me up. Otherwise, check us out@manufacturing.net. really love to see more subscribers to the podcast and our newsletters that we put out a lot of good information that we like to share.

So yeah, well we'll get, we're going to link everything up in the show notes so everybody just kind of scroll down and you'll see all the links there for, for Jeff's stuff and let's go, let's go follow them and I'm going to check out all your, all your work as well. So I really appreciate you coming on Jeff and you take care. Okay?

All right, My pleasure. Ron, thanks so much.

Thanks for listening. Whether you've been on the continuous improvement journey for many years or perhaps you're just getting started, Gemba Academy is here to support you. And while we're best known for our more than 1500 lean and 6 Sigma teaching and virtual tour videos, we also have a team of experienced Lean and Six Sigma practitioners available for one on one coaching as well as a variety of Lean and Six Sigma certification options. To learn more and to schedule a demo, head on over to gembaacademy.com.