IoT and OT Security Challenges with Barry Mainz at RSA Conference 2024

This is Textron tv. Hi everybody. Mitch Ashley here at RSAC 2024 in San Francisco.

It's always could be back. I tell you the energy is super high. A lot of people in attendance here, a lot of conversations happening, and I have a great privilege of being joined by Barry Maine, CEO, with ForeScout.

Welcome, Barry. Thank you. Thanks for Having me.

We haven't talked before, so I'm excited to chat with you. Um, many, many things that ForeScout does. I know one of the conversations we've been having is around the kind of explosion of the attack surface, the number of devices that we're having to worry about security for OT IOT devices, right?

Just to name a few is on a lot of people's list because we have so many more digital experiences now that's either part of our ecosystem or been added through an acquisition or whatever it might be. I'd love to hear your perspective on some of the conversations you're having about this. Yeah, you're exactly right.

I mean, I think as an industry, people kind of understand they have a security stack for traditional devices, laptops, PCs, mobile phones, and the tax service that we know from our research and also dealing with a lot of the customers is, um, smart things. And they could be electronic cameras, doors, you know, televisions that could be industrial automation machines where they're smart. Now many of these things are antiquated, but they were connected and they pose a real threat to, it could be man and or machine.

Um, and also just a social unrest if it was a power plant, for example. Yeah. We think of wifi enabled as a feature, but it also presents a whole set Of challenge.

That's exactly right. That's exactly right. And I'll tell you a little interesting story too.

I think the ecosystem and how these machines are built. I spent 10 years at a company called Wind River. We were basically the operating system to power internet of things and OT devices.

Yeah. And um, you know, we, tens of millions of devices were deployed on our software. And one of the things that we would do, the how the sales process works is you go through the design win phase and you're working with the engineers and sometimes a a third party board vendor or what have you.

And so at one point we were tasked with, hey, for the design win you need to have IP stack. Mm-Hmm. Because it needs to be smart.

So we went out, got an IP stack, not IPV four, not IV six, just an IP stack. Mm-Hmm. And we actually had in the, in, in our Ts and Cs, this is not a commercial IP stack.

Fast forward eight years later, I'm at ForeScout, we have our research lab, and about 10 months ago, the most breached operating system in IOT and OT was Wind River. And it was that T-C-P-I-P stack. Interesting, interesting.

Crazy, right? People just said, oh, it works, I'll go use it. And it gets out there.

And these things are wind turbines. These are people movers, you know, they're hard to, to update. They've been there for a long time and they pose a real threat to, to, It's not just garage door openers and thermostats, right?

No. They're like commercial Case, you know, critical infrastructure. You know, in, in my my working in the IO two industry too, part of that evolution was it sort of sell it and forget it, right.

For so many years, Years's, right. But we just, we'll cover it in the next edition, the next version of this product that will come out in six to nine months. You didn't have to update software, you didn't have to worry about it.

Now it's, yeah. Yeah. It's, it's connectable, but its That's right.

It's not manageable. It's not updated. Now that's started to change, but it's not the way we would manage infrastructure or servers or cloud Thing.

Yeah. And this whole notion of patch and vulnerability, we didn't have that concept. Right.

It was embedded, set it, forget it, and then you're right. It sits there and just works. And, um, you know, that works until it doesn't.

Until it doesn't. And so I I and I remember there were so many conversations about, well, the life expectancy, we think this is a 10 year lifecycle for this product. 25 years later it's still out there operating and running.

Right. That's Exactly right. What it was created with either off assembly line or not too far past it.

Yeah. I, you know, I, I saw at, um, one of our customers, they had, uh, air conditioning units from Ream. And I knew the version we had done a, a project at Wind River is 20 years almost still, you know, in a large facility working.

Mm-Hmm. Crazy. So is it the move to so many more digital experiences that companies have made, you know, during the pandemic and other reasons?

Is that why iot and OT are such a bigger part of our attack surface now? Or are there other factors driving this, this problem? Yeah, So there's a couple things.

One, I think the threat actors are getting smarter. Okay. Because they say, Hey, look, there's so much emphasis on traditional devices.

I'll go look elsewhere. So there's the first thing. Second thing is these legacy devices are connected now.

So now they pose a threat. You can go in there and mess with them, you know, turn 'em on, turn 'em off. Some are pretty easy to, to do.

And, um, I also feel like federal governments, whether it's the United States or also the European Union where they have disclosure. So, hey, you got four days to disclose, and that includes OT and IOT devices. Mm.

So, um, and then you've got the personal liability, C-E-O-C-O-O-C-F-O if you don't do that. So, you know, I think that uh, when there's mystery, there's complexity, there's risk, there's usually an opportunity to go help solve those problems When the risk is to customers and users. But it's also to ourselves, our own networks, our own infrastructure.

Yeah. Et cetera. I mean, that iot device could now doesn't have to go downstream, it could be upstream.

That's exactly right. That's exactly right. What are, what are some of the, you know, when I saw that order come out about the four day disclosure, sort of, well, well then how do you know, what's the thing that says, okay, that starts the clock.

Have we kind of figured dial that in better? Is it still, you gotta hire 10 consultants and take seven outta ten's opinion to say that that's when we'll do it? I think it's a bit of both.

I mean, you know, because it's materially, you know, known. So there's probably a little bit of a soak time on that, but it's still gotta be pretty quick. And, you know, hey, if you have an outage, um, you gotta, and it, you think it was a breach, you need to, you know, mention it.

You don't have to have the exact details yet, but you have to have the, I'm gonna disclose here's what we think it is. Right. So no longer can we say, Hey, let me take six months before I figure it out.

Can't do that anymore. Well, and imagine you don't want to disclose and say this happened, but we have no idea what the impact is. Yeah.

Problem's. You've got some assessment. Yeah.

What it is, and I don't know if you ever to report here's what actions we've taken or Planning to take. Yeah, that's exactly right. Yeah.

And I think though, you know, the first thing, you know, we were just kind of thinking about this, is that, um, people want to know, just show me what's on the network, tell me what it is, where is it, and you know, track behavior and risk over time. And if you could start with that, it'll help you, you know, get a good, you know, kind of framework that if you do get breached, you can see the, oh, here's over time, here's what's changed. Hey, we think it's this area, it's these devices, that kind of thing.

Mm-Hmm. So I think that practice has been, you know, um, I see a lot of customers, if they're not there yet, they're going towards that kind of, Hey, I gotta have my assets. I gotta have the risk associated with them and then give me some control so that I can actually do things in some reporting and it will help 'em with that disclosure.

Yeah. You know, we forever, we always talk about single pane of glass, of one place to look for everything. The world's so complex.

I don't know that that really is a plausible answer. It seems like being able to see the entire ecosystem of what's going on, but also dive into and understand different aspects, where they're connected, what's happening between all of that. Is that an accurate sort of description of the problem space you're trying to Pinpoint?

Yeah, so I, I I hear that the pane is PAIN. Yeah. You know, it's, it's, it's a real paint.

I the single pane of glass. Yeah. Or glass of pane.

It's the other One. Glass. Yeah, exactly.

Right. Um, so yeah, I, I I think people wanting to go and say, Hey, you know, maybe take a different perspective. They've got a lot of data, so what's the, what's the way they need to look at the data?

And people are taking a, I need a device view and I need a classification view. Like what is the, the type of device and version like that. And I need to understand behavior and, you know, get a risk model.

Those three things, I talk to many CISOs and federal government, they're like, Hey, we're really taking that approach and we need to take a network approach because with OT and IOT devices, you can install an agent on it. Right? So you have to look at the behavior of that device.

Mm-Hmm, good point. And all devices, you know, communicate a behavior and the manufacturers kind of put, you know, Hey, here's if then else on the behavior. And so if you have people that we create, we call our liquid sensors.

If we put a sensor and we can look at that traffic, we, and we understand the database has a set of conditions, we can say, ah, that's that device. It's a PLC from Schneider Electric. Here's the version, here's this, this behavior's not okay.

You know, there's CPU's too high, you know, it's the memory's, you know, utilization's too high, then we can do control and block it. Mm-Hmm. So we provide people, um, with a, you know, way to agentlessly manage those.

And that seems to be a really, really big, you know, kind of headache that people have. Uh, and a pain that, that we can solve for them. So I have to ask the AI question.

It seems like we're barreling down the, the road, the track with not only, you know, ml, ai, ml, but also generative ai. A lot of discussion about at the edge on the end device. Now we're talking about iot, whether it's a smartphone or maybe other things.

Right. What are, what are you thinking about maybe what are you helping customers think about to prepare for that? Maybe it's already here.

I I don't know if it's totally here, but, you know, we will kind of think about those things now to prepare ourselves for AI distributed across. Yeah. So this really, we're taking a little bit different approach with ai.

We have a, a product, it, it's an alpha right now called psa. And, um, one of the challenges is now you go and you made a point of saying, well, now I get to have all this, you know, asset visibility. Be careful what ask for now you got a bunch more stuff you gotta go see.

Mm-Hmm. So can you apply AI to tell people where they should focus? Hmm.

Like show me the devices that, you know, fall outta this risk window and you know, it'll go and look at the data and come back and say, here are the, the, the like, so being just helping people see where they need to focus their time, um, is like a number one for when we go talk to our customers. They're like, you know, AI is really cool, but if it could be smart enough to tell us to start here. 'cause we all know, and you probably get to hear from a lot of your people you interview that getting people to work on a soc and the sim there, there's shortages there that's, there's high burnout shortages.

So, you know, can apply a little smarts or AI to be able to have these folks tell 'em to focus. It also gets people booted up quicker. They don't have to kind of, you know, know how the forensic works.

So we're, we're, we've got about five or six alpha customers we're working with, and it's, it, it's showing really good promise, a very practical use of ai. You know, so we'll see how that goes. But, um, I'm pretty excited about that.

This, The practicality of knowing where to start was a big challenge. It seems like another thing that folks are trying to understand is just the context Yeah. Of how to connect the dots.

Mm-hmm. Is kind of the easy way to think about it. Some, some organizations are talking about connected graphs or teamwork graphs, or basically sophisticated way of saying Yeah.

How do these things relate to each other? And how can you kind of see the ping pong effect of as things happen? Imagine that's another area that, you know, we'll see more advancements with.

I agree. Applications of ai. Yeah.

And especially as you, you know, the, the more data, the more complex it gets, and so the interoperability or the interlocking, you know, components there, uh, makes a lot of sense. And so, yeah, I think, I think we'll start to see more and more of that as a, as a focus from a lot of the vendors like ourselves. Okay.

Very good. It's been been a pleasure talking with you and, uh, the iot OT space. You know, whether it's, uh, that sensor in the garage or the windmill Yep.

Or the thing that's regulating power from the, you know, running the oil well or the pumper or the solar energy management device on the side of the house. It's all over. I mean, it really is.

That's exactly right. Part of our World. Uh, I'd love to hear one more thing too.

Um, it is, is Fores Scouts tackling this problem with your customer, the largest security problem? What do you think are some of the most important things to focus on for what customers need today and kind of moving forward? Yeah, I, I think there's, you know, sort of four, four components.

One is gotta get your asset visibility, um, and classification down. Mm-Hmm. Gotta know what's out there.

Second thing is you have to build a risk profile that helps you with disclosure, right? 'cause then you can go see and say, Hey, how has things changed over time? And that's a good indicator.

'cause you're asked when you disclose how's it changed over time? So you should look at it. The other piece is, um, detection and response.

You know, we, we have some technology that helps people. Not only is the AI technology that we have here, but technology that helps people understand where they should focus on from the alerts. And the last but not least is the control piece.

Hmm. Like, you know, do you use segmentation to, to to manage the, the, do you, you know, fire off a ticket and CrowdStrike to go do something, right? That whole control module so you can actually do something, um, is really key.

So usually those are, that's a kind of our buyer journey that people go through. And typically that's where they're, where they're, uh, leading towards. And it seems like that even, and except is expanding.

'cause it may expand out of the SOC pretty quickly and do software development. That's exactly right. Platform teams or, you know, security, other security personnel.

So it's not just security working on security Issues. That's exactly right. That's exactly right.

And in particular, if you're talking about OT and iot and you have this, you know, big challenge on organizationally, many companies are so bifurcated. You know, you've got your OT folks, they have their own technology folks there, and then you have it, they're on the other side and oftentimes they don't really talk a whole lot. Mm-Hmm.

And so I do feel like, um, we're starting to see the, hey, maybe some organizational changes to make sure there's a more communication between the two and can you share best practices and what kinds of things can happen. We're seeing a lot, and I can tell you in meetings that I'm having, you know, now in RSA, there's OT people in there. Interesting.

They weren't before. It was the IT person saying, Hey, I gotta convince the folks over on the other side Yeah. That they have to do this.

The Army with a good story I can go help with. Exactly. Exactly.

Well, and having kind of that source of truth, right? It's my data says it's your data says that. Well here now we've got a more comprehensive look of what's going on that we can all leverage.

That's right. That's exactly right. Problem space.

Yeah. Well, good. Thank you Barry for coming by.

You're welcome. It's been a pleasure. I hope we get to do, uh, do this again.

Talk more. Okay. Absolutely.

Love to have you back on Textron tv and, uh, have a good rest of the show and, uh, thank you for advancing the conversation with our audience here. You're welcome. You Bet.

Ray Main CEO with ForeScout, another fantastic conversation and, uh, first time for me that I've gotten talk to, got to talk with Barry and look forward to more conversations. We stay tuned. We've got more excellent interviews just like this one, uh, to help advance the conversation for all of us.

Thanks for tuning in. We'll be back in just a moment. I.