Breaking Into OT Cybersecurity: Closing the Skills Gap and Protecting Critical Infrastructure

Aaron Crow: Hey, thanks everybody for joining me on another episode of the PrOTect IT All podcast. If you're watching or even saw the title, you obviously know who I'm talking to today. There may be some folks out there who don't know who you are, Mike, so please, first of all, thank you for being here. Second, why don't you introduce yourself, tell us a little about your background and how you got into this crazy thing called OT.

Mike Holcomb: Thanks for having me back, Aaron. Good to see you and catch up. I'm Mike Holcomb. I really focus on helping people learn about OT and ICS cybersecurity. Whether it's people like myself coming from an IT cybersecurity background who want to get into protecting critical infrastructure, or engineers and PLC techs and other folks already in the plants running operations every day who want to understand how to secure these things from cyberattack, or folks who lead programs and are either just getting started or feel stuck and need to figure out where to go next.

I have a small boutique shop, pretty much just me, myself, and I, where I try to do some field work each month and different speaking engagements, build training, do some private training for companies. I was just out in LA working with 50 or so of the largest water districts in California and some smaller ones. Water was actually one of the few sectors I didn't get to work in much in my last role, because we did everything in engineering but my water was limited to what you see in power plants or data centers, not dedicated water treatment or wastewater facilities. Really excited to have that opportunity. I also do a lot on LinkedIn and YouTube.

Aaron Crow: As I get people reaching out saying, "How do I get into cyber? How do I get into OT? How do I learn?" I brag about the OT community. It's fairly small, but there are a lot of folks who are really amazing and love to help. You're one of the people I point them at. "Go check out Mike. Follow him on LinkedIn, look at his YouTube, look at the training he's posting." That's so critical. It's the same reason I do this podcast. I want to get the knowledge out there.

We need more people in the industry to protect our water, our transportation, our electricity. There's not enough training and knowledge transfer happening on the OT side. So many of us are going to be retiring. People who have been in OT for 30, 40 years, before they even called it that, are aging out and there aren't enough people coming into the industry to take their hats over the next 5, 10, 15 years.

Mike Holcomb: Absolutely. One of the things I learned at my last company, one of the world's largest engineering and construction companies, we had 4,000 electrical and control system engineers. The majority went through my courses at some point. There were probably fewer than 10 who were really, really passionate about OT or ICS cybersecurity, at least that I was aware of. We had a strong IT cybersecurity team, over 30 people, and there was one person on that team passionate about OT and ICS cybersecurity. That was me. That's how I was able to make the transition.

There are just not a lot of folks out there who are really interested, passionate, or believe in the mission. We need people from both of those backgrounds coming together to protect power and water and make sure we have food that's safe to eat. OT cyber is something we all rely on every second of every day, but fewer people come into it than the demand we actually have.

Aaron Crow: Why do you think that is? We go to conferences like RSA, obviously S4 everybody knows about OT, but Black Hat, RSA, so many people maybe have heard of OT but can't really define it. They have no real desire, because everybody's going toward IT, AI, cloud. There's not a big banner saying, "Come over here, we need help here too."

Mike Holcomb: Right. For me, I come from an IT and IT cybersecurity background. Since I was a little kid, all I wanted was something with computers. I grew up as a kind of typical hacker kiddie. I was always focused on security, even though there was no such thing as cybersecurity 40 years ago. When I was in IT talking about securing our networks, people thought I was crazy. It took years, decades even, for enough bad things to happen before people started paying attention. Even then, there are plenty of folks in IT who want nothing to do with cybersecurity. Others say, "I believe in the mission. I want to keep the bad people out. I want to make sure our information and systems stay safe."

For me, it was, "I want to make sure nobody loses their job. If our company got hit, could the company afford that?" Most small-to-medium sized businesses fold their doors in six months after even a typical ransomware attack. I would never want to see that.

Then you also had people who got into cyber because they wanted to make more money. Okay, if you can do the job, more power to you. But the landscape is different now. The market is flooded. It really is for the people who believe in the mission and will stick to it.

Amplify that a million times for OT. It's a niche within a niche within a niche within a niche. You have to believe in the mission wholeheartedly. You're probably going to make less money than your IT counterparts. You're going to have more stress than your IT counterparts. You're probably going to have to work on site most of the time. I'm not trying to dissuade anyone, but it really is about people who come to OT security believing in the mission, protecting critical infrastructure, making sure our families, friends, and communities have the services they use every second of every day. It doesn't matter where you live. We're in the US, but you could be in the middle of China or Russia or Iran. At the end of the day, we're all people just trying to take care of our families. That's why I appreciate LinkedIn and YouTube being global platforms. You can reach so many people around the world.

Aaron Crow: OT problems here are very similar to problems everywhere. You've been on ICS Arabia's podcast. That's for the Middle East, but a power plant is a power plant. Doesn't matter if it's in Texas or Japan. The basic principles are the same. Heat up water, make steam, turn a turbine, turn a generator. That's a power plant.

Mike Holcomb: And it's always funny, I've heard this joke multiple times, and I still have clients with plants all around the world. You talk with the CISO, and he'll say, "Yeah, when we're in the United States, our number one job is always keeping the Chinese out of our plants. Of course, you go to our China plants and our number one job is keeping the Americans out." Everybody does it. Of course, we always want to draw the line between targeting critical infrastructure that would impact the public. Whether it's cyber or kinetic warfare, nobody should touch critical infrastructure. Period. The end. Watching the Russians bomb power infrastructure in Ukraine continually, especially in the middle of winter with sub-zero temperatures, there's a special place for those people.

Aaron Crow: It's hard to justify any of that. The analogy I give: in the States, we have hurricanes. When Katrina came through New Orleans, it was like a third-world country within a few days. No power, no water, no electricity, no nothing. People going door to door because they don't have food. You can't pump gas. Everything stops. How quickly we go to, "My fridge doesn't work, the food is bad, I don't have anything to eat, I can't open my cans because my can opener is electric."

Mike Holcomb: We had a hurricane come through here in Greenville, South Carolina, normally a once-in-a-generation thing. My girlfriend and I were out of town. Our apartment had power when we got back, but the house where my daughters live, they didn't have power for 10 days. My mom, 10 days. The first four, five, six days, everybody's barbecuing taking up all the frozen food in the freezer, having a gay old time. Day seven, eight, nine, it was stretching people's tolerance, their patience, their goodwill. Any more than two weeks is when you start to see the breakdown in society. We were lucky it came back in 10 days.

Those are the questions we ask in OT and ICS cyber: what would happen if a cyberattack brought down even part of the grid, or the entire grid? How would you start to bring it back up? There is no coordinated team responsible for that. We've seen how these situations have impact. We don't have to look far across the planet where there's real suffering because critical infrastructure just doesn't exist the next day.

Aaron Crow: So what do you see as the hurdles to get over, whether training somebody already in the industry, IT or operations, on the OT cyber side, or bringing in someone brand new? What are the things we can start fast-tracking to get people the skills to fill these voids, and what's the path from A to Z?

Mike Holcomb: There are common themes you see year after year. A lack of awareness and education at leadership. There are still environments out there that don't realize they need to do something about cybersecurity in their plants. It's like, that's your money, you might want to protect it. Colonial Pipeline almost five years ago changed a lot, because every type of attacker out there knows OT is a thing now. They're either going to want to impact OT, the plant network, or the IT network connected to it that still has impact on OT. If the leaders and the management don't realize there's an issue, how are you ever going to get support? You're not.

For people who want to learn and get the skills, a lot of it comes down to education. One of the reasons I started posting on LinkedIn and YouTube was because of conversations with folks at SANS, Rob Lee and Tim Conway. SANS is great. Great classes, great people. You can learn so much. But they're also expensive. Most people don't have $10,000 for a class and an exam. I've been fortunate to be able to go through all of those. Same thing with the ISA courses for 62443. Not as expensive as SANS, good classes, good content, but still $6,000 or $7,000 to take all four before the exams.

My first class was, "Hey, this is the class I wish I had before I went to SANS." I was so frustrated trying to talk with people and learn about OT and ICS. We didn't call it OT back then. We had ICS, or from engineering companies it was control systems, or IACS. The best thing about the GRID class was Rob Lee is very good at taking very complex topics and breaking them down into very simple terms anybody can understand. You leave thinking, "Wow, this isn't as hard as I thought. These are complex and complicated environments we're protecting, but protecting them from cyberattack doesn't have to be complex or complicated."

I focus on the fundamentals. My big five controls approach:

1. Backup and recovery, because it's not preventative, but every environment just like in IT is going to get hit. You need to be able to restore as quickly as possible. Do you have the right firmware file? Do you have the PLC logic backed up? Can you restore that system in a timely manner?

2. Asset management, because it's not fun or sexy, but it feeds so much. Especially in OT, we're not actively scanning for vulnerabilities, but we can query firmware versions to determine what's vulnerable. If you bring in a Mandiant or a Dragos for incident response, the first thing they'll ask for is your asset register. If you don't have it, you're spending hours or days explaining the environment, and that's time you need for response.

3. Secure network architecture, everything from having a firewall between IT and OT, to further segmentation and other controls inside the OT network. Slow the attacker down or keep them out completely.

4. Incident response planning. Most organizations get an F here. Not just tabletops, but even taking five minutes a week to look at what's going on in the outside world. "This happened over here. Could this happen to us? If so, what can we do to protect ourselves?" If organizations did that, they would be so much better off. We keep seeing ports and pipelines get hit where the exact same thing happened to another company three months ago and was all over the news, but they weren't paying attention.

5. Continuous vulnerability management. Understanding what's in the environment. OT is very different in how we do vulnerability management from IT. We still have to understand what's there, meet with the right people, engineers, operations, and determine, "Is this something we need to do something about or not?" It's still weird saying, "We have this really bad vulnerability, but we're not going to do anything about it." I still cringe a little, even after almost 15 years.

Aaron Crow: I remember going into a site assessment and they had Stuxnet in the environment. We made a decision that it wasn't a risk, because there was no Siemens equipment on site. So yes, it existed in the world, but there was no way the payload could impact anything. We knew we'd change it eventually during an outage, bring the vendor in. But it's weird to say, "I left Stuxnet in an OT environment and didn't do anything about it day one."

Mike Holcomb: If it's not going to impact safety, it's not going to impact operations, I really don't care. It's weird still to say that, but it's true.

Aaron Crow: I remember as an asset owner at a power plant, I had zero budget to go to a conference or take training. The SANS $10,000 course, I know it's worth it, I know those things are value add, but I built a team of six and had to fight to get a very small training budget. Definitely not $10,000 per person. Maybe $2,000 or $3,000. So we went to CEH classes, Schneider or Foxboro or Emerson or GE training, Black Hat. There was just no way I could send my whole team. My group should have been in those classes. We were frontline doing those things. That's what we should be thinking about for all of these things, IT or OT: getting to the leading edge of continuous improvement and education.

Mike Holcomb: Absolutely. I've seen a lot of organizations put a lot of training into IT cybersecurity, but very little into OT in general. 95% of security budgets go to IT. You might be lucky and have 5% go to OT. That's changing slightly, but we have a long way to go.

Aaron Crow: When I was doing this before OT existed as a category, I'd go to the plant and say, "On this new outage, you're doing a control system upgrade. We have to add $300,000 for cybersecurity, and it's going to come out of boiler or feed pump maintenance or whatever the thing is." When I was able to tie cybersecurity to the business, it changed. A lot of your five controls help the business even if you don't align them to cyber. Backup and recovery doesn't have to be a cyber incident. It could be a fire. Equipment goes on the fritz.

Mike Holcomb: For sure. I try to position pretty much anything we do for security in OT as operations first. I'm going to help you keep the plant up. When we deploy network security monitoring, 99.999% of the time you're finding operational issues, not an attacker in the environment. Let's help you keep the plant up and running, keep everybody safe. Oh yeah, by the way, we do get cybersecurity out of it, but honestly, it's not the main focus. Ensuring safety, keeping the plant up and running, and, oh yeah, it helps us stay secure.

Aaron Crow: One of the first plants we turned on, we did this massive architecture. Spans on every switch, east, west, capturing every packet, Splunk, ForeScout, NAC. We spin it up and we're monitoring as soon as it comes up, watching the logs. The first log that came through: there was a switch in the control system. Everything was redundant up and down the stack, multiple redundancies. One of the core switches was running fine as primary, but the backup was offline and nobody knew it. The logs were screaming. We walked over to the switch and there was a zip tie stuck in the fan. So it was overheating. We removed the zip tie and the switch spun back up. We just solved an operational problem with all these tools we brought in. A stupid problem. Who knows how long it had been there.

Mike Holcomb: We had one where a PLC was starting to overheat because it was in a cabinet where the vents were all clogged with dust. Five or 10 years goes by and the only way they caught it was with the monitoring platform. Where the HMI would normally query the PLC every 30 seconds, all of a sudden it was querying every second. "What's going on?" Turns out it was programmed so if the PLC starts to overheat, it queries every second. Apparently somebody missed the, "I need to program an alarm for when the PLC is overheating" part, to let an operator know they need to clean out the vents. Those are operational issues that could result in downtime or safety issues. Let's get those fixed. Oh, and by the way, we get security out of it.

Aaron Crow: It's all about messaging. When we go forward as security practitioners, to the plant manager, the CEO, the CISO, operations, we have to understand what they care about. We can put on the cyber hat, the financial hat, the efficiency hat, the downtime hat, the safety hat. How can the things we're bringing help them with the things *they* care about? If you talk about things they don't care about, it's in one ear and out the other. Be intelligent enough to know what matters to them, or just freaking ask them.

Mike Holcomb: Yeah. And one thing that was new to me in OT: so many owners are really focused on ensuring the trust of their customers. "If I have power, I don't want a bad name because we have blackouts every six months. If I'm a water provider, I don't want a bad name by having water outages or dirty water going out to customers." You have that in IT, but it's very different in OT.

Aaron Crow: So talk to me about BSidesICS. How did that come about? It goes along this path of giving back. I wish something like that had existed when I was starting in OT cyber and didn't have budget for SANS. I was looking for a place for my team. I understood it more, but some came from IT or operations and had zero coverage.

Mike Holcomb: I've always loved BSides. For those who aren't aware, BSides started as an IT cybersecurity conference, and it really didn't even start as a conference. It was a bunch of folks who got denied at Black Hat or DEF CON. They were pretty big in the community at the time and said, "I got denied the talk, but I really still want to talk about this stuff." A bunch got together at a bar pretty much across the street from DEF CON. That was the first BSides. Just hanging out, talking about what they wanted to talk about. Now there are like 140 IT BSides events around the world, which is amazing.

I started the one here in Greenville nine years ago. I had to step down last year because of BSidesICS/OT really taking off. We started the first one in 2025. I told this story at S4 in front of Dale Peterson, who runs S4, on the Unsolicited stage. I'd submitted to S4 a couple of years and kept getting rejected. Then one day it clicked. "DEF CON started BSides because of rejected papers. We don't really have anything like this for ICS. Why don't we?"

The first person I pinged was Rob Lee. He said, "Yeah, you have to do this. We'll be there, we'll help you with whatever you need." I was like, "Awesome." Talked to one or two others, they said yes. One person was kind of worried about what Dale was going to think, because we're BSides the day before S4. S4 is a great conference, but it's like $2,100 to go. Not everybody has that money. Our tickets are $40, half that for students or active military or veterans. Because of our sponsors, we put about $130 per person into the conference this year. All the money goes back into the conference.

Last year we had a little over 200 people based. 120 on the waitlist. This year we had over 400 signed up, a little over 300 showed up because of all the weather mishaps. It was 50 degrees in Miami, which is a little crazy. I'm going to England this week. We have our first international one in Bristol. The NCSC, the UK version of CISA, had seen what we did. They had contacts at the University of Bristol. They said, "Hey, look what the Americans did, you have to do one." Bruce Large is spinning one up in Australia called BSidesICS Down Under. We have one in Singapore in October. Folks looking at Belgium, Mexico City, Rio, a couple of cities in India. Really exciting.

Aaron Crow: That's awesome. I love seeing the growth. I love seeing the passion. It's clear with you, but also all the volunteers, the students there just hungry to learn and grow. I'm there with ICS Village helping with you. I don't care, I put on a shirt and took registrations and handed out badges. Whatever it takes.

Mike Holcomb: People like you, Sasha last year, Neijo was there this year, Sam Ryder, Van Ryder, you've all just been like, "Put us in wherever you need us, coach." I always feel bad and I'm like, "I don't want to use and abuse you," and everybody's like, "No, use us and abuse us."

Aaron Crow: It's the big picture. I'm passionate about this. I love OT. I think it's hugely important. I feel it as a calling. It's vastly important on humankind to do this well around the world. My team at the power utility, we didn't have the budget. Even if I could afford one ticket to S4, Miami is expensive, hotels are expensive, food, flights. A $2,000 ticket turns into $5,000.

Mike Holcomb: It happens real fast. That's why you have so many vendors at S4 and some owners and operators, a few engineers, but you're leaving a lot of people out. BSides is much more approachable. We're not taking anybody away from S4. If anything, people coming to BSides today will start going to S4 in the future. It's just hard for folks without resources. That's why we have BSides. That's why we have YouTube and LinkedIn. We'll take advantage of all of those as much as possible to get the word out.

Aaron Crow: It's also the chicken and egg. How do you get into OT unless you're in OT? You posted the other day: OT is not an entry-level position. You really have to have understanding.

Mike Holcomb: I get it. I've been there. Folks either come from OT or ICS, they're engineers or PLC techs, and want to get into cyber, so they need to learn networking and cybersecurity basics. If you're coming from IT and IT cyber like me, you have to learn what a PLC is, what an HMI is, how physics actually works. It's very different. You can't just jump in.

I feel bad because people reach out on LinkedIn every day. They're very excited, and I want to set expectations. That's why I made that post. You either need the IT and IT cyber basics and then learn the engineering side, or you need to be an engineer or in the operations world and then learn the IT and cybersecurity basics. Those come together to give you a firm foundation for OT cybersecurity. There are no shortcuts. You can't go from high school straight to being a doctor. I wouldn't want anybody in a power plant who hadn't at least gotten the foundations from both sides, or had somebody looking over their shoulders helping them along.

Somebody once called me a gatekeeper. Wait a minute, I'm the last person who'd be an OT/ICS gatekeeper. I'm just setting realistic expectations. It's also weird, I get a lot of parents who reach out for my son or my daughter. Okay, they're probably old enough where they should be reaching out. So they're probably not really interested, their parents are. I'll humor you, but it doesn't happen overnight.

Aaron Crow: It's not even like I can go take three or four SANS courses and that's enough to land a job in OT. That's not a check-the-box thing.

Mike Holcomb: OT is not really like IT where you can get a certification and at least it would help you get a job. I see more people, especially engineers I used to work with, or myself, take the ISA courses because they were required by a client. One of the largest oil and gas companies in the world wanted to see on paper that you have these qualifications to run things like 62443 risk assessments. So I took them. A lot of people in OT take certs to demonstrate expertise a client is requesting, not to get a job. That said, for someone looking for that first entry-level role, it can help, because it demonstrates you have the passion, that you took the time to learn and test.

I'm really excited about CompTIA's SecOT+ exam. Launches officially in November, beta in early summer. It's a $450 exam you can self-study. I'm helping CompTIA write their official course. I think it's one of those certs that helps people make the transition, because most just want something that shows, "I have a base level of knowledge. I might not have practical experience yet, but I'm trying to get my foot in the door." Here's a way to do that at a much more affordable rate than the other options.

Aaron Crow: That's awesome. So where can people dive in? Your courses, BSides, conferences. What's the call to action? You're in London this week.

Mike Holcomb: In London through Friday, then Paris. See me on the streets and say hi. Tourist thing. Never been to Paris, really excited. Everything's at mikeholcomb.com. Pointers to everything. LinkedIn, feel free to connect. YouTube, look for Mike Holcomb or UtilSec, the name of my company and the channel. I have four different full courses out there. I'm about to relaunch the updated version of the Getting Started in OT/ICS Cybersecurity course as soon as I'm back. The original class is two and a half years old and still very valid, but the first parts were recorded with my laptop microphone. My girlfriend got me a really nice podcaster mic for Christmas. I've come a long way.

I have a newsletter. That's actually the best place to get updates. You can sign up on my LinkedIn profile. Feel free to reach out at [email protected]. I respond to everybody on LinkedIn. Messages do back up a little because I spend about an hour a day responding. Most resources are on mikeholcomb.com, including all the infographics I post on LinkedIn.

Aaron Crow: Awesome, man. It's awesome to be part of this community. I see the success when folks come in because of people like you. Because of your willingness to respond to all those messages, even the moms saying, "My son's interested." That goes to show the type of person you are, and the type of community this is. I appreciate you. I'm proud to be part of BSides, handing out registrations, whatever I can do. Great to be connected. Thank you for your time, and best of luck with all the BSides things and the training.

Everybody, reach out to Mike. Take his trainings. Go to BSides. Think about having a BSides in your city or country. If there isn't one, reach out to Mike. Anything to close out, Mike?

Mike Holcomb: Thanks, Aaron. Good to see you and catch up. Thanks everybody. Reach out anytime.

Aaron Crow: Thanks, buddy. Appreciate it.

Transcript lightly edited for readability.