Cybersecurity vs Resilience: What Business Leaders Need to Know About Managing Risk

Intro & background

Aaron Crow (00:01): All right. Thank you again for joining me on another episode of the PrOTect IT All podcast. Today I have Lee. Lee, why don't you tell us who you are, a little bit about yourself, and where you come from.

Lee Ward (00:16): Hi there, I'm Lee Ward. You can probably tell from the other side of the accent. I spent 20 years in the UK Civil Service, a lot of my time in and out of security, but a lot of my time here with government service management. Unfortunately, [civil service is] not my job [now], but I then went…

Lee Ward (00:45): …alone and combined sort of the two things I know best, security and GRC. My main focus is on small and medium-sized enterprises in the supply chain: logistics firms, single warehouses, transportation, and bits and pieces. It's a sort of area of OT no one really thinks about, but there's a lot there that can obviously go wrong. And trying to fortify logistics, it's all those little nodes that are connected to the thing else together. And I do think that a lot of logistics companies, they can be a very attractive target. So that's why…

Lee Ward (01:42): …I want to help protect them.

Aaron Crow (01:45): Yeah, I mean, if you think about the logistics of, you know, as we're moving products around the world. The drink that we have, and the coffee, and the clothes, and like everything has to be moved from one place to another. It could be local logistics, could be big worldwide logistics, big companies, FedEx and UPS. But those aren't the only players and the only people in those games. So how did you get into, and kind of dive in a little bit around the GRC side of things? Because many people have heard it, many people may know it a little bit. Like what are you doing in those spaces, and how are you helping these organizations specifically to enhance or enable themselves to not be attacked and protect themselves?

What GRC actually is, and why regulators got teeth

Lee Ward (02:36): Well, in actual GRC it's governance, risk management, and compliance. Governance is just making sure an organisation works the best way it can. Risk management is basically looking after risk, making sure it's managed. Nobody can eliminate all risks, but you can manage them. And compliance, it's...

Well, internal annexing or internal policies, compliance with what your contracts [require] you to do or with local government, national government, or wider legal structures like that. Also looking at regulatory bodies and things like that, because certainly in the UK and also in Europe in the last decade or so, regulators have been given teeth and they are not afraid to bite.

Lee Ward (03:34): Unlikely so. But the thing is, just trying to help people understand that they aren't meant to be scary unless they need to be. They're there to help, but you also need to help. So a lot of other things I do, I'm very keen on education. So board awareness. You know, we've gone a long way [with] boards.

Lee Ward (04:02): [Boards] care about security, they understand that security is an issue, they just need help to bridge that gap. You know, whether it be in a corporate setting or an engineering setting or whatever. So I do some presentations with boards about, just to go over here's the things that you really need to know, and also help other people learn how to translate that technical risk in the board language.

Aaron Crow (04:36): Well, and that's huge, right? A lot of times, again, we do this for a living. So we eat, sleep, breathe cybersecurity and technology and the risks and compliances and all that kind of stuff. The board and leadership, and you've got CFOs, you've got people with different backgrounds that understand the business, but they don't necessarily understand the cyber risks that are in these businesses.

And it's easy to see. Especially, I've been a vendor, I'm not saying that I did this, but a lot of vendors are selling fear, right? That fear selling. Fear and uncertainty, the sky is falling, the end of the world, you've got to do this now or your company's going to go under. There's so much selling. There's large cyber conferences in the United States, RSA. I just got back from Singapore at DEFCON. There was a military conference, it wasn't a cyber, but there was cyber in it, conference upstairs. So there was DEFCON. Anyways, my point is there's all of these voices and messages screaming from the rooftops about how bad cyber is and what are all the things that you need to do.

It can be really overwhelming as a business leader, especially one that didn't come from cyber and doesn't necessarily understand the risk. Or even if you did, if you're at that level and you're not working it every day, there's so many things that are thrown at us that we have to be able to translate the real from the, okay, what do I do with this? I can't fix everything. So what do I need to do to protect myself and my business? Because if I spend more than I make on cyber, then what's the point? I might as well just shut the business down because I'm losing money and I'm not profitable, right? So there's gotta be this catch 22. And that's the thing that a lot of times cyber people don't get. You've got to fix this. It doesn't matter what it costs. But it does, because if it costs more than I make, then it doesn't matter. I'll just shut the business down. Because I can't spend more than I have.

From cybersecurity to resilience

Lee Ward (06:46): Yeah, absolutely. The other thing I forgot to say is I've recently come through a personal rebrand. I'm trying to remember not to talk about cybersecurity anymore, but talk about resilience instead.

Aaron Crow (07:04): Explain that. Why? What's the difference? Why do you say that?

Lee Ward (07:13): Well, certainly in the UK and EU, I've noticed the burden of legislation and regulators talk. It is all about resilience now. So taking the financial sector in Europe, we've got DORA, Digital Operational Resilience Act. It's not [a] security act. It's about resilience, and it's a bigger thing.

If we're hit, it may be a cyber incident. You may have some offsite server that's just been flooded because it's put near a river and that river's prone to flooding every winter. It doesn't matter. But if there's an incident, if you look at the CIA [triad], if the A isn't there, it doesn't matter how, but if the A's not there. So this is why I'm now thinking more about resilience than just security. Security is a great foundation, but resilience should be the end goal.

Aaron Crow (08:22): Yeah, ultimately risk. I mean, cyber is just one of the things that is a risk to a business. It's just one of the factors that you need to consider. But to your point, like if I run out of fuel, whatever the thing is, it stops me from being able to provide the service. If I'm thinking about electricity or transportation or your train system, only one of those things is a cyber risk. The availability of the train to get from point A to point B. There's a lot more risks and things that cause availability issues of your train not getting there than just a cyber attacker or a nation state attacker. That is one of the vectors, but it's one of millions of other ones that have nothing to do with cybersecurity whatsoever.

Lee Ward (09:07): No, no, but it is. And this is the point. I can help you know that the cyber angle of that. Again, just bring that voice to the room, just make sure they consider that as well as all their other multiple considerations they have to. If you want to place the organisation in the best possible place, you can't eliminate risk. That's just stupid. I think the other trick is getting boards to consciously acknowledge the risk, not just read it in a briefing and don't really understand, but actually acknowledge what this risk means.

Translating risk into board language

Aaron Crow (09:59): Sure. So how are you able to, because that's a very hard thing to say. We can talk about that, but just because I present a risk or I explain it. Understanding that risk, let's say it's a technology risk or let's say it is a cyber risk, how do I translate that to what that means to my business and what the potential impact [is]? Because a lot of times I see organizations accept the risk. "Oh, we're good with that. I'll just accept that risk." But back in the day it was like, "oh, well, I don't need a firewall there or I don't need endpoint protection or whatever that thing is. I'll accept the risk." But they don't really understand what that means until it's too late, and they're not really translating and understanding, okay, if this goes down, then this train doesn't get to the station, then people are stranded, then lives are lost. They're like, wait, wait, I didn't understand that. This could make that happen?

Lee Ward (11:01): Yeah. It's adding that. You have to talk about cyber from a business point of view. So financial, reputational, legal. These are all the risks that businesses face on a day to day basis. Cyber fits into all of them. You just need to adapt the language so that they fully appreciate the message, because once they do, then they can give you the correct answer, then they can be more useful. Even if the answer is no, we can't, we're going to have to accept that risk. Yeah, GRC are now thinking paperwork. Great, the board met and it's minuted that due to whatever reason, they have consciously accepted that risk.

You may not like it, but at least it's been documented. And it's just getting to that. Are you sure of the decision you're making? Without trying to patronise them, because these people are highly intelligent people. They've just got too much work for the amount of hours that they're hiring a day.

Aaron Crow (12:24): Well, and like you said before, you're never at a place where you've removed all risk. That's not even the point. Nobody's goal is to completely be risk free. It's impossible. I can never be secure. I can never be zero risk. It's about accepting and choosing which risks are important. And to your point, the real struggle is understanding what the real risk is. Not the vulnerability, not the score or whatever that comes out, but it's really, what does that mean translated to what is the impact to my business process? And really the key to that is more about understanding my business process than it is understanding the cyber risk or anything that's coming with it.

Because unless you can understand that, the real, how your business works, then you don't really understand how this one cog that's in this process impacts this overall process. The analogy I always give is, I've got two computers, or PLCs, or whatever. I've got one that controls the ice machine in the break room and the other one controls the train system or the turbine or something really important. They're the same computer. They have the same vulnerabilities. They have the same risk to an attacker taking them over. But it's not the same impact to my business. The ice machine going down. I've got some employees that have to have lukewarm water. If the turbine goes down or the train goes down, that's a huge impact to my business. So it's not the same thing, even though from a risk score in cyber, a lot of times we look at those two assets and the tools and they have the same score level because, red flashing, you've got to fix this. It's Windows XP or whatever. Okay, if it goes down, I don't care. It doesn't impact my [business]. It doesn't make me even have an emergency meeting about it, much less lose money.

IT vs OT and the patch-management trap

Lee Ward (14:31): Well, I mean, that's the difference between IT and OT. [In IT,] you've got to touch it. OT is, okay, what's the patch? What is the impact? If I think it's important, I'll bring it up in the next engineering meeting. And maybe we can put on, and again, governance is about simple things. Okay, I've got a document that says items that need to be purchased at next available moment. Just so that it's there, we remember and we can look at it. Because things may not be patched for a week, a month, a year, 10 years, or ever. So okay, here's a document of things engineers think need to be patched. We've now got it in a queue for when the next available time is. That as well, I think it's so important. Documenting that, so you don't [forget].

Aaron Crow (15:36): Yeah, well, if you think about the documentation side, it's so important because people change. The roles change. To your point, like why did we accept that? What was our justification behind that? Who made that decision? And beyond just the who, not pointing fingers, more around how did we come to that decision? Why? How did we get here? Obviously there were reasons, there were justifications. Again, I want to continue to harp on this because it's super important. Especially every time I go to a conference, I have these conversations, and it's like, well, you gotta fix that. You don't, actually. You don't have to fix everything. You can never fix everything. So you're having to choose. Am I going to fix this? Am I going to accept this risk? Am I gonna mitigate it in another way? And mitigating it in another way maybe is cyber insurance. It may be changing my process. It may be a number of things that have nothing to do with cybersecurity. And that blows cyber people's minds. Like, what do you mean?

Lee Ward (16:45): Yeah. You know, an idea, there's a patch. It's like, "I'm going to have lunch in 20 minutes, I'll do it then. I'll just restart my laptop, go and grab a bit of lunch. It's a good excuse to get a break, five minutes, come back to your life." And it's all about understanding what is the purpose of that patch. What does it impact? And also what's the impact if we don't patch it? Not just if we do, but if we don't. There's all these considerations that you need to take into consideration. I'm reading myself, sorry. But going back to my previous point, it's about governance and getting senior management these days to understand this is a process.

Lee Ward (17:41): And sometimes we need the board to say, what risks are you happy with? We've got this urgent patch. It may take operations down half a day, but we're busy. Christmas is in three months' time. We get put forward. What do you want to do?

Aaron Crow (18:04): Yeah. And what is the impact if you do it? What is the impact if you don't do it? Because, again, cyber people will scream the sky's falling. The warehouse is going to burn to the ground and we're going to kill people, and like all of the worst things in the world. And sometimes those aren't necessarily true. Sometimes they're exaggerated. So it's difficult to really be able to understand what the real risk is if you don't do it and what the real risk is if you do do it. And that's the other thing that some people don't understand. Sometimes the risk to patching, especially in OT, but not just in OT, sometimes that risk is bigger than not doing it because it can actually break the system. Like I'm old enough to remember when you could patch a Windows system and you were rolling the dice, hoping it didn't get the blue screen of death after you rolled out new Microsoft security patches. You didn't know. You didn't do it on the weekend, you waited until a Monday, you made sure you had a backup, because rolling out Windows patches could crash your system. And that still happens in an OT world.

Lee Ward (19:10): Yeah. And there's no, it's not something that you can say, "oh, I've got a pop up, this needs a few patches, great excuse, let's go and make myself a quick cup of tea to stretch legs." You can't do that.

How to actually run the board conversation

Aaron Crow (19:27): Yeah, exactly. So how are you helping folks to translate those cyber risks? Because there's so many things that are happening, so many risks. Even if we just talk about cyber, how are you helping translate folks, boards, and leaders to understand the real things they need to do, and let them make that decision? Obviously, you're not telling them. You're giving them advice or giving them suggestions, you're guiding them. But how are you helping them to have those conversations, to really understand the risks of their business and choose, "hey, we're okay accepting this. Hey, we need to go actually implement these things. Or I want to wait until after the Christmas season and we'll do it then. We'll just monitor it for now."

Lee Ward (20:17): Well, you just need to go in and say, before we start this conversation, this is going to be all cards on the table. No suggestion is too big. We'll just put everything there and we'll figure out what the best option is. It may take a couple of hours, but we need to do it. And then you start with them and go, well, what if you can't do this at the moment? What then? Tie it back to the business objectives, the financial regulatory risk or whatever, and just keep tying it back to how to keep an organisation solvent. That sounds extreme, but sometimes, okay, you don't say it, but it's like, well, if you don't do it, there may be a slight loss in the next quarter of revenue. But the flip side is, what risk are you most comfortable with?

Lee Ward (21:28): And let them make the decision. Here are the options. What do you want to do? And then document the decision.

Aaron Crow (21:41): Yeah, and that's the key. It sounds so simple, not really, but. How are you seeing, because it's not a technology problem, as we know. I think we've kind of harped on that up until now. Yes, one of the factors is a patch or implementation or a new tool or whatever that is, but that is a very small fraction. Even if it is a physical control that you need to install, manipulate, do a patch, reboot, install a new product, whatever that is. There's so much more to that going in or not being done that is beyond just the installation. If you think about a patch, you've got all these other things to consider. People, process, technology along the way. And that's the hard part, right? In this, the organization, the site, they understand their system, and they're telling you it doesn't need to be done, or it does need to be done. And then there's 10 layers of impact above it that have nothing to do with that, but are impacted by that. Those people-and-process side of the equation are just as big a factor and so much not understood by most organizations, by most consultants, because that part of the conversation, it's easy as a cyber person. You put on, well, you've got to patch it. And then you don't really have the other conversations of the people in the process side of this and all the way up the chain and all of the impacts that it has, or could have, if it's done or not done.

Lee Ward (23:23): You know, all that confide about [is] needs to be, about [going] just going to be out for two hours. So Bob's 15 [years on the job] and he's [there], and Sally is pregnant and she's expecting in about two and a half months. We just send them home. You know, technology is great. It's there to make our lives easier. And it is what, you need to be aware of the entire picture. Okay, you two go home, or do some filing and stuff. But if you take that away, what needs to come in place to keep that operation going? Or do you make the conscious decision that we're just going to stop completely for two hours whilst we [do] this thing?

Geopolitics, subsea cables, and what really takes you down

Aaron Crow (24:09): Sure. Yeah. Well, and it also rolls into, as we think on the global scale of things as well, geopolitics and oil prices and all of these things start factoring into risks that have, again, nothing to do with cybersecurity, but everything to do with risk to my business and resilience of, we have to get this product from overseas. Well, now I can't get it, or it's more expensive now. And all of these kind of things factor into the overall understanding of the business. And that's what we have to understand. Most of the people that listen to this podcast, they're thinking about things from that cyber lens. They're not always thinking about the other factors that go into making sure this conveyor belt runs. And it's not just because the machines can run, because somebody has to make sure that we can pay the electric bill and that we have product to come into the front so that we can make the widget and spit it out the back end. It's not just about the cyber risk.

Lee Ward (25:16): I mean, there's also been, the UK's a little island. It's like all the internet is all there, you know, out there with the magic dust and everything. Now it's not. There's subsea cables. What happens if a fisherman accidentally drops a trawler net and disrupts the cable? I remember talking to a client from Bermuda, they're in the financial sector. It says, sorry, it's September 11th, 2001. They were impacted. Why? Because a key cable went from Bermuda to, I don't know if it was [terminating] in the World Trade Center, but it got damaged and it was out. Nothing to do with the actual terrorist attack whatsoever, but...

Lee Ward (26:16): …that cable got damaged. Okay, now I know that's pretty long gone, that's 25 years ago almost, I know it's different now because you've got clouds and everything, but there's still that physical layer somewhere. Do you know all your redundancies are [in place]?

Aaron Crow (26:40): Right? Most of the time we don't, right?

Lee Ward (26:47): I'm not saying here, let's [worry] about every single event or anything, but you do need to sometimes just take a step back, take a holistic approach and think, okay, these are all the things that could happen, although the other [way is] that probably will happen. And then also going back to insurance. Insurance is such a big issue. What does your policy cover? What does it not cover? What does your direct liability insurance cover? Are you personally responsible for hundreds of thousands of pounds lost due to something in the supply chain that you had no control over but is having an impact on your operations?

Lee Ward (27:38): Yeah, board stuff. I get pretty scared when I talk about what your policy cover[s].

NIS2, DORA, and UK regulation

Aaron Crow (27:44): Yeah. So when you're having these conversations with these boards, obviously in the UK there's quite a bit of regulations coming out, and I've come from power utility and NERC CIP, and obviously there's NIS2 over there. There's a lot of these things. How are you seeing the impact positively and negatively? Because it's very easy to be, I can argue both sides. I hate the government stepping in and telling you how to do things and how's that gonna help me run my business. On the flip side, if I don't have these standards and regulations and requirements, then some people choose to not do anything and then that's a risk to the greater economy and the greater good of all the types of things. So how are you seeing it help folks to understand and actually implement and do the right things? And are people doing it, or are they just trying to check a box for compliance? I'm sure there's probably both. How are you seeing success with it?

Lee Ward (28:52): Yeah, I mean, technically there's no, it's easy if an organisation says, hey, we want to fully comply with [ISO] 27001. We want to actively do this. [Great,] because that means our senior management are actively thinking about security.

I live in the southeast of the UK. I am about 50 miles from the coast and about 70 miles from France. I've got a couple of airports near me. I've got the River Thames. I am in a hub of light industrial companies. They can be in France in two hours. The EU operates [as], if you want to trade [with the bloc], you need to comply with their regulations. Do you know how this impacts your organisation? Rightly or wrongly, they say, well, if you supply to Europe, you're supplying European customers, therefore you fall under our regulations. Do you know what you have to do to comply with those regulations?

Lee Ward (30:23): A lot of people say, we know we have to, but we're a bit vague on the actual detail. That's half worrying, because at least they know they've got that awareness that something needs to happen, which is far easier than [people who are] all certain, "we're not in the EU anymore, we don't need it." And again, you know…

Lee Ward (30:52): I mean, AI is the other interesting thing. Philosophically, the UK is geographically between America and Europe. Philosophically, we're sort of between Europe and the US as well. And it means a lot of work for people on GRC. It probably doesn't help that governments keep the GRC business intact, but it's trying to understand that, this is what we have to work with. How can we make it as simple as possible for you?

Lee Ward (31:31): I love simplicity. If we can do it a simple way, let's do it a simple way.

Lee Ward (31:39): But we need to make sure that what we do, we operate within the law of the territories we work in.

Aaron Crow (31:47): Sure. Yeah, I mean, the goal is, it shouldn't be complexity, right? It should be making it as simple as possible to follow, to understand, to have conversations around. If you're using big words to try to make yourself feel smart and make other people feel stupid, then you're having these conversations in the wrong way. The goal should be: make it simpler, make it more easy to understand, so that we can have these conversations, so that we can really understand what the risk is to my business. What the impacts of doing this or not doing this from a compliance perspective, a regulatory perspective, but also cybersecurity and resiliency and all those things as well.

Lee Ward (32:28): But I also try, maybe it's because I was in the civil service, I also try to look at it from the regulator's point of view. What are they trying to achieve for this business? And even if you don't have to comply, [is there] a bit of best practice [where you say] do we want to sort of adopt that bit? I believe GRC should be as flexible as possible, even though a lot of the time you can't be as flexible as you want to. Does that make sense?

Lee Ward (33:10): So I'll just go and finish, the easier you make all these compliance conversations, again, the better the conversation you have with the boards, the better their understanding, and the better their reaction to engaging in what you need.

People want to do the right thing, meet them there

Aaron Crow (33:32): Yeah. In my experience, people want to do the right thing. They want to make the good decision. They got in this business because, maybe at one point they were passionate, whatever the reason is. Most of the people I interact with, if you give them the solution or the understanding of what the impact can be, they want to choose the right thing. Most of the people I interact with are not horrible individuals that are out there making bad decisions because they want to do wrong. It's just, they don't normally get to that place, and they're not going to be successful in the long run. And obviously, this is small businesses, this is medium businesses, this is big business. It doesn't matter, really. So if you can make it translated in a way that they understand, most people are going to choose and try to do the right thing. That doesn't necessarily mean it's the way that you suggest. It just means in their mind, they're going to make the decision they think is best for them, their organization, and the future of their organization. So we have to know, when they make those decisions, they're not just saying, "I don't agree with you, or I don't like you, or your idea is dumb." They're taking that information. So if they didn't choose your path, you probably didn't describe it well, or there's something that they're factoring in that you're not understanding.

Lee Ward (34:55): Yeah, yeah. But again, try and speak as clearly as possible so that at least you eliminate the ambiguity in your part, even if you can't see the big picture which everyone else has seen. And again, make note: "it was discussed and decided that dot, dot, dot, signed, dated, keep on file." At least it's there, and it's there for reference. Maybe someone changes it once the climate [changes]. Or, "what did we discuss about that? We may be in a position to do it now." Who knows?

OT realities: secure protocols, air gaps, and Stuxnet

Aaron Crow (35:34): Yeah. And I think that's the important factor. I know I continue to harp on it, but I've had so many conversations. Again, I was just at DEFCON in Singapore, and I had a gentleman walk up to me. I'm working in the ICS Village (industrial control systems) and we're talking OT and plants and things like that. And it's all for education, it's just around discussing and training. There's a lot of students there. I've got this OT wall behind me that we take with us, and it's just a demonstration of what does OT look like, and how do I protect it, and what is it? Because it's different. And not everybody sees it.

This gentleman walked up to me, and he was like, "I worked in this industry for 20 years, and there's no security in the protocols." And I'm like, yeah, we don't really have secure protocols. They're wide open. And he was offended. He was like, "what do you mean? It's still that way?" And I'm like, yeah. He's like, "well, why? You're telling me that people choose to have insecure environments?" And I'm like, you gotta understand, having a secure protocol does not necessarily make my process better. And you hit on it earlier, that A in the CIA triad, that availability is more important in this OT space. And what you don't realize is, in this process, if I add encryption and all these other layers, that adds complexity. It can break the process. It can make it take longer. All those things can actually make it harder for me to do what I need to do. And there's other ways to secure it. So in OT, it's not that we're too stupid to understand that that's how to do security. We know how to do, and there are secure protocols in OT. We just don't always use them, because they're not always needed. And we're making that risk decision long, long in the way. It doesn't always align with your cyber world of "everything needs to be encrypted and protected and secured." It just doesn't always make the process better. That's hard for a lot of cyber people to wrap their heads around.

Lee Ward (37:47): Yeah. Who has access to it? If you've got it in [the] firewall configuration, you've got separation of networks and everything, you've got competent people on your maintenance teams, then yeah, [you] bet you can't [stop] every offence or attack, but that's a very, very good start.

Lee Ward (38:15): Yeah, something's always going to happen. Just because something's air-gapped doesn't mean it's secure. Take a little USB stick dropped in a car park outside an Iranian nuclear plant. The most devastating piece of OT attack was mostly down to luck. It was down to someone thinking that the human being is going to be curious enough to pick up this USB stick and see what's on it.

Lee Ward (38:57): And again, it goes back to training. It's like, are you sure you know what you're putting in that machine?

Aaron Crow (39:06): And it just goes to show, you can have the most secure environment, you can think you have the most secure environment in the world. And that's the funny thing when we're designing these systems. I was talking to someone yesterday, and it's so easy to think controls and cyber and technical controls to protect these environments. And that is great, and we should do these things, and we should have firewalls, and we should be monitoring, and we should add technical controls along the way. But I can have every product and technical capability in the world, but it doesn't stop Bob from walking the thing in the room and plugging it in. And I just bypassed all of those security [controls]. Or Bob walks over and unplugs from the firewall and plugs it directly into the internet. And now all of those technical controls are gone. Or Bob walks in, because that's the other piece to this. When we did a tabletop back in the day, we were like, well, what's the biggest risk? And one of the CISOs was like, well, if we had a bad actor and he walked in and put a gun to somebody's head, how are we going to protect the environment, and who's the most risk? And I raised my hand. I said, probably me from an OT side. Because I know the password to every one of these sites. I have three kids. And if somebody puts a gun to my head, I'm telling you, I'm going to give them the password. Because my family matters.

Aaron Crow (40:32): And you can't protect and you can't remove [risk]. We said this earlier, and we're coming back to it. There always is a theme when we go through these conversations, it seems to bubble up to the top. You can't reduce all risk. You cannot get rid of it all. Because, like we just talked about, somebody held a gun to my head, I'm going to give them the password, because my life matters, my kids' lives matter. I'm human. Right? Kill me. Right? It's just the way it is.

Lee Ward (41:05): But the issue there is educating end users on the common errors we see. And that may be as basic as someone from accounting [opening] a [phishing] official email. The firewall isn't properly configured. There's a way in from IT to OT, all because no one thought, let's look at this in [process].

Lee Ward (41:41): All you can do is plan for that to and happen. Okay, let's educate end users. Let's ensure IT and OT is as segmented as possible, while still allowing some access if you need to. Obviously different situations call on different levels of access and bits and pieces, but let's try and think through some common scenarios on where the weakness is. And that's part of, I suppose, part of governance as well. Governance is all about making sure things work, and let's just take this logically one step at a time.

Talent pipeline: the thing that scares Lee most

Aaron Crow (42:38): 100%. So, man, we talked about a lot of things. I've loved this conversation. What is, this is always a hard one, and I've changed the way I ask this because AI and everything that's changing and how fast things are changing, what's one thing that you see coming up over the horizon that may be scary? That we need to change, we need to address, we need to get in front of? And maybe one thing that's exciting that you see coming up, whether it's regulation, it could be technical, it could be the way people are seeing it. The sky's the limit. What comes to mind for you?

Lee Ward (43:19): I've been thinking about this a lot, and I kind of do want to [say] AI, but I don't want to say AI because AI is such a big broad thing nowadays that you can get really narrow AI just looking at specific things. Predictive maintenance, for example. AI is going to help a lot there, so that's good.

Lee Ward (43:46): On a practical side, I think, not for ease, awareness of the field. Yeah, let's be really basic, getting young people involved in both IT and engineering. Because there's going to be a time where a lot of the people who built a lot of the foundations, well, they're going to be on a golf course at one point, on a cruise, and not caring about working because they've done their bit. You need training pipelines so that the knowledge isn't [lost]. And even if [you're] working in IT, how do you get people to come to OT? You know, this is as important, if not more, keeping public transport systems well-powered behind everything.

Lee Ward (44:50): I don't know if it's just a UK thing or [a] global thing, [but] it's hard to ensure that that talent pipeline continues.

Aaron Crow (45:00): Yeah, absolutely. That's a huge one. The aging workforce that we have, and AI is changing things, and how do you get people interested? It's a global problem. I have a lot of conversations. I think I have as many conversations about how do I get into these things and how do I do these things at conferences as I do the technical side of things, which is good. That's why I do them, because that's the point: to get people interested and show them a path. How can I do these things? It's not easy, but it's worthwhile, and it's an enjoyable environment to be in.

Lee Ward (45:34): You know, I think it's getting better. I mean, you had Mike on last week. The amount of stuff he puts on about education, the amount of content he's got on YouTube. Absolutely great. His knowledge is phenomenal. It's out there. It's just trying to help people understand that actually it's not just IT. There's a whole world of OT as well. Not just from a CNI [critical national infrastructure] point of view, but from an everyday point of view as well. It's just as important. You don't need to be an engineer to think about this. I'm coming from a GRC point of view. I'm not an engineer, but I draw and look at things from a GRC point of view, [but] in an energy environment. And just get more people to look at these things and think about careers in the field.

Aaron Crow (46:34): Yeah, 100%.

Close & where to find Lee

Aaron Crow (46:40): Well, dude, I very much appreciate it. It's evening for you, so thank you for taking the time out of your day and having the conversation with me. It's a great comfort. It's not too bad. I was in Singapore last week, so it was 13 hours ahead. That flight back was pretty insane: 16 and a half hours. It's a different space, but it's really cool to see around the world how people are having these conversations. The risk is the same. We're approaching the same problems, whether it's in the UK, whether it's in Asia, the US. These things are international problems. We are having these issues no matter what flag you fly over your organization. It's a problem that we see, because the internet brought the world [together], right? So we are all interconnected in so many ways.

Lee Ward (47:36): Yeah. And people just want to help do their bit. Help keep the systems safe.

Aaron Crow (47:42): 100%. Well, awesome. And here's the call to action. How do people get a hold of you? What do you want them to know? All the things.

Lee Ward (47:52): I'm on LinkedIn. I think that's the best place to get hold of me. Obviously, my big passion is education and awareness. I've done sessions for boards. I'm also looking at helping people in security: how to translate risks so that you get board attention. So if anyone wants to chat, just hit me up on LinkedIn, and let's start the conversation.

Aaron Crow (48:25): Awesome. Well, thank you again for your time today, sir. I really appreciate it. It was a great conversation. And if you're ever in the US, definitely hit me up. Next time I'm in the UK, I'll let you know. We can grab a coffee or beer, whatever that may look like.

Lee Ward (48:36): Will do. Yeah, absolutely.

Aaron Crow (48:41): Thanks a lot. Have a good day.

Lee Ward (48:43): And [you].

Transcript lightly edited for readability.