jesper: Welcome back to Talk OT to me and welcome to season two and to my new co host. Okay. Yeah. Sure. By popular demand, welcome back and welcome to a fixed port part of the Talk OT to me cast. Thank you. It's gonna be quite fun to be part of this a bit more actively and being able to help with the topics and Yeah. Just bring some I don't know. Maybe something new. Yes. So the best part of having you on last season was your football analogy with the mini leagues in I think it was Guam of all places you played with AI. So by popular demand, welcome back dude. Well thank you. Good like I said, good to be in. Yeah. Nice to have you here. So today we are gonna talk remote access as infrastructure. Is it infrastructure? How do we define it? What is it actually? and have a talk about that one around it. So my question to you, Jeff, for the kickoff, is what happens when OT remote access stops? Is it in an inconvenience? Is it a production stop? Is it what actually is it? 'Cause that helps us define. Yeah. So that that definitely depends on what it's being used for. Yeah. So if it's one person logging in from time to time to check something, maybe maybe that can also be critical, but maybe not. Yeah. but the question you want to ask is really if it stops, do I need to have a plan? Yes. Right? That's a good p yeah. Yeah. So so if it stops, do I need to have a plan for for what happens if this is no longer available? Yeah. Yeah. I also think it's it's about like When I think about remote access being what is actually an infrastructure piece, it's also when does it go from being a tool to mission critical? Yeah. But I think I think it's part of that's also driven by the the compliance landscape. So there's it very much so there's different perspectives coming in. So if you look at the the compliance government all around the world, all the recommendations are that you need to have sort of a standardized way for remote access with varying levels of operational security around it. And this is something that's being brought in from this side regardless of the individual use case. you need to build a structure around it. But if you're looking at like at the individual use case, when does it stop being like a convenience, I can get in, I can do something, it it comes down to that statement really, that that beginning, that foundation, that very simple question is if it is not available, do I need a plan? because if you do, then it kind of gives you an idea, think Yeah, if it's not i it is kinda critical. So it's it's the the most the simplest part of the question. The other piece is is what is counting on it? What am I like if you have customers or what what is the the out the outcome of it not being available? Yeah. which informs that question. Like how many users do you have, how many connections do you actually have? But the right answer or the right question is not just scale or security is also dependency. What actually happens if that does this doesn't work for me? And a lot of times remote access probably isn't the thing that gets your machine to drop off, but it is the thing that needs to get started again because you need remote engineers to come in and help you support your your your factory. So I think sometimes you end up in this discussion that said, are we depending on running the production? No, we are not. But at the moment production stops, we end up being depending on it. And if we don't have it, what is the plan B? What are we then gonna do? Is it fly in? Do we have that all sorted out? Actually, if they fly in, how do we make sure they then connect safely so they just don't plug their PC directly into the HMI or PLC? So do we have a plan afterwards? And I think that's where a lot of OT's organization sort of gets gets a little bit stuck, is that it might not be the actual production stop, but it is when the production stop happens. What is the impact on how do we need to support that? Yeah. And then as you kind of pointed towards the redundancy of it. So the tool that I can get in and access, right, the infrastructure, what happens when that tool goes down. And we've actually had some interesting conversations. I'm not gonna say specifics, more than like in one case I was talking with somebody and they were like, Well, if the primary path didn't work, I'm usually running two or three POCs on the side. Yeah. And so then I try. What are the POCs and see if that one brings the access a bit more quickly? And that was kind of like an interesting take at it. But this still comes down to this kind of we're building up what this means. Yeah. today. And it's it's it's we're coming to terms with what we used to see as this convenience or this cost savings, right? Having remote access or secure remote access or being able to do something well. That was strictly a cost saving or that was strictly a navigational point. But when it comes into like I am guaranteeing specific hours of uptime, for example. Exactly. And if you're guaranteeing specific hours of uptime, if it takes you this two days or this eight hours to fly in, how much is that impact that ability to do that guarantee? And I think where it has changed in the years that I've been here is like when we started out with remote access, it was a lot about what you were saying, it was the cost of flying people in. That was the the the change of it. It was the that was the one that we're saying a lot of times when we had customers saying we can't run without this for the cost. Now for a couple of years this has been okay, we know we need it for the cost of them, to save cost is a critical part of our our our business. Then it was a lot about security But the in the conversation you and me are are now starting having with the customer, it's now coming back to the really an infrastructure piece. What happens if I don't have internet? What happens is a lot of the conversation are now also because business continuity is starting to become such a big topic, especially specific places around the world, especially in Europe, closer to the to the border, there it becomes a topic. So now it really starting in the last six months to be very much about infrastructure. This is critical for us. How do we run a business? What happens if we can't get remote access in? What do we do then? How do we solve that? What happens if internet goes out? And for me, for a lot of reasons, that points towards that that is a good proof point. If you're having those conversations in your organization, you're definitely in the infrastructure piece. If you're starting to say I I need redundancy on this system. I need to think about business disaster recovery solutions for it, then you are on a critical part of your infrastructure piece. And you need to treat it as such. Yeah. So I think maybe we circle a bit down and like the question is we're talking a lot about infrastructure. Yeah. Right. And it's a a big, pretty big, big long word, a lot of nuance to it. Very much. So so maybe we circle back and say, how would you define That's a very infrastructure. What is infrastructure? Yeah. I think my understanding of it is, or where I broaden my in understanding of it was that infrastructure can both mean a pure cable or a road, so a physical object that we run some, but it can also mean the criticality of infrastructure as something you need to run your operations. Infrastructure. So there's both the cable part of it. The discussion and then there is the actual discussion about is this critical for us on the is this an infrastructure? How do you how would you define it? Because it is a it is I spent quite some time looking at that word, thinking, where where do I place this? try to bring it into something a bit more more tangible at home, maybe. Everybody has a home. You have a kitchen, and you've got in the average kitchen, but people have different things. Maybe a stovetop, right? Maybe one oven. Maybe you have a sink, likely have a sink. Hope you have a sink. Some people have a microwave, depending on their perception around microwaves. And all these things are pieces of the kitchen. And they're all important and necessary, but if you're like you have a built-in redundancy more or less. You have the microwave, it can make things hot. You have the stovetop, it can make things hot. You have the oven, it makes things hot. So maybe those are redundancies to the ability to heat food. one of those goes down, you have a different way you can heat the food. But if the electricity goes down and you're fully electric, you don't have gas or other things, then the whole system doesn't work. So maybe I equivalent so there's different, let's say, criticality or different pieces of infrastructure. and so you have these different levels. and based on those levels depends the the the whether you need to do something special with it. So if my microwave stops working, my microwave stopped working, I've had another way to do it. It's not that critical, it's just It's fine. If my microwave and then my stovetop stops working, it gets a bit difficult to boil water in the oven. Yeah. and then if it's all gone, then that's kind of not so good. So circling back to this this when does something become infrastructure on that context becomes infrastructure when daily operation doesn't continue if it's no longer there. or if you need to to accomplish the task, have a redundancy in place. 'Cause this th I've had this discussion a lot over the years, like with with especially manufacturers, chief operating officer. Like do I need it to to run my operations? Do I need it to boil water? Can I live without it? Yes, I can live without it. And so so in that sense, remote access wouldn't be infrastructure because you you you you are day-to-day operation for some. Like it it again, like i it's a dependence. It it depends on your own. The the the OT needs to have a conversation about Do I need it? Because maybe you need it for your operators to be remote. we know we have factories that are one or two persons, but behind it sits a hundred person remotely helping with the operations of it, monitoring what goes on. And maybe you need remote access for that. So that there is this distinguish between do I need it to run operations? and for some plants, yes, you need it to run your day-to-day operations, you need remote access to be able to see the HMI, to to adjust temperature, to to monitor, to troubleshoot. in your productions or start up a line, for example. That can also be remote access. That that clearly becomes infrastructure pretty quickly because otherwise you can't run your day-to-day operations. Where the things go off the wheels for most remote access is my operation is down. That's hopefully not something that happens a lot. What do I do now? But that that goes back to the criticality. So if I take it I'm gonna I'm gonna probably do this kitchen thing a bit too much, but if I take the kitchen example My home kitchen, at home feeding myself by myself, that criticality is pretty low. If I can't if I can't get one meal or I go out and I get something else, but if I am, let's say, have a family. Yeah. And my kids are really hungry. Like your kids are really upset that criticality of that operation that's gone up a bit. there's a bit of pressure on it. Can I still maybe order something in or have another way around it? Yes. But let's say that my output is critical. Let's say I'm a caterer Because without it, I can't provide that service anymore. And at that point, this piece becomes critical. Becomes something that can't I can't afford to not have. And therefore, I either have to have ways to protect it to in The most obtuse have somebody log in and fix it remotely. So remote access for us is so remote access, it depends on the scenario. That's what we're saying, right? It's it's it's not it's never gonna be a black and white issue. And and it's something that the organization OT has to have a discussion with the operationals, with their c chief operations officer about like in what what sense of it is it infrastructure? Because it's It also depends on site, on endpoints. there's so much flexibility from site from from factory to factory, from operations to operations, whether or not they define this as criticality. And I also think you can see that in compliant. For example, like Nice is like right down the middle. It's not clearly one or the other way around. They they identify, yeah, you need a standard one, you need some subgovernance and cybersecurity requirements on it, but it really doesn't go either way on it. Where on some of the other things it goes clearly towards this is an infrastructure piece. You need to treat it as such. So it is up to the organization to have a discussion about what is remote access for us? How where do we place it in in the hierarchy? How does our factory look like? How do we do production? How do we do it? Is it only for troubleshooting? Is it for operations? And if we do troubleshooting, do we have other venues? And what is the cost of those other venues to get get the support we want? And what is the impact of it? So it's sort of a It is a a factory to factory, company to company discussion how do they place this as an infrastructure is not a clear-down lane. And if you look at the different thoughts out there, there are sort of the it's not critical, you can always fly in. There is, if you look at Siemens, for example, Siemens is very big at at defining this as this is critical in infrastructure, in your is this infrastructure in your operations, but it depends on what is your the the what is actually useful in your operation and i think this is where it should be something where a lot of times cyber it ends up being the cyber handles of cybersecurity OT cybersecurity but they really need to take their take their chief operations officer over and ask them what is the impact of this how am I how do I see this piece of equipment? I need the security part of it of course But how do I otherwise see it as infrastructure in your operations? How do you see it? Because they all those are the ones who can carry the requirements over and saying, Yeah, this is this is what it this is I feel this is infrastructure for us. Or no, we have o other ways around. We are fairly local with our suppliers local, it's not a problem for us. Or we are distributed around the world. If this goes down, we we can't operate. Yeah. And that that that's almost full circle. If you have to have a plan when it goes down. Yeah. Than its infrastructure. Yeah. That's why it's it's it's you can you can really break that down and make it very complex. Yeah. Right? And you can count the number of endpoints and try to come up with a threshold when when so many services are impacted that it becomes something I need to manage. and I think just keeping it very simple is the I need to manage it if when it goes down. I can't keep my promise or I can't produce what I need to. And so then comes the question with what do you need to manage around it once it is infrastructure? Yeah. Yeah. had this this story about with with somebody we were working with, which was like where the the chief operating officers and the CISU had this discussion of whether it was critical infrastructure or not. And at the end of the day they couldn't really agree on, but all they could agree on is was that they needed a Starlink on the roof to make sure that they had connections. If if you if you're having that discussion and but but in this setup I need a Starlink because if my landline goes down, I'm screwed. If you're having those kind of discussions, you have crossed the threshold. Yep. because now you're s really starting to build redundancy in the into the system. So it can be this academic discussion for them, but it does come down to what does the operational part actually need. So are you saying that the on-site test is if you're not if you're in the in a discussion with somebody in your organization and you're debating is this infrastructure or not, and you really want them to give you an honest answer, you go in, you turn off the internet. Yeah. I mean see what happens. For most factories, you turn up in it. So maybe you start by turning off the remote access and seeing how long does it take before it before they really notice. And for most, it wouldn't be long before they at least though a certain size of the planet, it wouldn't be long before somebody start to notice. Yeah. That wouldn't be, probably the safest way to test it out. But it's certainly one that makes somebody have an honest dialogue. Yeah. About what is the please please don't try this at home. Yeah. What is the really don't try this at home home. This is not a recommendation to the CISO out there to go out and start shut off or what I'm flipping switches. yeah. I think I think that at least that would might be be my point on it. Discuss it if it is in your industry in your in your settings and if you are starting to go to length on it where you are starting to build infrastructure on top of it to make sure it works, then you're probably cross the line. So once you hit that redundancy point where when you start to have a Starlink on the roof. Yeah, yeah. Two star links. We get into some long haired conversation sometimes about the interstructure part of it. then you you cross the line yeah for sure on on this point. But it is I also think remote access a lot of times because of the ca the the security impacts of it the CISOs it's also my recommendation to say if you are a CISO out there looking at remote access OT wise, the first conversation you have is with your I think I said this multiple times on the podcast Your first discussion is with your chief operation officers. Again, to discuss if it's infrastructure or not, what is the dependency, what is the impact. from a security perspective, you don't open connections into your factory unless operations says, I need this. And once they say, Yeah, I need this, this is the impact of what you're buying. That's your starting of your buying decision. If you start from I need just to secure this, but I don't have an understanding of what is the operational impact of what the system is supposed to do, then you're starting from the wrong part of it. Because where I think remote access a lot of times differ from, for example, asset discovery, which is a pure protectional tool, where the discussion becomes different from a remote access point of view, Because the only reason to have remote access is I have an operational need. because I have suppliers, I have people who are working 24-7 from home, I have remote people who are coming in. It starts with an operational point of view. So it should be an operational discussion about saying, okay, this is our needs, this is why we do it, this is what what we need from operational perspective. Okay, and then when you have that discussion. The the the CISO for OT says, Okay, what happens? What is the criticality of it? What if it goes down? What is and that helps him find out if the people says, that's no that's fine, no problem. And if they become really red in their face, okay, this is this is to be considered infrastructure. And you take those requirements into your day-to-day operations of your remote access solution or your purchase or where you are in the lifecycle of of your current remote access solution. But that's the discussion that that they should start with, in my opinion. Mm. Exactly. It is a discussion. It is a discussion. And then to to that point I also think what is a key is when they then move the discussion when when when we work with OT CISOs, when they then have the discussion with the board about what are we buying, what kind of budget we're having, it also should start with the operational part of it. Because a lot of times start with this is security we want. Yeah. But they forget that why are we paying this or why are we setting these redundancies up if you haven't had the the discussion with the with the chief operational officer. The chief operational officer should bring the criticality of the system, infrastructure or not, the business impact into it. And from there you then look at the cybersecurity part of it. Because this is where I think for most companies, when they have this discussion, they're gonna end up in the in the conclusion that this is inf infrastructure for us. Because what they're gonna say is. We can't operate a factory that is down if we can't have this. We can't install new machines. It costs us a a a ton of money if we do that. So we actually need this to be infrastructure, be named as infrastructure for us for our ability to operate our our factories. Yeah, but it also comes into how you're using the access. Yeah. So if I'm using the access to log in and check a couple numbers, yeah. Exactly. It's okay if it's not there. Exactly. If you're using the access because it's easier within the same factory to have some form of in that area a remote access so I can from one system to another system communicate but within the same building. Yes. You could probably suffer the walk to the to the panels if it if it's not available. still inconvenient. Yeah. If it's something where right you're in the same building. but it's not just used to log in and configure things, but it's also a recovery or resilience format. I use the remote access to recover systems should they have an issue or need a recovery. Then suddenly that that time to that recovery becomes a bit more and it's less of a convenience type topic to something that is when this isn't there, that takes more time, which has a value, specific value that you can calculate. And then on that now you're going outside of the factory. Right. something I'm I'm logging in to manage numbers from outside of the factory, then you have a transit cost associated. Not the end of the world, it's still kind of you can still do it convenient if you're if you're local, right? if you have high end equipment that requires a specialist, it's available only from a flight away. Yes. Then suddenly that this criticality comes up and you have to have a more specific plan. I repeat this too often probably, but it is you have to have a more specific plan. Yes. In the event it doesn't work on like a playbook. Yeah. I say that word too a lot. Yeah. and then that's infrastructure. Yeah. And I also think the the piece that also comes into where do you see your factory in ten, fifteen years. Because yes, right now it's where you are, but the explosion in remote people we've seen on factory isn't as great as the one we see in from offices, but it's still up there. Like the the supplier part, we see that every day, the amount of connection going through these systems. in the time just looking five years back, a remote access connection probably being used ten times as much now as it did five years ago. And if you look back to COVID, it's probably a hundred times more than it was before. Like so so this these systems has also over time, just from time of COVID to now had an explosion in the In the use and the criticality of it is, and now we're also working with customers who are saying this factory used to have 200 workers, it now has 10. The rest of them are remote to monitor, to work, to change the recipe, to start up the next next production line. The this area has changed a lot in a very, very short amount of time from having from this discussion. Before COVID was not a discussion at all. There w this was not critical business there was no way this was gonna be business critical. We're just gonna fly people in. No worries to now there are factories with ten people that used to be a hundred, but the rest of them are from home or f going in only when needed. Yeah. Yeah. But I think it's also interesting because we keep saying the word factory over and over and over again. Yeah. And it gets this misnomer that the the O T industry or that the remote remote access in this industry is like only for a factory. And it's it's not anymore. there's the the remote access to a ship. Yeah. For example. Or remote access to I don't know. Yeah. An a a self driving car potentially at some point. Like and it's also already coming in and being a thing. And the ship is a very good thing 'cause like again, before Starlink this was not at all a discussion. Now it was only when they get got close to port they could actually have remote access. Mm-hmm. Now you can have it, yes, with some latency, but almost from every everywhere. That has also changed. Yeah, the satellite has we have a team out that is installing remote access on some ships now. that that's also part of it. So that has also changed the capability of being able to use it now. Mm-hmm. So yes, it depends a lot on what you have out there. And again, yeah critical infrastructure. I was once part of a a a deployment where the word critical infrastructure was hard not to put emphasis on on it because it literally made sure millions of people could stay alive and the amount of redundancy and going through to get that up and running i mean the amount of remote access systems that was built on top of each other there just to make sure that whatever happened in that scenario, you could get remote access. Like it was unbelievably crazy. So of course there is a there is a very wide gap between this is critical infrastructure and remote access is a critical part of operating that critical infrastructure to make sure millions of people can have gas in their pipeline or just even stay alive. And then I'm producing something where yes it cost me some money but it's not life saving or maybe the the the the the hours of a breakdown doesn't kill me in cost right away. And there is a very, very big big gap between the two. So we defined a bit of infrastructure. Yeah. How would you define Critical. my god. Infrastructure. You are today's just the day we pick every word we can get in trouble for. Yeah, yeah. They are definitions we can get in trouble for. We should have started with AI definitions and then we could have really have some fun. critical infrastructure, that's a good one. I mean this is obviously an opinion, not like an academic definition. Not an academic. Because again, the the the cob-out answer is to say, hey, it's it's up to the the the factory to produce it. I think the core part of critical infrastructure is like you said, oil and gas, water, electricity, sewer, all the things that a society becomes really, really hard on not to work fast. So that's sort of the critical part of it. But what the next step is is also like food, for example. Like the before the Ukraine war, we would never have defined Part of the food delivery part as critical infrastructure. we wouldn't have. No, we wouldn't have. I guess the awareness probably increases at that point more. Yeah. But like trucks, we also do some work with grocery stores. Like you all of that part is yeah, it's second line towards and it takes some time before you have a couple of days before they end up being maybe called critical infrastructure. But once you have a few days, you get to the point of being called critical infrastructure. I was Yeah, so it's it that's a line that 'cause you're you're driving down, the highway, freeway, Autobahn, whichever country you're in, and you you get the semi trucks and they're passing each other and it it's like this moment of of interesting frustration. But then if you think back on it, it's like They're critical. Yeah. Right. It's critical. It's actually quite a interesting perspective to have when I'm driving late at night. Yeah. Yeah. It it goes it goes fast over the days. I come I before I worked in in this industry, I worked in in in finance and security around finance. And one of the things going through that process was being part of the n round of the world, the national disaster recovery plans. We s we sat in on some of those meetings was part of that because cash is part of that chain and how do you do and I I always keep cash after that discussion. I always keep extra food after that discussion. And I always keep extra water. just because I realized that what you think about critical infrastructure, yes, that is critical, but the chain every day you go a day out starts quickly breaking down and having these cascading effects that you don't actually normally don't like think about. And one part of it was like this food truck thing, or how many systems there needs to go down for the banking system to be completely out of like it's it's not a lot of hits that it needs to take. It's actually a for a country to be of confidence and comfort one has on like digital money even. Yeah. I think that's I think that's interesting though. So let's take a step back and try to condense that down into and and take some time to think about it because I think you've you've brought in so many interesting topics from so many different areas. And it came down to this this how long when it's not available, how long does it take for everything to fall apart is what I'm hearing. Yeah. And which other pieces rely on it is also what I heard in that. So if this one piece is out for X number for this period of time, how long does it take, or for any on a scale, how long does it take until another piece fails, another piece fails, another piece fails? And this cascading cascade of failure, what is the impact on society? Sort of what I'm taking from what you just said. At least that that's my understanding of like when we talked about about critical. And you can also take it back to like a a factory like okay the the packaging line breaks, but the production line is still up. Mm, that's not critical, but at some point that packaging line becomes really critical. Yeah. And then you're then okay, that that now it's part of your critical operations. How would you d how would you define it? I I wouldn't deem to be able to come up with a better definition than what you just did. I think that was that was really good. So that that was that was a fantastic definition. I think now bringing it if we'll circle back into the the topic infrastructure, is remote access infrastructure? So I guess I guess we just bring it down to that that answer you just you just gave. Maybe that we were saying critical, but at the same time I think it applies here. It's like when it no longer is there, yeah. What is the immediate impact? Are there other pieces that start falling apart in the chain? Yeah. And what is the timeline to that that Everything falling apart. And once you map that you have Yeah. Not just is it infrastructure, but how critical it is to your organization. I very much agree with you there. I think that was a really good definition. Yes. Thank you so much for listening to Talk OT to Me and welcome Jeff to be part of season two here. And thank you for listening for season one and so excited about going to season two now. So thank you so much and have a nice day. Take care.