Dragos CEO Robert Lee On Bridging The Gap In OT Cybersecurity For Critical Industries

Listen to Robert and Victoria’s Discussion on Cybersecurity Here:

• Origin story of Rob Lee: US Airforce to National Security Agency to CEO of Dragos
• Cybersecurity: Information Technology (IT) versus Operation Technology (OT)
• Advising boardrooms about cyber security risks: Scenario-based approach in cybersecurity
• The role of executives and boards in cybersecurity
• Leadership as a young CEO

“Most governments, most board of directors, most business leaders are surprised to find that 95%, not a made-up statistic, about 95 percent of all the budget to cybersecurity efforts is going to the IT side of the house, not the OT side of the house. But you generate all your revenue and have all your safety impact and your business impact and national security impact on the other side of the house.” – Robert Lee, CEO of Dragos

Watch Victoria and Robert’s Cybersecurity Conversation Here:

Dragos CEO Robert Lee On Bridging The Gap In OT Cybersecurity For Critical Industries

Welcome back to The Chemical Show. I am here with Rob Lee, who is the CEO of Dragos, one of the most premier cybersecurity firms in the US and maybe globally. Rob regularly gets called in to consult with companies, with countries, and probably more on cyber security issues.

Subscribe To The Chemical Show On Your Favorite Platform

Youtube Spotify Apple

We’re here again at the Marsh North American Energy and Power Symposium having this conversation. So when you hear a little background noise, you know why. But anyway, glad to have this conversation with Rob.

Yeah. Thanks for having me.

Absolutely. So tell us a little bit about yourself and how did you get into cybersecurity?

So I started my career on the US Air Force side of the house. I was building control systems. When we talk about cybersecurity, sometimes we talk about the information technology side of the house, which is more of like your email servers and computers and things like that. And we also have the operation technology side of the house, what we call OT, which is really your chemical facilities, your water treatment facilities, your power grids, like the physics side of the house. And so all my work is really focused on the OT side, and I enjoyed doing humanitarian work in the Air Force, building control systems, building wind turbines in places like Cameroon. And then I realized that cyber could be used to impact those systems, got recruited into the National Security Agency, and ended up building out the US government’s mission, looking at various states and criminals breaking into infrastructure around the world. And then after that, started a company called Dragos.

So why leave the NSA?

Yeah. Lots of discussions and the wrong liquid in the cup, but I enjoyed my time at the NSA. And surprisingly, we actually did a lot of interesting defensive and cool work in that way. It was actually when I got rerouted back to Cyber Command and looking at the offensive side.

I got to be other people’s adversary for a while. I just didn’t really agree with what I was doing. Like, countries should have military capabilities to impact others. Don’t get me wrong. Generally though, I think everybody should stay out of each other’s civilian infrastructure. And every 35 year old mom should be able to go home to her 5 year old kid regardless of nationality. And I don’t think that’s typically the view.

Yeah. Well, there’s different points of view everywhere.

Everywhere. Yeah.

So tell us a little bit about Dragos.

Yeah. So we’re a technology company, but we also are probably most well known because we have an instant response team, a services team who goes and responds to a lot of these big critical infrastructure attacks. So our software gets deployed in the operations technology side of the house to help reduce the risk by identifying vulnerabilities and threats and things like that. But a lot of the big incidents that take place, they’ll call us in, hopefully ahead of time, but if at worst after the incident to try to deal with this. So, we did the Colonial Pipeline incident. We’ve been involved in a lot of Ukraine attacks and analyzing the cyber attacks and electric infrastructure there. So kind of any of the big things you’ve heard of before or may have heard of in cyber attacks and infrastructure. Usually, it was our team that was there trying to help people recover from it.

So is this all computer related? When I think cyber security and cyber attacks, I think computers. Is that what you guys are working on?

I think probably one of the more surprising things is a lot of business executives of these companies feel, hey, we’re doing a lot of cybersecurity. But there’s so many different things in cybersecurity. And there’s that big IT versus OT bucket. And most governments, most board of directors, most business leaders are surprised to find that 95%, not a made up statistic, about 95% of all the budget to cybersecurity efforts is going to the IT side of the house, not the OT side of the house. Where you generate all your revenue and have all your safety impact, your business impact, and national security impact is on the other side of the house. So about 5% of all the efforts in the community and the resourcing is going to the side that actually generates all the revenue and national security impact.

So the actual asset, the infrastructure, the operating plant, etcetera.

Correct. So for all your chemical engineers and business folks, what cybersecurity is to them is probably, oh, secure my password, secure my data. That’s cool. The cybersecurity that actually impacts them is, as our industry has become more digital we’ve become more complex, more control systems and automation. That digital network with the physics impact, the physical world, that’s cybersecurity now. That probably wasn’t true 15 years ago.

Yeah. Absolutely, because we’re relying on computers, more efficient operating systems, etcetera, to run everything.

If an operator can open up a circuit breaker through a computer, now an adversary can too.

In fact, I’m gonna say this for our listeners. Brad Beauchamp, who’s CEO of Carpenter, was on the podcast a couple years ago. We will link to that episode. And he talked about the cybersecurity attack that they had. How it took down their operations and how they recovered from it. And they were able to recover. They found a solution, but it’s an interesting story and conversation. So I will link to that for people to hear about it.

Good on them, because one of the scary things in a lot of the boardrooms I get in is most companies don’t have the investments ahead of time into the cybersecurity of OT to even know when something goes wrong, was it cyber or not? A lot of the national security conversations with various government leaders, they have the question, when a cyber attack happens, it does this and what do we do? I’m like, how do you know that it’s cyber or not? And they go, oh, I don’t know. And it’s like, that’s the starting discussion.

So we’ve seen chemical mishaps, safety issues, etcetera, where people look at it and go, we don’t know. I guess it’s a maintenance issue. And you’re like, okay. And that kind of ruins your ability to respond to it.

Yeah. I will say on a personal level, if I think about the Internet of things and just the home Internet of things like, we have a ring doorbell. We have a nest one of those thermostats, whatever. And I do worry about the fact that somebody outside of our control can control it. And that’s on a microcosm on a home level.

Great example though. Like, think for a second, you’ve got a Internet connected thermostat. You’ve got an Internet connected alarm system.

And then you’ve got a Internet connected toaster. Right? Then one day, you have a fire in the house. Did somebody hack your system or disable the alarm system and cause a fire in the toaster, or was it just a mechanical mishap? That question, take that now into any digital infrastructure that we have, that’s really hard to answer.

It is really hard.

Especially if you don’t do the work ahead of time.

So what’s your recommendations?

Yeah. So, I think it’s easy, but it’s maybe not.

Easy for you, maybe not easy for me.

Maybe that’s coming off pretentious, but I think number 1, we’re all good at scenarios. The chemical industry as well as infrastructure in general, we have a very good safety community. And so understanding safety process, process hazard analysis, HAZOPS processes, like going through a safety scenario. We don’t sit there and go, I want a better valve, I want a better pressure rate. We go, what’s the scenario that can cause a mishap? Look at all the controls across it. So I think cybersecurity sometimes comes out with, you should deploy this thing or you should have this tool or complex password, but they’re not looking at the scenario. So one of the things I generally advise is, first off, look at the real scenarios.

Your company doesn’t have unlimited budget, doesn’t have the ability to go, how do we reduce cyber risk? Well, what does that mean? But we could say, here’s three scenarios we’ve seen that have caused impact in the chemical or in energy or water industries before.

Are we ready for those three scenarios? And across our 50 sites, 33 sites, 300 sites, what would it look like? Well, what are the abilities to try to prevent it, to try to detect it, and try to respond to it and recover it? You look at those controls across this scenario and you can very easily get to something that you cannot measure. Now it’s not some random presentation in a boardroom of high risk, low risk. Is it 33.5? Is it 40? And it’s like what does that mean? If that happened to us would we be okay? Like, oh, yeah. We could actually deal with that one.

So who should be in charge of this side of a company? You talk to a lot of people, what works?

Ultimately, the CEO owns the risk. So this idea that the chief information security officer or the chief risk officer owns the risk, they’re advisors. The CEO owns the risk with oversight from the board depending on your corporate structure and the rest of it’s about advice. So the CIO or the chief information security officer, sometimes rolled under a CIO, is presenting to me, here’s what I think the risk is. And you need to challenge those folks because a lot of the ways the careers have developed for chief information security officers is out of the help desk, out of IT. They don’t know your plans. So they really need to understand what’s your OT cybersecurity risk.

I’ll just speak about cyber. Challenge them. Is that the enterprise or is it enterprise IT? Okay. You’re talking the enterprise and you’re talking OT then.

Got it.

So are you talking about enterprise OT, chief information officer? Great. What do you advise against real scenarios?

And then it’s up to the CEO, usually also the CFO or or chief operations officer to sort of delegate that down. Especially in the chemical industry, ultimately, you’re coming to the plant manager. If I operate that asset, I am responsible for everything that happens at that asset. And I am responsible for the cyber risk that goes into it as well, but I’m not responsible to know all the possible cyber risk. I need advisors in my organization for that.

Right, I was gonna say because a plant manager, they’re often an engineer, a scientist of some variety that that’s grown up through the system. They would say, I’m not actually equipped to handle cybersecurity. However, risk management is absolutely one of their remits.

100%. And again, at a board level if you’re talking about a lot of these cybersecurity scenarios on operations, in fact, you are talking safety. You are talking massive financial impact. For a public company, this is your 8k and 10k filing discussions. You’re talking national security depending on the size of your company. It it should be an elevated conversation.

Once that elevated conversation happens, it’s really just binary. Are we going to address this risk? Yes or no? Not what level of it. No. Are we going to try to address this risk? Yes or no? Because then there’s gotta be funding. And that was what was really useful in the chemical industry after the Bhopal incident. So from a safety perspective, for many companies, it used to be that safety comes out of your budget

Yeah.

Do it or don’t. And then we looked at it as an industry and went, oh, that’s not good. We as a company shouldn’t be able to, deal with that. Let’s just say there’s a corporate budget for mitigating the safety risk. And if you wanna go beyond that, feel free to plant budget, but the minimum will take that out of the budget overall.

Long story short, there should be a company understanding of what are the risks we wanna mitigate. There should be a company understanding of to this level, we’ll resource it. And then underneath that and the “how to do it” should be the plant manager.

Got it. So I was gonna ask, this seems like an obvious question, you recommend that everybody have this risk review, a cyber risk review as part of their normal business practices?

Certainly, it may become federally required in the US actually. So what we’re seeing from that, SEC has made this determination that you need to talk about material events in your company. And material event obviously that’s true regardless of cyber. Usually a 10k that you file with the SEC saying here’s the things that can be material. And then when something happens that is material, you file an 8k to say something changed. And it’s required by law for any of the public companies. They have designated that cyber can be material, and they expect to see the cyber components through that.

So it’s already being mandated that you have to have the conversation. What we’re seeing as best practice is these companies are getting together saying, well, what could be material? Instead of waiting for something to happen and filling out the 8k, go reverse engineer the 8k. I’m a chemical company, what happened to make an 8k at the other 3 chemical companies that did it? Let’s take that 8k and reverse engineer it. And usually how that’s done is a tabletop exercise. So you go around the room with the appropriate people in the room, whether security people, operations people, whoever, and go, here’s a fake scenario, but it’s really happened.

We’re not just saying, lasers from space. I use something real. Right? Like, here’s what we saw happen before, respond. And then they kind of work through it like a game of sorts, and then they determine, oh, actually, we’re not in a good place to deal with this or we think we are. And that “we think we are” then should be followed up with technical assessments of, are you really? Did you really have those investments? And that should be reported back to the executive group to be able to say, yeah we were actually as good as we are.

Or, no we’re not. We have these gaps. Let’s go address those.

And you guys support companies on those exercises. Is that something that you do as part of Dragos?

So even though we’re a a tech company and that’s our bread and butter, that preparation ahead and those tabletop exercises where we get called in a lot and then unfortunately a lot on the responses as well.

So I like to always talk about leadership. You’re a relatively young CEO working with probably a lot of older CEOs. How has that played out for you? I’m just gonna ask that. It’s a broad question.

Really well so far and surprising. I used to go in, I’d have these meetings with these CEOS of these companies. And I’m like, hey I’m just a young CEO, whatever. Eventually, one of them told me, stop it. I always played the card, I’m first time founder, CEO, young guy.

They’re like, stop it. How long have you been CEO. And I said, well 7 years. This guy says, well I’ve only been a CEO for 3, so you tell me. And I thought, oh, okay. So I think a lot of the CEOs I meet are really humble in the position. I’m not saying everybody is, but most of them are very humble in the position to go, it doesn’t matter how many years it took me to get here. I’m here, and here’s my base of expertise. You have a base of expertise, and I’m calling on it. You tell me what your expertise is. So I’ve found them to be pretty open on that, but it’s been fun on the infrastructure side because in cybersecurity, a lot of the cybersecurity executives, chief information officers, they’re always yelling, how do I get the business to take me seriously?

And, I don’t have that problem. Because when I go talk to a president well, not yet, but I go talk to a CEO. No CEO, no president, no parliament member is confused about where their country generates revenue or risk. It’s just, fair enough. I don’t have the, well how do you secure your data? I’m like, hey if there’s a plant fire over there, it’s $300 million of lost productivity. They go, yeah.

We get that. And so the impact allows it to sort of be the, yes, now how do we wanna deal with that? And I think that allows the conversation to go pretty smoothly.

Awesome. Rob, this has been great. Thank you very much for the conversation.

I know that people are gonna love it, and I’m looking forward to hearing your speech today.

Hopefully, no one in this group ever has to call me. But if you do, do it in advance.

About Robert Lee:

Robert M. Lee is the founder and CEO at Dragos Inc. an industrial (ICS/OT/IIoT) cybersecurity technology company on a mission to safeguard civilization.  
 
He serves on the World Economic Forum’s subcommittees on Cyber Resilience for the Oil and Gas and Electricity communities, on the US Department of Defense Reserve Forces Policy Board, and has testified to the U.S. Senate Energy and Natural Resources Committee as well as the U.S. House Energy and Commerce sub-committee to advise on policy issues with relation to industrial critical infrastructure cyber threats.  
 
A passionate educator, Robert is the course author of SANS ICS515 – “Active Defense and Incident Response”, the lead author of SANS FOR578 – “Cyber Threat Intelligence” with their accompanying GIAC certification GRID and GCTI. 
 
Robert obtained his start in cyber security in the U.S. Air Force where he served as a Cyber Warfare Operations Officer tasked to the National Security Agency. He has performed defense, intelligence, and attack missions in various government organizations including the establishment of a first-of-its-kind ICS/SCADA cyber threat intelligence and intrusion analysis mission. He is also a frequent speaker at conferences around the world. Lastly, Robert, along with Jeff Haas, creates a weekly technology and security web comic titled Little Bobby.