Cyber Daily: You’re here in town to talk to a few people about basically the current threat landscape, what the government’s doing, what they can expect. What is your throughline message to the people you’re speaking to?
Rob Lee: Yeah, I mean the main thing that I’m telling folks is just over the past probably two years, we’ve seen some pretty dramatic shifts in the threat landscape as it relates to operational technology or OT, and there is the AI discussion as well, but that’s just a one component of it, so I’ve been going into details with them on kind of what we’ve been seeing and the the instant response case we’ve been taking and the threats we’ve been tracking, and and really the message is you don’t have to freak out and you don’t have to redesign all your security programs because you know the threats have gotten more numerous.
It’s just you need to have a sense of urgency, and so we already know what to do. We’ve got the guidance on what makes sense for OT security. It’s just you’re kind of running out of time to, you know, do a program. A lot of folks, when they go into OT security, it can take them three to five years to really roll out a program correctly, and they just don’t have that kind of time anymore.
Cyber Daily: How are people reacting to that news? The fact that everything is sped up, and they really need to basically speed up their own activity to keep pace. How are they taking that?
Rob Lee: I would say everybody’s in agreement. There’s nobody pushing back – it’s just a question of resourcing.
As an example, every water utility – I met with a bunch of water utilities today. Every single one of them thinks, “Yeah, we’d love to, but we can’t get the funding to be able to go do this work.”
I think we may have touched on this last time we chatted, but I think here in Australia, what’s kind of unique about the issue is, you do have a national security awareness and national security policy around what needs to get done, but it’s not aligned with your economic policy.
Cyber Daily: And it really does need to be entwined, doesn’t it? How do we convince governments to take that step?
Rob Lee: It’s going to have to be done at senior leadership levels. There are disconnects.
They’re very polite about it and cordial and try to be professional because politics is hard.
But if you set the key people down at some of these agencies, they will openly admit that there’s an issue. And so, as an example, the folks at ACSC and ASD have a very good view of what the threat landscape is, but then when it gets down to the economic regulators and Home Affairs and so forth, they’re up against their own challenges and telling Australians, “Hey, we might want to raise your water bill or electricity bill even by like ten cents” might be very politically unadvisable, and so they’re just not going to do it.
So I think what you’re going to have to have is either strong leadership at the top that pushes it anyway, or help build awareness across Australia. Tell people, this is what’s going to happen, and here’s why, and sort of tone down the backlash that would come from any sort of increase in prices.
Cyber Daily: The Australian populace is, like every country in the world, dealing with all levels of cost-of-living stuff right now. So selling that 10¢ increase for what is only a potential downside would be quite the hard sell. But it is only 10¢ for quite the good outcome, isn’t it?
Rob Lee: Yeah – they’d have to do the the economics on it, but but probably as little as that, but I would just say with these potential impacts, look at what’s happening in the United States right now, where an adversary is going after a bunch of water utilities – and we’re talking like just of what we know, it’s north of 50 different water utilities that are getting hit all at once.
So these potential outcomes, once upon a time, were one every year; OK, maybe one every other year. Now we’re seeing 100 cases a year, so it’s probably time to realise that we’ve digitised, we’ve connected, we’ve changed our infrastructure at the very time that our adversaries are willing more than ever to target it. We’ve got to change something, or you’re going to start having serious disruptions, or, unfortunately, probably get to a place where we have loss of human life.
And I just don’t think that that is something that we should be sort of OK with.
Cyber Daily: No, no, absolutely not! What do you think are some of the key drivers of this acceleration in the pace of these attacks? I imagine it’s a combination of geopolitics, technology changes … Technology on both sides, both the adversary and in the operation centre, actually. Is it a perfect storm?
Rob Lee: Yeah, absolutely.
The geopolitical situation for sure contributes, but also, we’ve changed. Like our OT environments are different [from what] than they used to be. We’ve massively connected them up, remote access and so forth. Sometimes for economic reasons, sometimes just out of necessity, we’ve standardised our technologies more than ever before. So there’s a lot of commonality in equipment and a commonality in software stacks and similar, so it’s easier to scale an attack for an adversary.
And you know, AI … There’s some hype around the AI stuff, but there are legitimate use cases and some components of the AI piece that are accelerating what adversaries can do as well, and so you sort of have this new technology advancement for adversaries in the form of AI. You have a technology change for the defenders, and the fact that we’re all connected, and you can scale.
And then you put the geopolitics into play, and then you also have new adversaries coming into scope. It was really not realistic to have hacktivists and criminals and ransomware gangs and non-state actors really impact OT 10 years ago; now they can, and we’ve seen direct evidence of state actors arming non-state actors with OT infrastructure capabilities, knowledge, etc.
So there are a lot more players in the game these days as well.
Cyber Daily: It does feel that everything’s accelerating, you know? The time to patch, the time to do everything was yesterday. Do you get the sense that it’s just too late for some organisations?
Rob Lee: It is, yeah.
You know, I never want to say that it’s too late. You can never do it …
But for some organisations, they’re not going to have any meaningful change inside of two years, even if they try to start today. And that’s terrible when you look at the accelerations that we’re seeing. Well, you just gotta hope that you don’t get hit, and we’ll go from there.
You know, I don’t want to be doom and gloom. You can always do work, but it’s just the reality that if you start today, it will take you two to three years to have a really well-functioning OT security program, and that’s if you’re moving with purpose and a sense of urgency. If you think it’s already kind of intense here now, two or three years from now is probably going to be a little bit more.
Cyber Daily: Yeah, yeah, I can’t argue with you there. Thank you very much for your time, and enjoy the rest of your trip.
Rob Lee: Awesome. Thank you so much.
Want to see more stories from trusted news sources?Make Cyber Daily a preferred news source on Google.
