Cesar Tascon with EY

SUMMARY KEYWORDS

Cybersecurity, OT security, IT convergence, Asset management, Risk assessment, Industrial infrastructure, Critical infrastructure, Data protection, Threat landscape, Change management, Regulatory compliance, AI technology, Incident response, Connectivity issues, Business process

00:00

Yes, you need to get your cybersecurity house in order. You need to attend the Barcelona Cybersecurity Congress that is November 3 through the fifth, and meet the best cybersecurity leaders in the world to help you along on your cybersecurity journey and who are protecting our future. Enter promo code BCC podcast 26 and get your discount. I will be there. I would like to see you there. Talk soon.

00:34

Welcome to the Industrial Talk podcast with Scott Mackenzie. Scott is a passionate industry professional dedicated to transferring cutting-edge, industry-focused innovations and trends, while highlighting the men and women who keep the world moving. So put on your hard hat, grab your work boots, and let's go! All

00:52

right, once again, welcome to Industrial Talk. Thank you very much for joining the number one industrial-related podcast in the universe that celebrates you, industry professionals all around the world. I say it all the time. You're bold. You're brave. You dare greatly. You innovate. Boy, do you innovate. You collaborate. Yeah, you do that too. You are making the world a better place. Take that to the bank. That's why we celebrate you. That's why you are the heroes in this story? All right, we are continuing our series with the Barcelona Cybersecurity Congress, featuring the just incredible professionals that are absolutely focused on your success and protecting what is important to you, and that is your business. And they keep current, and I am so grateful for them because it's a changing landscape all the time. And they just keep current, and they keep doing what they need to do. We're featuring in the hot seat Cesar Tascon. He's with Ernst & Young, or EY, and we're going to be talking a lot about OT. See, we have the OTIT sort of dealio. We're going to be focused on the OT. Just because your assets, your business, what you're trying to gain, receive that data, be able to analyze that data, you're connected. How do we protect that that very valuable part of your business, we're going to be talking about that. That, no doubt about it. Let's get on with the conversation. It never ends. I, you know how grateful I am. So we've been doing this series with the Barcelona Cybersecurity Congress, which is right around the corner. You heard it on the intro. Well, the the the ad. You need to be there, and and it covers everything. There's no gap in in this series that we've been doing on Industrial Talk. No gap. We've talked about everything from the human side to the internet side to the to the OT side to the IT, you name it, we've covered it, and it's all out on Industrial Talk. You just type in BCC, and you get all of those conversations. Again, for me, absolutely grateful for these individuals, for these professionals, and then when we go to Barcelona and when we set up our shop, we're going to be talking to more. This is a really exciting time to be in the world of cybersecurity. You need to look at it. Just it's critical. I I don't know how else to continue to expand upon it. It's just critical, and the tools and the solutions and the individuals, because it's a human conversation, are definitely passionate about making sure that your valuable assets are protected. There you go. I will be there. Remember, you get the discount. Listen to that discount. I want to say it's BCC podcast 26. You enter that, you get a discount. And you know what? The people of Barcelona is great. The event is great. It's it's just you need to be a part of it. You need it. The food is great. You name it, it's great. It's all. It's all great. All right, let's get on with the conversation. Cesar, Tascon, great conversation, paper and pencil. But the reality is, is that anytime we have these conversations around cybersecurity, it's it's incumbent upon you to be able to reach out to them, and you just go out to industrial talk. The stat card is there. The LinkedIn stat card is there. So don't don't fret. Don't fret. It's all out there. Reach out to them because they're really there to. God, it's just it's a great time, and we have. Great people, and oh, I'll share this with you. So I started this series specifically around cybersecurity with those wonderful people at the Barcelona Cybersecurity Congress. Great, I because of my small mind, it it just seems overwhelming, overwhelming to try to protect everything and to try. It just overwhelmed, but after my conversations, for me personally, I'm at ease. I'm comforted. I'm comforted by the fact that these individuals know what they're doing as well as the cybersecurity market, and it's they they they know what's going on, and I'm so thankful. All right, let's get on with the conversation. Here's Cesar. Enjoy, Cesar. Welcome to Industrial Talk. We are doing just for you listener out there.

06:02

We're doing a lot of Barcelona Cybersecurity Congress podcast. We are featuring cybersecurity professionals from around the world, and they're sharing their insights. Because if you are an operation, if you're an organization, if you have a manufacturing facility, if you whatever that industrial model, you need to be thinking about your cybersecurity. You need to be able to protect your business, and that's what we're going to be highlighting. We have Caesar. How are you doing today?

06:34

Not bad. Not bad. Thank you for having me here to share some conversation with you, Scott. I like

06:40

it. I like it all the way from Madrid. You know, I bucket list. We talked about this briefly, but I want to expand upon it. Bucket list for me is to go to Madrid and experience the food because everything. Every time when you travel, it's always food anyway, right? It just it just is eat. Why not?

07:01

You know that the Spain we are famous for good food, so happy to show you some good places around. Madrid is told that is one of the best places in the world because we can take seafood from different places around Spain. Very good meat, so I'm sure that you will enjoy it,

07:23

and the people are nice too. So every you've got you've got it all. You've got good food, you've got great drinks, and wonderful people. How about that for a recipe for success? That's sort of like a business. Well, you can't have drinks for whatever. All right, all right, Caesar. Let's let's talk a little bit about your background. Give the listener the opportunity to know you a little bit. Give us a little background on who you are and why you're such an incredible cybersecurity professional.

07:54

Well, it embarrasses me talking about something like that, but well, I've talked to everyone that I'm a security enthusiast. It's something that I have liked and enjoyed for for long, too many years, 28 or something like that of experience in the field of cybersecurity before it even was this this important. Up in the days, it was like information security or technical things around, because no one at that stage thought that it would be so important in in life and and for businesses. I studied computer science, and from that, I handled some machines in the university and so on, and I was hacked many, many times, and it gave me the the point to hey, we have to give this some more professional approach to the cybersecurity and to the controls around, and I have been lucky enough to be in an industry that has been growing. I have spent most of my life at consultancies, helping other other clients, and for the past 15, I shift a lot from the typical computer security to other kinds of cybersecurity, more related to industrial infrastructure, critical things, substations, meters, factories, water supplies, whatever these kind of systems that are also controlled, and the impact is perhaps much more clear for the population.

09:39

Well, I'll I'll tell you that you've seen a lot of changes. You've been in the industry for a number of years. You've seen a lot of changes, and of course, we're gonna we're gonna venture into the AI. But that's latter, you know, that's down the conversation because everybody's talking about it. What is of real interest for me is. When when we start talking about operations, we start talking about these connected assets. Yes, there's an ITOT convergence, but I'm really intrigued. That's a that's a unique unique situation. But I'm intrigued with the operational side. What are we talking about specifically? What comes to mind. What are companies needing to be aware of? Just because I know everybody's connecting their assets, what are we talking about there, Cesar?

10:30

Well, for me, the main point here is that is quite different to the to the IT wall we are quite used to. IT world has a time lifetime or I don't know three five years everything gets older easier and we are quite used to handle things in which the key point in terms of cybersecurity is the confidentiality the nightmare for a bank or whatever, perhaps is that the database is stolen, and they get a fine. Everything here in the OT world, we are completely different. Perhaps confidentiality is not the more important part. We have availability. If something gets stopped, we have a blackout, or we have we don't have water in the you know homes, it's very clear. So the timings are very very different. Even in some of the cases, it could handle some physical harm that is not easily recoverable because something may even explode or or getting a blackout, or having a huge impact in terms of safety, apart from security. So it gives a lot of constraints, and the approach for cybersecurity is quite different, and so it has to be think of quite differently in terms of how you handle those kind of things?

12:02

So I'm going to paint this picture. You're absolutely spot on. Here's here's how things have evolved. Right there was a time. Okay, we all have, and we all understand from an industrial perspective. You had you know PLCs or DCS, and that information is given to us from an operation perspective, and we're we're managing that. But there was a what happened in the past was one, there was always an air gap. You weren't going to be able to penetrate those PLCs. There's just if you know PLCs, you know they're a little whatever. But what has Truly, been a a tsunami from my perspective. You know, technology tsunami is the ability to be able to place devices out on these assets, pull information, and and and and there was a convergence of being able to get that data, right? All that data, good, good, good, and then be able to take an algorithm of some sort and be able to analyze that data, so that for me, as an operator or as an owner, I could see into my operations better and then make tactical decisions. But that was like amazingly fast, and everybody's just plugging these things out, and nobody rarely spoke or talked about those those penetration or potential penetration issues. Can you expand upon that?

13:36

Yeah, I completely agree on that. 30 years ago, most of those devices were a wire connected to to the PLC to a control room that was in the facility itself. Someone changes some switches to to optimize, or the engineers were there handling things to make sure that was as good as possible. But the the possibility of optimizing that operation, having that widespread in different places, getting all the data and optimize that, getting one lesson learned from a facility and moving to another, were so huge that everyone went into connecting everything, and also the technology and the and the structure has shifted and initially it was very very specifical devices. 30 years ago, a device in a substation was almost built exclusively for a client and so on. And everything, all all of these gets standardized, and then all those devices start getting some field ones, some IP protocols, some interface for administration. Some hey, this place was isolated, and I was sending someone to operate. But now I will put this, and I will operate it remotely, and so I will save on on the people that will go there. And the the benefit is incredible. is so powerful. Things that weren't possible, like distributed energy generation or things like that, are nowadays possible. But on the other side, it has some other challenges. It all depends on on technology and after it more. for it, more intentional, can cause a lot of harm, and so it has to be considered as it has been. I don't know other kind of possibilities like a thunderstorm or whatever in the in the past.

15:38

See, and I I agree with you 100% Here here, let's say, let's say I'm a company. Let's say I'm a power plant. Let's let's just say it, and I see the technology that exists out there today that I can gain greater insights. It's all there. The technology is available, and I think personally, we're still scratching the surface. We have so much opportunity in the data in that insights into that organization. We just it's all there and it's converging right, and that's exciting. And I think that companies truly and you're just going to have to hear me out. Companies have to if you want to achieve that efficiency by seeing into that data and being able to tactically take action. You're gonna have to figure out that whole cyber side and protect that business and live that dream and know that you're protected and keep at it. Right? You you can't just let it go. You can't say, "Oh, I'm done. You know that doesn't work that way. Do you agree?

16:46

Yeah, absolutely. I one of the messages I repeat continuously is that in the same time that your business is a process, cybersecurity around is a process, and you have to make it work within the business process. So, as as the those facilities evolve, those businesses evolve, and include more things, and it's that connectivity. Cybersecurity need to adapt to that and make sure that is reasonable and adapt it to that, because otherwise you will start putting barriers, and the business will not happen. So it doesn't make any sense.

17:25

How does and and take us through the process. So I'm a company. I'll use the power plant. I'll just use that as the example. You come in. I realize that hey, I've got all these devices. Hey, I want to live that dream of pulling the data. I'm I'm doing all of that. That's what I want to do. Take us through your engagement. How would you work with me? How would you look at my operation and know that I got to keep doing my work? How do how do we balance that?

17:56

Well, the first thing is that there's no the magic resype for for that, the perfect solution that will work for you. Perhaps is not working to another company equivalent to yours in in other part of the world. Depending on many many different things, from the type of facilities that you have, the history they have, perhaps you build them in different ways. Perhaps you bought some assets from another company or merchant organizations, whatever. Also, the kind of structure you have in the organization affects a lot. It depends if you have, I don't know, a very decentralized organization in which every asset owner, because the facilities are big, has a big team, a structure, and and then you can delegate some responsibilities and help them, guide them through the through the threat actors, through the risk level you want to to have, or perhaps you are I don't know more in the renewables area, and you have a lot of very small facilities with no one working at them. This kind of understanding of your landscape, your structure, your constraints, and your kind of government will guide us into defining more or less an strategy. Hey, I want to be more centralized. I want to rely more on managed services. I want to organize areas because you have whatever business organized per country or per technology or whatever. And as I was saying, cybersecurity needs to adapt to your organization or change your whole organization to make something something work, and based on that, we have to go down into what are really the the risk, the the threats that we have, and how we can control it properly without. Getting crazy into the structure because you can spend infinite money and still don't make too much progress. So we need to understand what are the different scenarios and prioritize them based on the on the actual impact. It's not the same. So I was saying, if you have something that explodes, and then we need to make sure that this is properly isolated and nothing spread. If you have a lot of facilities, we need to make sure that any kind of cybersecurity problem can be isolated to one, not spread to the the organization. Those are the kind of things that we need to categorize in terms of risk and and impact, and based on that, for the different areas of cybersecurity, we we need to start making decisions of what is feasible, what is not, what are the different delivery models, and if for all your structure, there will be one solution, or even different ones, depending on the criticality of the of the asset. If you are a power generation, as you were saying, perhaps for a big thermical plant or a nuclear or whatever, you want to have some levels of security, and for some others, you may have another lower because you cannot do everything at the same time. So you have you need to categorize them, ensure that no risk is widespread, and then start rolling down security measures based on that criticality,

21:42

so you you come in, you you you you secure me. It's good. You you you look at all my assets, you look at all my devices, you look at all that connectivity, and you're saying, okay, got it. Here's a strategy. Connect. What is the what's the protocol or strategy going forward to ensure that you're protected going forward, because sometimes some people just say done. Um, and but there has to be this ongoing effort as you you you you reach that point. What does that look like going forward?

22:17

24:33

A question I would have, and and that's absolutely spot on. Love it. Sustainable. Who's responsible? We have an OTIT type of structure that exists in these organizations, and now that we're talking specifically OT, does it get handed off to the IT to manage that security going forward? How would you structure this business going forward?

24:59

Well. As I was saying, this is part of the strategy part of the beginning. There's no the one size fits all. It will depend on the structure and the organizations. There are organizations that are so OT that the IT part is limited, and perhaps it worth having someone the other way around, there are organizations that are critical businesses, even in the IT part, and they have a little part of OT. Others that are small enough to not have two different responsibles that are more complex to align. It depends. We have to understand who who really Is responsible, and how it lands, because the operating model may differ. Perhaps there's an IT guy creating some policies, and the OT guy adapting that to the reality. Perhaps there's an OT security guy, and then some operations that will be responsible for the activities. You cannot try to change the organization, the whole organizations to create cyber security, but adapt cyber security to the to the organization. So, deciding what's the best thing for a for a company is not is not easy every time. It it it it

26:22

isn't. However, I believe the success going forward is vitally important, and it's always a human equation. Meaning, who is that individual? Who is that organization? Who who gets it? And and I think that that's real important. That you know that that human conversation moving forward and making that happen. I have to ask specifically, and I've got my notebook here. If you're looking out on the video, I'm looking down on my notebook. Is the human equation meaning the question? Is is I get the technology. I get all of the great stuff. I get how it can deliver success and protection. Got it. How is EY addressing that human side of being able to say, "Hey, we got that OT component. We're we're putting new devices out there, but it always gets down to that human. How do how do we address that?

27:27

Well, we usually tell our clients that it has two different factors. One is that we should not try to move everything or not at the same time, and that the this is change management. So we need to make sure that we are not trying to create a big bang that changes a lot of things, and the operators do not know what they need to do in a certain moment, etc. It's better to go slowly and put the critical pieces, and make sure that everyone understands why and how. And in most of the cases, we can do that not from cybersecurity imposing changes to the OT operators that are the ones that make sure that the the process is working 24/7, but the other way around. For example, I was talking as an example in in asset management. We should not try to tell everyone, "Hey, there's a new asset management tool that the cybersecurity guys are bringing. Now we have to put everything there. No, no, no, no, no. The other way around. Hey, when you have a work order, where do you have it?

28:45

Yeah. Yeah. Is it

28:46

okay? I can bring those data to one concentrated point. I need one change because you're putting here that you are updating a software. Would you mind a new field saying which version are you putting in the in the system, and then having a concentrated point in which I have from cybersecurity all the information, but not trying to move how they do things because this will create resistance. It's a process that has been working for 20 years, 30 years, whatever, and

29:21

is perfect,

29:21

or it has been perfect for the thread Latin landscape that has been working for the past 30 years. I'm bringing a new thread. Yeah, I have to modify the minimum and include in parallel the things I need, not changing how they are doing because they are very good doing their jobs.

29:40

Yeah, you'll you'll get a lot of pushback on that because you're absolutely right. I've been doing this for 30 years, and this is the way we do it. I don't don't please no change, but but it's the reality of what takes place in the market today. Now, with all that said, go ahead.

29:57

If I can ask there. They will tell you, "Hey, have you been working? This has been working without a single issue for the last 30 years. But that's when when we enter the conversation and say, "Yeah, but nowadays we have different threats that we have 30 years ago, and we are preparing this environment for those new threats because, as you were saying, Scott, this has been isolated and now is connected. Now there's guys out there that earn money with ransomware, trying to get your data and you pay their ransom. There's foreign entities that are trying to get critical information from our country. There's a lot of things that are different, perhaps more in the intentional part because the random things that thunder lands in the facility and blocks anything is perfectly controlled. But we are working on these other threats that are a little bit different, and we have to consider because otherwise the impact is is very big.

31:05

It's huge, yeah. It's yeah, it's it's serious. I have to ask now this question: You're you're in the EU. There's a lot of regulations. What do you see from a legal perspective, laws that are coming down in working to protect businesses from a regulatory perspective. What do we what do we see that we need to be aware of?

31:33

33:54

So when you when you mention complexity, this is this is where I always fall. I'm a business. I do what I do best. I have this opportunity to be better. I'm going to take advantage of that. It's connected. You got. You are connected, whether you like it or not. Therefore, I need to protect that business properly and have the right individuals. And so, when I I always think, who who do I trust? It's a person. It's a person conversation. Who do I trust? And then and then with that, who could be my partner, my sherpa along with that journey? And what I see when we start talking about the technology for protection and what that looks like, and then from a regulatory perspective, and then all of the other stuff that's happening within the marketplace. I find companies like EY and others they they have the finger on the pulse of what's taking place. And for me, as an owner, let's say, all I have to do is just go there and get the latest because I trust you. You're. Kind of help me along on that journey, and I know that my my business is protected. So I sort of look at it that way, and that's that's what you bring to the table. Yeah, yeah,

35:08

that's what we are bringing at the at the table. When you are on a on a client, as we call it, when you are in our organization, it's very easy to focus on your problems or your daily routine and the business as usual, and you don't know what is happening there, how others are approaching, what are the regulators thinking. There's a lot of things that are outside your own organization that perhaps you are not not aware how technology is evolving, providers, etc. And we are lucky enough to have different clients, different conversations. We are close to regulators. We are close to colleagues from other territories that may be more advanced because that specific law has been transposed one year beforehand, and so we have some lessons learned. And this cybersecurity world is small in terms of people. If you go into OT security, even less. So having some comparables, some people to talk with, is very difficult. And even more, if you are talking about a critical infrastructure, perhaps even in your territory, you are the only one, or you are two that do something, and you need to bring experience from others just to listen. If the approach for a problem is more or less the same, to be able to defend to these external threat actors, it's important to be aligned with your sector, with your government, with your peers, trying to battle by your own, it will probably leave leave you in a worse state compared to others when you are facing the same the same enemy.

36:56

Yeah, you're not you're not alone.

36:58

You're you're not alone, and and the impact will be to the weakest of the of the chain. We have had samples these days in which they have jumped from a peer to another, or from one vendor up to the to the provider of a critical service. This is about protecting the whole environment, the whole sector. Otherwise, from one side or another, you will have a weak point, and from that, you have a potential impact easier than if more or less everyone has a coordinated position and homogeneous level. And one of the complex points, if they share some information,

37:45

yeah, it, it, it, yeah, you're, you're absolutely right. And you look at it from a macro perspective. You're saying, hey, if it's power generation, if it's utilities, if it's whatever the the sector or that market is, yeah, there it would be great for us to be able to know that that whole area is is protected. Now, one last question, and I and I and I we've gone a number of minutes not asking the question, but it's AI. How are you looking at AI in the world of what you do from an OT perspective? Just generally speaking, not diving too deep.

38:22

40:46

It is an exciting time. Truth be told, it's an exciting time. Every time I have a conversation with professionals like you, it always sort of goes, "Oh man, there's just so much going on. But for me personally, I'm bullish on AI from a perspective of cybersecurity, and then being able to handle make that tool work best for you to optimize that individual, that human side to be able to do and focus on things that are really critical. So it, I think that's it's an exciting time, and I think I'm I'm very happy or excited about how that's going to be used. If if somebody is listening to this podcast and they say, "Hey, I want to I want to connect with you, are you out on and does LinkedIn?

41:33

I think my surname Tascon T S C O N is strange enough for them to find me easily here in in LinkedIn, you can you can find me properly and happy to have a conversation with anyone. It's very useful also for for us. As I was saying, we need as a service provider frame. It's very good to to understand the problems and the challenges that all have. Hey, this thing that you said is not feasible for my project because whatever this is helpful and happy to have a conversation with anyone and share experiences and so on.

42:13

It always gets down to a conversation. Always, you can't you can't operate in a bubble. You can't in a back. You can't. You you've got to have, with the market changing so drastically, so rapidly. There's a velocity that exists out there. You need to be able to have that conversation with individuals that are definitely in the trenches and going through it, and sees and and and they're having conversation. It's important. So you're going to have to be able to just sort of have those conversations, not with an AI bot, but with a human being with the face and has skin and all that stuff. That's how I look at it. You were absolutely says you you were fantastic. I really enjoyed this conversation.

42:52

Thank you very much, Scott. I enjoyed that as well. It's very interesting how we struggle with you or hear you.

42:58

Yeah, as a former PwC alum to another former PwC alum, I'm thoroughly grateful. Outstanding, my friend. All right, listeners, we're going to have all the contact information for Caesar at Aunt Industrial Talk. So fear not, reach out to him again. Have a conversation. Start protecting your assets. You you want to live this dream of connecting all this, these these pieces of equipment. You need to protect it. All right, we're going to wrap it up on the other side. Stay tuned. We will be right back.

43:33

You're listening to the Industrial Talk Podcast Network.

43:38

All right, before we get into the conversation, I want you to be aware of a conference that you need to put on your calendar, and you have time. It is the Barcelona Cybersecurity Congress. It is necessary. You need to up your cybersecurity game. You're connected. You need to make sure that you're protected right here. This event, Barcelona Cybersecurity Congress. It is November 3 through the fifth. You have time November 3 through the fifth this year in Barcelona, and I'm telling you right now, the team at Farah who put this particular Congress on the best. You will not be disappointed, and you know what else you get to do? You get to network with some of the best cybersecurity professionals from around the world. You need to do this. You need to put this one on your calendar. All of the contact, all of the information is out on Industrial Talk. I'm going to be there. I'm going to be broadcasting. I'm going to be talking cybersecurity with the best in the world. So be there. Put this one on your calendar. That is November 3 through the fifth. I'll see you there. All right, that was Cesar or Cesar. Tascon on his email, he has Alvarez, Hurston Young leading the way. He's leading the way. He's gonna be at the Barcelona Cybersecurity Congress. Yeah, we're gonna have a conversation. I'm looking forward to meeting him in person because he's a hero. I'm looking forward to seeing all those other individuals that have been on the Barcelona Cybersecurity Congress podcast series on industrial talk in person because they're cool because they're doing stuff that makes you a success, and if and if it makes you a success, I'm all in because industrial talk is always going to look out for you and your success. It's a non-negotiable. You have to succeed. You have to prevail. Protecting your business is vital, along with all of the other stuff that's happening in the world of technology, the the efficiencies that can be gained, AI, you know, everything. It's a must. We're all in, all in. You know, you can take that to the bank. All right. Again, consider, think, make it happen. Come to Barcelona, hang out with me. Be on the podcast. Do whatever is necessary, because it's a great event, and you need to succeed. All right. Be bold. Be brave. Dear greatly. Hang out with Cesar, and you will be changing the world. We're gonna have another great conversation, so always stay tuned.