In this episode, Marcus Seibold and Dr Mohsen Seifi interview Brad Keselowski, the founder of Keselowski Advanced Manufacturing. Brad discusses the pain threshold and the need for corporate cover fire in AM, especially when tackling friction points for buyers and programme managers. He explains the delicate balance needed to achieve specs for creating the most cost-effective parts and how to improve confidence with the digital workflow. Siemens Energy is the series sponsor.

In this episode, sponsored by Siemens Energy, Marcus Seibold and Dr Mohsen Seifi interview Vishal Singh, Co-Founder and CTO at Link3D. He covers how to scale the AM business, minimise the risk of production and maximise output by applying learning from the software industry. These lessons give insight into the best economic, business, and cultural practices needed for success in the AM industry.

Success in Additive Manufacturing goes beyond technology. It encourages new ways to think about business governance. Sponsored by Siemens Energy, Marcus Seibold and Dr Mohsen Seifi invite experts to discuss the economics, operational constraints, and the role of culture in creating a successful AM business. Their first guest is Neil Mantle, Director of Manufacturing at Rolls-Royce, with whom we shall delve into the issues around AM with his banker concept and his views on how to build trust and confidence.

Tom Kartanowicz joins us and shares his thoughts on CISO Reporting, Prioritization and the evolution of the CISO journey.

Christine Vanderpool is an Executive Board Member for Cyber Security Hub. She was Inteligenca’s 2019 Woman Cyber Security Leader of the Year and Molson Coors’ CISO before being whisked away to the world’s larges sugar cane refiner- Florida Crystals (which includes Domino Foods).

So Christine is certainly an excellent current example of a CISO. Her company is an industry leader, she’s the ultimate cyber security leader at her organization and she’s winning awards for her work. But her background doesn’t add up to what we once understood as a good example of a cyber security leader. She doesn’t have any military experience and “well, I'm definitely an extrovert.”

It’s safe to say that the ‘old guard’ of cyber security leaders is not a group of extroverts. “I love to use analogies and storytelling. It's really important for me that my user community, my executives, my leadership, they understand what it is that I'm trying to do. They don't just blindly believe me because I'm scared the bejesus out of them, but they actually get what I'm trying to tell them. They understand what our risks are. They understand how I want to mitigate those risks. And I try to do it in ways that are appropriate for our business at hand.”

In describing her mission, Christine doesn’t use the word technology. And it’s not because she’s some marketing person- her formative years were spent with IBM, Hitachi and SAP technology- she’s a technology person. But she realizes that just talking tech won’t get the job done. As noted, her job is for her stakeholders to understand what she is doing.

The Cyber Security Hub Mid Year Report showcased the fact that budgets are mostly flat or down. If Christine was arguing for budget, tech first- she would not find success. Her executives and leadership understand the risks and how to mitigate those risks in a way that’s appropriate for the business because she’s made the business case.

“I'm not going to buy the latest and greatest gadget just cause it's really cool, if we don't need it. My philosophy is you could take that same budgetary funding and use that on a say marketing project or a product development project that is going to increase your revenue. If your revenues increase, then my bonus increases. So I'm not stupid.”

She says she’s not stupid- which of course, is obvious. But that statement actually shines a spotlight on her brilliance. She’s going in to budget meetings and telling her leadership to spend money on product development and marketing based on the confidence she has in the business case she’s made. She is not worried about losing her needed budget.

And there’s depth to that doctrine. She does things “that elevate and help the business is rather than just saying no.”

As the interview with Bob Turner informed us, she’s leading the Department of Know, not the Department of No.

When asked if she’s a BISO- a Business Information Security Officer with a CISO title, she responds, “I wouldn't have a job if, if we weren't doing what it is that we do as a company. I work for a consumer packaged goods organization. So I need to always remember that that is the purpose of why we are here. We are not here because of security. We are here because we make a product that is sold to consumers. And that should be the focus.”

Bob Turner- a friend and Board member of the Cyber Security Hub- as well as the University of Wisconsin-Madison CISO - was kind enough to make some time for an interview. The following is an overview of the past, the present and perceptions of the future cyber security reality. 

The University of Wisconsin is a research one level university with about 23,000 staff, roughly 44,000 students during the normal part of an old-normal year. This number jumps to a total of 80,000 users overall, when considers affiliates and ancillary personnel which means roughly a hundred thousand end points. Thus Bob notes that the University has a large amount of important research.

His resources are focused- he's got 38 full time staff with about 20 students that are supporting governance, risk management, incident response, vulnerability and what they call the common system Cyber Security team- which focuses on the big ERP-type systems, HR, Finance and Student Information.

During the March, 2020 migration off-prem- Bob's team was responsible for protecting that research, rolling out the BCP and moving 3,700 classroom courses to online delivery- to name a few initiatives.

The BCP did in fact roll out well- Bob was happy with the team and confident in the execution, “the X factor, I think, was trying to understand how many of the different collaboration tools were out there and understanding about those tools that we may not have looked at very close in the past. We had to do that on the fly and we had to do it rapidly.”

It was confirmed for Bob and his team that ‘the past’ was secure. There were not issues in rolling out the business continuity plan, which was secure. There were not issues with the systems in place, which were secure.

The team continued with business-as-usual, “daily security routines run a playbook and a SOC and the regular pattern and pace of risk assessments and policy management, as well as trying to ensure that our users are aware of issues.”

Now 100% remote, with business-as-usual going smoothly, on a dime- ‘the present’ presented a threat matrix, which could not have been anticipated based on the fact that a 100% remote global workforce was not anticipated by anyone.

And so Bob and the team “had to put together a provisional policy on how to manage collaboration tools: What do you record? How do you record it? What type of data can you talk about over the air? Do the solutions have encryption in transit and encryption at rest, and is that encryption a suitable standard?”

As Bob tells it, beyond collaboration tools, “COVID brought with it a whole bunch of fun, little scams, a lot, a dramatic increase in the phishing attacks, business, email, compromise attacks and anything social engineering happening in real time.”

With digital machete in hand, Bob slashed through all of those new issues to ensure that he and his team could take a step back and have a big picture focus on what he’s always focused- people, process and technology.

With a big picture focus on people, process and technology- technology could be construed as your tools and process could be construed as your tactics. Tools and tactics can be improved or replaced to fit better with a new reality. But changing people is a more delicate and more gradual shift.

“If it's face to flat screen, not face to face, we need to be able to see the person on the other end and understand if they're stressed or if they're, calm and cool and collected. It's about listening very carefully to those indicators. We have staff who are spending part time as parents which means part time as a teachers and part time as the custodial staff in the house. And, and then they're also working for us.”

“So the eight-hour workday is not contiguous. We have to make sure that we're compensating for that appropriately.”

Truly understanding the human dynamic on his team is only the beginning. Bob is focused on understanding what each user needs and ensuring that user can appropriately and flexibly do their job with his support. He knows that his job is to ensure access with security. If he blocks access, the user will simply work-around with no security. As the future is now, he knows he cannot make decisions that negatively impact the work of his hundred thousand users. He has to be “thinking as a business enabler.”

The department of no must become the department of know.

During this digital summit panel, Suresh Chawdhary, head of security & privacy for Nokia, stresses the importance of a layered, multi-pronged cyber security approach to best protect from phishing and whaling. This layer defense mechanism moves away from a one-size-fits-all strategy, ensuring that everyone across the enterprise is well equipped to stay protected against threats.

1. By baseline testing employees for their susceptibility to phishing, an enterprise gathers statistics and builds an actionable and measurable improvement plan. Even within this layer, different departments are responsible for different deliverables. That means that malware threats and other vulnerabilities will affect separate industries and divisions within that industry to varying degrees. By customizing phishing tests—much like bad actors do—a holistic and accurate pattern emerges.
2. A second layer is to have targeted training sessions for employees so that they understand what is anticipated and expected from them, how to report phishing attempts properly, and how to make sure that they are not processing payments or sending these kinds of sensitive personal information on emails when they get these kinds of emails.
3. A third approach is targets key executives. Suresh warns that this can get tricky. Leadership team members are often global, meaning they’re traveling frequently to meet customers and vendors or participate in seminars and conferences. They also have a multiset of technologies at their disposal. With all these touchpoints, it is difficult for a CSO or an information security organization to inform executives of the varying degrees and types of risks. In this case, Suresh suggests relying on proactive, reactive, and detective controls to safeguard them. Because awareness alone doesn’t cut it for these busy individuals, multifactor authentication mechanisms and email encryption are a must. For example, a two-factor mechanism for approving invoices through email mitigates risk considerably.

Finance and HR employees are particularly vulnerable due to their payment processing duties. An email spoofing the head of finance or the CEO may expertly convince an employee to urgently transfer money at the click of a button. The possibility of getting that money back is nearly zero. Additionally, HR has a massive amount of sensitive data at their fingertips. Data is the new oil in the cyber crime industry. All it takes is one slip or a single lapse in judgment for a breach to expose personal data so sensitive—such as credit card and social security numbers—that it creates a lawsuit or enough bad press to devastate an organization.

Examining the big picture and important factors of an organization helps build a plan that fits the company in terms of cost, risk profiles, and the size of the organization. Considerations may include:

• Cloud service encryption packages
• Appropriate number of training sessions per year
• Regulations and limitations of certain technologies across different geographies

A security plan isn’t going to be the same across an organization. Still, there are certain baseline technologies that build the foundation of security—namely an antivirus solution and a personal firewall for every employee across the globe. While email encryption is a nice-to-have for all employees, it is a must-have for people who are prone to whaling attacks, including the C-suite and leadership team. Other departments to keep in mind for customized control mechanisms are finance, HR, legal procurement, and suppliers. It is important to have a combination of proactive and reactive controls when dealing with these hidden enemies.

The obvious goal to a phishing or whaling attempt is an immediate financial gain. However, an advanced persistent threat can do much more damage. In this scenario, a bad actor gains access to an organization’s network by confiscating credentials. Once inside, they can find and extract data while remaining undetected for long periods of time. Of course losing money hurts, but the loss of IP like propriety algorithms or software can be a nail in the coffin.

Suresh estimates that only about half of all organizations have a solid baseline of security, although that estimate goes up to about 80% for middle and large sized companies. Unfortunately, too many companies make significant investment into cyber security reactively. The ROI and business case for a primary, proactive cyber security strategy often isn’t obvious until it’s too late—that is, a breach has occurred. It is a CSO’s job, then, to build and communicate a strong business case around why a security technology investment is worth it.

Also, while training is a worthy and necessary investment, humans are only human, and phishing and whaling attempts will sometimes work. That is why a CSO must argue for build-on reactive honeypot technologies.

Honeypot is a security mechanism that deploys within a network and spots malicious traffic patterns in an out of the network. Honeypot can be set up to divert traffic to particular devices that slow the traffic down and even forensically investigate the source, destination, and the TCP or UDP port numbers. It identifies the types of files and time of the breach as well.

Suresh closes with a reminder for CSOs: they are responsible for not only protecting and safeguarding critical information assets, but also to mitigate these kinds of threats that might be underpinning on certain specifics or functions. Beyond security talent, management and business skills are required.

During this digital panel session, Jim Brady discusses real-time change in incident management. His extensive experience in a multitude of security roles throughout his career means he has seen a lot of changes in the healthcare cyber security field. Naturally, the latest change to make its mark is the new remote work environment COVID-19 has deemed nececessary.

In the past, incident response plans are created and workshopped on location—in the case of healthcare, at the hospitals, command centers, etc. Now, with most of IT, the administration staff, and even doctors working remotely, new considerations must be taken.

Now that vendors, legal counsel, and staff are working from home, are they vulnerable to new threat actors, or are the bad guys giving healthcare a break during this global pandemic? Unfortunately, opportunistic phishing scams are increasing as the world is combatting COVID-19. For example, some phishing attempts run under the guise of PPE equipment vendors.  

Additionally, while telehealth works as a good alternative to in-person doctor appointments, is it secure?

A well, executed cyber security incident has the possibility to severely disable or even take down organizations. In the healthcare field—especially during this time—it is imperative that hospital doors remain open. CSOs are especially on alert for the following three threats:

1. Data breaches
2. Ransomware and wiperware
3. Medical device and IoT tampering

There are a few key things CSOs can do to effectively mitigate these areas of vulnerability. The first challenge is managing the environment remotely now that key security staff is working from home. System access needs to be the same as it was onsite. Home networks require an appropriate amount of bandwidth and the right VPN access must be granted. Home workers need the proper security for their home router firewall.

A holistic cyber security plan not only works to prevent incidents but respond to them as well. In the way that fire departments educate on fire prevention while also maintaining the ability to put fires out, responding quickly to a breach is imperative. For example:

• Knowing who to go to if a critical IT system needs to be shut down
• Knowing who the decision-makers are and having their contact information up to date and accessible
• Creating a communication plan across departments that includes at-home employees’ contact hours and preferred forms of communication.
• Keeping contact methods such as video chats on secure platforms

Architecting a command center is difficult enough on prem with a team. It has only gotten harder with everyone spread out remotely. A communication grid helps clarify who communicates what to who. The C-suite needs regular high levels of communication. Clinicians on the front lines delivering care need access to the technologies that are required to do their jobs. Educating the administration staff on how to stay safe at home is also imperative. These non-technical positions are more prone to insecure home network and firewall setups. BOYB devices must not be used by family members or left insecure. All of these things need to be considered when developing an incident response plan during this pandemic.

The health and safety of employees is also tied closely into cyber security. For example, is there a contingency plan if a large number of IT staff get sick? Are hospital-issued laptops and repurposed IT equipment disinfected properly? Are vendors shipping safe goods? If a cyber security attack affects technology tools at a hospital, who retrieves that device for forensics purposes? Do they have protective equipment to keep them safe? All of these considerations must be a part of an incident response plan.

The business and IT side of healthcare banded together and willingly risked their health to set up the technological side of medical tents and drive-through testing. Jim considers the possibility that such a positive and efficient crisis response will set an impossible precedence in the future.

If ever there were a silver lining to Coronavirus, long-term healthcare changes going forward may be it. Traditionally, healthcare is an industry that lags behind in technology adoption. Telehealth--a method of healthcare that brings down cost and increases patient satisfaction—will be the new way forward. Jim expands on this idea before answering live-audience questions.

Jamal Hartenstein is prior unified security management (USM) in military intelligence. He’s worked with the department of defense on military bases, as a part of joint task forces and has experience with every branch of service. He’s helped with cyber security and data privacy initiatives for hospitals, federal agencies, pension funds and other private sector industries.

Jamal is wary of thinking that everything was ‘wine and roses’ prior to the global pandemic. He’s aware that some organizations had it right- they were leading edge thinkers as far as cyber security. But most organizations were (by definition) not best in class. “The reality was that the threat vectors were more so contained within an enclave or an enterprise of a known like end points. There was easy to wrap your head around BYOD or CYOD policy. There was a CMDB [configured management database] that was probably accurate at one point but that’s if you were a mature enough organization.”

And so even if you’ve gotten to today without a major breach Jamal points out that with a completely new and 100% remote technology stack, “there is not an understanding of what data is entering our enclaves or enterprises.” He quickly follows that there is also not a complete understanding of where it's entering from via what equipment. That ‘completely new’ terminology is not for all, but it’s for most as, “not every organization was capable or mature or had a sophisticated remote work toolkit in place.” This has all lead to a threat landscape that has “expanded exponentially.”

It’s not that Jamal’s outlook is bleak; he’s just concerned that those that have not been subject to major incidents do perhaps not understand the past correctly which means that they’re not dealing with the present with a suitable approach.

He focuses on a would-be executive who feels that they remain prepared for CCPA or GDPR because they just had an assessment done in January. “Well in January, your work from home workforce and your threat landscape was dramatically different.” Beyond dealing with the traditional issues associated with a breach, “the settlements and fines and fees or payouts after data security, breach litigation are oftentimes much more than the cost of remediation or mitigating audit findings or a Cyber Security assessment.

Jamal’s industry assessment is that there are some that have not felt the actual tectonic shift that’s occurred for humanity and thus, cyber security. His point is that everything is different now- whether you feel it yet or not.

And so, with that understanding, he parts with...

• Investigate new forms of data protection
• Ensure you have multifactor authentication
• Focus on encryption at deeper layers in the OSI model
• Realize the protection data in transit and data at rest
• Revisit your mitigation factors

The bottom line- prepare yourself to address the new threat vectors on your new landscape

Robert Welborn is the Director, Data & Data Science for General Motors. As he sees it, global corporate enterprise has- for the most part, seen data as a luxury, “we'll get to reporting when we get to reporting, we'll upsell, we'll monetize.”

Not that monetizing is a bad thing, but Robert’s point is that we haven’t been using data as the ultimate element of decision-making. Sure- data-driven decision-making has occurred, but not to the extent of managing enterprise existence.

The global pandemic had a particular effect on Robert’s company. For over 100 years General Motors manufactured motor vehicles. Then on April 8th, 2020- General Motors became a ventilator manufacturer. What used to be a fun data dance that Robert and his team would do privately suddenly became precision choreographed ballet of the highest order with every decision-maker involved.

“What we had used as a luxury before suddenly was driving everything. We're having conversations with our suppliers, with the UAW and with the plants showing them through data what we're going to do next.”

And the data told them just what to do. Robert and his team were seeing vehicle-level data as the pandemic burst across the globe and made it’s way to the East Coast of the United States. “The data is saying we can shut down. And the data that we're getting from the state of New York in specific is saying that we, if we were doing anything right now- we should be building ventilators. If there's anything that we would do, we should build insulators and we should build masks.”