This is Russell Treat, and this is the Pipe Liners Podcast, episode number four. The Pipe Liners Podcast, where professionals, public eats, and industry insiders share their knowledge and experience about technology, projects, and pipeline operations. And now your host, Russell Treat. Thanks for listening.
I want you to know we really appreciate you taking the time out to listen to this episode and to show our appreciation. We will let you know about our prize pack. We are offering a free stainless steel Yeti Tumblr to one listener every episode. Here's how you register to win.
Simply visit pipe linerspodcast.com slash win. That's pipe linerspodcast.com slash the word when to enter yourself in the drawing. It's our way of saying thank you for supporting the show. So we're very fortunate today to have William Gage as our guest.
I had this distinct privilege of being able to serve with Will on the board of directors for the internet conference. And got to know him and had an opportunity to kind of cut him over to the side one day and say, Hey, so what it is that you do for a living? And frankly, I got to tell you, Will's got a really interesting background, particularly in terms of cybersecurity and skate and all that. So with that, let me introduce you to Will Gage and welcome to the Pipe Liners Podcast.
Russell, thanks. I appreciate the opportunity to be here. Well, listen, I appreciate you participating in being one of our early guests. So why don't you why don't you share with the listeners how you came to get interested in cybersecurity?
Yeah, so let me let me just start off by saying, you know, fortunate to grow in a household with a computer early on when I was able to start reading. I was learning how to do NSDOS, Windows 3.1, so that that dates me a little bit. But getting in through the middle school and high school, I had quite the active early career in in computer systems networking and things of that nature. But it really wasn't until almost out of college.
So Facebook, the wonderful Mark Zuckerberg invention brainchild, I signed up and was using a little bit and this was just, you know, right after college. And I was like, Oh, wow, this is interesting. All of a sudden stuff's showing up on my my wall board and like, wait, that's not supposed to do that. Come to find out your early early Facebook attack.
And so I kind of shut down my account and was like, Hmm, that's not supposed to happen. I guess I have to thank Mr. Zuckerberg for I guess him launching me into cybersecurity. And so from that, I've been working in the industry only guess, doing a myriad of different jobs.
So everything from installing meters out on runs, setting up vibration, pressure sensors on the compressors and various other equipment. All the way into actually changing out skater systems, doing help best email, the full nine yards networking communications. So I've had my hands in a lot of things. And early on, taking the concept of my Facebook exploration to heart is teaching others, Hey, we're all manipulative in some form of manner.
And what I mean by that is the social engineering sphere. And so I've, I've used that a lot and I think fairly successful in my career thus far. And of course, now I work for enterprise products partners in Houston, Texas. And we're a very large transplant transportation company.
And we've got about 50,000 miles of pipeline in my group. Its responsibilities are keeping the skater system running, always having the the uptime and availability for our pipeline controllers to operate that safely. First, and then secondly, to meet our businesses. You know, that's a lot of responsibility and quite a bit of that goes in with the cybersecurity perspective, managing all these users.
How do I work with all these people? Because you have people with basically no computer experience whatsoever, all the way up to people that work, work side by side, our department that are quite good at computers. And they're typically the most dangerous from a cyber perspective. Well, one of the things that I do is I teach a skater fundamentals class.
And when you talk about when you look at the things that cause system failures in the skater world, almost all of them are the lion's share of them, certainly are related to human intervention. Often it's people doing routine maintenance or jobs they need to do and something happens. Something goes wrong to get something wrong. In other words, a human error, human intervention that often causes skater failure.
Having the opportunity to read, you know, some of the intelligence and cybersecurity about what's going on in that domain. Just in the last few years, it seems like there's been a significant increase in the activity in the in the cyber domain. People just being more aggressive and starting to actually be more aggressive in the in the industrial controls. Are you are you seeing that in what you're doing?
Oh, absolutely. Well, let me let me back up and I say yes, I do. However, at least in my world, we have a lot of visibility because of the things that we put together. But I would say across the entire sector, skater and ICS vulnerabilities are drastically up just a numbers that because I have some of these memorized is I mean, if you think about an 85% increase in the vulnerabilities disclosed from 2010 or I think it's 2009, 2010 into 2012.
I mean, you went from somewhere in the 20 high twenties to almost I think it was 240 disclosures. And so, you know, definitely definitely seeing the trend of yes, there's a lot of confirmations and eye openers that are happening across the sector. And I mean, sector, ICS electrical wastewater, right, a myriad of other other other sectors that utilize this. The same world that we live in.
And there are brothers and sisters over there having just as many problems. But I definitely think that that with those disclosures, we've we've been quite and then try not to try not to jinx ourselves, but we've been quite good about being almost in certain areas ahead of the ball game. Right. Now, saying that I understand that there are areas where we're still lacking and I know that the entire idea of the next framework was to help incentivize.
You could have a benchmark. But again, I think that it comes into not setting a standard per se. I think it's everybody getting on the same page. Yeah, just for the listeners, I know that in a lot of these things, we start talking about technology.
This can get fairly jargony, if you will. ICS is a it's a common phrase. You see it used a lot more in the process industries than in pipeline, but it refers to the industrial control system in the pipeline world. That's everything from the, you know, the meter stations or compressor stations or pump stations all the way back through the computer systems and systems used to operate the pipeline.
And then you also mentioned the NIST framework. Can you tell us a little bit about what is the NIST framework and why should I care as a pipeline operator? NIST is a great kind of a great tool as I call it. It's a toolbox.
So you have 800, you've got a few pieces in there. 53 is the big one that I like to look at, but it all kind of comes to this. What are you doing from a cybersecurity standardization? Right.
So if I go look and it's the best of the best as I like to call it, you go through and you're like, OK, this is the best practice to do this. And that might be setting up a sandwich DMZ for controls and delegate responsibilities, at least privilege. And it ties ties in, I think, what's so good is for years, we have had sands and an API and INGA and a number of other industry leaders that said, you know, we're going to come out and make posture and kind of help everyone kind of reach a level of security that we feel that we all should be doing together since we all share the same data, since we are all connected together. And this basically takes it to the national level.
Yeah, I'm certainly no expert in cybersecurity, but I know enough about it because being a company that offers skated solutions and control solutions to pipelines, we need to be knowledgeable about that. One of the things that we participate in or I participate in actually is Infragard, which is a partnership between FBI and the public domain where the FBI shell shares threat intelligence with the public. They have a fairly rigorous process, you know, vetting people to join. I think you're probably a member of that as well.
Do you find that useful? I find that useful. And I also, more interestingly, I really believe that that sector of cybersecurity is really, really postured towards our friends over in IT and the internet facing domains. And especially in financial systems, I think it's the best.
Now, I prefer my friends over at ICS, I like to talk to them frequently in the week and keep up with things there because I believe, even though I know this information kind of gets disclosed through all these various government alphabet departments, I find where my relationship with the folks at ICS or even TSA, even it's a great partner from a pipeline transportation company. And I think that they're very keenly aware of what we're going through, of course. They have that understanding of what it is we do and why it's so important. Yeah, I think I think that's well stated.
And again, you're using a lot of jargon and I get it. I mean, I know what you're talking about. Some of the people listening to this might not. No, no, it's fine.
So what we do, what we'll do is after the show, we'll make sure that we take all these kind of buzzwords and organizations and such and we'll link it. We'll link them all up on the show notes page so that if this is something you want to know more about, you can go to the podcast website and the show notes for this episode and learn more about, like we'll say, the alphabet soup that we're talking about here. Yeah. The other thing that I know about cybersecurity is it's not just cybersecurity.
You mentioned something earlier that I think is probably a topic that's important to talk about and is really much broader than just by planning. That's this idea of social engineering. So what is social engineering and what would I need to be aware of to kind of understand and be prepared for that kind of security threat? Yeah, this is one of my favorites.
I have a good remembrance of thinking back on, okay, what really is social engineering and what are forms of it? I mean, I love social engineering. I like to tell the story of the Battle of Troy, right? What got built?
This big old freaking horse that was hollow and was holding, you know, troops and then they brought it and they're like, oh, here's a gift. And then, you know, everybody comes out while they social engineered that. They thought it was a present. So it's exactly the same today.
So various people are using methodologies engineering their way into you trusting them. That's really all it is. And so you could do that from a physical perspective. You could do it from a cyber perspective.
And I think that the two of those typically are the ones that I find working together are successfully attributed to a number of the issues that we've had in the past with cybersecurity breaches. From a perspective of how do I protect against social engineering is always train the people that work with you and for you. And I can't say that enough. I might say it again, train the people that work for you and with you because you need to take the opportunity and realize not everybody knows everything.
I mean, I don't even know everything. I am learning every single minute of the day, reading through material, going in and getting into places where I probably shouldn't say and just absorbing the information as possible as much as I can. And so from that then I take and I'm sharing with our skater folks, with my people, hey, think about emails, right? Oh man.
Oh man, you know, I got on and was on Amazon and all of a sudden I get this this email, maybe a day later, something just like coincidence, says, hey, your package is arriving. Go click on this link and you know, you can track your package. And I'm thinking, oh yeah, I was there and I'm going to do that. So immediately I click on that and because I'm used to shopping at Amazon and I didn't see anything wrong with that, once I click on that, I've immediately given that person trust.
And so with that trust, then I could download packages that could create a command and control, which means that now I have an opportunity to control this machine. And I can use this as a hopping point. It's like a beach head in the military. I think about the Marines a lot and they storm the beach and they get everything secure here and they're good.
And then from that point, they move forward and each of those is a hopping point. We do a training class in skater fundamentals in the last day of that class is on cybersecurity and a good friend of mine by the name of Clint Bo-Dunchen teaches a big part of it. And Clint is he's a cybersecurity guru and hit his thing, but he loves to do a sit in the lab and figure out how to hack. Yeah, I know Clint real well and I agree that's that's his passion.
For years, people said that, well, you know, there's no way we use Modbus. Nobody's going to be able to hack Modbus. And he downloaded some stuff off of the internet in a conference. And over the course of 30 minutes, he did a man in the middle attack by capturing Modbus messages and spoofing a host, spoofing, meaning tricking a host thinking I'm real and was able to overflow tanks while telling the host that everything's good.
You know, it's funny about that. I have no idea. What's funny about that is I have that all on video. Oh, yeah.
Yeah, I think he made a YouTube video that it's pretty bad compelling, particularly for people that think that this hacking stuff is hard. But it's one of the things is it's not really. No, I remember a guy. I wish I could find it.
I'm going to have to look for this if I can link it up. But there was a video of some guy sitting in an auto plant and the robots are going nuts and they're painting something on the side of the cars and then it cuts to a little kid who's on a laptop and watching this going on in a plant. And her mom says, Suki come to dinner and Suki is what's being painted on the side of the cars. Oh, yes.
Yes. Yes. The funny thing about this is that it's not like that is impossible to do. So anyway, so yeah, I think it's interesting.
The other thing about Clint and kind of this whole domain and to talk a little bit more about social engineering is one of the things that Clint used to do. He doesn't like doing this kind of work, but pretty lucrative. And it's one of the ways he kind of got anchored in the business. He did red teamwork.
I'm sure you know what that is. But listeners might not. Red team is where you hire somebody to hack your systems and get control of your control systems. And he was he was engaged by some, you know, some large companies.
If I were to put their names out, he would you would recognize those names. And I often ask people how and I'll ask you, William, how often do you think he was successful getting 100% access to a critical control system? Mm hmm. 110%.
Yeah, that's exactly right. The answer is 100%. So the issue was never could he? The issue was always what did it take?
And when it was hard, it always involved some kind of social engineering, either directly with people, you know, where I managed to get into the control room when I shouldn't be in the control room and, you know, shove a thumb drive into a workstation or whether some other kind of process. But but when you combine creative social engineering with creative programming, you know, cybersecurity is just like, you know, putting walks on the door of your house. You know, it keeps the honest people out. If somebody's dishonest and they want in your house, they're going to get in.
Yeah. If you put locks on the door and do things that are appropriate, then they're probably not getting in kind of the same thing. I think. No, I agree with that.
It's interesting kind of a quick tangent on that is realizing that when I first started getting in and going, oh man, these flash drives, right? We're called jump drives and flash drives were like the cats me out, right? And then about three months into it, when I was one day I put an executable on there and I ran it off the USB and I didn't think about it until I went, oh crap. And then I was like, USB's are from Satan.
Now it's another tech vector and you're like, oh, how do I say myself? So exactly. So I'm going to disable all the USB ports on all my computers so that I don't have to worry about thumb drives, right? Yeah.
And I know people that put hot glue in. Yeah. Yeah. Yeah.
I mean, in things that have access to critical control systems, a lot of times that makes sense. And yet, you know, people that have to work on those, it's like a lot of other things. When you know enough about it, it starts getting really complex and fairly difficult. I think if more people read the intelligence of the threat and what's going on and the kind of things that are occurring, there'd be less resistance to complex passwords and difficulty in accessing control systems and all that kind of stuff.
I know that all that creates obstacles for doing our daily work, but they're, they're important obstacles. Yeah, absolutely. We always have a saying, or at least maybe I have the saying. And that is cyber security really doesn't need to be the kiss mentality.
But more importantly, it's always about availability. And that's where on the opposite side of the wall, and I call it the opposite side of the wall from our brothers in IT is our triangle is a little bit different, right? So we're always keen to make sure that the system is available. It's always, it's always a safety thing for us and availability helps that a lot.
And then we're concerned about the integrity of the data and then we're concerned about the security. And so with that, we always have to think in the back of our minds, OK, as long as I'm not going to create an opportunity to take the system down and the data is good, then I can do this work. And so in our area, it really kind of keeps things fairly straightforward. We don't have a lot of jumps and things we have to worry about.
But on the flip side of that, it does have some exposure, does have some risk. But if you were looking at it from multiple attack vectors, if you're looking at it across the scale, there's a solution for each of those pieces that is that can simplify your life. So patching, you know, things of that nature. Well, yeah, you might have to do some things manually to get them over.
But there are also areas in the world where we're like, yeah, we need to do some automation work because we've got so many machines and we know that we can do these things without, you know, affecting our availability. So, you know, I haven't heard it put that way. I think that's actually really important because one of the things that's unique about control systems with critical infrastructure like pipelines is the availability because they're absolutely necessary to protect people, to protect the environment, to ensure safe and continual delivery of product. It's a big deal.
So these systems have to be up. They have to be available. If they're not, there's pretty significant can be pretty significant consequences. Before we leave this broader topic of cybersecurity, I do want to ask you about one of the things I think it'd be appropriate to talk a little bit about standards.
There are a ton of cybersecurity standards that are out there. ISA, there's NERC CIP, you've got the NIST framework, API 1164, and on and on and on. How do you approach that kind of standard soup, if you will, in order to figure out how to do a program that's, like you said, keeping it simple. Oh my gosh.
Okay. So that's not how much time do we have to talk about this, right? Yeah, all right. That's loaded.
So for everybody listening, because this is one of my favorite things to do is I like to and I shoot these out all the time to people. So ISA, ISO, IEEE, cryptographic protection, you've got API 1164, BSI 100, 1 3 4, you've got C and SSI, you've got NSS. There's NERC, there's SP 800, there's. You're scaring me because you know all of this all right off the top of your head, or you're wearing me a little bit about what you do with your free time.
Well, yeah, we'll talk about that. So we'll talk about later from a perspective on standards. I think that really standards are guidelines. And what I mean by that is you have to know when a standard is right for you and the standard is not right for you.
And I think that everybody goes into this the same way. And that is, oh my gosh, it's a standard. This is what we have to do. And that's not the case.
Really, you need to have the opportunity to sit down with the standards and really go through them and say, yeah, you know what, this all makes sense. I look at it and I say, really standards are a set of guidelines that we use to create our own program. And underneath that program are our policies and underneath our policies are our standards. And from those standards, we have procedures and guidelines and all the other, you know, documentation that we need.
It's all set up in that perspective. You need to take the opportunity and utilize all these various tools. They're tools. They're nothing more than tools.
Yeah, you know, and you know, obviously, enterprises is a large company and you guys have resources beyond what many of the companies that we work with. We tend to work more with the smaller pipeline operator, smaller midstream guys, the guys who don't have the resources to have a staff that full time is doing all this type of thing. So it's a real challenge to help them kind of get their brain around it. Because again, I think you make a really good point, Will, that mindset is, well, if we have a standard, we ought to follow it.
But cybersecurity is one of those areas where the standards are ubiquitous, maybe is the right word. There's a lot of them. And you really need to go through them. You got to rationalize them and figure out how you're going to apply them.
And it becomes a trade off between risk management, availability and complexity. And there's actually value to the industry that everybody does that a little bit differently. Yes. Because it actually makes the industry hardened to the nefarious actors.
Yes. Because, you know, not everybody does it the same way. Then if I figure out one, I figured out everybody. And there's two pieces I'll bring up real quick.
And that is best practices aren't standards. They're they're also, I feel like guidelines as well, of course, but they're they have more, I believe, meet in them than standards do. I know a lot of people would be like, what? Well, that makes no sense.
But in reality, they do. They really get in and talk more about the why and how's. Yeah. And I think that that's important.
A great example, sans 20, those top 20 critical controls. And I like that because that's the that's that's what that's exactly what you're saying is. So here here's my 20 categories and I'm going to try to find technology that meets those 20 categories. I'm going to have a bunch of different types of technology from different vendors.
And I'm going to achieve my OK, I'm meeting that and I'm building my program off of that. Yeah. I always like to say this. I'm a sandwich DMZ between control systems and the corporate world.
That's just my philosophy. I've always thought that and I feel like it's a little bit safer. However, I also find that it's important to think and consider, well, if my two firewalls that are in my sandwich, they're their Cisco products, well, I didn't make it any more difficult for a person to hack it because the one person that knows Cisco is going to be able to get through those. Now, if I make one of those like a juniper product or something else, Palo Alto, then I've effectively said, huh, guess what?
You only know Cisco. You only made it that far. Now you got to figure out the rest of the world. And by the time you do, I'm going to be able to throw you out.
That's it. Again, that's really interesting to me. So I understand what a sandwich DMZ is. Basically a sandwich DMZ is a area that I want to keep secure and there's two way, two paths in and out, you know, the internet may be being one side in the corporate network being another.
And I'm kind of in the middle of those two things. And I've also heard of defense in depth, where as I take my network and I firewall it and stack it so that, you know, the skater servers are firewall from the radios that are firewall from the PLCs, that kind of thing. What would you call having different kinds of network gear or different kinds of product? Is there a, the use cybersecurity dudes have a name for that as a strategy?
What would I like to call it is I like to call it ain't nobody know everything? Yeah, you're using complexity as a tactic. Yeah, differentiation of product, absolutely. Yeah.
Yeah. Because someone might have the skills to go do one thing, but they don't have the other. Yeah, again, that's a, that's a really interesting observation. I want to kind of shift gears on you, if you will, and talk about something else.
It's kind of a passing of both years in mind. And that's what you do with your church. We had talked earlier in the week, we were kind of visiting about doing this, about, you kind of having a vision for cybersecurity for churches. Why don't you tell us a little bit about that and what you're doing there?
Oh, yeah, absolutely. Being involved with, with my faith in my church and things that I do on my second job, if you will, I'm always here at the church doing something technology wise and helping out where I can. But I was coming over the church just to make sure that everything was ready for Sunday and looked over at our announcement machine, which runs and does all the slides for the entire building and, and everything. And noticed, oh, that's weird.
It's not running. So pull it up, the application up looking at it going, um, this doesn't look right. And sure enough, I go look at the server and the server. Had been ransomware.
Um, and, and it was my favorite because I could look at it and I could, you know, at the top of that directory right on the main mount was that file that was, that was so clear as day, like, uh, hey, we are protecting your files, uh, pay us and, uh, we'll, we'll get rid of the bad guy. And, um, is my favorite favorite thing to ever see in my life. I've got, I think I've got, I've got a copy of it and all sorts of stuff, but for a church to be hit like that and you think about churches don't have the resources to handle this. Luckily, my church, um, they have me and, and because I can't be here all the time, we actually have a company that helps us out.
And so, um, they're really good at some of this stuff too. And so I'll help them with them. And it took almost two weeks to get everything back where we needed to be because of that. How did that, you know, I've realized, wow, you know, that something really needs to be available to churches and faith based organizations.
And so from that, I've actually kind of started a little something called white hat church. Um, it's white hat church.com and I'm getting ready to start a podcast and solution based, um, white papers that will help take pastor Steve, who basically knows how to work as laptop. And basically give him three really simple straightforward things to do to increase your security posture as a user of, you know, whatever it is you're doing. And it's going to scale up, not really becoming more technical, just scaling up on the, what I would like to call protection level.
And so we start with training staff to the point then where I can move to the next level and say, okay, now that you kind of understand your posture is better. Now let's talk about some additional fundamentals and how can we help? And so right now my focus, you know, not focusing on money or anything like that, it's solely to help give churches resources that they don't have access to today either because of financial reasons or just because I don't know where to go. And I think that it's important because I know a lot of churches are heavily invested on the cloud and I know in the ICS world, oh, the cloud, oh no.
But the reality is is Facebook is the cloud and we use it for all sorts of things. Twitter, Instagram, SoundCloud, we go on and on and on. My church, we moved quite a few things over to like Google Drive so that we have access to some of those very critical things everywhere we're at. And so we don't have to have nearly the infrastructure.
But with that also comes the responsibility of understanding how do I protect the membership, the pastoral staff as well. So my goal with this is really to really help train pastoral staff and tech staff and whomever else. I mean, you don't even have to be on staff at a church. You just really care about your church and you want to do this for them.
Hopefully this will really grow into something. I think that's awesome. Well, I really do and certainly I have connections fairly active at my church. And when you when you start getting this a little further down the road and you're looking for some other people to take advantage of it, please let me know.
I'd welcome love the opportunity to help kind of spread that word. I think that's awesome. We're talking about cyber security. I tried to be pretty hard as an individual, right?
In terms of hard to get access to my stuff. And I had an issue just earlier this week where somehow somebody got access to Facebook messenger and started using my account to send emails. And I went through a process and I cleaned it up. And I was lucky that some people told me it was going on or I wouldn't have known and was able to get that cleaned up pretty quickly.
But software as a service is a great idea for things like churches that don't really want to invest in not so much, not have the infrastructure, but don't want to have to maintain the infrastructure. So they're moving to the software as a service model and they're becoming more reliant on Facebook and social media to execute their mission. And that does create risk. So I think that's awesome.
Well, look, we've kind of come to the end of our time. I'm definitely going to ask you to come back. I know that there's other subjects that we could talk about in terms of high performance, HMI and alarm management and some other things that I think our listeners will be interested in. But I think we probably buried them in enough buzzwords and jargon for one episode.
Well, look, again, thank you very much for being our guest and we look forward to having you back into all the listeners. Thank you for listening. Just a reminder that you should go to the Pipeliners Podcast for an opportunity to win a Yeti Tumblr with the Pipeliners Podcast logo and blazin on the side. Simply go to pipelinerspodcast.com.com.com.com slash the word when to enter yourself in the drawing.
Thanks for listening and we look forward to having you here next time.