In this episode, we dive into the challenges of managing legacy operational technology (OT) systems. Join host Ken Kully, Cyber Tech Lead at Verve Industrial, and his guests Tyler Bergman, Doug Artze, Dylan Stencil, and Andrew Wintermeyer, as they discuss the complexities of legacy systems, spare parts markets, and the importance of security in maintaining older technologies. They explore real-world stories, the economics of keeping legacy systems running, and offer insights into potential solutions.
Key Takeaways:
- Legacy OT equipment can have extremely long lifespans, often much longer than typical IT hardware. This leads to challenges in finding support and spare parts as the equipment ages.
- There is a thriving market for reconditioned and resold legacy OT equipment, but the chain of custody and security vetting of these devices can be unclear.
- Maintaining documentation and access to legacy software/configuration tools is critical for supporting and troubleshooting older OT systems, which can be difficult as vendors discontinue support.
- The economic and operational costs of upgrading legacy OT systems can be prohibitive, leading many facilities to try to keep them running as long as possible through creative means like sourcing spare parts.
- Planned obsolescence by vendors and the lack of right-to-repair policies can exacerbate the challenges of maintaining legacy OT equipment over time.
- Visibility into the OT asset inventory and having a plan for securing legacy systems are important for managing cybersecurity risks in these environments.
Timestamps:
00:00 – Introduction and sound check
02:00 – Ken’s story: Decommissioning PDP-1184 systems
04:50 – Challenges with legacy equipment and backup solutions
09:00 – The aftermarket for OT equipment and security risks
14:00 – Securing legacy OT systems and ensuring safety standards
27:00 – Real-world experiences with aging OT infrastructure
39:00 – How cybersecurity standards affect legacy systems
50:00 – Solutions for managing legacy equipment
Guest Information:
Tyler Bergman: Experienced in utilities and OT security with over 20 years in the industry.
Dylan Stencil: Research team member with a background in technology and controls work.
Doug Artze: Operations team member with experience in nuclear power and wastewater treatment.
Drew Wintermeyer: Research team member and overseer of Verve’s internal labs of OT devices.