Forescout CEO Barry Mainz on Operational Technology and Cybersecurity

hi I'm Jam Maguire here at the RSA conference with Barry man's Chief Executive Officer of for scout very very good to talk with you today you as well thanks for having me all right so I'd like to talk about operational technology but please first tell us about fores Scout what does the company do how does the company serve its clients okay good question um so simply this you know we provide the ability to take a look at what assets are on your network M you can classify them tell you what they are what version of Something uh we help people assign risk to that so based on the behavior is there a risk profile you prefer or not prefer we give them the capabilities to detect and respond and then we have control hey if someone comes on the network we don't like what we see we can say block them put them down a segment what have you and we do that for not only manage devices but what's turning out to be really exciting and we do that for unmanaged devices without an agent so that could be OT devices or iot so there's certainly a lot of buzzer on operational technology what do you see as the key trends driving the sector these days so I was kind of think that when there's um risk there's complexity and maybe you have government regulations coming in right there's an opportunity and with the 4-day disclosure that came out in January the government saying hey you have to disclose for breaches not only for traditional it device also OT and iot devices um we see at the federal government in you know Europe and within un doing the similar thing so um it's driven you know I go and talk to cisos or Executives and O iot first thing on their mind hey what do we do are we protected from it can you help us with this kind of thing so it's top of mind so if companies come to you and look for advice and how do we handle our OT what sort of advice do you normally give them well we if they're current customer we say you came to the right place because it's just an expand of what you currently have and let me tell you how the strategy works and with really is compelling is we don't have to install an agent cuz they're all worried about like some of these devices you can't put there's no USB stick to install something so we do it with technology um kind of our liquid agent that we do it based on looking at traffic and information so that's the first thing we say hey we can help you came to the right place it's an add-on if it's a new customer let's say you're like a very large uh grocery store change sure maybe the second one largest one that I met with today and I tell them hey well where are you on the the the chain are you you know just kind of starting with asset and just you know kind of uh disclosure and you know kind of uh um risk assessment and then usually start there um and they say hey I just want to know what's on the network give me a risk profile we walk them through a buyer Journey we have a very specific buyer Journey that we walk through they tend to start there with the end up being control and then we talk to them about hey you know an asset's an asset to us we can do both OT iot we have different reports that talk to OT people if you need to to and um you know we can kind of get a vision match on where they want to start and tend to kind of be a pretty nice uh rinse and repeat for us is this normally uh large Enterprise midsize what what are the company say typically um most of our Revenue comes from large the largest to be fair um Enterprises whether they're public or private cor I mean that's 80% of our our Revenue sure okay let's drill down into the fores Scout product offering what sets for scout apart from its competitors so I you know we've got a traditional um netc product right so it's Network segmentation and management so we can give people policies on hey you have a a set of policies on what you want people to abide by to connect and we make sure that those people will comply okay and that's our traditional Pro we also have uh products that can are very specific towards OT and iot so um it's you know have the right users use use cases have the right reports because reports are different for iot and OT then let's say a report might be for traditional PCS and you know how you look at things how they want to look at them this kind of stuff so um we provide you know specific uh platform for OT and iot um and then we have our uh ecosystem connectors that we have that allow people to partner with through software work with different partners to do things like let's say um we we have a a connector that interfaces with all the Cisco hardware and if you have Cisco and you have let's say um P the networks we can do both all heterogenous right so we have the the ecosystem connectivity all right Barry let's go ahead and take a look to the future I mean what do you foresee in the in the near to midterm future say two to four years out where is cyber security going and most important how can companies get ready for that now yeah so um it's going to sound kind of corny but at first I think it's just education oh right that there's there is there are solutions out there um if you look at the people that are managing operational technology they're very different than the people that are managing it or information technology so I think there's an education on how do you look at uh uh a secure and control device what is the difference there just I'm just curious yeah most of them have backgrounds in building things and mechanical things and they know how to work with you know infrastructure and pieces let's say if you're work for a power utility there's a lot of manual things that have to happen you know versus virtual things sure um I also think there's or structure changes that we're starting to see because in a typical organization you have the it folks they report up through siso what have you right and there is a OT it but that often reports up to the COO or something different and we're starting to see some structural changes on we've got to bring these together a bit maybe not completely but you know let's say Hey how do we measure risk what do we do with things as a company hey we the government's come to us and said we got to you know uh disclose what does that mean and so I think we're starting to see a lot of the routines change on how they look at the business and really get I even see one company I thought was you know pretty clever they're moving people from it moving them into OT letting the report there to say Hey how do we you know again put the routines in place how should we be thinking about the reporting what tools Technologies should we use that seems to be working I there's three or four companies I know that stared to do that is there one sort of worry or challenge you think it's like looming in in the in the horizon or not necessarily as you see it there's a lot of them I you know we talked before we we started filming here and that um we do a lot of research and so we have vulnerabilities over you know millions of end points right you read the data on that yeah and um about 10 months ago it started popping up that the embedded operating systems were showing that they were being exploited and the embedded operating systems are the ones that are in the critical infrastructure in the Planes Trains automobiles in the more vulnerable very vulnerable and they're hard to go fix because it's like hey let's say you have um yeah let's say you have a bunch of plcs uh in a in a device that's you know or in a a manufacturing plant you could have 4,000 of those things so how do you update them there's no us be stick what do you do they're hardcoded in so it makes it more complicated a little more challenging to say hey what do we do um and they may not even know where they all are they're in a a big thing that's built there it's a you know industrial robot for example that's a headache yeah it's a headache it's like I got to take the thing apart to go find it so there's some challenges physical challenges but you know I do feel like um got to get our arms around hey let's put together some solutions let's be smart about it um and the good news is you know like wor Scout we have solutions that can help them today Barry that's a lot of great material thank you so much for sharing your expertise today very much appreciated you're welcome thank you're happy

This transcript was generated automatically from the video's captions and may contain errors.