Sell the Value, Not the Fear: Funding OT Security and Getting Ready for Post-Quantum

Work with Aaron: https://protectitallpod.com/work/
The book: https://protectitallpod.com/book/
This episode: https://protectitallpod.com/ep130/
The OT Security Starter Kit: https://protectitallpod.com/starter-kit/

You do not need to scare anyone to get OT security funded. Shaun Six, President of UTSI International, makes the case for selling the value instead of the fear.

Shaun spent about a decade on the operator side before his company fell into cybersecurity, and he and Aaron cover the ground in between: who is leaving the OT workforce and who is coming in, losing engineers to venture-funded apps, where to put the X and what OT expertise is actually worth, a one-page budget the board will read, and why a water district's cyber budget competes with a police cruiser. The last third is post-quantum readiness for long-lived control systems: pair the retiring expert with a junior, and build the inventories, including a cryptographic bill of materials, while you are out in the plant.

Key takeaway

You do not need to scare anyone to get OT security funded or understood. Put what you spent, what you got and what you are asking for on one page. Pair the people who are about to retire with the people who are just arriving and have them do the inventory together. And while you are out there, build the lists (including cryptographic) that tell you what is actually in the plant.

Chapters

• 0:00 Intro
• 0:19 Welcome and introduction
• 0:55 From oil and gas operator to CEO: how UTSI fell into cybersecurity
• 2:16 Deploying connected equipment, and learning the exposures later
• 3:54 Aaron: learning from the intern, and "stop when unsure"
• 7:34 Why OT people are humbler: the risk profile starts with people
• 9:33 The workforce gap: who is leaving and who is coming in
• 11:12 Quantum at the conference: a myth on one side, a research team on the other
• 12:46 Losing engineers to venture-funded apps
• 13:42 Getting people into OT: Mike Holcomb, ICS Village and community colleges
• 15:49 Entry level with five years of experience
• 17:00 Physical I/O on the show floor, and the pay problem
• 18:22 Maslow's hierarchy and the 16 critical infrastructure sectors
• 20:33 The value gap: the expert with the hammer, and the five-day assessment
• 24:38 Where to put the X, fixed price, and the three-day fix
• 26:57 Quantifying the value: a trusted advisor, not selling fear
• 28:42 The one-page budget for the board
• 29:42 Water districts and city council budgets
• 31:08 Selling availability and reliability, not "cyber"
• 33:09 Cyber safety is physical safety: educating the board
• 34:30 Water: a lower-cost assessment for utilities
• 36:07 How Shaun got into quantum: the box he could not test
• 37:29 A book for CISOs: quantum and cryptography for non-specialists
• 38:51 Why AI and quantum are accelerating each other
• 41:59 Timelines for post-quantum plans
• 43:47 "Moore's law is dead" and the book behind the term
• 44:06 Aaron: what should listeners ask their boards this budget season
• 45:01 Insurance, assessments and standard frameworks
• 45:48 Pair the retiring expert with a junior
• 47:32 Segmentation, deprecation and a migration you have tested
• 48:01 How to find Shaun and UTSI
• 50:34 Close

About the guest

Shaun Six is the President of UTSI International, a Houston-based leader in OT cybersecurity and ICS engineering. A recognized voice on OT innovation and quantum, Shaun is a frequent speaker and panelist at industry events and has spoken on quantum cryptography at several conferences. He has entered a joint venture with Quantum River to provide an entropy-as-a-service platform, including specialized blockchain technology services, and UTSI has partnered with SeQure Quantum to apply QRNG products in OT environments.

• UTSI International: https://utsi.com/
• UTSI on LinkedIn: https://www.linkedin.com/company/utsiinternational
• Shaun on LinkedIn: https://www.linkedin.com/in/shaunsix/
• A Practical Path to Post-Quantum Readiness in Operational Technology (Automation.com): https://www.automation.com/article/a-practical-path-post-quantum-readiness-operational-technology
• What OMB Memorandum M-26-15 Requires for Your Agency's PQC Migration Plan: https://www.zscaler.com/blogs/product-insights/what-omb-memorandum-m-26-15-requires-your-agency-pqc-migration-plan
• Post-Quantum Leadership: Knowledge and Practical Perspectives by Dr. Georgianna Shea and Adam C. Firestone, the book Shaun recommends for CISOs: https://www.amazon.com/dp/B0H3H72RHX
• Quantum Supremacy: How the Quantum Computer Revolution Will Change Everything by Michio Kaku: https://www.amazon.com/dp/B0B8HCLTYY
• Shaun's Grok deep dive, military facilities and 90-day self-sufficiency: https://grok.com/share/c2hhcmQtMw_71698ae4-f820-4205-862f-312b4dc36f38
• Recent cold wallet hacks: https://www.google.com/search?q=cold+wallet+hack+recent
• Recent cold wallet hacks, Ledger: https://www.google.com/search?q=cold+wallet+hack+recent+ledger

Learn more about PrOTect IT All:

Work with Aaron: https://protectitallpod.com/work/
The book: https://protectitallpod.com/book/
This episode: https://protectitallpod.com/ep130/
The OT Security Starter Kit: https://protectitallpod.com/starter-kit/
Support the show: https://protectitallpod.com/go/support/podcast
YouTube: https://www.youtube.com/@PrOTectITAll
Email: [email protected]
X: https://twitter.com/protectitall
Facebook: https://facebook.com/protectitallpodcast

To be a guest or suggest a guest or episode, email [email protected].

Please leave us a review on Apple or Spotify:
Apple: https://podcasts.apple.com/us/podcast/protect-it-all/id1727211124
Spotify: https://open.spotify.com/show/1Vvi0euj3rE8xObK0yvYi4