Subscribe
Share
Share
Embed
Discover how Tri-State and our members are embracing the opportunity to power the West in our new podcast, Western Watts!
We'll dive into the heart of energy issues, from reliability to wildfire mitigation, and share firsthand insights relevant to rural, agricultural and mountain communities across Colorado, Nebraska, New Mexico and Wyoming.
This podcast may contain certain forward looking statements concerning Tri-State's plans, performance, and strategies. Actual results may differ materially because of numerous factors, and Tri-State undertakes no obligation to update these forward looking statements. We urge you to review Tri-State's filings with the Securities and Exchange Commission for a discussion of these factors.
Dom Maddalone:What we've noticed in our industry and others is that the philosophy has changed to assume that the bad guys are gonna get in. You continue with the prevention. You continue with your tools and your tool set, but you also have to be nimble and agile enough to be able to respond to an actual threat that has been successful.
Elizabeth Schilling:Thank you for joining us for Western Watts. I'm Elizabeth Schilling.
Julia Eshleman:I'm Julia Eshleman.
Elizabeth Schilling:And today we have the pleasure of speaking with Mr. Dom Madalone, Chief Information and Technology Officer here at Tri-State. Welcome, Dom.
Dom Maddalone:Thank you. It's nice to be here.
Elizabeth Schilling:We're glad to have you. And while you are in charge of IT, we are gonna spend a little more time focusing on cybersecurity today, but we'll start with some basics. Think Julia has a question for you.
Julia Eshleman:Yes. My biggest question is with a name like Dominic Mattolone, just how Italian are you?
Dom Maddalone:How Italian? That's kind of a tough question to answer. So, literally, third generation Italian American, as Italian as you can be, from Chicago. I would say I'm Italian enough that if there's a family gathering, no one goes hungry, And if there's a disagreement, everybody's got their own opinions to solve it.
Elizabeth Schilling:We'll get to the real stuff, I guess,
Julia Eshleman:if we have
Elizabeth Schilling:Now that we got that out of the way.
Dom Maddalone:No, right.
Julia Eshleman:Burning questions solved.
Elizabeth Schilling:So can you tell us a little bit about your background in IT?
Dom Maddalone:Sure. I've been in IT for thirty something years. I've had the opportunity to come up as a programmer when I first started, and then move into infrastructure, which is all the kind of background plumbing, data centers, servers, and storage, and PCs. And then move into some larger organizations that gave me the opportunity to get into enterprise architecture, cybersecurity, larger infrastructure initiatives, and then move into more business process reengineering, company transformations using enterprise software on a global basis, which was also a great experience. Then moved into leadership maybe about twelve, fifteen years ago.
Elizabeth Schilling:So you've got all levels. You know the tools. You know how they accomplish something for the business. You know how to secure them. Tell us a little bit more about your experience with cybersecurity.
Dom Maddalone:Cybersecurity, so, you know, I've been in the industry for a long time, and when I started, cybersecurity wasn't really cybersecurity. It was at best something like network security, where we had something like an early version of a firewall trying to keep the bad guys out and the good guys in, but it was also, it wasn't really anything part of the organization. It was just kind of an add on to somebody else's role. And then over the last thirty years, we've seen that become more and more important to not only the technology organization, but to the business overall and their reliability or their performance or whatever their mission is in order to continue to work in this technological environment. So it became much more of a discipline, and then it became its own kind of group.
Dom Maddalone:So not only within the technology environment has it become much more precise as to what cybersecurity is, but then you've got, you know, the education system's caught up with it as well, right? We've got opportunities for people to earn their bachelor's, master's, and PhDs in cybersecurity, which is awesome. So quite a maturity in a relatively short amount of time, like twenty five years, to become something that is not only foundational but absolutely needed in order to run almost any business or organization.
Elizabeth Schilling:Yeah. You can't get through any part of life without technology in some form.
Julia Eshleman:If I wanna continue using a credit card Yeah. I will continue to support cybersecurity. Yeah.
Elizabeth Schilling:But then you have that added level of working for a utility. So utility specific, what are the kind of risks we're looking at?
Dom Maddalone:As electric utility, we support every other sector, every other industry out there, right? Health care, telecoms, banking, everything else depends on us. All those other industries, their backup electric procedures all assume that we, if we have an outage, are gonna be back up within hours, maybe days at the max. So that's why we're critical. Thirty, fifty years ago, it was keep the lights on.
Dom Maddalone:Now it's make sure you keep the lights on and defend against the bad actors that are trying to cause damage or disruption.
Elizabeth Schilling:So it's not just the accidental things that can go wrong, but the actual targeted attack.
Dom Maddalone:Absolutely. Yeah.
Elizabeth Schilling:Constantly, right?
Dom Maddalone:Constantly. So I was just talking to our CISO, and he's he's claiming 500,000,000 cybersecurity events a day for Tri-State itself. An event would be, if I can use an analogy, is a bad guy trying your doorknob or your window, right, to see if it's unlocked. But it's hundreds of bad guys doing it multiple times a second from across the world, and trying to find out all those doors and locks and windows. So that adds up over time.
Elizabeth Schilling:So the door can't be unlocked for a moment. They're gonna find it.
Dom Maddalone:No. Not not for a moment. So there's an adage, right? They can try 500,000,000 times, and if they are right once, if they break in once, they effectively have won the game. And we have to...
Dom Maddalone:We as defenders or as the utility, we have to be right every single time in order to win the game. No pressure. No pressure.
Julia Eshleman:Especially with utilities, you have a lot of older infrastructure that you're constantly in a race trying to update and get up to speed with everything else. How do you update with also just the huge cost of introducing it to thousands of miles of infrastructure, all these hundreds of facilities and stuff like that?
Dom Maddalone:Yeah. That's always a kind of a balance between innovation and cost and risk management. So always trying to invest smartly in technologies, commencement with the risk that we're trying to manage and mitigate, knowing that we can't boil over the ocean, we can't invest everywhere. How broad a net can we cast where we continue to invest in our people, process, and technology, invest in kind of refreshing, and also bringing that technology, the digitalization technology that's evolving so quickly back into the realm of the analog and the older technologies that have supported the grid for so long. We're not gonna change out relays or necessarily any kind of sensors that were originally designed implemented the last thirty or fifty years, right?
Dom Maddalone:Those are gonna continue to be there. What we can do is put in place monitoring or notifications and other protections, so that we know if a piece of that older infrastructure is being attacked, we know about it, and we can take the right precautions or the right remediation.
Julia Eshleman:I know some companies are also starting to look at AI as a way to detect cybersecurity attacks too, but you're relying on an outside company to provide for you and gets a lot of access to your data. So how do you feel about, and where's Tri-State out with using AI or guarding against AI for cybersecurity?
Dom Maddalone:So AI has been around for a long time. It's only recently that it's kinda really taken off with generative AI and some of those capabilities. So the older technologies around security incident and event management had kind of the basic pattern matching that you would consider older technology. So we're not new to that particular point of it. The generative AI really kind of adds another layer of protection.
Dom Maddalone:So the bad actors out there are using generative AI and some of these newer AI techniques to hasten their attacks, broaden their attack surface. They don't need the skills, the technical skills they needed maybe five years ago. The generative AI really kinda helps them speed up a learning curve or not even have a learning curve. The defenders, us, we're starting to use AI as well, mostly right now on that triage. And when I say AI, we're talking about generative AI.
Dom Maddalone:It's really good at identifying trends and going through massive amounts of information that would have taken us day or two days or three days to identify the signal from the noise, right? Who's really rattling just the door handles and who's actually made some level of penetration or gained foothold in our system. AI is really, really good at identifying that quickly and a large amount of information, so we are definitely pursuing that level of it. When it comes to sharing that information, I think we're pretty mature, the vendors are pretty mature. We've been sharing information with third parties again for a long time, so it's not a very large leap to continue that momentum and understanding what they get to process, what they get to hold on to, at the same time providing us with that visibility into our environment when we have so many different events occurring at the same time.
Julia Eshleman:When you say attackers are using generative AI, what are some examples of that? Like coding whatever they were doing or creating a voice fake or something like that?
Dom Maddalone:So... Yeah. So those are two real good examples. Social engineering comes to mind, which is crafting the better phishing email. Right?
Dom Maddalone:Getting rid of grammatical mistakes. You're making it much more emotional, so you're trying to get that rise out of somebody who you want them to press on this button or download this this software. Another piece of it, you hit on it, was better coding. Coding used to take a certain level of technical expertise and knowledge, and now you can have generative AI able to code some exploit for a vulnerability, search for those vulnerabilities in your network, and then apply those exploits without having necessarily a background in IT or programming. Those are human directed.
Dom Maddalone:The next kind of levels and stages that we're expecting is a little bit more autonomy from AI. The bad actors, whoever they may be, just direct a platform that they've configured or developed themselves to go and attack a company or sector or an industry or region. The agents then themselves form their own plan, their own goals, and their own techniques to apply those attacks.
Julia Eshleman:Overall, especially from your perspective, are you more excited or overwhelmed by a...
Dom Maddalone:Definitely both. Right. The technologies are advancing and evolving so quickly that if not week to week, day to day, there's always something new, and it's important as we're looking into this to be able to classify the hype from what's real and what's really effective, and that's maybe the more difficult part. But that's the exciting part, it's also overwhelming. I spend probably too much time trying to analyze what's going on in the field, both because it's something that intrigues me, but we also have to stay on top of it, not only from the cybersecurity perspective, which is key and fundamental, again, to protecting Tri-State, but also how can Tri-State start to take advantage of using AI here in the near future.
Julia Eshleman:And that's just a portion of your job, because then on top of that, you also have the technology part too.
Dom Maddalone:Yes. Yeah. AI is touching everything, but yes, so we're still trying to settle down some of our enterprise software. We're trying to improve our resiliency and operations. We've stood up a new AI organization, and then, of course, cybersecurity as a standalone organization within the technology group.
Julia Eshleman:You said AI is really good at combing through and summarizing the huge amount of data, and that's a huge part of what Tri-State does, like GIS, facilities, lines, all these data points. So you can't leave it behind, but you also can't, like you were saying, let it overwhelm you either.
Dom Maddalone:Right. So especially in our operations area where we have much more, I would say, compared to maybe the enterprise side of things, we have a lot more velocity and volume of information and data. So being able to identify those opportunities where those attributes of AI, where they're effective, can be applied to operations is something that we're taking a hard look at. A lot of what's going on with AI today is gonna be based on the enterprise software, just because it's easier and it's more standard, right. So standard Oracle, standard GIS for the most part, there's a lot of opportunity there, but it's somewhat commoditized.
Dom Maddalone:The real bang for the buck, the real value that we're gonna get is gonna be more bespoke tailored AI solutions that are taking advantage of our particular dataset in the operations world, which is unlike any other utility or any other company in the world. That's really where the most advantage Tri-State's gonna get from AI.
Julia Eshleman:Well, you're stressing me out.
Dom Maddalone:I'm sorry.
Julia Eshleman:So we talked about attackers and bad actors. Can you tell a little bit about cybersecurity free utilities, especially in the face of the Iran and Ukraine war?
Dom Maddalone:So both good examples. Ukraine was an example of how... I think it was 2015 and 2016, bad actors, more likely Russians or Russian linked actors, were able to penetrate a Ukrainian electric utility and actually cause an outage. From that, there were some lessons learned that all electric utilities could take advantage of. By 2022, when the bad actors tried again, the same utilities were able to defend against that.
Dom Maddalone:So a lot of good information about what worked, what didn't work, as far as resiliency, detection, being able to contain malware and persistent threats. And we haven't seen much there as far as negative effects on Ukraine or Ukraine type of attacks on the electric utility industry. From the Iranian perspective, we've seen more kind of opportunistic attacks, not successful attacks against the electric utility industry, luckily, but they have targeted other critical infrastructure here in The US. I don't think it's been officially identified, but the experts out there would say that it's predominantly Iran. We had maybe a month or two ago a number of water utilities attacked across 12 or more states in The US in a very short period of time.
Dom Maddalone:Very opportunistic, kind of high concept, attack a lot of water utilities at once, but low tech. And what I mean by low tech is that the defenses that the water utilities used for their cybersecurity defenses weren't really up to par. So again, kind of a lesson learned for that particular industry. Luckily, the electric utility industry is a little bit more mature than the water utility industry in The US. We've been at this much longer period of time, and we've got regulations and standards from FERC and from NERC, SIP standards, critical infrastructure protection standards that we've implemented, probably ten, fifteen years old by now, that have really spurred on cyber defenses at electric utilities.
Dom Maddalone:Now here at Tri-State, we're subject to those standards, but we treat those as a floor, not a ceiling. So we layer on top other cybersecurity frameworks and other defenses just to ensure that we're protected appropriately.
Elizabeth Schilling:Let's spell out NERC for a second just in case people don't know what it means. Yep, please. North American Electric Reliability Corporation. And SIP was critical infrastructure protection. Yeah.
Elizabeth Schilling:Thank you.
Julia Eshleman:Since utilities, a lot of times too, are also carrying fiber and communication stuff, Do you think that in the year 2026, they're more looking to take over or intercept communication that we have or just actually shut down the electric grid and cause havoc?
Dom Maddalone:It's the latter. But they may use any kind of opportunity, whether it be our own fiber, or a PLC that's hanging off the Internet without a password, or still the credentials of an employee working in finance, just for an example, not to pick on finance. They'll use any and all means to try to get to their ultimate objectives. The objectives, as we've seen, have evolved over the maybe the last few years. Ransomware has always been kind of a biggie.
Dom Maddalone:A lot of groups have gone after it. It's a revenue generation, and it's been commoditized to a point where a lot of ransomware is almost like ransomware as a service. People have platforms out there that bad actors can rent to go after a particular industry or a particular company. The other type of attacks were data exfiltration, trying to grab any kind of information out of the company that maybe they can use for leverage now or in the future. What we've seen recently, maybe over the last thirty six months, is that while ransomware remains a big hitter, the next evolution has been more bad actors trying to get a permanent foothold in an electric utility, and then sit there for a while, learn how the operations work.
Dom Maddalone:It's called prepositioning. And then decide at the proper time, after they've understood the topology of where they're living within our technical environment and the operations that it's supporting, find appropriate time to trigger an attack to damage, to your point, damage the grid somehow. Go after a substation, go after a generation plan, go after the core operations in some way.
Elizabeth Schilling:So so we can't just lock ourselves down on an island and have no access to anything else because the grid is about connections. There's thousands of electric utilities in The US alone. We use each other's power lines. We buy and sell power from each other. We share infrastructure.
Elizabeth Schilling:So how do we guard our own assets when there's so many variables, so many access points where we have to be connected?
Dom Maddalone:Well, that interconnectivity is really the strength of the grid, right? That's how we are so reliable. If one generation trips and goes offline, the rest of the interconnected grid can cover it. So that's really a strength. It's those kind of additional mitigations and approaches to cybersecurity that we need to make sure are occurring.
Dom Maddalone:So I've talked about the high level of cybersecurity framework that we're all following. All utilities of a certain size are following these standards. So we have a certain level of faith and trust that our neighbors who are connected to us, that they're on top of it. Right? They're doing their own monitoring.
Dom Maddalone:They have their own cybersecurity defenses in place. They know how to respond to cybersecurity or physical security incident. So we feel comfortable that way. We share a lot of information. That's a great thing about the utility industry, different from other private industries.
Dom Maddalone:We share an amazing amount of information amongst ourselves. Best practices, what have you seen? What are you doing in this particular realm? Whether it's cybersecurity or other IT or anything else in the operations and corporate functions. Again, a real true strength through sharing that information and using it.
Dom Maddalone:I think it makes them feel better about what the future holds for us.
Elizabeth Schilling:Almost like we're stronger together.
Julia Eshleman:That's a good point. We take all the cybersecurity trainings and stuff like that. It can seem tedious.
Dom Maddalone:Yes.
Julia Eshleman:And we do it every year, but that is one of those things where we hope the guy at the next company also has to do that too.
Dom Maddalone:Exactly.
Elizabeth Schilling:What kind of people or organizations would target utilities?
Dom Maddalone:Okay. So a few categories here. Criminal organizations, right? They're the guys and gals using ransomware for the most part. They're trying to extract value by locking up our systems and holding them ransom, extortion payments, and that's how they make their money.
Dom Maddalone:Another would be nation state actors, and those are the ones that we're particularly careful of, because they have access to a greater set of resources. They're using AI or other advanced techniques. Those are the ones that have been able to gain a foothold in companies, including electric utilities, and stay there for a while. Another group would be hacktivists. So people who have maybe an ideological bent, and for some reason, they wanna attack the grid.
Dom Maddalone:The last group is insider threat, and that could be a disgruntled employee or it could be somebody who makes a mistake. Perhaps another example would be an IT person who leaves credentials out where they shouldn't be or misconfigures a network device. That would be an accident, but also categorized as an insider threat.
Elizabeth Schilling:So how is Tri-State stepping up to handle the threats? You talked a little bit about some of these things, but what are the tools in our toolbox?
Dom Maddalone:We continue to evaluate what's effective and what's emerging, and consider what the threats are gonna be. We have the traditional defense in-depth, so we've segmented our networks, putting gates and walls and moats and chain link fences that people need to be able to pass through before they can get to sensitive assets or data. We've segmented the network between our enterprise systems and our operational assets. So there's an air gap, if somebody gained a foothold in our enterprise, on our Microsoft applications, they wouldn't automatically be able to pivot to our operational assets. We continue to invest in our people, in training, and we continue to test our own responses.
Dom Maddalone:A lot of cyber in the past has been about prevention. How do you prevent somebody from getting in? Again, network security having, back in the day, antivirus on your PCs, and that's evolved into a newer technology nowadays. Behavioral analytics, so that we can be able to pick up anomalous behavior in the networks in place. But that's all prevention, keeping the bad guys out for the most part.
Dom Maddalone:What we've noticed in our industry and others is that the philosophy has changed to assume that the bad guys are gonna get in. You continue with the prevention, you continue with your tools and your tool sets, but you also have to be nimble and agile enough to be able to respond to an actual threat that has been successful, To detect that there's an attacker in your network, or that malware's been downloaded onto a PC, or that there's some strange thing happening on the network, we need to be able to detect that as soon as possible, and then begin the cleanup behind it. And think that's a very healthy attitude. Continue with prevention, but also think about resiliency. When you're under attack, how can you, as quickly as possible, respond to it and get the business back into operations?
Julia Eshleman:Tri-State has 9,000,000 different types of software. How do you monitor these incremental tiny disturbances across so many different types of softwares that may or may not even connect with each other?
Dom Maddalone:So a couple of things we categorize and segment out those critical applications and software. Right? The operation stuff is the holy of holies. We spend a lot of time making sure that we have observability around that. We know what the assets are, and the appropriate protections are there.
Dom Maddalone:So there's a lot of energy, a lot of investment that goes into that, and people are particularly trained on supporting that environment. Getting it into more of the enterprise applications, and those are more industry standard, and they come with their own cybersecurity strengths, their own defenses, and we augment that with our own frameworks. And those are also categorized as of medium criticality, as of lower criticality, and the higher criticality gets a little bit more kind of attention. Then you have the entire environment in which these applications live, and that's where a lot of the cybersecurity defenses are situated, and that's the prevention part of it, right, so that's where we're really trying to get people out of it. Then we have another category, which is what you're really into, the other 900,000,000 applications.
Dom Maddalone:We have certain ways of allowing little tiny spot solutions to interact with us or not interact with us. So if they're not sharing information with us, with our enterprise or operational systems, While we do care about it, we validate them, and we make sure we understand where the software's going, where the data's going, we kind of allow those to play on the range. If they're off by themselves, if they get attacked, there's not much of an impact to Tri-State, because we're not sharing data with them, and they're not interacting with our systems. If we have a software solution out of those 900,000,000 that somebody wants to interact with Tri-State's technology environment, then we go through a stricter kind of discipline. We understand a little bit more about what that data is, what the cybersecurity controls are, We put monitoring on place.
Dom Maddalone:So it's going back to tiering and making sure that the controls we have in place are commensurate with the risk of that particular software that we're utilizing.
Julia Eshleman:So my Photoshop account isn't a blip on your radar.
Dom Maddalone:It is. And if it blips too much, we're gonna take care of it. So we are monitoring everything that's going on the laptops. Even if it's Photoshop or some web application that you guys find useful in your lives, in your careers, in your jobs, We'll monitor the data that's going back and forth. And if we see something that looks like it's being aggressive or dangerous, we'll either proactively shut it down or have a conversation with you and try to understand more about what it's doing.
Julia Eshleman:Our department specifically probably drives your people the most nuts where they're like, what the heck is Canva? What is this GoPro app? I'm sure they're always just like, what is this even?
Dom Maddalone:Oh, absolutely. But that's where you get to that kind of tearing and understanding, you know, how how it's being... How it's acting on the PC, and, again, if there's any kind of data that's going back and forth. And if there isn't, like you said, there's millions of these applications out there, and they're all very low risk and maybe of some value. So we can't cover everything.
Dom Maddalone:We can't boil the ocean, but we need to protect the most important aspects of the technology environment.
Julia Eshleman:So you're talking about cybersecurity being a wall. I guess my observation is cybersecurity actually has to be much more flexible than what I even realized.
Dom Maddalone:Nowadays, I think that's kind of that evolution. Before, it was lock everything down, whitelist those applications or those technology services you wanted to use, and everything else was blocked. But that's not a realistic way to run a business. Right? There are all kinds of needs, and they and they change over time.
Dom Maddalone:So you have to have the right controls in place to allow that flexibility, but not allow the bad actors in.
Julia Eshleman:I understand it in retrospect, but once upon a time for, like, an Easter social media graphic we were gonna do, I wanted to grab one of those marshmallow peeps. So I went to their website to grab one, and it blocked just the peeps.com website. And I didn't realize it at the time, but in retrospect, I was like, oh.
Elizabeth Schilling:He put me back. I don't think it's blocked anymore, but that was pretty funny. For you. No for you. That could be its own podcast.
Elizabeth Schilling:Pro peep or... It's not peep. I am astonishingly pro peep.
Julia Eshleman:Had some Doctor Pepper flavored ones. They were great. I... As a nineties kid, I think I just like the taste of red dye, or whatever those. We talk about tools in the toolbox and stepping up to handle cyber threats.
Julia Eshleman:What's Tri-State investing in right now for cybersecurity and keeping us up to snuff?
Dom Maddalone:Sure. I've talked about investing in our cybersecurity staff and training, ensuring that we're invested in the right cybersecurity tools. We've also brought on new leadership, very strong, good leadership, who provided vision and maturity in the organization. You know, another part of this is bringing all of Tri-State employees along with us on cybersecurity defense. That's maybe an underlooked part of it, of cybersecurity programs, but the employees play an incredibly important part in keeping Tri-State safe from bad actors.
Dom Maddalone:So we've increased our simulated phishing from, I think it was think it was quarterly, maybe semi annually when I got here, so we're doing it monthly now.
Elizabeth Schilling:It leveled up. Sometimes I get hung up occasionally
Julia Eshleman:when that didn't used to happen.
Elizabeth Schilling:I clicked one. I'm sorry.
Dom Maddalone:That's okay. Don't be sorry. What's important, it's a learning lesson. So we incentivize those people who report the fish, right? So every month, we get plenty of people who report the fish, which makes me sleep better at night.
Dom Maddalone:We incentivize that by whoever reports it. We put them in the poll, draw five names randomly, and give them a small token of our appreciation. But having our employees be aware of the bad actors and being aware of email phishing, which is a very high, useful attack vector for the bad actors and will continue to be for a while, we need our employees to be aware of the different methods by which phishing is gonna evolve. Leadership, employees, technologies, tools, threat intelligence is important to us. We were up in our game there.
Dom Maddalone:Threat intelligence is having the right conduit to information, real time information accurate and actionable. So the more we know about our situations, the bad actors and what the environment looks like is an incredibly important, just opens up the visor, the windshield for for us to view the entire ecosystem, not only Tri-State, but what's going on with the larger environment out there. Those are several different aspects that we continue to invest in. I would assume that within two years, the priorities of those investments may change, just because the attackers are gonna find new vectors that they can take advantage of, and then our defenses would have to change to accommodate those different attacks.
Julia Eshleman:Elizabeth, what's the dumbest fish you ever fell for at Tri-State? Trying to
Elizabeth Schilling:get the last one I fell for. It wasn't dumb, though. It was inviting me to be a part of a team I felt included. I should have thought, why would they want me on this finance related team? But I clicked the button.
Dom Maddalone:But that's the nature of a fish. Right? It kinda gets you that emotional rise you don't wanna go through and read or excited about whatever's in that email. You're... Maybe you're terrified.
Dom Maddalone:You're scared of whatever's in there, or you're excited and happy about it. But those are how they're crafted.
Julia Eshleman:I fell for a dress code violation one because I was pissed. I was like, who ratted me out? I quit spending... Just out of straight rage,
Elizabeth Schilling:I pressed the button right away.
Julia Eshleman:Emotions are powerful.
Elizabeth Schilling:This is a really good tactic. Now I'm questioning everything though that I get.
Dom Maddalone:I'm like, I don't know. I don't
Elizabeth Schilling:know about the setbacks. Alright. Thinking about the idea of investment, and obviously, we have to put financial resources into cybersecurity related upgrades or processes, programs, trainings, all of that. How do you measure out the investment we put in versus the cost if something went wrong? What that impact would
Dom Maddalone:let's talk about the cost for a second. Whatever damage has been done from a cyber attack, and then the recovery behind that, trying to get us back up and running, any kind of forensics. And then some of that may be covered by insurance, which is another cost. Then beyond the direct costs, if we have a cyber attack here, we're gonna get extra scrutiny from the regulatory agencies, and that's gonna be a cost. It's at least an opportunity cost, because our staff will be working on things that are non value add, right?
Dom Maddalone:They're trying to satisfy information requests or prove that we are properly protected after the fact. Or it could cost in that we need to stand up other protections that we didn't invest in previously. Then there's any kind of reliability costs that we may encounter. And then a trust or reputation cost. Maybe it doesn't show up on the income statement or balance sheet, but if we've impacted our members or we've impacted our communities, there's a certain amount of reputation and trust that we've lost that's gonna take much more time than the actual cybersecurity event to recapture and regain.
Dom Maddalone:The The biggest costs around cybersecurity defenses are gonna be around ensuring that we have 20 fourseven operations. The maintenance and monitoring of what's going on within the organization is probably the biggest cost. There are other costs, like software defenses and the hardware defenses we put in place, and the training of our staff, and maybe partnering with third parties who specialize in defenses or costs there. But again, we invest in those with the idea of mitigating the risks. We try to go through a quantitative understanding of what the risks are across the operational environment, the enterprise environment, what's going on even on the endpoints, and then take advantage of the defenses that come baked in.
Dom Maddalone:I've talked about AI defenses, or using AI to do triage. That's a new environment for us, a new defense platform for us that we didn't have even a year ago. But that's, again, come up, and we found it useful because bad actors are using AI, and the amount of events that we're seeing are scaling rapidly, and we needed to invest in a new tool that could keep up with that. So we look at these tools and these platforms on a regular basis, quarterly, definitely an annual basis, and keep informed with our vendors and our partners as to what's going on, and then invest and implement it as necessary.
Elizabeth Schilling:So sometimes it's worth the cost to add the extra lock to the door, the deadbolt. Sometimes it's worth the cost to expand the moat.
Dom Maddalone:Yes. Okay. Very well put.
Elizabeth Schilling:I didn't think about this either too, but our members are also
Julia Eshleman:relying on us to have extremely good cybersecurity because we're a big choke point to get Yeah. Energy to
Dom Maddalone:That's a good point. We're upstream of our members, obviously, so I think of it as two things. One is reliability. If we have a cyber attack that affects our physical operations, that is directly put upon by our members, and then their customers themselves, and then the cost of it. So going back to being a nonprofit cooperative, we live by those principles, even in cybersecurity, and we try to invest wisely, use our member dollars very, very wisely, and have the right level of defense against what we think are the current and emerging threat factors out there.
Dom Maddalone:So it's reliability and cost that we keep top of mind.
Julia Eshleman:It's really hard on members too if you talk about email phishing, a lot of their age demographics for those regions. You have a lot of people in their sixties or seventies where they didn't have email when they were a thing. It's all of a sudden new to them. And then you have these extremely advanced AI where they can, like, clone a family member voice asking them for something. You know?
Julia Eshleman:It's insane. So even with our members, cybersecurity is important because their end consumers are, like, part of that vulnerable group, especially to phishing, which is now super easy due to AI.
Dom Maddalone:Phishing and all other types of scams of the voice thing is becoming more prevalent. We were asked by KC Electric to come out to their annual meeting this past quarter, past half year to present to them cybersecurity best practices for their members. So we sent out our chief information security officer, and the feedback was awesome. So we're happy to do that with any of our members.
Elizabeth Schilling:Great to have that expertise we can share. So utilities are critical to national security. What is something the entire industry should be aiming for going forward?
Dom Maddalone:I've touched on this before. So it's moving from prevention to resilience. Continue to invest in the gates and the moats, in the locks and the double locks, but assume that you're going to be attacked, and then upon that assumption, have your resiliency practices and processes in place. Here at Tri-State, we have an incident response plan. We've consolidated a number of different incident response plans that maybe transmission generation or corporate environment had.
Dom Maddalone:We combine them into one, so we have one Tri-State way of responding to a cybersecurity event. Right now we're practicing on a monthly basis, so that the cybersecurity team, and then eventually others, becomes more like muscle memory, right? So when somebody gets that call at 02:00 in the morning, they know what to do, right? Assume again that you're gonna be attacked successfully, and be able to identify, and then clean up as quickly as possible. So whatever data backups you have, make sure that those are tested.
Dom Maddalone:Whatever resiliency in hardware, or different sites where you can move your operations to and from, make sure that those are exercised on a regular basis. Trace8 does that as well.
Elizabeth Schilling:I feel confident.
Julia Eshleman:Do you feel confident?
Dom Maddalone:I feel very confident on our program. I feel very confident in our people. I feel confident in the way that we've deployed our cybersecurity defenses, but we're not complacent. We never sit back and go, okay, job well done. Move on to the next job.
Dom Maddalone:It's always a continuous reinvention, always continuous analysis of what's happening, and then put ourselves in a posture that we can respond appropriately. Constant.
Elizabeth Schilling:Constant. Anticipate. Analyze. React. Do it again.
Elizabeth Schilling:Do it again. Do it again.
Julia Eshleman:I can barely get into my own phone with all the MFA. We're extremely secure, especially from me. What's something you're excited about? I mean, there's a lot to deal with, but what's on the horizon?
Dom Maddalone:The AI defenses. We've already dipped a toe... More than a toe into it. Right? Another one would be password less authentication.
Dom Maddalone:So instead of typing your 12 character password every time you log in...
Julia Eshleman:Heck yeah. Take a vial of my blood. I'm ready.
Dom Maddalone:We'll go to face identification. We'll go to fingerprint identification. The technologies around that are getting much better.
Julia Eshleman:This might be a little off topic, but there is the talk about securing supply chains because we're worried about where certain parts are made. And a, is that a legit worry? And b, what the heck is the point of worrying about it when everything's manufactured overseas anyway?
Dom Maddalone:So super legit. And the technology industry has experienced supply chain attacks. So here's how a supply chain attack works. An attacker, instead of trying to attack a thousand or a 100 utilities, does a little bit of research and comes to understand that the 100 utilities that he or she wants to attack all use the same type of software. Maybe a piece of software that does network monitoring that's very prevalent in the industry, everybody uses it.
Dom Maddalone:Then he continues to do, or she continues to do research on that particular piece of software, and if I can attack that company and that software somehow, then I'm going to insert some malware, I'm going to insert some kind of backdoor, I'm going to insert something that's going to damage the user of that software some way, And that's occurred. That had occurred not less than, like, five, six years ago. Is that
Julia Eshleman:a SolarWinds thing?
Dom Maddalone:Yes. Yes, SolarWinds. So the bad guys attacked SolarWinds. They inserted dangerous code into it, and then SolarWinds, not realizing that, pushed out updates to everybody who uses SolarWinds. The entire globe uses SolarWinds.
Dom Maddalone:And then once it was pushed out, they waited a while to kinda settle down, and then the bad actors took advantage of the code issues that they implemented, that they inserted into this trusted platform, and started to attack. That's a supply chain attack on the software side. And it could occur on the hardware side as well. So, you know, how do you mitigate against that? That's a little bit of a work in progress for the entire industry, but the first thing is to understand the bill of materials on the software side, what that looks like.
Dom Maddalone:Where was this information sourced from? Right now, we don't have that for everything. It's such a wide ecosystem of software, both commercial software, proprietary software, and then open source software. And it's proven that either is at risk, but just having an understanding of all the software that it goes into, that is assembled into a platform, and then you have multiple layers of that, it's not just one layer, right? So all the software that you've identified, those are built on other components of software, and so on and so forth.
Dom Maddalone:So it's not an easy problem to solve, but the industry is working toward first identifying what's in here, where does it come from, maybe authenticating it in some way, and you can do the same thing on the hardware. On the hardware side, maybe it's a little bit easier because you're dealing with actual something tangible, and it won't change as frequently as software does, but it's a challenge that we all have to deal with at this point.
Julia Eshleman:Cool, especially because people are waiting in line years to get a transformer, and then if you could only get them from one country or two countries, and then you're on a three year wait list or whatever, like kind of desperation thing.
Dom Maddalone:We're gonna have to shift some of that responsibility from us, the end user, if you will, back onto the hardware and software vendors. They need to come up with some way to certify and verify that what they've assembled and sold to us is, in in good graces, is safe, has not been has not been penetrated or damaged in some way.
Julia Eshleman:If it is a physical hardware thing that got added on, how do they access that? Like, is that a software thing, or is it, like, someone has to physically access whatever it is?
Dom Maddalone:All the above.
Julia Eshleman:Okay. Good. Yes. I don't know
Elizabeth Schilling:if this is, like, from eighties or nineties movies, but I'm picturing, like, the chewed up piece of gum stuck in the door, And then you think it locks, but it didn't. You're leaving it open for other threats to come through. You think you're protected, but
Dom Maddalone:There's a ticking time bomb in
Elizabeth Schilling:there somewhere.
Julia Eshleman:Interesting. You might have already said it before, but what is the most common cybersecurity attack Tri-State experiences?
Dom Maddalone:It's email phishing, for sure. The most successful would be email phishing. But then beyond that, especially with AI nowadays, it's all the pinging, all of the rattling of the doorknobs in the windows that makes up most of those events. Just trying to find out if they can recognize a particular technology service, and then once they recognize it, threw them into a database that says, oh, that service has a vulnerability, and here's how you exploit that vulnerability. That's the other side of the mechanism here.
Julia Eshleman:What's your best advice to not fall for a phishing email?
Dom Maddalone:So I'm gonna answer that and another question too. We were talking about phishing emails are getting more sophisticated in that they're trying to get that emotional reaction and make you do something without thinking through. So if you're ever in that position where you're overly excited or fearful, right? It sounds prosaic, but it's just taking a breath, take a beat, kinda understand it, reexamine that email that you're looking at, try to use your training that you've taken, and see if it's safe, and if you can't make up your mind, report it. Report the phish to cybersecurity, and they'll let you know whether or not it's safe.
Dom Maddalone:From a company perspective, what we need to do, and all companies need to do this, we need to make employees feel safe that they can report the fact that they've run into a phish or any kind of cyber security attack, right? So if somebody has done something like clicked on a phishing email and doesn't report it until Monday, they've turned a cyber security event that could have been contained into a whole full blown cyber security incident, that's gonna be more costly to clean up. So I need to make sure that all Tri-State employees feel safe, that they can report this without being blamed for anything, right? We're never gonna blame an employee for clicking on something. It's an emotional thing, right, like we've been talking about.
Dom Maddalone:But I need them to feel confident that when they do report it, that there's not gonna be some punishment or something like that. I need them to feel like this is really fast and easy to report, and I'm not gonna be blamed for it. That keeps Tri-State very, very safe.
Elizabeth Schilling:Well, thank you, Dom, for everything you shared with us today. I think Julia and I will try to control our emotions when we click on emails or don't click on emails.
Julia Eshleman:It sounds like now is the best time
Elizabeth Schilling:to be a cyber attacker because it's so easy. They just know they need to invite me to something. Yeah. So I feel included.
Julia Eshleman:Chat GBT. Please make me a ransomware website. Thank you. We
Elizabeth Schilling:appreciate you walking through the technical and tangent that we covered today. Thanks for being on the podcast.
Dom Maddalone:Thank you guys for having me.
Elizabeth Schilling:Thanks for tuning in to Western Watts. You can find us on Spotify, Apple Podcast, YouTube, or on our website at tristate.coop/wwpod. We'll catch you next time.