Navigating the Complex Landscape of Cybersecurity in Mission IT Environments

By Seth Eaton, Vice President, Technology & Innovation, Amentum

Click here to listen to the podcast episode “Exploring Cybersecurity Fundamentals and Essentials: Part II” on Spotify

Hello, everyone. I’m Seth Eaton, and welcome to another exciting episode of “What the Tech!” Today, we dive deep into a critical subject that touches every corner of our digital world—cybersecurity. We’re honored to have Adi Karisik, the Vice President of Global Technology Enablement and Cyber Intelligence at Amentum, join us for Part 2 of our cybersecurity podcast.

A Unique Perspective on Mission IT vs. Enterprise IT

In our discussion, Adi shed light on the distinct differences between cybersecurity for mission IT environments and traditional enterprise IT environments. Unlike enterprise IT, mission IT environments are tailored to specific client needs, often driven by national security objectives, regulations, and the unique technologies in use. For instance, industrial control systems, like those in weapon control networks, often rely on non-Ethernet endpoints, necessitating a different cybersecurity approach.

Adi illustrated the pivotal point that while enterprise IT systems operate under well-defined standards like ISO 27000 or NIST 800-53, mission IT systems must be flexible and adaptable to the specific needs of the location and client circumstances. This complexity demands a bespoke strategy that balances technological needs with mission-critical decisions.

Challenges in Contested Environments

Ashley Isaac, my co-host, asked Adi about the challenges in protecting mission-critical networks, particularly in contested or forward-deployed environments. Adi emphasized the importance of understanding the unique risks and solutions required for each client. He noted that decisions in these environments might not always align with the best technology choices but must support the overall mission objectives.

One notable example Adi shared was how zero trust architecture has become a contentious topic, with various companies claiming to have the ultimate solution. This disparity in understanding often leads to differing perspectives between clients and vendors, making it crucial for integrators like Amentum to bridge the gap and ensure mission success while managing cybersecurity risks.

Ensuring Cyber Resilience Amid Complexity

Ashley further probed into methods for ensuring cyber resilience when integrating with multiple partners, contractors, and government agencies. Adi explained that Amentum leverages advanced technologies to standardize cybersecurity measures across all stakeholders. These solutions help minimize exposure and manage risks effectively, even in complex, multi-faceted environments.

When we shifted our focus to enterprise IT, Adi highlighted common weaknesses, with human error topping the list. He stressed the importance of adhering to established procedures to mitigate risks, emphasizing that cybersecurity is about managing risk, not eliminating it entirely.

Adapting to New Norms

The evolution of work patterns, including the rise of hybrid work and increased cloud adoption, has introduced new cybersecurity challenges. Adi discussed the importance of maintaining good cyber hygiene and adapting to these changes. He drew parallels to the early days of online banking, noting that the next few years will be crucial in defining secure processes for cloud and hybrid work environments.

Securing Aging Systems

One of the standout points was the discussion on securing aging IT and OT systems. Adi proposed a flexible approach, akin to military doctrine, that focuses on adaptability and planned, incremental upgrades. This strategy helps balance the high costs of replacing outdated infrastructure while maintaining minimum acceptable cyber risks.

Learning from Real-world Examples

Adi’s real-world examples struck a chord. From the theft of supplies due to poor physical security measures to major incidents like the Target hack and the Colonial Pipeline ransomware attack, each case underscored the interconnectedness of physical security, industrial systems, and cybersecurity.

Future-Proofing with AI

Finally, we touched on the transformative role of AI in cybersecurity. Adi highlighted its potential in predictive behavior analysis, creating a unified security dashboard, and automating response strategies. However, he also warned of the challenges as adversaries leverage AI for their malicious purposes.

In closing, Adi’s insights were invaluable in understanding the multifaceted nature of cybersecurity across mission IT and enterprise IT environments. His emphasis on adaptability, tailored solutions, and the human factor offers a comprehensive framework for navigating the ever-evolving cybersecurity landscape.

Thanks for tuning in! If you have any questions or suggestions for future episodes, drop us an email at [email protected].

As always, stay curious! -Seth