Sunday, March 3, 2024
HomeTechHow Krishna Tata is inspiring others to take up cybersecurity in the...

How Krishna Tata is inspiring others to take up cybersecurity in the Operational Technology (OT) space to help secure our critical infrastructure

As our world becomes increasingly reliant on technology, it is more important than ever to ensure that our systems are secure from cyberattacks. Unfortunately, many companies and organizations do not have the necessary expertise or resources to adequately protect themselves. That’s where OT cybersecurity experts like Krishna Chaitanya Tata come in.Krishna, a leading expert in cybersecurity in the Operational Technology (OT) space, is inspiring others to take up this important field to help secure our essential services and critical infrastructure. Krishna has built several cybersecurity products for IBM since 2015, including award winning ones such as IBM QRADAR SOAR and QRADAR SIEM.

He uses his vast repertoire of original contributions in this domain with IBM to raise awareness about the importance of OT security. Krishna’s work is vital in today’s landscape as cyber-attacks on critical infrastructure industries continue rising especially ones targeting federal or state industries. With his knowledge and expertise, he is helping to make our world a safer place for us all.

Read on to find out more about Krishna’s journey and how he’s making a difference in this important field!

Who is Krishna Chaitanya Tata?

I like to describe myself as a fervent practitioner of technology, particularly cybersecurity. This is not just a buzzword or a flavor of the season for me but my life’s work. Technology has vastly changed since my masters from Syracuse University back in 2010. A lot of this change has been phenomenal although also highly disruptive! Things such as artificial intelligence, deep learning, or the internet of things were all so new back then; but have become mainstream conversational topics now. This constant flux in the technology industry fascinates me. In short, I am a cybersecurity subject matter expert and a perpetual technology enthusiast!

How did you get interested in cybersecurity? I asked.


Ever since I was a child, I have always been interested in solving complex problems like puzzles, chess, and basically anything that used to challenge me! During my undergraduate degree in electronics and telecommunications engineering at Pune University (one of India’s premier universities), I was exposed to the intersection of software and electronics. It was fascinating how code could be used to change the functioning of electronic components. During my master’s, I was able to put into context programming languages, machine-level code, and ASIC to see how integral they really were to cybersecurity! 

The complexity of architecting the right solutions and applying that to real-life organizations to help secure them peaked my interest in this domain. 

With so many industries and companies at risk of cyberattacks, what inspired you to pursue a career in this specific field of OT cybersecurity?

Working in the OT world has always been fascinating to me because of how different it is from traditional IT. I consider OT as the real frontier for cyberattacks. We do a lot of work with government and critical infrastructure, so there is a great responsibility to be sure that those systems remain secure and stable. We see daily incidents of various attacks such as denial-of-service attacks on airports, malware attacks on power grids, cyberattacks on critical infrastructures or government agencies, and so on.

The cyber response teams work around the clock to keep this critical infrastructure safe and constantly running. Seeing the potential for chaos and disruption that cybercrime can cause inspired me to focus my efforts on this specific field of cybersecurity in order to help protect people’s lives and assets.

You are considered a leading expert in OT cybersecurity and have built several security products for IBM such as the QRADAR SOAR. Can you walk us through your journey in OT cybersecurity?


Absolutely! I have a Bachelors in Electronics and Communications Engineering from University of Pune in India. I was exposed and developed a keen interest in Programmable Logic Controllers (PLC) and Supervisory Control and Data programming right from the beginning. These are devices that perform automation actions in critical infrastructure industries such as manufacturing, oil and gas and energy such as changing a transformer’s voltage levels, turning off safety valves or changing the speed and direction of an assembly line.

What is interesting is that most of these technologies have been built over since the 1950s-60s till the 90s in an era when cybersecurity as a field was nonexistent and the engineers did not foresee that cyber-attacks impacting their operations.

When I joined IBM, I was interested in increasing the importance of OT security for our critical infrastructure clients. I built the OT security practice starting in 2014 and went to on to create our portfolio of OT security products. The first product I created was IBM QRADAR SOAR in 2016, which was crucial in automating remediation or resolution activities of security alerts, coming from security detection tools. This was the first time we were able to auto-resolve OT security alerts in the cybersecurity industry.

Then I created another product called XFTM for OT, which helped in ingesting OT alert data from detection tools into an already established IBM tool called IBM QRADAR SIEM. I also created another product called VMS for OT which helped in ranking OT vulnerabilities based on their exploitability potential in the wild, as opposed to generic non-OT centric CVSS scores based National Institute of Standards and Technology (NIST) recommendations in those days.

All of these tools form an ecosystem in our portfolio, where OT alerts can be ingested into QRADAR SIEM, OT vulnerabilities can be ranked and scored and auto-resolved if possible using the QRADAR SOAR platform. I also laid emphasis on increased hiring and building our practice by interviewing right OT security candidates for IBM. 

All during the period of last 10 years, I have been constantly interacting with my clients and my efforts in building our products and services always take their requirements into consideration, such as creation of relevant use cases. 

How can I make my business more secure with cybersecurity for Operational Technology and Critical Infrastructure?


Managing your OT cybersecurity is essential for protecting your business from cyber-attacks. First, you should start by assessing the current level of security in all areas of your business from access control to network security, data security and OT device-level security.

You should also prioritize continuous monitoring of your OT systems to detect any malicious activity. Additionally, consider investing in trusted solutions that provide end-to-end security and help you remain compliant with relevant regulations. By following these steps, you can increase the overall security posture of your business and better protect it from cyber-attacks. 

What are the best platforms you would suggest where we can learn more about Cybersecurity in general and Operational Technology and Critical Infrastructure in particular?

For OT Cybersecurity, we always strive to make cybersecurity education more accessible for everyone. We have curated a list of some of the best online platforms and courses available to learn more about Cybersecurity in general and Operational Technology and Critical Infrastructure in particular. Some of the recommended sources are Udemy, Coursera, edX, MOOCs (Massive Open Online Courses), LinkedIn Learning, and SecurityTube.

Additionally, we encourage you to join our upcoming seminars and webinars led by industry experts from SANS and ISA. These seminars provide an immersive and interactive environment that allows professionals to delve deep into the topic of OT Security. 

Cybersecurity involves non-technical skills too such as cyber risk management and policy development. You don’t necessarily need to be a programmer or engineer to get into the field. Employees can cross-train into cybersecurity if interested. I know several colleagues of mine who have found success in this space without technical experience, proving that there are many ways to make meaningful contributions in cybersecurity.

How can I report a cybercrime if my business is attacked by hackers?


If your business is attacked by hackers, you should immediately contact the relevant authorities responsible for cybersecurity in your area. This could be a law enforcement agency, a local or regional cybercrime unit, or an independent third party. For example, in the US you can report a potential OT-related cyber incident to Cybersecurity and Infrastructure Security Agency (CISA) using their online form or helpline.

We recommend that you contact relevant TO Cyber Security agencies as soon as possible so that they can assist you in taking the appropriate steps to mitigate any further damage and protect your critical infrastructure.

What are the types of industries you have worked with in OT cybersecurity? Are there nuances to how cybersecurity is architected for various industries? 

Yes, there are nuances to how cybersecurity is architected for various industries. We have worked with many different types of industries, from government agencies and financial institutions to transportation, utilities, and healthcare organizations. Some of my clients such as Metropolitan Transportation Agency (MTA), American Honda Motors (AHM), NextEra energy etc. are major organizations in the critical infrastructure space where cyber-attacks can cause catastrophic consequences.

No matter what type of industry you’re in, we understand that each OT environment requires its own strengths, capabilities, and security posture. The advantage of working with OT security experts such as our team at IBM is that we know every type of OT environment, so we know exactly how to provide the right security solutions using the most up-to-date technologies.

Any other advice you would like to give business owners that can help them in securing their essential services and critical infrastructure?

Business owners should start by understanding the security risks of their essential services and critical infrastructure and prioritize those risks accordingly. They need to identify the most urgent threats and implement measures to reduce them. This is particularly key in critical infrastructure as these industries have traditionally never prioritized security.

Secondly, they need to ensure that all employees are trained in cybersecurity best practices, such as never clicking on links in emails from unknown senders and regularly changing passwords. Last but not least, they should monitor their networks actively to detect possible intrusions as soon as they occur, and put in active remediation steps. Having a security operations center (SOC) specific to OT is a valuable investment for businesses.

Last question – What is the best or last statement you would want to tell our readers before we end this interview? Any one statement?

As a cybersecurity expert and leader, I highly recommend everyone think about their role in protecting our critical infrastructure. There are lots of opportunities where you can join forces with experienced security professionals like myself and make a significant impact on reducing cybercrime and keeping our essential services secure.



Please enter your comment!
Please enter your name here

- Advertisment -
Google search engine

Most Popular

Recent Comments