From cybersecurity and big data to cloud computing, IT Brew covers the latest trends shaping business tech in our 4x weekly newsletter, virtual events with industry experts, and digital guides.

IT Brew

A semiconductor icon depicting IT hardware

Hardware

Eoin Higgins

itbrew.com

Look, up in the cloud! It’s a bird! It’s a plane! It’s a…petaflop?

Supercomputers have come a long way since the days of Deep Thought. Today’s mainframes have processing power that was a fantasy just decades ago, and the advent of new technologies such as AI may only boost their capabilities in coming years.

Petaflops are a unit of measurement for processing power. “Flop” refers to “floating-point operations,” Nvidia Product Leader Dion Harris explained, and “peta” indicates a quadrillion of those per second. It’s a huge number.

The petaflop supercomputer has existed for nearly two decades, and it’s capable of incredible feats. Harris analogized it to using a computer to build a plane.

“You have to simulate the wing, and then you’ll simulate the nose cone, and you’ll simulate the landing gear,” Harris said. “But if you had enough computational power, theoretically, you could simulate the entire plane at the same time with the same level of fidelity.”

Currently, the most powerful petaflop supercomputer in the world 

 at US Department of Energy-funded Lawrence Livermore National Laboratory in California.

The federal government isn’t the only organization with access to that sort of power. Just in the last year, the technology has seen an explosion in accessibility, with smaller petaflop-capable supercomputers hitting the market from Nvidia, Asus, Dell, and others. That increase in access has come as AI capabilities have skyrocketed. As Nvidia CEO Jensen Huang 

: “AI has transformed every layer of the computing stack. It stands to reason a new class of computers would emerge—designed for AI-native developers and to run AI-native applications.”

Today’s supercomputers have gone beyond petaflops and into exaflops. If a petaflop is 10 to the 12th power, an exaflop is 10 to the 18th.

One big change that occurred in the last decade to make that leap possible, Harris told IT Brew, is mixed precision, which allows users to determine which aspects of the computer’s calculations can be executed with less precision—freeing up capacity to do more.

“Think of it like a hammer and a chisel—in other words, the fine-grained elements use it for what you need,” Harris said. “But there are some areas where you can just use a hammer to get down to the crude, fundamental building blocks before you need to do the fine-detail level work that requires more precision.”

AI’s input in the supercomputer process has accelerated the space. What comes next is anyone’s guess, but Jim Piazza, VP of AI, Machine Learning, and Predictive Systems for Ensono, wonders if we might see laypeople rather than scientists and engineers running ultra-complicated simulations. That’s just one potential advancement as the underlying technology continues to evolve.

“Over the last 10 years, we saw an 80%-ish increase in petaflop performance,” Piazza said, adding, “if we follow that curve, and even if you expect that, there’s some point where we won’t see quite as many gains. I do think that we’ll see 5,000-plus petaflops of performance over the next couple of years.”

As supercomputing becomes ubiquitous, Piazza said, advancements could come quickly. It’s a question of access to the technology, he added, that can open the door to working through difficult problems. Piazza told IT Brew he could potentially see changes coming in the next three to five years.

“It’s a good thing for us as humans on the planet to have that technology be accessible to a wider audience,” Piazza said. “Now, obviously you could play devil’s advocate and say there’s also the opportunity for bad actors to creep into that space. But I’m a positive person by nature, and I’d like to believe that people are going to use that power for good, in solving real world problems in that time frame.”

Supercomputers accelerated with petaflops, and AI promises to push the technology further.

Supercomputers accelerated with petaflops, AI promises to push the technology further

“It’s a good thing for us as humans on the planet to have that technology be accessible to a wider audience,” one expert says. 

Brianna Monsanto

In a country so divided, one thing unites us all: the USB-Type C connector.

 USB-Type C, also known as USB-C or just Type-C, is the connector with the small oval-shaped port that seemingly comes with all of your electronic devices these days. And by all, we mean 

“Airplanes, automobiles, cell phones, desk lamps, displays, electronic toothbrushes, medical electronics, power tools, wall sockets. It’s literally everywhere,” Jeff Ravencraft, president and COO of the USB Implementers Forum (USB-IF), a nonprofit organization that looks after the standards for USB technology, told IT Brew.

For the average person, the USB-C connector may be the reason why forgetting a phone charger at home is less of a headache these days: Just ask anyone around, and chances are good someone is carrying one. The widespread shift to USB-C in the past decade marked a significant turning point in the hardware industry.

 USB-C connectors first hit the scene in 2014 when the USB-IF released Type-C specification 1.0. At the time, the tech industry was ripe for a new connector, several hardware experts told IT Brew. One big reason was the desire for a jack-of-all-trades connector that was capable of charging, transmitting high-performance data, and supporting high-performance display, said Ben Hacker, general manager of Intel’s client connectivity division.

“Typically, for the highest performance things, that would be a dedicated connector just for that,” Hacker said. “So, just the best display connector, maybe just the best data connector, and then charging, historically, had been separate.”

Hacker, who joined Intel as a full-time staffer in 2004, added that the tech industry yearned for a singular connector that could be used beyond just the PC market.

Around this time, Ravencraft added, the industry was at an inflection point. Smaller form-factors were emerging, including mobile phones, MP3 players, digital cameras, and more. While Mini-B and the Micro USB connectors were available, these predecessor connectors weren’t designed to support large devices.

“They were originally designed specifically to support cell phones and they were not really robust enough for larger devices,” said Ravencraft, who worked as a senior technology strategist at Intel for more than two decades before becoming the president of the USB-IF in 2010.

Abdul R. Ismail, senior principal engineer at Intel and chairman of the USB-IF, said the quest for a new connector was also driven by the changing function of USB technology and power demands.

“It used to be [that] keyboards and mice and hubs were the number one thing that people were using USB for,” Ismail said. “That transitioned to power. People were using it for charging all the time.”

USB-C connector caught the attention of the tech sector. According to Ismail it successfully combined the three functions that previously required a variety of connectors to accomplish. USB-C specification 1.0 was able to support up to 100 watts of power. In comparison, Micro USB can support up to 7.5 watts.

“You plug your laptop and you just have one cable going into it and you can do power, you can do your video out, and you can do all your other data as well,” Ismail said.

The USB-C connector also had a reversible design, meaning that it didn’t matter which way you plugged it in. Kevin Koestler, business lead of USB-C controllers at Texas Instruments, said this was previously a large pain point for USB-A users.

“You have a 50/50 chance of making sure the Type A port is plugged in,” added Koestler, who joined Texas Instruments in 2017.

USB-C connector was kind of a big deal because it “changed the paradigm” of how people thought of USB; traditionally, USB cords had a different connector at each end of the cable (for instance, one side may plug into your computer while the other into your phone). However, USB-C introduced the new concept of having both ends have a Type C connector.

“That was kind of a new experience for customers and users and people who are just buying the technology and aren’t deep in the weeds of engineering,” Hacker said.

While the USB-C connector had an attractive design and advanced functionality, it was an open question whether the industry would embrace the newcomer. Ravencraft said a connector transition is one of the “hardest transitions a company can make.”

“A connector change is the most difficult change you can make in the industry, second to none,” Ravencraft said. “It affects the consumer. The consumer doesn’t necessarily want to get rid of a product that they paid good money for and it still works fine.”

Despite this, Ismail called the transition to USB-C the “fastest-adopted change in connected technology” the USB-IF has worked on.

So, how exactly did USB-C connectors become ubiquitous in today’s tech landscape? Koestler said the transition happened in three waves. The first occurred within the PC, notebook, and laptop industry.

“It was a natural evolution,” Koestler said. “They had Type A. They wanted something that was reversible, that had higher data, higher power, and so that transition was pretty seamless.”

He recalled Google’s Chromebooks as one of the first devices to take the big leap to Type C. In March 2015, Google 

 that its new Chromebook Pixel would have a USB-C port.

That next month, Apple released its first MacBook with a USB-Type C port and went so far as to make USB-Type C the sole port for the device. Hacker called the move “bold” and said it garnered a lot of 

“That’s a testament to how much they thought that connector was really gonna take over the world, which eventually it has,” he said.

Koestler said the next big wave occurred when the European Union made a successful push for a single connector in a bid to reduce e-waste and provide convenience to customers. In 2022, the EU Parliament voted in favor of requiring phones and small devices to have USB-C ports, giving companies two years to comply. Koestler said this ultimately led to USB-C ports being added to phones, with Apple leading this wave. Apple’s iPhone 15 family of phones sported the Type-C ports. The Galaxy Note 7, released in 2016, was the first Samsung phone to have the new port.

The last and current wave has occurred among a wider range of equipment and industries, Koestler said.

“Not only is it consumer electronics, but now we’re starting to see another wave of industrial equipment…appliances, e-bikes, wireless speakers, server racks, even access points, [and] routers,” he said.

Today, USB-C connectors and ports have become ubiquitous. In fact, the connectors are so universal that manufacturers are taking note.

“We’re starting to see some interesting trends where the customers that we deal with don’t want to ship a charger at all,” Koestler said. “Because it’s so universal, now our customers can just make their end product and then they just assume that the consumer, us, would have a USB-C charger.”

Ravencraft, who says he has dedicated most of his life to USB technology, said USB-C has “hit the high-end sweet spot on power.” The latest specification of USB-C technology allows it to support up to 240 watts of power.

“We believe for where we’re at with data performance as well as power, that we have plenty of headroom with this connector,” Ravencraft said.

Close up of a USB-C plugged into a laptop.

How USB-C stole the heart of the hardware industry

Mobile phones, desk lamps, displays, electronic toothbrushes, power tools…if it needs power, chances are good it has a USB port. How did that happen?

In 2011, Prakash Arunkundrum took a trip to the Logitech office for a videoconference meeting with a participant in another part of the world. Today, the task may seem mundane, but back then, getting on a videoconference call could feel like something it took a village to do.

“Either the bandwidth won’t work, or you wouldn’t know which button to press, or you had a bunch of controllers and you didn’t know which controllers to use,” Arunkundrum said, adding that he ultimately waved his white flag and called for IT help the day of his videocall.

Arunkundrum, now president of Logitech for Business (L4B), Logitech’s enterprise solutions arm, said things are much different now, partly because of the company’s early efforts to simplify workplace technology.

Since 2011, L4B, formerly known as Logitech Video Collaboration, has had big dreams for enhancing videoconference communication. The BCC950 ConferenceCam, one of the first products in L4B’s lineup, aimed to deliver high-quality audio and video through an easy-to-use interface. The device propelled Logitech—which Arunkundrum said was once known predominantly as a “mouse company”—into the unified communications category.

Those bets paid off. Today, one in three meeting rooms and desk solutions use Logitech’s workplace tech, according to data shared by the company.

“We are in finance. We are in boardrooms. We are in startups. We are at your coffee shop,” Arunkundrum said.

Logitech’s early foresight helped propel it to become a leader in enterprise technology as the pandemic transformed workplace norms.

Prior to Logitech’s enterprise product line taking off, Moor Insights & Strategy VP and Principal Analyst Melody Brue said Logitech was known for its selection of computer peripherals.

“They’re known for their keyboards, their webcams, headsets, conferencing systems, and then more consumer gaming accessories,” Brue said.

Arunkundrum said Logitech had wanted to simplify conference room tech, which he noted was “super complex” in the early 2010s. While the BCC950 was the business group’s first product, Arunkundrum called Logitech MeetUp, an all-in-one conference camera device first released in 2017, L4B’s “breakthrough” product because of how it simplified the conference experience.

“We’ve sold over a million units of those over the years, and it’s the fastest-growing meeting room category,” Arunkundrum said. “So, we essentially super-simplified that whole experience.”

 And then, just like that, Covid-19 happened.

When the pandemic hit and forced many workers to adopt hybrid and remote working styles, Arunkundrum said demand for Logitech products surged, both on the video collaboration side and the personal workspace front.

“I’d say there was a Goldilocks moment where some of our foresight actually got fast-forwarded because of Covid,” he said. Webcams on Logitech’s website quickly sold out “due to high demand” during the peak of the pandemic.

 announcing the tech company’s Q4 financial results for the 2021 fiscal year, former Logitech CEO Bracken Darrell said the company had its best year yet. Logitech brought in $5.25 billion in sales that year, an unprecedented amount for the company.

“Our powerful and resilient capabilities allowed us to both deliver remarkable performance in a challenging FY 2021, and at the same time, invest in compelling plans for the future,” Darrell, who departed Logitech in 2023, said at the time. “The world has just caught a glimpse of what Logitech will become.”

The company’s growing traction didn’t end there. Crawford Del Prete, president of IDC, said the pandemic’s lasting impact on the office continued to aid Logitech’s success.

“We’ve all read the stories of the companies that say everybody’s got to come back,” Del Prete said. “Well, the reality is people now work from both places, and because they work from both places, that’s been a tailwind to Logitech’s business.”

Arunkundrum said L4B currently makes up 40% of Logitech’s overall revenue. While the pandemic may now be a not-so distant memory, the business group still has big plans for workplace tech.

In January, the tech company announced Logitech Spot, an office sensor capable of tracking a room’s stats like occupancy, temperature, and humidity in order to make automated changes (e.g., automatically making a room available to book for meetings if its current meeting ends early). In the same month, Logitech also announced Rally Board 65, an “all-in-one portable videoconference solution” that quickly equips the room or small space it occupies with the tools needed for a collaborative conference room.

Arunkundrum said L4B is focused on solutions that enhance the workplace experience as the IT professional role increasingly evolves to support the needs of employees and their workplace environment.

“Facilities, IT, and HR are working closer together than I’ve ever seen, and I think this is certainly something that we are helping equip as part of our technology,” he said.

Del Prete said the new era of products reflects Logitech’s ability to pivot its focus to new areas and innovations.

“They see these opportunities and they move to them and then that becomes a category expander for them,” Del Prete said. “And I think that’s really one of the marvelous features about the company.”

Update: An earlier version of this article referred to the acronym for Logitech for Business as “LOB.” Internally, it is called “L4B.” 

Zoom in of a web camera with a mouse arrow pointing towards it.

How Logitech’s foresight on workplace conferencing paid off 

“We are in finance. We are in boardrooms. We are in startups. We are at your coffee shop,” Logitech for Business President Prakash Arunkundrum says.

Jobs you may not know that exist: ice cream taste tester, professional bridesmaid, snake milker…and USB warrior?

The latter is more of a working title to describe what members of the USB Implementers Forum (USB-IF), the nonprofit organization responsible for improving USB technology, do. If you have a pile of tangled USB cords in the corner of your office, chances are you have encountered the 30-year-old organization, whose members include Intel, HP, and Apple, in one shape or form.

Jeff Ravencraft, USB-IF president and COO, told IT Brew that he has practically dedicated most of his life to advancing these connectors.

“USB is the most successful [input/output] interface in the history of personal computing, and it has migrated now into all types of consumer electronics product segments,” Ravencraft said. “Airplanes, automobiles, cell phones, desk lamps, displays, electronic toothbrushes, medical electronics, power tools, wall sockets. It’s literally everywhere.”

IT Brew caught up with Ravencraft and USB-IF Chairman and CTO Abdul R. Ismail to break down the certification process and what’s ahead for USB connections.

Responses below have been edited for length and clarity.

What does the USB-IF certification process look like? Is it just you sitting in a room, plugging in connectors all day, making sure they adhere to your guidelines?

 We test for 10,000 insertions, but that’s not a person sitting at a desk plugging a connector into a receptacle 10,000 times. Some of it’s done with automation. Some of it’s done through math and parameters of insertions. We also certify silicon that goes in the devices and the host. We certify cables. We cut the cable open, look at the material. We do poisonous gas testing. It’s quite in depth.

 For the poisonous gas test, what we’re actually talking about is aging. We’re aging the cable, five years, 10 years. Those tests are not just to check the poisonous gas effect, but to cause aging of the cable to make sure that it can still work after five years, after 10 years, for example. And for the 10,000 extractions, there’s extraction force and insertion force. We have all these things to make sure it behaves the same way.

How far away are we from ditching port connectors altogether and just going all in on wireless connections?

 Today, there’s not really wireless charging. There’s no such thing. It’s a pad that you lay your phone on, and coming out of that pad is a USB Type-C connector…The issue with true wireless charging is they have not figured out how to actually send wireless signals through the air without killing someone. What if you have a pacemaker? What if you have some other device? How high is the charge going to be? There’s no such thing as wireless charging. I’m not saying they won’t solve it, but they’ve got to solve how to send power waves over the air without killing someone.

Any tips for IT professionals and organizations when shopping around for connectors?

Today, every manufacturer wants to be the lowest cost provider. Now, I’m not saying that’s good. Just because it’s low cost doesn’t mean it’s a good product, but that’s the nature of the beast today…I would caution them to not focus strictly on cost to the company or for their organization.

Always look for certified components. If a consumer buys a certified connector with the USB-IF logo on it, you will be assured that you will get quality products, something that will work every time.

USB-IF goes under the hood on the USB standards process

USB-IF president tells IT Brew that the certification process for connectors and cables involves 10,000 insertions and poisonous gas testing.

As if IT pros didn’t have enough on their plate, decommissioning hardware is another responsibility with the potential for security breaches.

How and when you dispose of old and obsolete hardware infrastructure—whether you’re closing down your business or upgrading your tech—could have serious ramifications. Tim Rawlins, NCC Group director of security and senior advisor, told IT Brew that the sensitivity of data you have written on your hardware can often determine to what extent you’ll need to go to ensure it’s protected before you throw it away.

“At a low level, just rewriting it over, three times is enough. If it’s more sensitive data you might look at fully encrypting the hard drive so that there really is nothing in there that can be obtained,” Rawlins said. “And at the highest level, if it’s got sensitive data, then you would go for physical destruction.”

This kind of data cleanup is often referred to as sanitization. Rawlins said that the need for protection varies depending on how valuable the information is and whether or not there’s a viable threat. Organizations often hold onto their assets for longer than needed, meaning that the hardware gets used past what it’s made for, leading to further attrition when it comes to data on devices and hard drives. And on top of that, there are many boxes to check, according to Rawlins.

“You need to identify the data, you need to figure out how you’re going to destroy it, whether it’s just that sort of digital destruction or physical destruction,” Rawlins said. “You’re going to record that you did it so that you’ve got a record that you can use as part of any evidence that you might need to be able to demonstrate that you’ve done that process.”

The threat is real enough that agencies on both sides of the Atlantic are raising the alarm. 

 from the FBI detailed the risk of attackers exploiting remote access management on old routers to infiltrate systems. These attacks are a way for threat actors to go after internal information and show the threat that old hardware can pose.

In the UK, the National Cyber Security Centre has 

 for decommissioning hardware to avoid the security threat posed by stored data. It also lays out the steps companies should take for sanitization. “Some forms of sanitization will allow you to re-use the media,” the Centre explains, “while others are destructive in nature and render the media unusable.”

David Redekop, founder of DNS and security firm ADAMnetworks, told IT Brew that sanitization has, roughly, two main paths. First, and perhaps easiest, is to hand the work over to a trusted third-party vendor who can manage the sanitization. Second is to do it yourself. Which way you do it should rely on your risk posture, Redekop said.

“Whatever data you have, absolutely none of it should ever leave the premises, or the possession of a trusted employee, or trusted company premises,” Redekop said. “That’s the bottom line.”

Where the risk level is depends on a number of factors, but the primary concern is how much of a target your organization is to attackers. As Redekop explained, high-value targets tend to be those that have highly sensitive data or currency on their hardware; attackers getting their hands on hardware with that data could spell disaster.

“We’re talking about an attack surface that today is still growing,” Redekop said.

Data on old hardware requires sanitization—here’s how to do it

Agencies on both sides of the Atlantic are raising the alarm over the need for data cleanup.

You’ve been tasked to look for new hardware, and cost is a priority. There’s the potential for buying recycled equipment, but you’re wary—who knows if the previous owner properly wiped the device, or, more worryingly, if it’s still accessible from the outside?

Those concerns are part of the calculation IT teams need to make when looking for replacement hardware. As Rapid7 Principal Security Research of IoT Deral Heiland told IT Brew, it comes down to firmware: how it’s managed on the devices and whether the hardware has been sufficiently cleaned of prior data.

“If you’re buying network infrastructure gear, you can usually come in, purchase it, flush everything, factory reset, put all new firmware on, all new passwords, accounts, everything, and you got a perfectly safe device,” Heiland said. “If there is a cloud or internet component to that, then you need to consider, ‘Can I properly flush that disconnect and ensure the device can’t be registered by somebody else after I’ve purchased it that would give them some level of access?’”

The possibility that something can slip is enough to bother security professionals who are 

. For David Redekop, founder of DNS and security firm ADAMnetworks, the concern isn’t just how the device has been decommissioned and cleaned, it’s whether it can actually do the job.

“You need a little bit more horsepower or maybe a little bit more storage, because the drives weren’t as big back then,” Redekop said. “But what you can do with that now is practically the same thing you can do with the brand new one, and so there’s huge economic value in buying used equipment for those that want to run a sustainable business and would like to go on-prem versus on the cloud. Huge, huge value.”

Replacing the firmware on used devices allows for removing data the purchaser doesn’t want; removing embedded data is a chance to ensure the hardware is safe, no matter where you get it from. You don’t want another user, maybe half the country away, being able to access your “new” device, in other words. But for most branded tech, even when it’s used, that’s not an issue—nonetheless, the risk isn’t zero.

Doing a risk assessment is what anyone buying used hardware needs to keep in mind. There’s always the possibility that recycled devices could be used by malicious actors to infiltrate the systems of the buyer, but the likelihood of that happening is minimal unless you’re the specific target.

“If you’re really, really paranoid about security, then obviously buying new stuff is the way to go,” Heiland said. “If you’re fine with a little bit of risk, even if it’s very minimal, then buying on the secondary market may have some real value.”

Cost is often a motivating concern, and that gives the chance to compare and contrast new and used devices. While the newer hardware may have a higher upfront cost, used devices often need the aforementioned extensive patching and wiping, making it a wash. But supply chain uncertainty could change the calculation, offering attackers another way in by alteration between the factory and the user.

Redekop called it “buyer dependent, buyer beware.” It comes down to making the right decision for the specific user, much like a used car.

“If you know what you’re doing, buy it used, because you’re going to get tremendous value,” Redekop said. “If you are a buyer that just needs to go through a tremendous amount of checks and validations, new is going to be the way to go. So, it really is going to vary quite broadly on when I would make a recommendation one or the other. There is no simple answer.”

Aerial view of trucks unloading trash into a landfill

Buying recycled hardware has ups and downs—here’s what to look for

“If you’re really, really paranoid about security, then obviously buying new stuff is the way to go,” IoT researcher tells IT Brew. 

Hacks are a pain, and that’s the truth.

 on a train vulnerability based on remote-control linking got the railway industry to work on resolving a problem that had existed for years. Attackers could, hypothetically, infiltrate a packet that links the head and end of the train, and then control the brakes.

While the Association of American Railroads (AAR) was made aware of the vulnerability as early as 2012, the organization more or less ignored the danger for years, researcher Neil Smith 

 on X on July 11. According to Smith, who was working closely with the federal government’s Industrial Control Systems Cyber Emergency Response Team (ICS-CERT) at the time, AAR declined to take action because the danger of the exploit had not been sufficiently proven.

Sounds bad. But hold on, said Hussain Virani, Dragos response command lead and principal incident responder. The danger might not be quite as dire as it sounds.

“Is this something which we can kind of put off to the side and not pay attention to? Certainly not,” Virani said. “It is important. After all, it involves the safety system. Does it deserve full-out panic? No, it doesn’t.”

In an emailed comment, AAR spokesperson Jessica Kahanek said that “every operational strategy, safety protocol, and piece of equipment is viewed as an opportunity to enhance performance and safety.”

“Accordingly, railroads have, and will continue to, put concerted effort into advancing next-generation end-of-train devices and the technical standards that govern them,” Kahanek wrote. “Next generation devices and standards have the potential to significantly improve communication between lead locomotives and the end of the train, securely enhance reliability, and streamline operations.”

Any unexpected braking would be noticed and acted upon by the conductor, Virani continued, so while there is a danger the actual effects are unlikely to be life-threatening. The human element is helpful, putting people in the process. Plus trains have a system called Positive Train Control, a technology that prevents accidents.

“There’s this overarching safety system in place to mitigate against a system like an end-of-train device failing,” Virani said.

Impacts of the potential exploit go further than the trains and the AAR. Houbing Herbert Song, an Institute of Electrical and Electronics Engineers fellow, told IT Brew that he sees the AAR’s inaction as symptomatic of the way the transportation industry as a whole addresses security concerns.

“The infrastructure is very old, so a lot of people don’t care about the cybersecurity issues here,” Song said. “This problem, this issue, is one vulnerability that has existed for many years.”

A patch for the problem is expected in 2027, 

. That’s a slow fix that could appear to indicate the flaw isn’t a major priority—but, Fortinet Head of Cyber Policy and Global Field CISO Jim Richberg said, the reality is more that in the OT space, security is often a distant third, after safety and reliability. IT security considerations and processes are simply not the first priority for this space, and transportation is no different.

“We’re always going to be playing catch-up,” Richberg said.

In order to manage the threat going forward, Song said, defenders will need to adjust how they approach security as a whole. Transportation isn’t fundamentally different from other sectors of the tech space, though it’s often treated as such; understanding it as a part of the IT security framework—something that experts have called on IoT to do 

“The perspective is to treat transportation infrastructure as a cyber, physical, human system—a social, technical ecosystem,” Song said.

Like most OT-capable infrastructure, the transportation industry moves slowly and solutions are cost-dependent. Virani said that the hard realities of specific maintenance windows and mitigated controls allow for repair, but not on an accelerated schedule.

“If we know this system is prone to a certain vulnerability, then we can put additional measures in place in order to prevent anything from happening, or at least to reduce the consequences,” Virani said.

The fix might not come for a few years, and it’s unlikely that security will become one of the top two priorities for the OT space. But for the train vulnerability, the fact there’s a patch at all is a sign of a positive change that Richberg hopes continues.

“At this point, something like 95% of organizations have got OT reporting up to the corporate CISO,” Richberg said. “They’re starting to say OT affects more than just the OT operating environment, it’s part of the whole business.”

a train with computer error messages overlaid