Original article published on Forbes
When a hacker tried to poison Tampa-area city’s water with lye (sodium hydroxide) last week, the US public was exposed to an unfortunate reality of interconnectivity. Upon breaking through a vulnerable remote access point, a hacker was able to remotely increase the level of lye in the city’s drinking water from 100 parts per million to 11,100 parts per million — 100 times its normal rate. By chance, a plant operator in Oldsmar, Florida recognized the breech by the hacker who leveraged similar capabilities of a plant manager or supervisor. What would have happened if the plant operator did not catch the change? What could have prevented this from happening in the first place? What if this happened at a pharmaceutical or biotechnology company creating life-saving products, or a power plant keeping city lights and security systems activated? In the last week, the public was simply exposed to a harsh reality: there are bad actors in the world who are looking to cause harm to innocent people, and it is essential to have the right safety measures in place. As a record number of companies and governmental organizations embark on digital transformation journeys to embrace Industry 4.0, they are leveraging Dragos for industrial strength cybersecurity.
Rob Lee, Founder & CEO of Dragos, the global leader in cybersecurity for industrial controls systems (ICS)/operational technology (OT) environments, contends the public need not freak out about every case. “Our infrastructure providers have done right by the community by investing in delivering safe and reliable services. However, as the digital transformation takes place and it converges with an ever increasing industrial focused threat landscape, reality is we have to do more than what has been done before to avoid disastrous scenarios,” says Lee.
Dragos, founded 6 years ago in Hanover, Maryland, maintains the safety and security of hundreds of customers in areas such as manufacturing, chemicals, utilities, transportation, energy, mining, and pharma across more than 20 countries. Dragos recently closed its Series C financing of $110 million, bringing its total funding to $158.2 million from investors like Koch Disruptive Technologies, the investment arm of Koch Industries, Canaan Partners, Saudi Aramco Energy Ventures (SAEV), Hewlett Packard Enterprise (NASDAQ: HPE), Adam Zeplain’s mark vc, and others. With 80% ARR growth last year, the team aims to grow from 220 employees to 320 this year with multiple offices around the world.
“Koch Industries has more than 500 global manufacturing facilities, and the need for protection from cybersecurity threats grows each day,” said Byron Knight, Managing Director of Koch Disruptive Technologies. “As we continue to transform and modernize operations, Dragos will be a key partner in helping protect these assets to ensure we can continue providing products and services our customers prefer.”
Lee, an Alabama native, was born in a military family whose path to founding Dragos resembles one of mere destiny, similar to that of a Tolkien tale. As a student at the United States Air Force Academy, Lee signed up for humanitarian missions in Cameroon, Africa where he had his first taste of control systems. These control systems were used to help generate micro-economies for essential activities including water filtration for clean water and wind turbines for green energy. “At the time, I never knew there would be ill-intentioned individuals in different parts of the world who would try to target these industrial control systems helping support the lives of innocent people,” says Lee. After graduating from the Air Force Academy, Lee’s mission was clear. Instead of accepting a prestigious pilot slot, he became a Cyber-warfare Operations Officer. Several months into the program, Lee questioned what his superior officers were doing about the programmable logic controllers (PLC), an industrial computer monitoring both inputs and outputs that makes a series of logic-based decisions for machines or automated processes.
“Aviation platforms, satellites, naval vessels, and all the power we depend on is all control systems. I was surprised they didn’t know the role of a PLC, so they gave me a platform to teach instructors and students all about them,” says Lee. Lee’s success in the role resulted in an opportunity for him pick his duty assignment from which he chose to work at an intelligence site in Germany over the most prestigious assignment of serving in a cybersecurity role for the White House. In Germany, Lee conducted cyber and intelligence operations supporting counterterrorism efforts. Once again, he questioned what his colleagues in Germany were doing about the control systems, which maintain the security of the unmanned aerial vehicles. Unknowingly, he was overheard by a superior officer and transitioned to a new assignment for the National Security Agency (NSA). For the next few years, Lee worked at the NSA where he created the US Government’s first mission looking at adversaries breaking into control systems. “The program had an immense amount of success. Next thing I knew, I was in briefings with individuals from the White House and US Generals,” says Lee. Following his role at the NSA, Lee built the cybersecurity community’s first class for identifying and responding to threats targeted at ICS at the SANS Institute, the world’s largest company that specializes in information security and cybersecurity training.
“When I completed my service, I thought I’d be done... but, in December 2015, the first ever cyber attack to take down electric power systems took place in the Ukraine,” says Lee. He was called up to lead the investigation, discovering that Russian adversaries broke into Ukrainian power systems, taking it down the different ways Lee’s team warned about. “This is when I saw their answer was more of the same. It was let’s take what we are doing in the enterprise IT networks and copy and paste it into power substations, rail cars, and everything else. I tried to advise them that you have a different threat, different systems, different missions, different risks, so you cannot take the same security controls,” says Lee.
Lee’s mission to start Dragos was not driven by anything egotistical or materialistic. Simply, it was his calling. “I started Dragos largely out of the desire for my child to have lights and water. Starting a software company was not my life’s goal. I just felt no one was going to build an effective solution, so I said let’s go take the smartest people from the industry and show what’s necessary on ICS and codify it to make it scalable across the community... I simply had no choice,” says Lee.
“Combating cyber threats against critical assets that power our operations is at the center of our risk management approach across the entirety of Koch Industries,” said Jarrod Benson, Chief Information Security Officer of Koch Industries. “Industrial cyberattacks can impact worker safety, plant productivity, and business continuity. Safeguarding our data is important and protecting our operations is essential.
Lee has recruited some of the best and brightest for Dragos’ mission. Dmitri Alperovitch, co-founder and former chief technology officer of CrowdStrike (NASDAQ: CRWD), a $53.57 Billion cybersecurity company, serves on his board of directors and discussed Dragos last week at a US Congressional hearing on Homeland Security. “I co-founded CrowdStrike 10 years ago because I was passionate about the mission of protecting the national and economic security of the United States against data breaches from foreign adversaries like China, Russia, Iran, and North Korea. And we largely did that by protecting enterprise IT networks of thousands of enterprise and government customers. Joining the Board of Directors at Dragos and helping Rob build it into the world’s leading industrial security company was a natural extension of that mission. As critical as it is to protect the enterprise IT networks, there is nothing more essential in cybersecurity than safeguarding the physical processes that provide us with drinking water, energy, and manufactured critical goods we need for our survival. I couldn’t be more proud of the work that Rob and the team are doing to literally save lives,” says Alperovitch.
According to Adam Zeplain, Co-Founder & Managing Partner of mark vc, an investor in both Crowdstrike and Dragos, “I received a call from Dmitri (co-founder of Crowdstrike) telling me I needed to get to D.C. to meet Rob. Dmitri made it clear it would be a meeting I wouldn’t regret as Rob was building the ‘Crowdstrike for Industrial’. It’s rare you meet a founder with such intelligence and humility. It became clear to me that what originally looked like an insurance policy or a nice to have, would quickly become a need to have. Rob and his team are quite literally safeguarding civilization, and it was something we had to be a part of.”
What differentiates Dragos from other companies is trust. “Our customers trust that in their hardest hours, we will be there for them backing them up,” says Lee. In the next three to five years, industrial companies will enter an even more converged hyperconnected environment where ICS cybersecurity should not just be an option, but instead a critical component for any company’s digital transformation. Dragos aims to be that trusted partner as the leader and category creator.