A quick Interview with CEO and Founder of Waterfall Security Solutions, Lior Frenkel

By Heidi PP, Editor in Chief 

Waterfall Security’s unbreachable cyber solutions keep the world running. Customers include global oil and gas companies and petrochemicals pipeline companies and refineries, among others. The International Society of Automation and International Electrotechnical Commission and many others recognize Waterfall’s Unidirectional Gateways as a best practice for industrial cybersecurity. Waterfall continues to evolve its portfolio of Unidirectional Gateway and associated products, founded the Industrial Security Institute and produces the Industrial Security podcast.

Waterfall CEO and Co-Founder Lior Frenkel has more than 20 years of hardware and software research and development experience. Lior serves as member of management at Israeli High-Tech Association (HTA), of the Manufacturers’ Association of Israel and Chairman of the Cyber Forum of HTA.

I was lucky enough to catch the CEO of Waterfall Security Solutions at his installation at the Offshore Technology Conference held in May of 2023 at the NRG in Houston, Texas.

Where are you based out of?

I am based out of Israel

I read a bit about your company and you are managing cyber security on large scale operations. Tell me about your background and how you came by your expertise in the field of cybersecurity. 

All of my career is in cybersecurity. I started coding when I was 8 and started hacking systems for fun, because, you know, it’s fun. I started getting paid for my hobby when I was a teenager, like 16 or 17. Then I went to the Israeli Air Force and I was there for about 6 years doing technology and the intelligence part of the business. I finished my service, and I founded a company that was doing offensive cybersecurity for the Israeli Government. Really fun stuff. That was a lot of fun. Seeing how easy it is to remotely penetrate presumably highly secured networks, I said hey we need to fix part of that. Because it doesn’t make sense to have critical infrastructures such as Power Plants, RailWay Systems, Airport Systems, etc…accessible from the internet presumably secured by firewalls and VPNs but in real life we penetrate them all day long. I realized critical infrastructure can not be protected in that way. Bad things are going to happen that affect all of us. It has a state level impact, a societal issue, so I moved to open up Waterfall; I built this technology called Unidirectional Security Gateway. We are focused on industrial cybersecurity securing the industrial parts of the industry from remote cyber attacks. To be more specific, let’s say you have an oil and gas company with an offshore platform. The Off-shore platform has the turbines and pumps and everything it needs to pump the oil from the deep sea. You would not like that network that controls that machinery and those processes to be accessible from the internet. 

Right, of course not.

You say right so fast, but they are. 

I guess it is something that we take for granted as the public; that these processes are not accessible, but it sounds like you are saying many companies have left themselves vulnerable to attack. Is it because it has just grown and changed so much that many of the higher ups do not understand what is needed? 

I do not think it is intentional, it isn’t that they don’t care. The technology surrounding industrial operations has evolved in a way parallel to the regular IT technology that we all know. The systems, the sites, the technologies that they are using, a lot of it was designed 15 to 20 years ago, when industrial cyber security was not a real risk. It is a new risk today. Even five years ago nobody really would remotely hack into my system and do something. It was rare; it was mainly part of the game between states and nations, you know, espionage, maybe terror based. A mid-sized oil and gas company in Utah at that time would not think that they were a target for whatever nation was trying to attack them and they were probably right. Also it is the federal government’s business to protect against an attack from another nation. They perceived no risk, so they said let’s use everything. Why not? So they started advancing technologies, and open protocols and connecting everything and enjoying a lot of the advantages and cost reductions that you can get by contracting your control network out to the internet or the vendors, or cloud services or whatever. It really provided a lot of efficiency. Now, especially because of RansomWare, it’s the big thing and it’s not going anywhere. It’s only going to get bigger. 

By RansomWare, you mean when they simply hold a company’s system hostage for a price?

Yes, and doing it from another country. There’s no physical; risk nobody will get hurt or arrested. It is such a profitable criminal activity. They move towards targeting industrial facilities because of the potential risk to the public and the implication of down time. They shut down the Colonial Pipeline for a week. 

Besides just holding it hostage, are hackers able to cause damage such as causing a leak?

The real answer is you don’t really care. If somebody has remote access to your network that controls your Railway System, your water purification plant, your food production, you need to shut it down because it’s a safety risk. That’s what we protect against. 

Has it become more organized? 

It has become dramatically more organized, and also now you can get a hacker for hire as a service. There are groups who have the technology and the know-how. You can find them on the darknet.

How long have you been in the business of working against them?

20 years on what we do. We protect against the number one threat, internet connectivity into Industrial Facilities. Our technology allows data to go out of those control networks but eliminates any possibility of anything coming in. You can connect the control network that controls the oil rigs out to the internet so you can monitor their operations in real time, but nothing can go back. So you can share everything. You can see what’s going on. You have full visibility of all of your fleet, but nothing can get back in comparison to a firewall that does not protect against this. So that’s what we do based out of Israel. https://waterfall-security.com/