Why Cybersecurity Matters: Protecting Our Food Supply from Digital Threats with Kristin Demoranville

Aaron Crow (0:1.518): Awesome. Hey, thank you for joining me. Kristen, why don't you introduce yourself? Tell us who you are and what it is that you do.

Kristin Demoranville (0:8.854): Okay, great. Thanks for having me on the show. I am Kristin DeMaranville. I am the host of Bites and Bites podcast. That's Bites Like You Bite Something and Bites Like Computer Bites, where I talk to cybersecurity and technology professionals and anybody else in the food and agricultural industry about cybersecurity and technology and what that means to our food supply. It's a really fun show, so you can check us out. I'm sure you'll have out of the show notes and all the fun things. Also, we're kind of doing a joint episode here.

Kristin Demoranville (0:38.730): It's one of those things that, welcome to my listeners as well. But what I actually do, I am the CEO of Anson Sage, which is a cybersecurity firm that's focused on the food and ag industry, mainly risk management, OT related assessments, those kinds of things, trainings, lots of trainings. I keep writing lots of trainings on what it means to be a cybersecurity professional in the food industry and how to be a better food professional.

Kristin Demoranville (1:7.902): with cybersecurity knowledge. So that's kind of cool. And then the other thing I am, I'm also CEO of Anzen OT, which is a OT resilience intelligence management platform, risk intelligence, really. It features different things like cyber PHA assessment, scenario building, playbooks, lots of really cool intelligence things behind it. It is new on the market. We are a new startup. So

Kristin Demoranville (1:37.560): come check us out there. I'm happy to talk about that all day long as well.

Aaron Crow (1:41.478): Very cool. Well, and for your listeners that maybe don't know me, my name is Aaron Crow. I've been in cyber security and network security and this OT thing before it was ever called that. I grew up in working in critical manufacturing, power utility, a lot of those critical infrastructures. I actually do have some experience in the ag side as well. I'm from Texas, so, you know, there's a lot of plants and things like that in this space from

Kristin Demoranville (2:4.898): Nice.

Aaron Crow (2:10.280): from chicken plants and a lot of ranchers, cetera. So I also have a podcast, Protect It All, and emphasizing OT and IT. I do emphasize a lot of that in the OT space, but as we talk about this stuff, I had this conversation, this is what, the 14th of August, that when we're recording this, and I just came back from Black Hat and Defcon.

Kristin Demoranville (2:19.594): you

Aaron Crow (2:37.550): And I had so many questions and I work in the ICS Village. I'm a volunteer in the ICS Village, which is a nonprofit. If you don't know about that, definitely check it out. ICS Village is great. They do a lot of training and nonprofit things to kind of spread the word for operational technology and the importance of it. But a lot of the conversations I was having at DEF CON, I've got this really cool Blinky Light OT wall that's got, you know, a PLC and secure mode access and a firewall. And it's really just a conversation piece to help people understand.

Aaron Crow (3:6.814): And I got so many people, this is 2024, there's so many people that came up to me were like, what is this? So I said, this is OT in a box. What's OT? And I'm like, okay. Like we still, many of them, and I love the question. I'm very glad that they said, I don't know what that is. some of them were like, I've heard of it. I don't exactly know what it is.

Kristin Demoranville (3:21.998): Yeah.

Aaron Crow (3:31.058): So it was great to just be able to have that conversation, explain it. And there was one gentleman that he was going for his PhD, his dissertation, and he was writing this dissertation from an IT OT convergence. We hear that all the time. I know my face did the same thing when he said it. And we had this conversation. He's like, well, I think OT and IT have already converged. And I'm like, really? Like explain that to me. He's like, well, the technology is the same. Okay.

Aaron Crow (4:0.158): I'm like, he goes, it all OT now all has IP. So that means it's IT. And I'm like, no. So I had a 30 minute conversation with this gentleman about why I feel that OT is different than IT. The technology is the same. Like we see VMware and network servers and switches and all that kind of stuff that we have seen in IT now in OT. But the difference is, what we do with it and how, what it impacts, right? And the, and the, implementation of, of

Aaron Crow (4:29.544): policies. can't just take an IT policy and push it into OT because it breaks stuff. It just doesn't work. And we've seen that and it doesn't matter the vertical. You're in agriculture, in power utility, in oil and gas, in wastewater. It doesn't work to push it down in that way because it breaks stuff. And it's just a different way. we just saw this crowd strike. I talked about the crowd strike incident a thousand times this week. That's a great example of I should not be patching or pushing updates to my OT systems just

Aaron Crow (4:59.184): Hey, send it all. I should be sending to one at a time so that I can test and make sure like we should all have a testing plan. And it's not a crowd strike issue. It's a, it's a policy. It's the people and process side of people processing technology that are really the biggest difference in OT versus IT. So that was my long rant of, of who I am and what I do and why I'm so passionate about this thing that we talk about.

Kristin Demoranville (5:20.354): I think the biggest difference between IT and OT, and I'm maybe a little bit more blunt than you in this regard, but I always say, well, IT is more about data, right? And OT is about safeguarding lives. We could kill somebody. IT is not necessarily going to kill anybody, right? So it's a different mindset altogether where you're focused more on the people process side and the tech and OT, but we want to make sure it just stays up and available so, you know, someone doesn't fall into a vat.

Aaron Crow (5:33.832): Right, yeah.

Kristin Demoranville (5:49.482): and becomes part of the muffin mix, you know? Or they don't get electrocuted, or they don't drown, or they don't do anything that's awful and horrible and nobody ever wants to go through that. And IT isn't dealing with people's lives necessarily. There probably is a little crossover there somewhere, but generally speaking, when I worked in IT, I was never worried about people's lives. I was more worried about my own life and being assaulted by an end user because they were upset. You know, that was really probably my biggest thing there, right?

Aaron Crow (6:3.058): Right. Right.

Kristin Demoranville (6:18.122): OT, I was worried about me catching on fire, watching somebody else get caught on fire, and all these other things happening around it. And I go back to those analogies, because I think that's how it works a lot. We have to just keep talking that way to find that connection, that relatability. Convergence, I cannot stand that term. It's right up there with air -gapped and a few other terms that we say a lot, because it's silly.

Aaron Crow (6:43.122): Yep.

Kristin Demoranville (6:45.186): We gotta stop putting terms on everything because it's not helping. It's just becoming more of a problem where we just need to focus on, we're trying to protect and safeguard lives along with making sure that all these services that we support stay up and running. Cause we like running water, we like electricity, we like the food that's on our plates. We like that we can just go to the grocery store and buy whatever we want, whenever we want, because there's no seasons in a grocery store now, those kinds of things. And that's why I love working in the industry.

Kristin Demoranville (7:13.934): Cause I feel like I'm having an impact. I'm sure everybody in OT can say this and ICS is we feel like we have an impact on the greater good. And if you say greater good back, we're best friends by the way, because that's how that's the response you do. yeah, yeah. And that's, that's how I feel about, especially the food industry, because it touches so many aspects, all the suppliers, the third parties, things you don't think about, like the containers of food comes in that has to be done in a food grade level in terms of manufacturing.

Aaron Crow (7:24.990): you

Aaron Crow (7:27.730): Absolutely.

Kristin Demoranville (7:43.224): how we're interacting with the food, food safety aspects, all these different things. It's like a jigsaw puzzle, I love it, because it really expands your system thinking and you have to realize everything is in a holistic sphere. And I think that's we do as OT as well, is we're like, if something goes wrong here, up here at like, know, three o 'clock is not gonna be really messed up, if seven o 'clock is messed up. Like, obviously, this is gonna cause a problem with the whole, because we all understand how production works, because it's all the same, right?

Kristin Demoranville (8:12.878): It doesn't matter what you do. mean, it's the same type of thing. Materials come in, they get mixed up and kicked out the other way. But that process in between, the thing that's the most important and the biggest issue is the people in the process. Because technology is not going to cause the problem. It's people. And they'll circumvent everything we do to make sure it gets done because they don't care. They just want to their job and go home, right? And it's daunting.

Aaron Crow (8:34.940): Right. Well, and it's always been that way. Even, even back when I was an IT person, my first job in IT was like a desktop support. And, you know, our joke was always like, if we take the users away, my job would be easy. Right. Cause, cause I can make the technology work. It's the people that cause my problems. Like they they're clicking on something, you know, this is way back in the day dating myself, but you know, the, old school desktops, the big tower things. And we would literally have people use the CD -ROM.

Kristin Demoranville (8:40.593): Mm

Kristin Demoranville (8:47.694): I always said that. Yep.

Aaron Crow (9:3.670): as coffee cup holders and then their CD -ROM tray would break off and we don't have CD -ROM trays anymore or even CDs for that matter. But that's another conversation.

Kristin Demoranville (9:13.128): we're really dating ourselves now. my God. So funny. End users are the best and the worst at the same time. They're the best line of defense and the worst. I once walked into a factory. I think it was a media factory. So made like DVDs and CDs and games for consoles and things like that, which still exists. Console games apparently still exist. I didn't realize they were still making them.

Kristin Demoranville (9:39.530): and their help desk that was on site actually had a sign that said, if you ask a dumb question, I will light you on fire. I just, I died because I was like, wow, first of all, HR violations for days, but good for you. Like you, you set the pace of what's going to happen when someone walks in that room looking for help. So I can appreciate the end user comment.

Aaron Crow (10:4.720): Yeah, and it's the same in any industry, right? But speaking of, so I know you spend time and a lot of time in the agriculture. Before we started recording, we kind of talked about how it doesn't get as much limelight as some of the other, you know, more popular, I guess, is maybe not the right term, critical infrastructure, power, utility, oil and gas, even wastewater and water.

Kristin Demoranville (10:7.876): yeah.

Kristin Demoranville (10:28.547): Mm

Aaron Crow (10:29.758): But there are 17 critical infrastructures in our country deemed by, know, DHS and Department of Homeland Security. why do you think, two things, why do you think that agriculture doesn't get the attention that it may deserve? And secondly, what are some of the common problems and maybe even unique problems that agriculture has in the space that we need to make sure that we're thinking about from an OT cybersecurity perspective?

Kristin Demoranville (10:55.950): This is such a big question and I don't have the right answer. So I'm just going to kind of give you some train of thought on it. Agriculture and the food industry as a whole wasn't added to the critical infrastructure number for CISA or Homeland Security until 2020. That wasn't that long ago. You know, that is disturbing, first of all. I think it's a kind of a twofold issue where people think that the food industry doesn't have any money.

Aaron Crow (11:11.262): All right. Now.

Kristin Demoranville (11:25.550): which is hysterical because I mean, Mars just bought part of Kellogg's today, as of today. And that was a $300 million deal, I believe. Don't quote me, I will put it in the show notes, but it was something ridiculous. So tell me again, there's no money in the food industry. Also, I believe the largest payout for ransomware to date that we're aware of, and I say that loosely because we don't know at all, was the food industry. So there's money. So I don't buy that really very well.

Aaron Crow (11:35.742): Sure. Yeah.

Kristin Demoranville (11:55.084): I think the actual reason is because nobody's got to handle on what the actual supply chain for food looks like. And that was shown very clearly when the ransomware for JBS hit the meat company, because it was awful and still is. I was actually just speaking to some people from the cattle industry last week and they were expressing their frustration of just how difficult it is to manage their supply chain. So what if a supplier gets hit like JBS?

Kristin Demoranville (12:24.568): How do the grocers purchase any meat? They can't purchase it from them, so where do they go? Is there a backup plan? You know, there's all these questions, and I went even further and said, well, what happens with JBS because the cattle couldn't get slaughtered in time. So then you've got cattle that's standing in trailers or in holding pens. You can't retract them to the farm because they don't have feed or space for them probably by then because they've already rotated. There's all these, though, who does the burden fall onto? The rancher?

Aaron Crow (12:48.413): Mm -hmm.

Kristin Demoranville (12:53.442): God, I hope not. Does it fall on the distributor? They don't have overflow pens necessarily. Nobody's ever tested their backup incident response plans. There's no disaster recovery. There's no BCP because people just think, well, it's like business as usual. We're just going to lean on people around us in the community. But the community has shrunk because we're losing agriculture jobs every day because people are moving to cities. It's not as popular anymore.

Kristin Demoranville (13:23.084): It's trying to get a little more trendy, I'll be honest, around like regenerative agriculture because you can be a total nerd and geek and still farm because now you can bring your cyber truck out to move your chicken houses, which looks sexy, right? Like not that a cyber truck's sexy, but it's just the concept of it is sexy. You could use, know, hybrid cars or plugins to do that work. So that kind of is attractive, obviously. It's like, I've been kind of joking around, it's like cyber farming.

Aaron Crow (13:37.536): It does.

Aaron Crow (13:40.691): Yeah.

Kristin Demoranville (13:52.450): You know in a way, but I'm don't quote me on that because if somebody brands that I'll be like well but those kind of things people just don't have a good handle on the supply chain at all because it is Huge and instead of actually and I say this all the time and I rip this off a friend of mine That's an OT in the UK But we literally keep trying to boil the ocean find that silver bullet moment when we just need to sit down and make a cup of tea and if we start focusing on the smaller aspects like

Aaron Crow (13:53.192): Yeah.

Kristin Demoranville (14:21.708): you know, people process because honestly, it's probably easier and less expensive to deal with and then move to, okay, we've got these technology that are in these environments. What are we doing with them? There are companies out there turning tractors into autonomous vehicles via like a little kit. That's O T I C S like, hello. Does the industry know that? Did you know that listener? Did you know that? Like that's that stuff. When I hear that, I'm like, my God, did anybody talk to the security teams around these? Like

Aaron Crow (14:38.202): Mm -hmm. Mm -hmm.

Kristin Demoranville (14:51.478): If the farmer doesn't have a security team, the farmer isn't have time for that. They are just happy if they break even and make some profit at the end of the year. Like that's what they want to do. Keep their families fed, the lights on, their cattle fed, like that's it, right? It doesn't have to be more than that. But here we are as security professionals who have been in the industry long enough, both of us, and we know just how bad it's gonna get because nobody's been dealing with this. So my worry...

Kristin Demoranville (15:21.036): And I know I'm jumping your question set, everybody get in. What my worry is over the next three to seven years, roughly, is that we're gonna have such a major foodborne illness issue out of the food industry because of some cyber attack that hit, whether it's nation state, bad actor disruptor, brand disruptions, whatever, that we're gonna be so rattled that we're not gonna know what to do. And...

Kristin Demoranville (15:46.210): We're going to do the wrong things. We're going to put a band -aid that needs to be a stitches situation, and it's just going to make the supply chain even worse. And that's my concern. And I've talked to a few food safety experts who've asked me on air, literally, hey, how many bodies need to be on the floor before somebody does something? And my response back was probably a lot. And I hate to say that out loud.

Kristin Demoranville (16:9.580): the person who asked me that actually lost a child to E. coli poisoning. So it was this really personal moment of, I'm sorry to say, I just think we're not smart enough to deal with it ahead of time because people don't like being proactive. They just want to be reactive because whatever reason. And that's frustrating. And I'm about to use some buzzy terms, so everybody just brace, but we need to move away from being in recovery mode all the time to being resilient, especially in the food industry.

Aaron Crow (16:19.965): Right.

Kristin Demoranville (16:38.314): And that's what I constantly go in and talk about. You're going to get hit with an attack. I don't want to hear that you're not because you are. Are you prepared? And the response back is, I don't know. That's bad. Let's get on it. know, like that's, let's just not even think about it. I actually, as an owner of a software company, I actually got hit with a brute force attack a couple of weeks ago. And instead of freaking out, we quickly triaged and everything was fine. We didn't have any issues. No breaches happened, nothing like that.

Kristin Demoranville (17:7.404): But I actually afterwards, I had this cackle laugh for like five minutes with like tears, because I was like, we're legit, we got hit. Because you got to turn it around to be like a positive in a way like, yeah, we're cool enough to be hit. Like, what did we do? Sweet, you know, whatever we're doing is must be working our branding or keep it going because we're doing well. And I think if people started looking at it from that almost a comical mindset, there might be the laser to roll through it.

Aaron Crow (17:21.968): Right. Yeah.

Aaron Crow (17:27.720): Keep it going. Yeah.

Kristin Demoranville (17:36.962): But I am very worried about our food supply chain. And I'm not just speaking about the United States. I'm speaking globally, because it impacts globally. It's not just here.

Aaron Crow (17:44.305): yeah.

Aaron Crow (17:46.526): Well, and we saw so many supply chain issues during COVID. Like it really brought to bear how bad our supply chain in general was. We're already concerned with global warming and population and all of these things. The way that we do farming today with, they talk about how our top soil is, we have limited, yes, we're limited in how we can do that.

Kristin Demoranville (17:50.774): Well, you

Kristin Demoranville (17:56.110): Mm

Kristin Demoranville (18:10.284): of the monoculturer. Yeah.

Aaron Crow (18:14.332): regenerative farming is the way of the future, but how do we feed everybody with that method? And there's just so many things that go into that, but just basic, again, you hit on something that I repeated probably a hundred times this week in all the conversations in Vegas, talking at Black Hat and DEF CON, and it's OT a lot of the times, it's not sexy. The things that I need to do in the very beginning are not,

Aaron Crow (18:41.406): AI and quantum computing and all of these fancy buzzwords. Most of the time it's very basic. You know, do I have a recovery plan? Do I know where my critical assets are? Do I have an asset list? Do I have a recovery option? Have I executed that thing? Does everybody know what part they play? It's usually basic, basic, you know, tackling, right? And it's not all technology based. Maybe let's say it's 50%, which I don't even think it is that.

Aaron Crow (19:11.890): less than half of it is finding a technology solution, which there's some of the vendors that I work with that don't like it when I say that. I'm sorry, but it's the truth, right? There is no product I can grab off the shelf that's gonna take away all the risk if I install it in an OT environment. I wish there were, but there's not. There's just not.

Kristin Demoranville (19:29.464): There isn't, there isn't, and there's no real collaboration. It's getting better. shouldn't, I'm sorry, I shouldn't say that because a lot of the OT products want to work together in some type of a collaborative environment, but they're still like, you know, this is mine, that's yours kind of thing, which is fine and whatever, I get it, but there's no, how is an end user supposed to navigate all these products when they're already working on slim margins and whatnot? Because you know this being in the utilities, there's no money.

Kristin Demoranville (19:58.530): Like money's allocated out, it's forecasted to hell. The food industry is the same way. And everybody runs on slim margins and slim production because they want to get things moving and they call it efficiency. They bring in just product enough that they have to get in and then push it out. It's never anymore so there's no spoilers or overflow. The water industry actually is learning how to feed itself, as I say, where they're selling their gray water to data centers that are close by to them.

Aaron Crow (20:24.606): Sure. Yeah.

Kristin Demoranville (20:25.018): Brilliant, brilliant strategy, right? But that now means that OT is in data centers even more than it was before. Has anybody thought about that? Because your cloud needs OT. Like, hello. It's pretty obvious, right? And the water guys need more love because they don't get any either. And I will advocate for them until I turn blue in the face as well because we need water for so much stuff in the food and ag industry, obviously.

Aaron Crow (20:37.597): Right.

Kristin Demoranville (20:53.582): and we already have droughts everywhere. So there's that fun moment as well. Glaciers are melting. We have droughts. Global warming. Fun times.

Aaron Crow (20:56.222): Mm -hmm.

Aaron Crow (21:3.627): Well, a friend of mine is, I won't name the name, but a friend of mine works at a social media company with a very large data center. There's quite a few of them. It doesn't matter which one it is, but they have millions of PLCs, millions, controlling all sorts of things from temperature to pressures to lights and air conditioning and Val. There's so much, there's Halon systems and all these different things.

Kristin Demoranville (21:12.109): Mm -hmm.

Kristin Demoranville (21:18.255): yeah. Yeah.

Aaron Crow (21:29.692): Buildings have OT, any skyscraper, even not even a skyscraper, just a normal building you walk into. There's controls around sprinkler systems and all these different things. OT is everywhere. We just didn't always classify as such. Like it's a new term, relatively new term. It's been around forever. We've been doing automation since the 50s and before really, but automation has been around. We've just started putting the technology side and putting IP addresses on it.

Aaron Crow (21:57.150): So we brought these other risks into this space, but the OT has been here for, I mean, my dad worked in power utility for 40 something years. He's in his mid seventies now. He's been doing this, this whole time. He was never cyber related. It was always control systems and control engineer and, you know, automation and instrumentation and, know, even continuing, you know, emissions monitoring as that came in to be a thing. But all of these things have been around for decades.

Kristin Demoranville (22:8.216): Mm

Aaron Crow (22:27.336): We're just solving new problems to old, adding new problems to existing and older problems.

Kristin Demoranville (22:33.550): It's true. And I have a similar situation. My dad was a fireman for 45 years, and that was all industrial equipment and PLCs and various other things. And he never really made the connection until I explained what I did. And then he kind of was like, huh, so you're like a chip off the block kid, aren't you? Like, this is like a continual theme. said, yeah, civil service clearly runs with the family, dad. I mean, because that's, that's really kind of what we're doing is civil service. But yeah, no, absolutely. The more we added tech into these environments,

Aaron Crow (22:55.600): Exactly. Right.

Kristin Demoranville (23:3.660): And I mean tech by like internet ready, IOT, that kind of stuff. The more we turned all these legacy devices onto the internet, they were like, whoa, what is this? I don't know if I like this space. I might cause a problem now because like, know, like it's kind of like you gave your grandparents like a cell phone or a smartphone and they were like, what is this? And all of sudden they started falling for all those scams.

Kristin Demoranville (23:28.654): It's kind of the way legacy tech works. It's sort of just like, hey, you're my friend, come on in. I don't know you. And the problem is we didn't put any guardrails around that at the beginning, and now we're still kind of digging out. And it's so funny because you go around the world and it's the same everywhere. I mean, that's the united front for us. It's really quite brilliant in that regard. I thought I was going to deal with it less in certain countries than I did in others, and nah, it's the same all around.

Kristin Demoranville (23:56.290): We can't get people in process, right? That's what keeps messing it up. But I do absolutely adore this industry. I think that we're a great group of people. I also think that we should start some type of a game, because you just gave me an idea about how we'll be in a place like Vegas or wherever we are at a security conference and play the game of like, kind of like a bingo game or like a trivia game. Like name all the ICS OT equipment that's around you. Go.

Kristin Demoranville (24:26.670): You have, here's the number, it's about 150 or something like that. It's like a scavenger hunt, right? I think that'd be cool. So if somebody does it, let us know, because we totally want to participate and probably dominate it and win it. But I just, that's how I used to do it too, when I'd be sitting around with people who didn't understand, I said, well, where we are right now, I can count at least six devices that are close to us that run that type of equipment. And they're like, well, I don't understand. I said, that elevator? That alone. Like, you know, that kind of thing. And it's...

Aaron Crow (24:30.034): Right. Find them all. Yeah.

Kristin Demoranville (24:55.660): It's so interesting watching people realize like, well, I've worked with that kind of equipment before. Well, you've been an OT then. Like that's, I'm not saying you are an OT person, but you have worked in it before. I actually jumped into OT at a bakery company and I didn't even make the connection I was doing OT because I was doing IT. We didn't have an OT department. We were the OT department, but I didn't know all the really cool technology.

Aaron Crow (25:3.282): All right.

Kristin Demoranville (25:20.010): names and bells and whistles and things. I just was like, the thing that goes over there and doesn't kill anybody. Like that's all I recognize it as. And realizing as I moved through my career, I was like, I've been an OT for a while. Yeah. Okay. Like that's fine. But I enjoy it because we're protecting people. It's not just about the data because data is sexy. Don't get me wrong. It's like, you know, the new gold and we all love it because it's cool and gives us good things we can look at.

Kristin Demoranville (25:47.608): But the idea to be able to sit at the end of the day and realize that you helped save someone's life and kept them to go home to their family, like that's amazing. Like that feels really good, really, really good. And I want to continue to do that, especially when it comes to food, because we're like a breath away from a foodborne illness because we don't understand food security around the tech that's in these environments. And we just keep adding more stuff because digitalization is a huge thing in the industry.

Kristin Demoranville (26:15.618): They've been automating forever. You if you think about the food industry as a whole, how it's come up, you know, we originally were the ones plowing the field and we would attach the cattle or whatever horse. And then we moved to the tractor and da da da. The food industry has been innovating forever. They're great innovators. R &D is fantastic. I mean, we have lab grown meat now. Hello. Like these are things that are like kind of crazy. We can 3D print a salmon. It will be pea protein, but we can do it. So for me,

Aaron Crow (26:41.020): Yeah. Right. Right.

Kristin Demoranville (26:45.652): Why aren't we attaching cybersecurity to technology more? And I don't want to get into the whole product security conversation because that's a whole different rabbit hole and I, blessings upon the people who do that work. But why aren't we having more of that conversation inside of these environments? It's because cyber needs a rebrand for OT. We literally cannot explain what we do very well. And I think if we could, we'd probably win more hearts and minds for that people process aspect.

Aaron Crow (27:15.036): Yeah, absolutely. And the talk I gave it at DEFCON actually in the ISIS village was about cyber informed engineering, which came out of a term came out of Idaho National Labs, which is a DOE sponsored laboratory. And the whole concept around it is we need to build cyber as part of the overall system and integrate that when when I'm designing the system, cyber needs to be considered. Right.

Kristin Demoranville (27:15.928): for sure.

Aaron Crow (27:43.122): We've got old equipment, we've got legacy equipment, we've got new equipment. Anywhere in there, we need to be considering cyber as a risk and as a part of our remediation. How are we going to recover? When we say cyber, people that are outside of this or even people at DEF CON and Blackout, when I had this conversation, they immediately think, well, I'm a nation state, North Korea, China, whatever. It doesn't necessarily mean that. It can be simple ransomware.

Kristin Demoranville (28:6.862): Mm

Aaron Crow (28:9.830): It can be misconfigured hardware. can be insider threat. Like there's a lot of things and it's not always bad actors from another country that are, you know, trying to attack us and start World War III. Some of them are, but not all of them.

Kristin Demoranville (28:13.793): Mm -hmm.

Kristin Demoranville (28:23.042): Yeah. Yeah, I know exactly. And I think we have to think beyond it inside of the OT environment. So I'll give an example, right? And people can think what they want with this one too. Please. I would love to hear your thoughts around this. You have an allergen issue inside of a factory. So you have a peanut area and a non -peanut area. You have a disgruntled employee that goes from the peanut area to the non -peanut area. Whose problem is that? Sure. Food safety, food defense. Absolutely. You get that problem.

Kristin Demoranville (28:52.376): but it's also cybersecurity's problem, because with the industry that we work in, food and ag, cyber -physical is still cybersecurity to me. Physical security is still cybersecurity to me. That access control should have been managed better, whether it would have been biometrics, if you could do that without gloves or those kind of things, eye scans, badge readers, that's cyber, and IT, which also could be connected to OT depending on your access level control, where you are. Cameras.

Kristin Demoranville (29:21.634): There should have been cameras, there wasn't. I mean, the only reason they found out is because they did some testing on the other end from Quality and they realized, whoops, we have peanuts in our cookie that we shouldn't have that go out to this major retailer, which they lost that retailer because of that incident, because they lost face. It was a mess. It was a total brand incident, total nightmare. That, to me, is something that cybersecurity and OT should have been involved in.

Kristin Demoranville (29:49.622): It shouldn't have happened in the first place because they should have set up parameters to get around that, you know, not to ever happen. And then on top of it, we should have had that conversation. We should have been part of that conversation. That bothers me a lot that we don't think that far because that's a resilience piece. Cause people are like, well that's not, that's not an adversary. That's not a cyber attack. It's an insider threat. To me, describing this incident to a food defense professional, they literally said that's terrorism.

Aaron Crow (30:11.857): Mm

Kristin Demoranville (30:18.178): they would class that as terrorism on their report. And I went, wow, so that's like domestic terrorism? They're like, yeah. And I'm like, whoa. So now we have a whole other level of things I didn't understand at that time. And now looking back on and thinking about the system as a whole, yeah, we have a stake in this. We have responsibility. Access control is our problem. And I've had to define what a cyber physical system is multiple times recently. I thought it was self -explanatory. I'm sorry. And I'm not.

Aaron Crow (30:46.738): should

Kristin Demoranville (30:47.756): I'm not picking on people who don't know, but I literally have had four people in the last two weeks ask me exactly what that is. And I've been on air when it's happened. And I'm like, well, it's something that can get on the internet. Like, I guess that's how the best way I would describe it to you. It's something that could be both physical and cyber related. So push a button, pull a lever, but you could also sit on your couch and push a button on your phone, you know? And people were like, cyber physical. Wouldn't that just be IOT? I'm like, not necessarily.

Aaron Crow (31:6.438): Right. Right.

Aaron Crow (31:15.077): Right.

Kristin Demoranville (31:15.862): So we've got some branding term issues we need to deal with in order to make this more mainstream, even though it is mainstream because we all eat and we all work around this a lot. And I don't think it's us. I don't know. I don't know what it is. But we need kind of a rebrand on the OT side to be able to start communicating what we need in order to serve the companies and the people that we do.

Kristin Demoranville (31:45.678): Because we can sit in room all day long and geek out and get excited. We do every time we're at a conference together. Everybody's like, woo. I will say that OTICS conferences are my favorite, not because I'm biased, because I'm in the niche. But we have a different conversation. It's personal. It's almost intimate, because we understand the human factor here differently. And we look at it like that in a very severe way. And like you said,

Aaron Crow (31:51.281): Yep.

Kristin Demoranville (32:13.046): It's not sexy all the time. We have to wear more protective gear that makes us look crazy all the time. I mean, you have hard hats behind you, right? I mean, I have had to wear multiple hair nets and like basically a shield and you have to like put yourself into a zip up like white suit and booties. Like it is not, you are not attractive. You look like a stay puff marshmallow went wrong. Like a, you know, it's not good. And I, but I still love it.

Kristin Demoranville (32:41.784): Like I can't imagine not working in this industry, right? Like I can't imagine not being here. And the fact that I get to sit on podcasts like this and talk to people like you, it's just so much fun. I have such a great time here.

Aaron Crow (32:52.130): Yeah. Well, and there's so many, again, we mentioned it, but there's 17 critical infrastructures. And the reason that they've been categorized as critical is because they're critical to human condition as Americans in our country. And if any one of those go down, it is going to impact our lives, all of our lives, not just yours, not just mine, but everyone's like, if the power goes down, you can't.

Aaron Crow (33:17.374): pump gas, you don't get water, don't like everything tumbles down. you. Exactly. So the reason these things are critical is because really smart people sat in a room and they said, hey, what are the things that if they go down are going to impact society like the bigger society? So there's there's 17 of those. And I would argue and I've worked in many of them, not all of them, but many of them. And I would say almost all of them, at least the ones that I've been in, are

Kristin Demoranville (33:20.630): You can't go on a hospital. Forget the hospital. Don't even bother going.

Aaron Crow (33:47.002): underfunded, under, people don't understand the risk, including the asset owners, and they don't have the right people and processes. And unfortunately, cyber is not designed and engineered into the system. And it's an afterthought. And unfortunately, usually an afterthought after something bad happens, like the example you just gave about the peanut, right? They start looking at these systems when there's an attack, when there's a breakdown of physical or cyber incident,

Aaron Crow (34:15.610): And then they have to because the spotlight is on them and they're required to, and then everybody else maybe hopefully around them that are similar say, it happened to them, it could happen to us, we should look at that too, or there's regulation that comes down. So unfortunately, that's where we sit a lot of times in this industry is, and it's not because the companies are bad companies, like it's not, these are some of the best people I've ever worked with. They want to do the right thing, but they are strong behind.

Aaron Crow (34:42.482): They can only do what makes them money. And unfortunately, cyber and all this stuff is not a revenue center. Like we're not creating revenue value. My power plant's not more efficient. I don't create more wheat because I put in cyber security. It's more almost like an insurance policy and nobody likes paying for insurance. It's just like this.

Kristin Demoranville (35:3.062): It's a return on investment, right? You've got to value your property, if you will, or your IP or whatever you want to call it. If you don't, then you're going to be running into this constant recovery mode that we're stuck in. Like on repeat, we are on repeat in recovery mode. We need to get out of recovery mode and start focusing on being resilient because it's going to happen.

Kristin Demoranville (35:25.822): And there are cost -effective ways to get around it, but again, it's not the sexy stuff, it's the people stuff, right? And nobody wants to talk about people because people are hard. And maybe that's part of the reason why food and ag and even water kind of got left to the side is because people are hard. And maybe that's part of it. Also, the people who came to the table first were oil and gas. I mean, they have a stronger lobby. Let's be real.

Aaron Crow (35:48.200): Yeah. Yeah.

Kristin Demoranville (35:48.898): But most of the countries that are out there also have their critical infrastructure and food and ag was put on there's the first bit. I don't, and we have so many examples and I know, I don't want to be heavy like nation state poo poo here, but here we are. We already have examples of how this is happening. If a country who needs, if they want to disable a country, destabilize a country, they will do that through electricity and food.

Kristin Demoranville (36:18.926): because they want you to freeze to death in the winter and they want you to starve. It's basic warfare, right? I think we all kind of picked that up in critical thinking in college, you know, and if we didn't, we picked it up a long way anyways. That scares me that we already have examples. Ukraine is a great one. I'm not a great one for a good reason, but it's a great example of this for happening. And it's so frustrating to me that we still haven't realized this.

Kristin Demoranville (36:45.550): I have a good friend of mine who is a agricultural futurist. He's a strategist. He does focus on cybersecurity as well. And he asked me deadpan one day, have I ever starved? Or what was the longest I went without food? I'm like, I don't know, 48 hours maybe because of a flight situation or something like that. And he goes, he's like, I tried an experiment for 10 days. And he's like, I didn't make it that far. And he goes, it made me realize.

Kristin Demoranville (37:13.998): how many hours or days would it take you to commit a crime if you had to feed your family and there was no food? And I thought, I don't know, probably some people make a couple hours. He goes, if he said the average of something like eight hours, and I was like, that's chaos. That's chaos in the street, literally. And everybody would feel it the same way. I can't imagine specifically the United States being in that type of chaos with

Aaron Crow (37:18.535): -huh.

Kristin Demoranville (37:43.852): the amount of guns we have in this country, for example. I just think that that is, this would be apocalyptic, right? So the fact that we haven't completely focused dead on to how we're gonna deal with the supply chain, yikes. And also we're growing so much food for animals rather than human consumption. And I'm not saying that's bad because we still have to feed animals. it's sort of like, it still doesn't make sense to me that we're still feeding animals like soy and corn. I understand like,

Kristin Demoranville (38:13.762): they don't normally eat that. And it's kind of weird to me, but we don't have the grazing ability for herds that we have to do that the normal natural way, I guess. So the fact that we have these monocultures that are killing the topsoil, and there's been some studies recently that come out because I'm a total nerd for the environment because I have a degree in environmental management. I love wastewater treatment facilities. I think they're coolest things ever.

Kristin Demoranville (38:38.872): But they're doing a study right now based on the wars that are going around the world. What's that doing to their topsoil as well? And how that's gonna impact the world on a global front. And I'm like, yeah, now we've got that to worry about. Like, great, like what's next? Locusts? I'm sure we've got that coming too, you know? I'm not asking, I don't want it. I'm all set. If it's a bug, it was a.

Aaron Crow (38:56.766): Careful what you ask for.

Aaron Crow (39:2.652): Well, the the the one the one thing I'll say on that is, is you look back and we do have a couple of examples of that and in America and you go back to Katrina when we had the hurricane that came through in New Orleans and we saw martial law in two or three days and people that were were committing crimes and going at gunpoint. And these are not bad people. These are these are everyday people like you and me that are desperate.

Kristin Demoranville (39:14.574): Mm -hmm.

Aaron Crow (39:31.346): because their family is starving, their baby is starving, they don't have food, they don't have water, they don't have a way to evacuate. There were basic needs in our country and that was with FEMA and with the National Guard and the amount of public services that we have and it was one small area. Imagine that on a large scale. Imagine that across our country.

Aaron Crow (39:52.402): When we can't just, you know, rally the troops from all over their country to this one geographical area. Imagine if that was on the East coast in the center and on the West coast all at the same time, it would be, we wouldn't even recover as well as we did at Katrina. And we all agree that we didn't recover well then, like it was really not our best time.

Kristin Demoranville (40:14.016): No, I mean, look how the other disasters that have happened, whether it's the train accident or Flint, Michigan, they're still have fallout because priorities shift and we've got to spend money in other places or we've got conflicting opinions or something stupid like that. This is why it's so important for OT to continually beat the drum of this is a problem.

Kristin Demoranville (40:40.236): this is where it needs to be fixed. If you aren't willing to fix it, you now have to accept the risk of this could potentially happen. And by the way, when I'm not gonna turn around and tell you I told you so, I'm just gonna give you a report so you know. Like, and I'm here if you need me kind of thing. Like, that's it, it's all we can do. But the fact that we have to sit on this type of knowledge all the time and go to sleep at night, it gets a little frustrating sometimes. And...

Kristin Demoranville (41:6.654): And this is why I think as a community in OT, the fact that we all support each other so well and kind of uplift and kind of have that, you know, therapy moment, if I even want to use that term, when we're together is so important because I have sat there and listened to tales, and I know you have too, of just stuff that's going on. And obviously we're being very respectful. We don't talk about where it's happening or what's going on. But to have someone tell me that story.

Aaron Crow (41:19.186): Yeah

Kristin Demoranville (41:36.300): and then you could see the weight lift off of them. But now it's on you, because you now know. But the fact that we can come together as a community like that, I just wish the rest of the cyber community would do that. Let's rally behind each other instead of just being jerks. That would be great. And like I said, I adore this community in general. And I love that we fit so well into the companies and the places that we serve, because we're just as geeky as they are for what they do.

Kristin Demoranville (42:6.514): And I, like I said, we all love to eat, so it should be a no -brainer there. You know, I realize that all of us have different relationships with food based on your body and different things in your life, but we all do like to eat and we identify with food from where we're from. It's part of a cultural experience. We celebrate with cake. We say goodbye with cake, right? Cake is kind of the thing. We also have, you know, our favorite food memories. I talk about this on my podcast all the time. What's your favorite food and your favorite food memory?

Kristin Demoranville (42:37.090): What is your favorite food in your favorite food memory?

Aaron Crow (42:39.646): I have so many because my family, I grew up in Texas and a lot of our celebration, all of our celebrations are really around food. My grandmother making food and you whether it's fried chicken or whatever it is, I remember my grandfather having these big mouth. He was very, very skinny person, grew up very poor. But you know, as an adult, like he just loved to eat. So it was always just this big mound of we had more food than we could ever eat in a lifetime. Every time we got together, it was always around food.

Aaron Crow (43:9.550): And that's the irony of what you just said, right? Is that food memory. We all have those food memories. Now, maybe the food that we bring is different because of where I grew up or where you grew up or what country you're from or whatever. But I think we all tie back to breaking bread together, right? And some of the best relationships, know, the best nights out wherever, you when I go out with my wife, the best meals that we've ever had, I think they would not be quite as good if they weren't with her.

Aaron Crow (43:38.226): Right? It's the company that you're with. Yes, the food's great, but if you have great food and horrible companionship, all those things are linked together. So it's not going to be that great and memorable of a meal. But if you're with great, the people that you're with are amazing. The food can be mediocre and it's going to be the most memorable time that you have. And you're going to be like, yeah, we had this and it was a really good burger or cake or whatever the thing is, because you're there together. It's part of human nature.

Aaron Crow (44:7.068): that we have all of these things and that we tie it all around the campfire and cooking and eating food together. It goes back to the beginning of time.

Kristin Demoranville (44:16.696): Yeah, it's also identifier, right? I mean, you say you're from Texas, so Tex -Mex, we all kind of know what that is in this country. People who live in other countries, because I do have a lot of listeners around the world, you probably had some variation of it in your own country, because sometimes other countries do it better than us. Who knew? And I've had some of the best curry of my life in Japan, not Japanese curry, but Indian curry, because they do it really well. The UK has its own version of curry, whatever.

Aaron Crow (44:20.988): Yep. Yep.

Aaron Crow (44:29.182): Sure. Right.

Aaron Crow (44:36.776): Right, yeah.

Kristin Demoranville (44:44.013): I think that it's interesting how much that blends, right? Because my fiance's British, we do curry on Friday nights as an example. And curry wasn't something that I grew up with. I grew up in New England. We eat basic, boring food. No offense if my mom's listening, I love you. But it's one of those things where I wasn't used to that, but now it's blended into my culture and my reality, right? And I love how food brings you together like that. Try something new, experience something different.

Aaron Crow (44:53.054): Sure, Brian.

Aaron Crow (45:5.180): Yeah. Yeah.

Kristin Demoranville (45:12.120): but also have the nostalgia of things you remember. And I remember family cookouts too. I mean, we did some weird things with salads and jello and I don't know what was going on. The eighties and the nineties were kind of complicated or with like mayonnaise and like, and anyways, and you know, I'm Yeah. What was the cool whip? the, yeah. So just too much.

Aaron Crow (45:28.754): Margarine, lot of margarine.

Aaron Crow (45:33.542): yes, yes.

Kristin Demoranville (45:35.756): Too much, yes, but these are brand names that we remember and they're still on the market. You can still get them and they're very clearly there. I mean, I don't know if I'd have it now, but because I'm in a different state in my life, but you know, it's fun for kids, you know.

Aaron Crow (45:40.286): Mm -hmm.

Aaron Crow (45:49.694): But even today, like my kid wins, you know, gets a trophy or whatever, we're celebrating with food. Like, let's get you ice cream. Let's celebrate with ice cream. Let's get you a cookie. Like all those types of things. And we try not to go too much because, you know, we don't want them to be unhealthy. But at the same time, it's fun. It's memorable. They enjoy it. Like we, get joy from this food and we take it for granted, especially in America, where we have unlimited amounts of food. If I want anything, I grow the grocery store and they have it. Like anything I want you like.

Aaron Crow (46:19.294): curry, know, sushi. Like you can literally go to your grocery store and get sushi. Is it the best? No, but it's pretty darn good comparatively speaking. Think about 200 years ago, trying to get sushi in the middle of the country. Like it wouldn't have happened.

Kristin Demoranville (46:34.488): mean, you could probably cut open a freshwater fish and try to shishimi yourself into it, but I don't know about that. But I think it's also changed my perspective on food. When you have it in an authentic space, like I've had the privilege of going to Japan several times for work and I can't eat sushi in the States anymore. It kind of wrecked it for me. It's sort of like, I can't drink Guinness in the States. I really only want an Ireland or the UK. Certain things have changed, but then you wait for that moment and you have it and you're like, yeah.

Aaron Crow (46:38.364): Right. Nope.

Aaron Crow (46:52.444): Right? Yeah.

Kristin Demoranville (47:3.202): And it becomes this whole awesome thing. And if I think about the fact that we have all these issues globally, some of this food that we love and we talk about may not be available to the next generation or the generation after that because we made bad choices, people process. And also the idea that a cyber attack threatened people's lives through food, I can't really think of anything even worse than that, right? Honestly.

Aaron Crow (47:18.930): Right. Yep.

Kristin Demoranville (47:32.322): because it's such an intimate attack. It's an intimate attack. It's not just like, we're going after finances and da -da -da -da, no, no, no, that's to destroy people. That keeps me up at night, not every night, but there's some nights where like, my God, we're just like a hairpin from it sometimes and it scares me. And I don't want people to know that because I do have professional and friends that have lost children to E. coli poisoning and other different poisonings.

Kristin Demoranville (48:1.346): to tell a parent that their child is passing because of a burger that was contaminated, I mean, that makes me want to burn a house down. Like that's not that I'm an arsonist because I'm a firefighter family. However, I will say it does make me very angry. And my anger doesn't matter, right? Because at the end of the day, I can only do what I can do. But I want more people to understand that, especially in the OT space, we are doing things that safeguard lives on a whole other level than we expected to in our career.

Kristin Demoranville (48:31.938): I certainly didn't think this was going to happen in my career. didn't think it would be like putting a, someone was like, you're putting a cape on every day and like a superhero. And I was like, I don't know if I want to go that far, but if it helps you with the visualization of what I do, that's fine. But I don't want to put myself on that level. This isn't a pedestal moment because we are a team. Like OT works as a team. We really believe that we are in supporting each other. Yeah.

Aaron Crow (48:34.568): Now.

Aaron Crow (48:56.294): 100%. Honestly, I think we should all put on the cape, right? I think it's everybody's duty to do your part in whatever small way that is, right? The people part of that is we all have, you know, a calling to do something and your little, each person's little contribution in stopping and saying things and raising your hand and not just, well, he's smarter than me. He's been here longer than me. I'm not going to say anything. No, raise your hand.

Aaron Crow (49:23.420): voice that concern, bring that thing up, push that agenda or idea ahead because it matters. In the grand scheme of things, it takes us all to challenge, know, evil prevails when good men do nothing, right? It's really that simple of, we have to stand up and say, no, that's not okay. Like we have to stand up, even when nobody else in the room is gonna agree with you. I don't care, stand up and say it.

Kristin Demoranville (49:43.149): Yeah.

Kristin Demoranville (49:46.966): Exactly. And be curious, start asking questions like, really? Is that OT? Like, I want someone to actually ask me that, like, do you think that's OT? I'm like, yeah, it's connected to the internet and whatever it's, you know, and I want that question. Be curious to the point of annoyance. We don't mind. We really don't. And we want you to ask questions. And we also want to ask questions. That's what we do because we are constantly evaluating everything. It was funny. When CrowdStrike hit as an example.

Aaron Crow (50:1.352): Right, yeah.

Aaron Crow (50:15.838): Mm

Kristin Demoranville (50:17.186): First of all, my heart went out to anybody who's dealing with it, obviously. But it didn't surprise neither myself or my fiance because both of us are in security, and OT specifically. And it was just one of those like, mm -mm, you know, like this is not good. However, hopefully it's a lesson learned moment where you can't just have one thing holding the pillar up out of all of it. You need to actually have a better look at it.

Kristin Demoranville (50:41.868): And I hope that the people that were affected are taking a long -hungered look of what they have in their environment now, what else could be critical and concerning, right?

Aaron Crow (50:51.038): Yep. And my biggest concern with the whole CrowdStrike issue is that I think from what I've seen, I think a lot, and from my experience, a lot of these folks are going to be pointing the finger at CrowdStrike as a company and looking at, this is what you did wrong. And I'm not saying there is no blame because in this it's just like, you know, anything there's blame, there's plenty of blame to go around, but that's not going to solve anything. At the end of the day, yes, there was a misconfiguration. They pushed out something.

Aaron Crow (51:19.390): But ultimately the bigger problem was, that these companies just randomly pushed it across their entire organization without testing. Like in an OT environment, especially in a power plant environment or any of these critical infrastructure, I would never just blind, I don't care if it's been tested 50 times before. I'm gonna push it to one system, make sure that it comes back up, and then I'll push it to a second one and make sure that one comes back up. And then I'll push it to a third one. It's a pain in the butt and it takes longer, but it's what I'm gonna do because I've,

Kristin Demoranville (51:30.754): Yeah.

Kristin Demoranville (51:42.403): Yep.

Kristin Demoranville (51:45.386): It's phasing,

Aaron Crow (51:49.182): I've seen the bad side of this for the past 20 years. This is not the first time I've gotten a blue screen because of an update. So I'm not going to get burned by that again. And we've gotten, it won't. And it's not CrowdStrike's fault. Like, yes, this incident it was caused by CrowdStrike, but it's not the bigger picture of the root cause analysis. If I did a root cause analysis on this, the issue, yes, that was the trigger, but that is not the root cause of the problem that caused this bigger issue.

Kristin Demoranville (51:57.708): It won't be the last time either, you know? No.

Kristin Demoranville (52:15.776): It's people and process. really is. And I actually, when the event happened, I messaged a good friend of mine, my best friend actually, who works in a cheese company in Wisconsin, insert laughter. But I asked, said, I know you guys have CrowdStrike, like are you guys all right? And he goes, well, actually we happened overnight. We were able to pull some backup systems and we're able to roll it back. it didn't affect our production. It just affected like a sanitation shift. And I was like,

Aaron Crow (52:18.085): Exactly.

Kristin Demoranville (52:42.238): thank God, like, you I was really, and I was checking on other friends just to make sure they were okay kind of thing. And thankfully the food industry was okay, which is good from the small sampling I did in my life. But I was glad to hear that they focused on resilience more than recovery. And I was like, yes, like we're getting there slowly. I don't care if it was five people I knew, but it was good. But as OT professionals,

Kristin Demoranville (53:9.166): I can't even tell you when you read an article or have a conversation with somebody and they're like, yeah, it's about legacy systems that aren't patched. Is it? I mean, there are systems inside some of these factories that I've worked in, I know you've seen this too, that are probably like 40 years old, probably running a 98 second edition rocking it, right? 98 second edition is a solid operating system if it's still up, I'm sorry. We all know you don't touch the dust.

Aaron Crow (53:27.491): huh. yeah.

Aaron Crow (53:35.248): Yep. Yep.

Kristin Demoranville (53:38.550): You don't touch anything on it because it's probably holding it up by a thread, which isn't good because you don't want that either. But there's ways around dealing with that that you don't have to upgrade because upgrading a system like that is probably running one process that comes up once a quarter. It's going to be millions of dollars, probably the entire budget for a year for a company. Right. The trick is, is just making sure that you segment it and you know it exists and making sure you watch it. Like, just watch it. It doesn't have to be anything more than that.

Aaron Crow (53:38.886): Yep. Yep.

Aaron Crow (53:53.971): Yep.

Kristin Demoranville (54:7.298): It doesn't have to be the big fancy everything around it and all these bells and whistles. I mean, if you could afford all that, that's cool, but do you need all that? Somebody once said on a podcast of mine, not that long back, do you actually need that tech? Are you okay without that tech? Specifically talking about farming. And I was like, that's a really great question because you actually need it. If everything's working okay, and you're okay and everything else around it is okay.

Aaron Crow (54:29.096): Mm -hmm.

Kristin Demoranville (54:37.102): Why do you need to bring that in? And he goes, isn't that just another risk attack factor? And I was like, this is a brilliant conversation, I love this. Because it's true. That's how I think about it in one of these industrial environments, do you actually need that? Do you need to be able to sit on your couch at night and monitor the temperature of your vat? I mean, if you do, tell me, that's fine, but do you really need it? Because you have a 24 by 7 plant. Do you personally?

Aaron Crow (54:42.822): Mm -hmm.

Kristin Demoranville (55:6.494): Why do you need it? Are you going on vacation? You shouldn't be looking on that on vacation anyways. What is this? If it's got a practical reuse, that's brilliant and we'll do it. But if it's anything crazy, let's rethink it. I think we need to have that conversation more in the industry, especially in food, because we automate and we add all these really cool things and we do all this stuff and it's awesome. And now we have Chick -fil -A mobile delivery units in Georgia. I don't know if you see them. They look kind of creepy.

Kristin Demoranville (55:36.499): It's literally like a little bike that drives up to your house and it's all automated and it's insane. And I'm just like, I don't know if we've gone too far. Like maybe we need to roll that back.

Aaron Crow (55:41.202): Wow.

Aaron Crow (55:49.800): Well, I'll give a last story here and it's very similar to that, you know, working in these places. Operators have, we do what's called operator rounds where they walk around with some kind of handheld. It could be a piece of paper, whatever. In this particular area, it was a power plant and they were, we had RFID tags on equipment. So they would, the operator would walk up and they would scan the RFID tag and it would pull up the operator round portion and it would be a valve or a

Aaron Crow (56:18.686): a gauge or something and they would put in readings, temperature, pressure, vibration, they put hands on it, they talk about if there's anything, any oil leaking or if it's dirty or whatever the thing is for that. And it could be 10 steps long or it could be 100 steps and it could take them all around the facility. And we started noticing as we were doing reviews of the operator round and the data, the data didn't make sense.

Kristin Demoranville (56:44.760): Hmm.

Aaron Crow (56:44.862): And we were trying to get better information to do tuning and all that kind of stuff. And it just didn't make sense. And sometimes the numbers were like way off. Like temperature would be 9 million. Like, yeah, I don't think so. So is that an error? Is that an operator error? Are they entering it wrong? Is a key sticking? Like what is going on there? So as I'm walking in and I'm doing this, and so I've got this guy and we're doing around and we're walking and he's scanning and we're going through it and everything looks fine.

Kristin Demoranville (56:56.642): Yeah.

Aaron Crow (57:11.868): And then at lunchtime we go in the break room where all the operators hang out and they're in there playing dominoes. And as they're playing dominoes, one of the guys he's like, hang on. And he leans back in his chair and right behind him. He's got, he's got the handheld in his hand and he leans back in his chair and he scans an RFID tag that's sitting on the wall and he does something on his thing and he goes back playing dominoes. And I was like, what did, what, what did you just do? He's like, man, I got to do a round right now, but I'm in the middle of the game. I'm like, okay.

Aaron Crow (57:41.958): What'd you just scan? He goes, I made a copy of all the RFID tags are out in the field and I just scan them right here and I can do it right here from launch room. So they had gone out of their way, gotten blank RFID tags, went through all the rounds and duplicated every RFID tag. And he knew how long it took him to get from one to the next. And he was just randomly scanning them and putting in fake data.

Kristin Demoranville (58:3.054): No... I mean...

Aaron Crow (58:8.502): So, so it goes back to your point of sometimes you don't need the RFID tag and the fancy thing to make it more efficient and know exactly when they're scanning. Sometimes you just need somebody to watch over and say, Hey, that's not a good idea. And those things had been there for a long time and nobody noticed. Nobody saw saw somebody. It took me five minutes. Like I was in there for half a day and I saw him scanning in the lunchroom and it was very obvious.

Aaron Crow (58:36.658): but nobody ever checked. And it's not the guy was a bad guy. He was just, everybody else had done it. He thought it was okay. He didn't understand. And it really came back to a people problem. And it wasn't that this was a bad person. He didn't understand the value of the round. So when we started digging into it, it was like, dude, we've been putting fraudulent data in here forever because the system is broken and nobody says anything. So obviously you guys are not getting value from this. So it's a waste of our time. And that's really what it came down to is

Kristin Demoranville (58:47.939): Yeah.

Aaron Crow (59:6.226): They thought it was a waste of time. So why am I gonna go walk out there for something you're not looking at anyways? I'm gonna stay here and play my dominoes. And he wasn't wrong. And we were trying to fix the problem. And the ultimate problem was explaining and fixing it so that we were looking at the value instead of just having them do medial tasks to make sure they weren't being lazy, which is what originally I think the thing was put in for. And it completely broke it and it blew it up and we changed the policy.

Kristin Demoranville (59:15.446): No, he wasn't.

Aaron Crow (59:33.872): all throughout the company because of that one incident that we found and he didn't get in trouble. In fact, I thanked him for letting me see it and help and I asked for his help to help me build a better process that they would be part of and want to make it better.

Kristin Demoranville (59:49.550): See, this is why you gotta go back and talk to the people because they'll find the exploits for you, you know, and they'll tell you. And he didn't do anything inherently wrong. It just, it seems a little shady. Of course, when you describe it, you're like, my goodness. But at the same time, like, first of all, good on them for exploiting a system, like for, that was causing a problem for them. But like I always say, if you put a control in no matter what it is,

Aaron Crow (59:55.432): Correct.

Kristin Demoranville (60:18.614): If it's affecting their production level or interferes with their safety, they work around it. I've seen it too many times. And also if you don't work with the environment you're in, it's never gonna work. Well, I remember, this is something I learned on the job. Did you know that wifi signal does not go through bags of flour?

Aaron Crow (60:23.154): Yep. Yep.

Aaron Crow (60:39.922): Makes sense? Yeah.

Kristin Demoranville (60:39.928): Fun fact, it does, but I had never made the connection because I never dealt with it before. And I found a maintenance manager who had no cybersecurity background or IT background on a scissor lift moving an access point because they couldn't get signal to pick the orders on their little forklifts. So he was up there and I just happened to be in the factory that day walking to the floor to get to the production area and I caught him and we had a fight.

Kristin Demoranville (61:3.842): right on the floor, not physically, just verbal altercation of you're an idiot, you're an idiot kind of thing and back and forth. And then my response was, why didn't you do a heat map scan for the wifi when you had a full warehouse? And he goes, because we're busy. And I was like, okay, then there needs to be some give and take here. Let's have a conversation. I got somebody in to do it right after and we were able to kind of like readjust a little bit, but man, exactly, people are gonna do whatever they have to do to get it.

Kristin Demoranville (61:33.590): either play dominoes or get orders picked, for sure.

Aaron Crow (61:36.442): Exactly. Exactly. So we've been at this for about an hour. I know that we both have a lot going on. Why don't you tell us where you, I know you mentioned you've got some speaking engagements coming up. Why don't you tell the audience how to hear from you, where they can find you and maybe see you live in person doing some conversations around this fun stuff.

Kristin Demoranville (61:56.440): Sure, I am easy to find on LinkedIn because I have a very long last name. So good luck with that. And obviously I have a website for Bytes and Bytes. So you can find me there. Both my companies have websites. I'll make sure it's in the show notes for everybody as well. So I don't have to read it all out. But I am speaking at the Food Safety Consortium that's going to be in Washington, DC. The dates are, stand by because I don't memorize everything in my life.

Kristin Demoranville (62:26.606): They are going to be on the 21st. be speaking and then I have to haul my butt down to Atlanta because I have two speaking engagements in Atlanta for ICS conference in Atlanta this year. I'm very excited about that. I'm actually talking about agriculture as a forgotten critical infrastructure. So you can continue this conversation with me there. I'm also speaking with another CEO from excellence, which is a cyber physical company.

Kristin Demoranville (62:51.414): out of the UK and we're going to be talking about the food industry and why you need to care about cyber physical. So that should be really fun too. And then I am speaking at in cyber in Montreal, but doing a round table type, I guess, fireside chat, not panel. It's going to look like a panel, but it's not a panel about why agriculture is important and the work that bio ISAC is doing. And also I'm going to have a food safety expert that's going to be there. He's also part of the,

Kristin Demoranville (63:18.272): Emmy nominated documentary Poisoned on Netflix. If you feel like watching that, it's an excellent documentary. So that should be an amazing conversation too at the end of October. I think I'm speaking some other places too, but to be honest with you, can't remember right now because God, there's so many of them, but they're obscure. So they're not necessarily OT. I bring OT wherever I go though. So I hope that people know that that's what I'll be talking about. But yeah, I am very excited about the fall, autumn, sorry for the UK listeners, autumn.

Kristin Demoranville (63:48.238): because God knows we can't say fall.

Aaron Crow (63:50.440): right?

Aaron Crow (63:53.310): Well, that's great. There's a lot of opportunity. There's so many fun places to go and learn and grow. Not everybody can go to Black Hat and Def Con. Not everybody should go to Black Hat and Def Con. RSA, S4, there's just so many great conferences. I'm actually going to a new one in Savannah, Georgia called Reset Con that's focused on ICS. And it's the first year it's going, super excited to be there. Happens to be my wife's birthday weekend. So taking her so that she can enjoy Savannah.

Kristin Demoranville (64:1.762): Yeah. No.

Kristin Demoranville (64:11.137): Mmm.

Kristin Demoranville (64:18.445): one.

Aaron Crow (64:21.886): while I do some nerdy, know, geek squad type stuff. But yeah, that, always doing stuff with the ICS Village, any place they're at. I'm usually there in a volunteer mode having conversations like this. I love having conversations with people, no matter what their experience level. If you're a student or you you've been doing this for 30 years, there's always something to learn and great conversations to have. And that's why you and I do this. Like we want to spread this knowledge, not pretend that we know it all. We never.

Aaron Crow (64:49.802): I never claimed it. I've never heard you claim it. yeah, I mean, we just enjoy having these conversations and using our experience for good to, you know, to hopefully make a difference and make, make, leave the, leave the space in a better place than where we started out.

Kristin Demoranville (64:51.286): I, nope, don't know anything.

Kristin Demoranville (65:6.328): That's right. That's exactly what it is. Absolutely. And I'm hoping that I've heard a little rumor on the wind that hopefully there's going to be a B -Sides ICS being built. So I'm excited for that wherever that is and whatever it is. So, cause we, we deserve our own B -Sides, you know, that's how I feel about that. Yeah, that's right. I'll let, I'll let the organizer know that there's support coming out of the airwaves now.

Aaron Crow (65:21.502): That'd be great.

Aaron Crow (65:24.334): Absolutely. Absolutely. I'm down. Let's do it.

Aaron Crow (65:34.148): Absolutely, for sure. We'll broadcast it everywhere. Well, thank you for your time today. I really appreciate it. It was a great conversation. I'm sure I will see you. think I'll be at ICS in Atlanta. I'm not exactly sure as you'd kind of like what you said. Like my schedule is all over the place depending on where I'm going to be. So, but that is definitely one that I usually try to get to.

Kristin Demoranville (65:42.051): there.

Kristin Demoranville (65:53.102): Yeah, it's a little bit closer for some of us on the East Coast. It's difficult getting across the country. know people in other parts of the world are like, well, imagine if you're traveling 12 hours. Yeah, it does feel like that though, by the time we get over there, the time zone changes and everything.

Aaron Crow (66:6.696): For sure. Exactly. Well, thanks again. It was, it was a great conversation. really appreciate it.

Kristin Demoranville (66:13.272): Great, anytime.

Transcript lightly edited for readability.