Key Conferences and Networking Opportunities for Cybersecurity Professionals in 2025

Aaron Crow (0:3.320): Happy new year, everyone. Welcome back to Protect It All podcast, where we tackle critical issues facing OT cybersecurity, technology, IT, cloud, kind of everything, obviously with a critical infrastructure and OT spin. But we definitely tackle things that are non OT and hit the business and enterprise side as well. My name's Aaron Crowe. This is the first episode of 2025. New year means new challenges.

Aaron Crow (0:31.187): opportunities and events to look forward to. I'm going to pause there and start over.

Aaron Crow (0:42.648): Happy new year, everyone. Welcome back to Protect It All podcast where we tackle critical issues facing operational technology and informational technology, IT and OT, cyber security. Obviously there's definitely a spin on critical infrastructure from power utilities to trains, manufacturing, critical manufacturing, hospitals, supply chain, that kind of thing. But also, you

Aaron Crow (1:6.626): Technology doesn't stop at the plant. It is impacted by the things in the corporate side, the things that are put in the cloud as, as, architectures and organizations change. there's that, that line, that clear line of delineation between IT and OT is blurring. so, you know, yes, I definitely talk about a lot of OT stuff, but have to really make sure that we're talking about more than just, you know, the stuff that's at the plant or the manufacturing facility or on the plane, the train, et cetera, right. maritime.

Aaron Crow (1:36.206): Um, uh, my name is Aaron Crow. Uh, this is our first episode of 2025 new year means new challenges, opportunities and events to look forward to. Uh, today we'll discuss, you know, what's ahead, um, how you can get involved, uh, and some major OT cyber security events, uh, and news that should be on your radar. Uh, let's, let's dive in. Um, so kind of what to expect in 2025, um, definitely doubling down on the mission of the podcast.

Aaron Crow (2:2.298): providing actionable insights for OT and IT cybersecurity professionals. We're gonna explore how evolving landscape threats impact critical infrastructure, emerging trends in OT and IT. I don't wanna say it, but the convergence word that everybody uses, security technologies from secure mode access to all the different things, the buzzwords,

Aaron Crow (2:31.288): passive, active monitoring, asset management, patch management, all the things that we're needing in this space. And most importantly, how do we build resilience into systems? It's not all about technology. It's people process and technology. You can't just buy the latest and greatest widget, whether it's a firewall or any of the other technologies, the tools themselves don't solve the problem. You need good people, you need good processes to make sure that those, even a...

Aaron Crow (3:0.086): an inferior product if implemented well is better than the greatest product that is not managed and sits on the shelf and doesn't actually get utilized. The tool itself doesn't solve all the problems. Expect deep dives into real world case studies. Definitely having lots of expert interviews, folks coming on with expert experience, case studies, vendors with solutions and kind of everything in between and definitely actionable takeaways.

Aaron Crow (3:28.078): to level up your cybersecurity strategy. I look forward to folks reaching out who wants to be on the podcast. Maybe you've been on podcasts, maybe you're a vendor, maybe you're a asset owner and you want to kind of get your case study or your example out there. Or maybe there's some things that's coming up on the horizon that you want to make sure that everybody else in the field. I see this as a team sport and really want to make this a platform where people feel comfortable and come on and learn, grow and expand.

Aaron Crow (3:58.274): Let's dive into upcoming events and how to get involved. One of the best ways to stay ahead in the field is by getting out there. Networking is huge. Learning and sharing knowledge are great. Going to conferences is a big way to do that. There's so many conferences out there today. I definitely can't list them all. Not even all the ones that I'm going to go to or my team or others are going to be going to, but some of the top ones in the industry to mark on your calendar.

Aaron Crow (4:26.602): Really kicking off is going to be S4 in Tampa. Usually it's in Miami this year. It's in Tampa. Really excited about that. This is a place for advanced discussions on OT security. It's happening in February. Again, Tampa, Florida. It's a great way to kick off the year. All the OT folks will be out there. The vendors and asset owners. It's a big one. And besides, ICS is going to be there as well the day before. So again, that's just a great place.

Aaron Crow (4:54.318): you know, very, very low entry costs to get into. And it's at the same place and time as S4. So those are a great one, two combo to hit in there. So definitely we'll tag that and Mike Holcomb, who's kind of leading that ICS one and obviously Dale with S4 and one of my favorite conferences all year long. RSA conference. Obviously that's not a OT cybersecurity conference. A lot of these are not dedicated to OT.

Aaron Crow (5:21.442): But RSA is a very, very large cybersecurity conference in San Francisco. It's in April, I believe. And it's definitely huge. So many vendors, so many great conversations and talks and speeches. And I'm there every year with ICS Village in the sandbox where you can come and touch and we'll have kits, kind like the one I have back there. That's an ICS Village kit. We'll have our OT wall.

Aaron Crow (5:49.102): There's a lot of different things that you can actually touch and play and ask questions. And you know, there's there's a lot of opportunity no matter where you're at in your career, whether you're the cyber executive or you're the guy, get guy or gal just first getting into into cyber. Definitely, definitely a good one to come to. Black Hat and Def Con in Vegas. Probably you've if you're in cyber, you've definitely probably heard to heard of it. If you've never been, definitely recommend Black Hat is is more of the

Aaron Crow (6:18.534): commercial, you know, very similar size and whatnot to RSA. And Defcon is definitely the, you know, engineer hacker conference. Same group of people. Well, there's definitely different people at them, but a lot of the folks, you know, kind of bridge both of those. It's a week in Vegas. And these those two events are back to back in August. We're actually I'll talk about it a little bit later, but we're actually going to be hosting a shooting event.

Aaron Crow (6:49.547): in Vegas at a gun range. So definitely check out their reach out if you are a cyber executive and or vendor looking to sponsor events and black hat grid grid set con. That's a favorite one for me as being a former asset owner. It is it is around the electrical grid. It is essential event for utility professionals. So if you are a

Aaron Crow (7:14.830): control systems person, you work in a power company, you support power industry, know, NERC SIP, you know, all the different things that come with that. That is definitely a one to get. It's put on by one of the ISACs. ICS Atlanta and Houston Seccon, OT Seccon, those are great ones. They're quote unquote regional conferences. I don't really know if that's true. They're both really big. I went to Houston Seccon this year.

Aaron Crow (7:41.602): great conference. You know, the guys that put that on are, it really just has turned out to be an awesome, awesome kind of S four in the fall, which is, which is really great. You know, lots of insights, lots of good talks, vendors. Again, I'm there with ICS village. I mean, I'm in a lot of these with ICS village. If you don't know what ICS villages definitely look that up. Thomas van Norman leads that with, with Bryson Bort.

Aaron Crow (8:7.554): and just a great organization to get information out there. They're actually going to be doing some training this year, having training opportunities. definitely, definitely reach out for information if you want to, volunteer and, or just, you know, learn more about, OT. All right. So lastly is, I kind of teased to it before, the Lone Star cyber shootout. we're actually doing it in a few weeks, January 16th and 17th at staccato ranch just north of Austin while the shooting days at staccato.

Aaron Crow (8:37.102): We're actually having an executive dinner on that Thursday night round table conversation at the vineyards at Florence. I'm so excited about this. It's not just about cybersecurity, it's about building community. One of the kind of pillars that you'll see through this is networking. There's a lot of knowledge at all of these conferences. Some of the benefit that you don't always see on a P &L or an ROI,

Aaron Crow (9:5.318): is the connections that you make and the things that you can learn from others in the field, in the industry. So having the ability to rub shoulders, to ask questions, to get to know these people beyond just what you see on LinkedIn, go shake somebody's hand and actually talk to them, have a beer, have a coffee, go to lunch. Those relationships and connections help you build your personal brand, but also when you need help, like, hey, I remember Bob did this thing at his last place or at his current place. Let me go ask him how, what do you?

Aaron Crow (9:35.500): What he thought of that, whether it's asking about a product, whether it's asking about a vulnerability, whether it's asking about, you know, how did he get budget or how did he get something approved or him or her? Like it's it's so over. can be overlooked, especially coming as an engineer type, you know, technologist who focuses on getting the latest certification and learning the latest, you know, skill set. That skill set needs to be considered.

Aaron Crow (10:4.034): having the ability to build your network, your personal brand to again, if you lose your job, if you're looking for a new job, if you're looking to grow and get to that next career path or again, technical questions, et cetera, having that network is priceless. All that to say, the Lone Star Cyber Shootout is really that, right? It is networking, it's doing fun activities together. Yeah, this one happens to be shooting.

Aaron Crow (10:33.242): But you know, there's a lot more to it than that, right? It's you know, again, the dinner the night before there's a lot of networking stuff. We're doing a factory tour where they build firearms. So there's some OT, you know, looking at machinery and how they secure that stuff and just their overall process. Very, very cool. Definitely don't want to miss out. All right, so let's move into some of the some of the latest events that have been in the news. Not all of these are cyber events. Not all of these are specifically OT.

Aaron Crow (11:1.862): but unfortunately the news over the holiday season reminds us why our work is so important. there, there's just been a lot going on from, know, the airlines going, and, know, being unavailable during peak times, unable to book, book flights, know, flights getting canceled. there's been a spike in things targeting airline systems, causing delays, raising concerns about pasture safety, all of that.

Aaron Crow (11:29.366): All of these systems are old. They're big. They're complex. It's not as easy as, well, let's just upgrade it. Let's just add a firewall or add a whatever thing it is. It's not that simple. OT many times is very complicated and why it's antiquated is no surprise. Cell phone provider data breach. I think we've all kind of seen some of this stuff with

Aaron Crow (11:59.266): You know, even the government coming out and saying, don't use text messaging because it could be compromised. Using, you know, secure channels like Signal and, you know, WhatsApp and other products really tells us something that, you know, normal text messaging is potentially compromised. Now, obviously your, you know, text message to your wife saying, hey, grab some milk is not a big deal.

Aaron Crow (12:26.264): But it's the bigger picture of things. I know I just posted a podcast the other day about cyber criminals and how they use your information to attack you. And it goes to that, right? If they have more information about you, they can use that against you. Having information can be dangerous. Again, it's not just your social security number and your PIN or all that. It's just how you speak. How do you normally interact with your loved ones and family and friends that can be used against you?

Aaron Crow (12:57.547): obviously this today is January 2nd, on new year's Eve, there were terrorist attacks in New Orleans, not a cyber event. but it, just really shows, there's a growing concern around, you know, tactics and, you know, terrorist activities. You know, this time it was a, it was a person in a car or a truck, driving over people, and, know, had IDs in his truck.

Aaron Crow (13:26.516): there were multiple other IDs. There's obviously it's fairly new, not, not trying to get into any of that, but you know, there were potential other, other attackers as well. And then there was the cyber truck, Tesla cyber truck explosion in Vegas. again, not a cyber event, not an OT event even, right? there were fireworks and explosives and gasoline and all that kind of stuff in the bed of the truck. and exploded in front of the, you know, the Trump, hotel in Vegas. So,

Aaron Crow (13:55.202): There's just a lot going on in the world. It's easy to get distracted. It's easy to get concerned. This is the time where we need to be diligent around, you know, stay in my lane, focus on what I can control, secure my areas. If I'm working as an asset owner, if I'm, whatever, whatever my focus is, focus on the things that you can do. Like look at the small stuff, the details matter. These incidents highlight the importance of not just securing digital systems, but understanding the interconnections of physical operations.

Aaron Crow (14:26.635): I've talked about it before, but this goes to, you know, security by design, cyber informed insurance, you know, engineering, I've had conversations around this. talked about it at DEF CON and a talk I've talked about a couple of times at conferences, but this really goes to that, right? Is, is all these systems are interconnected. I can't just work on the cyber side of things. There's the physical, the operations, the safety, all of these things are interconnected.

Aaron Crow (14:53.678): We need to make sure that we're considering all of them when we're looking at, you know, upgrading, controlling, you know, securing these environments. So on to a better note or higher note or not so depressing or frustrating note. If you want to make a difference in 2025, how do you get involved? You know, attend a conference. There's there's lots of conferences that are that are in your area. There's beside stuff. There's stuff all over the country. Again, like I said, there's way too many that I could list.

Aaron Crow (15:22.594): I just hit some of the big ones, but find one. Go find, reach out to others, go to an event, go to the BRI SAC, which is a great organization if you ever heard of, same thing, right? It's networking organization, people that have like-minded that are wanting to learn more about cybersecurity and grow and network, all that kind of stuff, right? Find something that you can be part of, learn to grow your network, grow your intellect, grow your capabilities.

Aaron Crow (15:52.078): All of those things, joining the discussion, LinkedIn and social platforms. Yeah, you can use them like Facebook and Instagram, all the kind of stuff on the personal side, but on the business side, like use your network for your benefit. You know, reach out to me directly, follow the podcast, you know, share your thoughts and experiences. Ask to come on the podcast. I'm always looking for great conversations to have, and you don't have to be a 20 year cyber professional to have value.

Aaron Crow (16:22.094): that you can give back to the community. So please definitely reach out. If you have something to talk about, you want to hear a topic again, you want to talk about it specifically, you know, reach out, stay educated, keep up with training certifications, thought leadership, and it shouldn't, in my opinion, should not all just be technical. I think one of the things again, coming from a technical background, one of the things that I always focused on earlier in my career was the technical stuff. And you know, it got me where I was going, but at some point I needed to have other skill sets.

Aaron Crow (16:51.308): And those skill sets become those soft skills, know, people skills, being able to negotiate. You know, one of my mentors told me, and I've said this probably a hundred times, all businesses are people business. Doesn't matter if you're the janitor, the CEO, the engineer, you have to interact with people to be truly successful. You have to sell your ideas. You have to sell your, your, you know, concerns. All of that is, is you're really a salesperson, even though you're not.

Aaron Crow (17:18.818): you know, going out and getting commissioned. You're not going out with a sales quota. You're selling your even internally in your team to your manager, to your wife, to your kids. You're selling yourself and your ideas, right? And you know how to win Flynn friends and influence people. Another book that that really ties to this is, you know, what got you here won't get you there. At some point you're going to get whatever you're if you're the best in the job that you're at, you're it's going to be hard for you to get to the next place. We see this all the time where, you know, the best engineer gets promoted to manager.

Aaron Crow (17:48.416): and they're not any good at it because they don't have the skill sets. They were great at their job as an engineer, but they're not great as a manager. It's not because they're not capable. It's because they haven't built the skills and being a people manager, a manager of people and processes is different than coding. It's different than systems administration or managing a firewall or any of that type of stuff. Right? So know those skill sets and be open to whether it's a 360 review, whether it's, you know,

Aaron Crow (18:15.918): really just looking in the mirror and saying, Hey, what things do I suck at? Um, because those are the things you need to go work on. Um, beyond just the technology stuff, you need to work on, you know, those, those softer skills as well. So as we kick off 2025, I want to say thank you for being part of this journey. Um, this year's all about growth, uh, professionally, personally, and as a community, um, together we can tackle these challenges ahead and build a more resilient future. Um, if you're attending any conferences I mentioned or any of the others, you know,

Aaron Crow (18:46.145): or are joining for the Long Star Cyber Shootout, definitely let me know. And I'd love to connect in person. Stay safe out there, stay vigilant. Let's make 2025 a year of impact. Until next time, this is Aaron Crowe signing off from the Protect It All podcast. Thanks a lot.

Transcript lightly edited for readability.