A Year in Cyber Podcasting: Building Trust and Community in Cybersecurity

Aaron Crow (0:1.166): Thank you for joining me for another episode of Protect It All. This is a special episode. It's the 52nd episode. I do these once a week. It's been a little bit over a year. There were a couple of weeks in there that we missed due to conferences and business and travel schedules, et cetera. But 52 episodes, experts from all around the world, some really awesome, amazing stories and lessons that were powerful for me.

Aaron Crow (0:30.330): Hopefully they were powerful for you guys as well. This is the one year anniversary of the Protected All podcast roughly again. And I just want to thank everybody if you've been with us since the beginning. Thank you for that. this is your first episode, like no worries, you're out of time. I appreciate you being here as well. Just want to thank the listeners. Y'all have helped grow this into something bigger than just me talking to a screen and

Aaron Crow (0:59.410): some experts around the world, but really focusing on building a community of learners and protectors and people that frankly give a damn about cybersecurity and protecting whatever their thing is, whether it's power utility or whatever critical infrastructure or enterprise, it doesn't matter, but we're all defenders of the things that we focus in,

Aaron Crow (1:26.594): You know, I want to thank the guests, the people that have come on my podcast and shared their journey, their experiences, their lessons learned, their struggles and their wins. And we've had folks from, you know, obviously here, continental United States, as far away as Iraq, South Africa, New Zealand. We had listeners from around the world as well. We've had global voices sharing unique stories and perspectives.

Aaron Crow (1:55.816): And the fun thing about that is that it's, you know, we hear those stories and they're so similar. There's differences for sure in the UK and Middle East, et cetera. But so many of the OT problems and cyber problems in general are not that vastly different. We're all facing the same hurdles in these spaces. We've talked about real and raw and urgent issues that we see in our organizations and our

Aaron Crow (2:25.762): in our use cases and implementing and shortcomings in products and vulnerabilities, et cetera. You know, some of the topics that, you know, kind of move the needle. We've talked to everything from AI, cloud, people, process and technology. We've deep dove into topics that are people lover and love and hate, like ITOT convergence. It's like a curse word sometimes.

Aaron Crow (2:53.154): all the way down to enterprise risk, even, you know, small, smaller, you know, into entity, defense, you know, wastewaters and small business and things like that. Right. Not everybody has a huge cybersecurity team. Many times they have folks that wear multiple hats. and I may be the cyber person and the electrician or the cyber person and the, you know, desktop guy, any number of things, but not everybody has a dedicated cybersecurity, a role in these spaces.

Aaron Crow (3:22.890): We've talked high level strategy. We've talked deep technical conversations. My entire intent is to leave nothing off the table. If it's cyber related adjacent from leadership to recruiting people, process and technology, all these things, the whole intention is to level up, you know, bring value to us. Even as a technologist, even as a cyber security person, I still have to do presentations. Leadership matters.

Aaron Crow (3:49.998): You know, I'm going to have personnel and, and, you know, staff and work and consultants and, you know, business people. And, and, you know, one of my, I've said this many times, one of my, my, mentors along the way said, you know, said something that really stuck with me and it was all businesses of people business. It doesn't matter if you're the CEO or the janitor, you have to interact and, and, and deal and work with people and through people, you, you get your success and.

Aaron Crow (4:19.458): The other thing that one of my buddies says a lot and I stole it from him. say it a lot as well as we do. We do business at the speed of trust. And for me, what that means is is the more that I we are able to connect with the person sitting across from us, even if we disagree like, you know, we can be having an argument or a disagreement about the way that we're going to implement something or the need for a certain technology or I want to use, you know, vendor A over vendor B or.

Aaron Crow (4:47.714): I don't think we should spend this money at all on this. I'd rather do X, Y, Z, right? The whole reason that we can get things done is, and the way that we get it done faster is to build that trust and that relationship. It's one of the reasons why we do the Lone Star Shootout, right? And having a different event that is not focused on socks and bagels and coffee, bourbon and cigars only.

Aaron Crow (5:14.742): It's it's more around building those those trusted relationships as a vendor as a as an asset owner Those things are value add when when the person calls you and it's just a sales guy that you don't have any connection with and You just know that they just want to try to sell you something like you're less likely to answer But if you've spent all day playing golf or shooting or or having lunch or whatever that thing is and you've built a relationship doesn't mean your best friends doesn't mean you

Aaron Crow (5:44.258): you know, necessarily want to, you know, go ride a motorcycle with the person. But you it's more than just surface level transactional, I guess is even a better way to say it, transactional relationships. And when we when we build, we build that integrity and have those deeper conversations and deeper level, we can move faster. We're able to move forward because you've you've built that that trust. And and you're you're more willing to take

Aaron Crow (6:12.046): take risk and actions based on those those relationships. We even talked through, you know, recruiting and how do I get into cyber? I have a lot of you know, I to a lot of conferences. Obviously people listen to the podcast and I'll see, you know, folks, guys and gals from from, you know, still in college interns, you know, trying to break into cyber security, even, you know, even folks mid career that are that are doing a career change. So

Aaron Crow (6:41.420): having conversations, insights from recruiters and leaders and learners and hearing people's journeys around how they got into cybersecurity, how they got into OT or IT or cloud or AI or whatever the thing is that they do and found their niche. We've had some really cool conversations about emerging technologies from AI powered tabletop exercises like ThreatGen's Auto Tabletop, using those on how to pressure test your team and using it more than just a check box.

Aaron Crow (7:11.034): that many folks use a tabletop for, all the way down to one of the keys or touch points or sweet spots, especially at OT, is that asset visibility. Training and process risk is part of that, but really just the power of asking the right questions. It's not about just having an asset list, having a list of how many PLCs I have.

Aaron Crow (7:39.798): One of the analogies I like to say is I can have two PLCs that can be the exact same vendor, firmware, all the things. One is controlling a turbine and the other is controlling the ice machine in the break room. They have the same vulnerabilities. They have the same, you know, risk of that vulnerability, but not risk to the business. The ice machine may upset people because they want to make ice or they want to have ice in their drinks, but it's not going to bring the business down. So the business risk of those two things are different.

Aaron Crow (8:9.528): So knowing that is that next step of, yes, I have an asset list, but what are each asset? What is the risk? What is its function? And what is its priority? If I could only do one, which should I do? And if the other goes down, how do I isolate it? If I'm not going to mitigate or whatever, how do I isolate that so that it doesn't, you know, that ice machine one doesn't actually bring down the turbid one? Every episode, my intent is to bring real value because that's the mission.

Aaron Crow (8:39.522): Right? I enjoy these conversations. I don't prep for them in that I don't give a list of questions that I'm going to ask. I don't want the the the guests to give me questions to ask them. My intention is is and I tell everybody that comes on my intentions is it to feel like we're sitting down having a coffee, a beer, a meal, and you're explaining we're talking candidly about cybersecurity. We're talking about your journey. We're talking about lessons learned. We're talking about how you got in. What went well?

Aaron Crow (9:9.262): funny stories, normal conversations, because that's what I want to hear. And those are types of podcasts that I listen to. That's the way that I learn well. And hopefully those things work with you guys as well. We've had some standout moments, know, tours from CISOs and tough questions that need to be asked and guests who came in and shared vulnerable, passionate, you know, and things that they're doing from volunteering at nonprofit organizations, from, you know,

Aaron Crow (9:38.274): how they're retrofitting their environments and so many amazing fun stories that have come out from people's experiences. all these folks that I've had the pleasure of talking with have been passionate about what they do. They don't come on this thing. Like I've never had a single person on this podcast as a guest that is not extremely pumped about the things that they're doing and the value that they see and their desire and drive.

Aaron Crow (10:7.960): to do more and to, and not from a perspective of, of just capitalism in selling and, and, conquering more so in they see value. You know, I see this as like a, a, you know, a suit that you're putting on like a, uniform, you know, and you're, we are the defenders of these spaces. so with that, you know, some of the lessons learned for me, you know, personal takeaways, consistency,

Aaron Crow (10:37.130): Is an easy there were a few weeks where we missed a couple of episodes again due to scheduling and travel and you know guests couldn't couldn't make it. It's not easy to schedule something like this. Everybody's busy. All of these things happen in in our downtime like this is not my my job. I don't get paid for this right. We I do this in addition to having a full time job and not allowing this to get in the way. The same thing with the guests that come on like these are.

Aaron Crow (11:6.828): You know, I'm not paying them. They're not paying to be here. They they're doing this because they want to. They want they see the value in getting the message out and having that that personal brand and, you know, getting those those cyber lessons learned and passing that on to that that next cyber defender. Some of the best conversations came, you know, because and when we don't try to be perfect. I always talk to the guests about.

Aaron Crow (11:32.898): just take a breath. This is going to be easy. It is edited. If we need to cut something out, if your dog walks in the room or your wife, you know, comes in or your phone rings, which all of those things have happened, there's been some funny stories around some of those types of things, but it's okay. Like that, that, happens in life. and you know, it's still able to get that raw result when we're just having conversations. I've learned so much from having these conversations, from having these

Aaron Crow (12:0.364): these subject matter experts come on and share like we can all learn. It's like a lesson. It's like a college course lesson in all of these perspectives. We've got people from all the different critical infrastructures from around the world sharing stories, implementations, products, like all this stuff. And again, they're not doing it to push their product. They're not doing it to push themselves necessarily beyond the primary value is to bring up uplift the community.

Aaron Crow (12:29.742): You know, from an industry insights perspective for me, it's, know, I still see us as way too siloed. You know, as much as I have, I've been an OT person much of my career and I see the value in OT and IT being segmented. We're still all one team, you know, so even if we do have IT and OT and cloud and identity and you know all the things we're still wearing the same uniform like we're on the same team. We're not opposing.

Aaron Crow (12:59.254): on opposing teams going against each other. And that's the value that I think we need to continue and growth that we need in the industry is to remember that. And how can the IT team learn from the OT team? How can the OT team engage and use the IT team without giving up the keys, without releasing control, but getting the value out of their experience, their knowledge, their capabilities and their teams. Usually,

Aaron Crow (13:28.990): In all the places I go, the IT team is vastly larger than the OT team. They also usually are more focused on a particular thing, firewalls, networking, etc. Whereas the OT team is usually more general. So they have to cover more things. They have to kind of do it all, jack of all trades type. So, so, on those OT teams or technologies, their, their, their, you know, T's and C's with their vendors and their support contracts and pricing and all that kind of stuff is, is beneficial.

Aaron Crow (13:57.300): instead of just necessarily going directly to a separate vendor, having a different switch vendor, like that just doesn't make sense. Cyber security isn't just about tools. I can't harp on this enough. Like it's easy to go to Black Hat and RSA and see all the latest tech and all the widgets and the hardware and the software and the, cetera, et cetera, et cetera. But it's not just about product. It's not just about technology. It's not just about

Aaron Crow (14:25.154): blinky lights as much as I love blinky lights. Anybody that knows me, love, you know, the hands on demonstrations. That's why we built an OT box. That's why we take it to conferences and part of, you know, ICS Village and all this stuff. Because people learn visually, I do at least, from that, blinky lights. But it's way beyond that. It's about those people giving a shit, like understanding the why. If I don't, if I can't translate or explain that why and have them take that baton,

Aaron Crow (14:54.132): and into their daily job and they're just checking a box, then you're going to struggle. that's with everything. It's not a cyber unique problem. People and their drive and desire is the more raving of that person to be a fan and driver of OT and cybersecurity and IT and cloud and all the things, the more likely they're going to give more and put more thought and energy into it.

Aaron Crow (15:22.060): And the job is not just about defense anymore, right? It's resilience, it's leadership, it's education. It's you know, you can't just be a firewall guy. Like eventually you're going to need to do more. You're going to have to interact. You're going to have to sell your idea even to your leadership. Everybody is sales. Even if you're you know the entry level sock analyst like you've got a picture idea or the problem that you see or the issues that are there.

Aaron Crow (15:51.926): to your team, to your leadership, to get an improvement, remediation, whatever that may be. So what's coming next? Where we go from here, more of the same. I continue to want to do more solo episodes, hard truths, stories, talk with more folks around the world. I love the fact that we've been able to hear perspectives from different environments, from different organizations.

Aaron Crow (16:20.632): from around the world, different perspectives in the UK versus, you know, Middle East and, and, know, Kiwis in New Zealand and, and, and, you know, East Texas, right. And everything in between, looking to do more, you know, paneling episodes with more, you know, multiple bodies, round table type exercises, you know, live events, Lone Star Cyber shootout.

Aaron Crow (16:48.270): having folks come out to those things and value add on those doing one during Black Hat August 8th. Details be releasing with that very soon and then more around the physical and cyber. know that Lone Star shootout is really around that right? Bridging the gap between physical and digital. You you can't just put a firewall and then leave your front door open. They can just bypass the firewall and plug straight into your network right there. There is that thing of we need physical

Aaron Crow (17:17.806): protection, need cyber protection and all those things kind of the concepts of the same. The implementations and tools are a little different. Obviously the teams and the skill sets are different, but they're still using the same models and the same ideals, right? Defense in depth works in physical. It also is the same thing that we do on the digital and cyber side. A lot of these concepts are similar, just like in IT and OT. You know, the concepts are similar. Implementation may be a little different. Training may be a little different. know, remediation may be a little different.

Aaron Crow (17:45.902): I'm going to remediate differently if somebody jumps a fence at a nuclear power plant than if it's in a manufacturing facility. Nuclear power plant, there's going to be a pretty stiff response plan. I've been responsible for a nuclear power plant and all that that entails and heard some harrowing stories about things that people tried to evade the physical security perimeters at those facilities. It's a little different than if it's at a small manufacturing facility. Yeah, I'm just going to call the police or

Aaron Crow (18:15.406): We're immediate, right? Stronger focus on empowering individuals, not just companies. Like I love the stories and I don't care if you're you're my competitor. Like I love hearing the stories of folks that come on here and share because I see the value add and lifting, you know, rising tides raise all ships. So final thoughts, you know, a little over a year in 52 episodes. To me, it's just the beginning. Technically, this is, you know, year two and a half or so.

Aaron Crow (18:44.908): the first version of the podcast rebranded as this one 52 episodes ago, but before that it was another 40 episodes. So, but doing this and I love it. My intention is to continue doing it, have more conversations, more, more amazing interviews. So, you know, my ask for you is to make recommendations on topics, folks that you want to hear on, you know, dig into things like, you know, AI cloud.

Aaron Crow (19:10.606): OT in the cloud like all of these things that may be taboo. I'm not saying I'm endorsing any of those things, but we need to talk about them. If we can't talk about them, it's hard to find solutions and see all even the problems and how to mitigate those things. To the guests, you guys have made this valuable. It's amazing to go to conferences and people say, hey, I listened to your podcast. Like it's so weird and amazing that it's not just going out into the ether. So I appreciate everyone that listens.

Aaron Crow (19:39.958): I appreciate everybody that subscribes and likes and comments and all the things all of you guys are. That's the reason we do this and I do this right. You know, to that, you know, my ask is just welcome to the mission, right? Dive in, share it right? Subscribe, subscribe and share it. Get that voice out there. Bring on folks like we need more and more and more people in cybersecurity conversations around difficult things like we need to.

Aaron Crow (20:10.030): Just because we've done something in the same way for 40 years doesn't mean we need to continue to do it. And the only way we get past some of those limitations is by having conversations, having a diverse discussion and dialogue around the problems, the solutions, the issues, the shortcomings and everything in between. So thank you for 52 episodes. For those of you that have listened to them all, like, wow, that's amazing. For those that maybe this is your first one also.

Aaron Crow (20:39.630): Thank you so much for being here. I appreciate you. And definitely excited about the next 52 episodes and see where we go in the next year. Thank you for joining me and see you next time.

Transcript lightly edited for readability.