Why Cybersecurity Is More Than Just Technology and Tools with Paul Marco

Aaron Crow (0:1.454): Welcome to the show. Thank you again for listening this week. I'm excited to have my friend Paul on the podcast. This is going to be a fun one because I was just on, Paul and Evan's podcast. A couple of weeks ago, we recorded there's they had bourbon and all the fun things and drawing ideas out of a hat. So if you haven't listened to their podcast, absolutely go over there. Great content, a lot of fun, a lot of amazing discussions and people coming on guests, et cetera. So Paul, with that, please introduce us to the, to yourself, to the audience.

Paul Marco (0:18.422): There you go.

Aaron Crow (0:30.254): and let us know a little bit about you, sir.

Paul Marco (0:32.116): Yeah. Well first, thank you for having me. This is weird to be recording during the daytime. We usually, I usually record it's nighttime, it's late, like work is over. Like, so this is a different experience for me, but yeah, to your listeners out there, what's up everyone? My name is Paul Marco. I am a lifelong cybersecurity professional, right? As, as you said, we've been trading podcast appearances. So thank you for that. And this was my turn, right? And I'm, super psyched to be here. You know, funny, funny thing is

Aaron Crow (0:36.334): you

Aaron Crow (0:40.588): Yup.

Paul Marco (0:58.902): We started this podcast, and I started our podcast, Cyber After Hours, because I was basically just bitching one day. was like, dude, I can't get on a podcast. It's something I've wanted to do forever. I've always wanted to get out there and have these types of conversations. He's like, dude, we'll just start one. I'm like, oh, OK, great. And now this is the second one I'm recording that's outside of mind. It's like when it rains, it pours, right? So yeah, so a little bit about me. So like I mentioned, lifelong cybersecurity professional.

Aaron Crow (1:20.974): That's right, man. That's awesome.

Paul Marco (1:27.496): most of my career has been in cybersecurity operations. So almost entirely focused on things like building detection response, incident response, cyber threat intelligence, kind of putting all those pieces together, everything that's part of that ecosystem. I love the IAM space. I've run a few different IAM spaces from an ops perspective. I've even delved into things like vulnerability management and app security, although app security is not my strong suit, right? My app security experience is like,

Paul Marco (1:54.868): Hey, smart people, like what do you need? I'll help you, right? That's it. The other stuff I can play around in, but that's really been it. It's always been, I've always been the guy that takes all these amazing tools, all the incredible innovations we have in cyber and does something with them, right? That's kind of how I like to explain ops is like, all right, we've made all these investments. We spent all this time tuning, loading logs, normalizing, parsing, putting in blocks, right? But now someone's actually got to take that information and do something with it. Those are the spaces I play in.

Aaron Crow (2:22.552): Well, and that's where the rubber hits the road, right? It's easy. I just got back from RSA. It's easy to go look at RSA or Black Hat or any of these, know, Gartner, any of these large cyber conferences, or at least conferences that have cyber vendors there, and to see all the cool stuff. I mean, there's literally a thousand different vendors at RSA, and they all have amazing things. But if you really look at that and you think about it, hey, I'm an asset owner. I've got XYZ problems. I don't need a thousand solutions to my problems, right?

Paul Marco (2:37.408): yeah.

Paul Marco (2:52.202): Right. Right.

Aaron Crow (2:53.535): I may already have a tool, maybe I've got some overlap. Am I using my tools correctly? Are my people trained on my tools? Do we have a process to respond? There's a lot of things that beyond just going, and again, I came from being a vendor as well. I was the CTO of a software company. Software and products are good. I'm not bashing the product space, whether it's hardware, software, or even services. I do services, consulting, but.

Paul Marco (3:12.682): For sure, yeah.

Aaron Crow (3:19.250): Sometimes it's really easy to focus on the FUD and the cool new AI or the new widget or the new capability. And it's just like, okay, are you really running what you have to the best of its ability? Because that's usually the first place I look as a consultant. I'm not your stereotypical, you need to rip it out. And the assessment has read all over it, like my ninth grade English paper that just looked like somebody bled on it because I'm so bad at that kind of thing, right?

Paul Marco (3:25.344): Yeah, yeah, yeah, right.

Aaron Crow (3:49.666): But it's foundational things. Like, are you doing well with the things you have? Like, what technology do you have? Are you getting the most out of it before you start upgrading, right? And before you start saying, well, I need this new thing, I need this new thing. Because I've seen so many organizations that have bought the latest technology for the past five years and they never finish implementing it. Or they implement it, but it just sits there and nobody's actually using it. So they're really not getting the value out of those tools. How often do you see that?

Paul Marco (4:18.418): my God, preach. I think it was three minutes before he got on our first soapbox. This is going to be a good one, right? I'm psyched on. No, look, I, I a hundred percent agree. I find your ideas intriguing and wish to subscribe to your newsletter. Like the things that you're saying are a hundred percent true. And this is the problem is, and I think part of the issue is like cybersecurity is born of technology, right? We're all technologists first, right? And then we have to learn tech. We have to learn how those systems work. We have to learn how things are talking.

Aaron Crow (4:40.418): Yep. Sure.

Paul Marco (4:46.568): And then we have to figure out the security on top of that, right? So the thing is as technologists, like we love innovation, we love playing then, we love getting into the new tech and the new interfaces and pushing the buttons and seeing what things do and saying things like, this is cool. But that's the trap, right? The trap is you can start to look at products and be like, I wonder what problem I have that this can solve for me when anytime you're purchasing tech, should be, this is my problem. What's that?

Paul Marco (5:14.698): what's in the market that I can use to solve that problem, right? Otherwise you're just collecting technology. And to your point, like, you know, this is where we start to get like the duplication of capability, right? I'm a fundamentalist, right? For me, it's never about product. I don't talk about Palo or Cisco or Splunk. I talk about, do I have the ability to block things at the network level? Do I have the ability to search logging? Do I have the ability to contain a workstation, right? When you break that away, those capabilities away from the product,

Paul Marco (5:43.466): That's how you build true control. And the thing is like these products come with multiple capabilities. So when you buy something for that one D2Z problem that you have, you might have six or seven other capabilities you haven't enabled. And now you're getting into duplication. That's where folks like you and me can come into an organization and be like, let's do some tech rationalization. We can actually save you some money. We can actually rip some stuff out. Every time I do an engagement, almost every time I'm like, you can turn that off, save some money and redeploy it to something else.

Paul Marco (6:11.828): send your folks to training or invest in this other capability you don't have. Like that's where we get to like really like see this is where we get to like show that value just by justifying the things that are in place that were purchased for a real reason.

Aaron Crow (6:27.574): Yeah, and sometimes simpler is better. know, just because again, to your point, I love Palo, I love Cisco, I love Splunk, I love all of these things. I've got technology behind me and I'm always tinkering and playing with the newest stuff and AI and building bots and all the stuff. That's fun to me. But I'm doing that in my home lab. There's a reason. a prime example of this is back in the day, I had a completely custom built

Paul Marco (6:30.912): Mmm.

Paul Marco (6:39.658): Yeah, man,

Aaron Crow (6:57.154): home network. I had PF Sense as my firewall and I had like this hodgepodge of really cool, it had all this functionality, I had custom dashboards, I had all this stuff. And it worked great until it didn't. And when it didn't, almost nine times out of 10, I was out of town. And it was so complex that nobody else, I'm the only technologist, my kids were small, my wife is not a technologist. So it would go down and then we had already, you know,

Paul Marco (7:8.480): Amazing.

Paul Marco (7:21.088): Right.

Aaron Crow (7:26.328): cut the cords, we don't have TV other than streaming. My kids are like toddlers, so everything to them is Disney and streaming on a tablet or whatever. And then now my wife is three days without anything to help in that area. And by the time I get home, she's like pulling her hair out and wanting to punch me. So I went to a very simplified system. I went to Ubiquiti. Is Ubiquiti the best in most and blah, blah? Whatever, that's not the point. The point is is that

Paul Marco (7:29.686): Nice, yeah.

Paul Marco (7:42.909): Yeah.

Aaron Crow (7:56.118): It's all through an app. Everything automatically. It's self-healed. It's a mesh. Like I've got redundancy. I've got battery backups on things like I made it so that it's reliable. It doesn't necessarily meet all of the technology. Now, ubiquity is really great. They have a lot of capabilities, all that type of stuff. I'm not saying I'm not trying to bash on ubiquity, but the point is, is that I had all this cool stuff. It's the same reason why I went to an iPhone. I used to be an Android guy. I went to an iPhone because I can control all of my kids' devices. I know exactly where they are. could.

Aaron Crow (8:24.622): control what apps they have on their phones. Like it's just, it just works. And then I don't have to think about it. Like the days of me wanting to break down a server and look at a packet capture to troubleshoot my network in the middle of the day, I'm just not daring. I do it on my spare time when I want to, but only when I want to, not when I have to.

Paul Marco (8:36.640): Right.

Paul Marco (8:41.238): Right. Yeah. And not, and not because things are out and you got to like figure stuff out. That's the worst. Right? No, look, I mean, you know, I sat here and said, we're all technologists. You just went through your home tech stack and I'm legitimately worried that the rain is going to cut my internet on my satellite internet here. So it's a little, it's a little different, right? I guess I'm a technologist at heart, not in practice. Um, no, growing up, we've all done that. Like I remember I was working early, early in my career, I was working at a law firm and they were replacing desktops.

Aaron Crow (8:45.742): Correct.

Aaron Crow (9:0.728): Right. Sure.

Paul Marco (9:10.326): And I was like, what are you doing with these desktops? I'm like, oh, we're going to recycle them or whatever. I'm like, can I have like six of them? And I brought them all home. And I made domain controllers and DNS servers. like, he just kind of like, you know, set them up and I may or may not have borrowed a Microsoft server license. It's possible. I don't know. Like, but yeah, yeah. Allegedly, allegedly. Right. That's how that goes. But no, like, like as a technologist, again, getting back to this, to this point of like,

Aaron Crow (9:27.180): Right, yeah, possibly.

Aaron Crow (9:30.894): Mm-hmm. Mm-hmm.

Paul Marco (9:37.566): cyber and honestly like part of what makes cyber so complex like part of the problem the thing that we have to solve is that we have all these options we have these like massive huge like technical networks and we have smart people running them but geez like those things are living and breathing right we how do you keep up like there's no level of documentation that gets maintained that we can go back and look at and figure these things out these aren't the the clam shells i had under my under my desk you know 20 years ago

Paul Marco (10:6.134): These are like these massive, massive, like these massive networks. And then we have to like, we got one by this tech to make it all simpler, but that adds its own layer of complexity, right? The things we've got to solve for. So yeah, I mean, it's a good problem to have. I get it keeps people like you and I busy, but it's a problem nonetheless.

Aaron Crow (10:24.162): Well, the other thing that brings up for me is most of the time, now obviously if you're in a cyber service, you do cybersecurity as a profession or you have a cyber solution services offering hardware, software, whatever, but most organizations, cyber is not their business. Cyber is something that is probably bolted on to protect their critical process, whether that's...

Paul Marco (10:41.748): Right.

Aaron Crow (10:49.452): you know, financial services, which is banking and, and, know, all the transactions, or it's a retail environment where, you know, they have physical stores or it's, you know, a, you know, a power utility company, or it's a manufacturing facility and they're, protecting their, their, you know, their intellectual property and, whatever those things are. Cyber is usually a cost center. So every time we add something.

Paul Marco (11:12.621): it is, yeah.

Aaron Crow (11:16.226): that we're solving a problem, we're also many times adding complexity or at least if not adding complexity, changing the way the process and change is hard. People don't like change, especially at scale.

Paul Marco (11:28.148): Right, No, well, so yes, again, that is an absolute issue because the business just wants to do business, right? They just want things to work, right? And the problem is, and this is one of the like kind of the age old issues with cybersecurity and cybersecurity professionals, you don't want to hear from me, right? You want me to be there, but if you hear from me, there's a problem, right? Like if we're talking, we have an issue. So, you know, this is like, how do you solve that problem by demonstrating value?

Paul Marco (11:57.238): but also being like the guy that's like, you want, you don't ever want to see me, right? Cause then things are, things are down. Things are, there's an issue we have to deal with. And the thing is like, you know, it's, like these other, it's like these other products, like insurance, right? People have no problem buying insurance and hoping that they never use it. They love throwing that money into a bucket and being like, I hope it's gone forever. Cause I have to use that issue, I've had that issue. But the thing is like, I don't think we've gotten there with cyber yet, at least not, not as a kind of a cultural conversation, right? People are still like,

Paul Marco (12:27.392): Do I really have to buy this thing? Am I really gonna spend $50,000 on this product, you know, to try to make things better and then just add friction to my business? Like those are the conversations that make justifying those spends or spending time on the program itself a hard sell, especially in smaller shops where it's really about being lean and running a business. Like now you want me to recertify access?

Paul Marco (12:52.618): Get the fuck out of here. Like, I'm not going to wait. No, I need these people working. I'm not going to sit here and have every manager review everyone's access. And by the way, I have no idea what the security group even means, right? Like, these are the things that you and I and your listeners as cybersecurity professionals, these are table stakes for us, right? We don't want people to have expansive access. We don't want folks like, you know, traversing the web and in all of its corners without any protections. We don't want endpoints that haven't been managed in heavy DR, but all of those things with a cost.

Paul Marco (13:21.760): they come with cost and the cost is either a licensing cost or it's, it's, it's hours, right? It's people like, and that's an additional cost as well. So it's, it is a hard sell until there's a breach, right? Like, and this is unfortunately what I've seen time and time again, is you have those companies, they're splitting in these two buckets and bucket one is I'm not dealing with this. I don't believe in it. I don't care. I'm going to save the money and then some shit happens, right? And then when things go down, they're like,

Paul Marco (13:50.294): How could you let this happen? What do we need to do? What do we need to spend? And then there are those proactive companies that understand not only is it important because you want to maintain that resiliency, the super smart companies have turned this into a marketing element. They've turned this into something that actually drives business. Hey, customers, if you're choosing between this competitor and this competitor and me, here's what I'm spending to protect your data.

Paul Marco (14:16.436): Here's what I'm doing to ensure that your services are up and you're not gonna be stuck on the corner somewhere because the system didn't work and the data you needed or the service you needed wasn't available. This is why you need to work with me. The companies that have done that well, they're killing it.

Aaron Crow (14:32.226): Yeah. Well, and that's that's another interesting point in that, you know, five, 10 years ago, you know, if you if you were in a hack and it was it was public, it was like people were really scared about that. They're they're they're they're name. You know, the bad publicity, the bad press, that kind of thing. It's so common now. I wonder how.

Aaron Crow (14:54.328): how that's reduced people's response. Like we're constantly, well, Target released all of your personal information to, they were hacked and all of your personal information that was in your Target account is released to the internet. They have your name, your social security number, your credit card numbers, your blood type, like whatever, right? And it happens so often. Here's a free credit monitoring thing and everybody has it. And it's almost like, yeah, it's just another one of the same things.

Paul Marco (15:12.217): Right.

Aaron Crow (15:22.210): And I wonder, you and I hear that and we're freaking out, know, and, but I wonder how non, I want to almost say normies, the non cybersecurity nerds that are just going about living their normal lives, how they don't necessarily understand what that means and the impact it could potentially have to them and, you know, domino effect of things in their lives, their, their accounts, their kids, all the different things of.

Aaron Crow (15:49.580): of how big of a deal some of these things are that hit the news and people are just like, whatever.

Paul Marco (15:54.358): I mean, but here's the ironic part. Like you and I, we're cyber pros, been doing this decades, right? 42,000 hours of experience. I'm at the point where I'm just like, right? Like it used to be fear-mongering. It used to be an element where people were truly like concerned and, and, my God, what's going to happen to the stock price or am I going to lose customers? And yeah, the stock price takes a dip, but it almost always comes back. I don't know any cases where it didn't, right? And the thing is like, yes, everyone gets those credit monitoring pieces.

Paul Marco (16:23.574): how many people actually sign up. I was doing a tabletop for a large company and we're doing this tabletop and we're working through the breach scenario. Finally we get to the point where it's like, yeah, listen, double up filtration. They took terabytes of data and they're trying to quantify cost and I'm like, well, you also have to provide credit monitoring. And they're like, yeah. And I'm like, well, what's it gonna be? And they're doing the numbers. And let's just to make the math easy and the story simple, let's it was $100,000 to provide all of the credit monitoring, right?

Paul Marco (16:52.374): And I'm like, all right, well, it's going to be $100,000. And they're like, no, no, Statistically, only like 20 % of people sign up for that. So it's going to be $20,000. Right? Like the vast majority of people don't actually take it. And let's be honest, do we need it anymore? Those services are free. So like the reason why I you brought that you brought this up is because we think about confidentiality, integrity, and availability. The CIA triad. are like, I won't speak for all your listeners. I won't speak for you. But I'll speak for myself.

Aaron Crow (17:4.909): Right? Yeah.

Paul Marco (17:18.780): I always viewed those as equal pillars, right? I always viewed those as the three things that we as cyber professionals have to do. But the times have changed. Confidentiality is not really a thing. It's really not. Like if you think about what's happened to us culturally over the last 15 years, we've given up our data in exchange for free services. We happily give away all the information, our name.

Aaron Crow (17:40.846): Mm-hmm.

Paul Marco (17:44.082): our birthday, all of our relatives, pictures of our kids to social media. And we do it gladly. We love it. We share things out to the entire world with no concepts or semblance of like a concern for privacy. And we think people are going to be outraged because part of their social security number was implicated in a breach that showed up on a dark web forum a year ago. Who gives a shit anymore? The thing is, what I've realized is that CIA triad was not equal parts.

Aaron Crow (18:7.822): All right. Yeah.

Paul Marco (18:13.886): And the parts that matter now are really availability. Of confidentiality, integrity, and availability, integrity is critical. It's always going to be critical. Because we have to make sure no one's jacking the numbers. No one's messing with the data. They're not changing your age on a system, or they're not changing numbers in a bank account, either up or down, to commit fraud. So integrity is always going to be there. Availability is the new hotness. If you think about it, people just want services to be there, and we want them to work. I want my life to be easy.

Paul Marco (18:44.084): I don't actually give a shit about my data. I know it's out there. Equifax was breached. Target was breached. Home Depot was breached. Like the list goes on. I'm sorry to pick on you all, but look, this is you, not me, right? So deal with it, right? But like the reality is like the data's out there. So like at this point, I think we as cyber professionals have to rethink this paradigm and refocus efforts on the things that matter. Now, I want to preface this, because I can hear half of your listeners screaming at the steering wheel right now as they kind of commute home.

Aaron Crow (18:44.238): Mm-hmm. Great.

Paul Marco (19:13.162): Yes, there is an element of confidentiality that hasn't gone away. I'm just thinking about this from the perspective of consumers and the perspective of other elements. To think about these as equal pillars now, that I think is the fundamental shift. There are still data sets that can't go out there. They'll move markets. If you start releasing things like non-public information, that's a bad day. SEC implications. You start losing things like military secrets, that's a bad day. Geopolitical implications. There is confidentiality there still.

Aaron Crow (19:27.500): Yeah. Sure.

Paul Marco (19:43.210): but this conversation has changed.

Aaron Crow (19:45.870): Yeah, it 100 % has it. And it's been that way in the OT space the entire time, because we haven't really cared about confidentiality for the most part. We really care more about availability. Now, obviously Coca-Cola cares about the intellectual property of the secret Coke formula. But you go to a power plant and you generate electricity the same at a power plant. They don't have a competitive edge because of their secret sauce and how they

Paul Marco (19:57.471): interesting. Okay.

Paul Marco (20:3.958): Right, sure.

Paul Marco (20:15.232): Right? Yeah, they don't have better uranium, right? Yeah, exactly. Yeah, all right.

Aaron Crow (20:15.758): you know, burned coal, right? That's not it. No, that's not it. There's no IP in that, right? And they share all that information because it's a critical infrastructure. So that's not it. It's all about availability. you know, obviously integrity, you know, absolutely skewed on the importance and the value statement on the availability side. And I agree with you. I think the consumer market is more that as well.

Paul Marco (20:33.078): Yeah.

Paul Marco (20:42.742): Nah.

Aaron Crow (20:45.314): Like I'm gonna go to something that's reliable, even if like a prime example. So I use a password vault. Like again, we're in cybersecurity, we use password managers and password vaults. I used to use LastPass. How many times did LastPass get hit? Like 10 times? It was like eight before I finally changed. I'm like, yeah, but I've got my own password on my thing and they're probably not gonna get to my database and my database is stored locally and.

Paul Marco (20:56.970): Right. Yeah.

Paul Marco (21:1.227): my god, all the time. Right, yeah, right.

Aaron Crow (21:15.158): Like it was like, okay. And then after like eight times, I'm like, okay, obviously these guys are not going to change anything. They're going to continue doing this and I'm just playing with fire. So I moved it off to something else, but they just, even me in a, a, in a cyber role, I've been doing this for decades. And I was just like, is that the big of a deal? You know, I was, I had top secret security clearance, you know, for government clearance. And, I've worked in a power plant and, and I worked at nuclear facilities. So I had multiple clearances on for different, different places.

Paul Marco (21:41.855): Okay, yeah.

Aaron Crow (21:45.230): And during that time is when DHS was hacked. all of my, know, everybody in the DHS thing that had security clearance, they have all of that information. So I'm just like, every time there's a thing, like, there's no way it's worse than the one I had from DHS. So there's no way they could have more. I mean, I did a 500 question psych evaluation to get badged for a nuclear badge, right? So, I they know, and I somehow passed. I don't know exactly.

Paul Marco (21:50.058): They're out there, yeah.

Paul Marco (21:53.788): Everything, right?

Paul Marco (22:9.960): And you passed? Good for you, Nice.

Aaron Crow (22:14.382): Maybe they just, you know, we're like, eh, it's borderline. Yeah, we'll let him go.

Paul Marco (22:17.674): Yeah, nice, nice.

Aaron Crow (22:20.494): But it's crazy, like it's amazing how much it shifted. you know, I think I may have told you guys this, you my mother-in-law listens to my podcast. She's a seven-year-old woman. She's not in technology. She was never in technology. She listens because she sees it. It's interesting to her, the guests that I bring on, the conversations that we have, but more and more people just in your daily life.

Aaron Crow (22:44.670): cyber is going to impact you in some way. It doesn't mean you have to do it for your job. It doesn't mean that you have to be a cyber security professional, but I was on a webinar with a group of moms while I was an RSA. So I was in San Francisco in my hotel room and I was talking to a group of about 50 to 60 moms and it was about how they need to be digitally protecting their family and how today kids as...

Paul Marco (22:47.179): VR.

Aaron Crow (23:12.375): as young as eight is about the first time that they see pornographic material. And that's terrifying to think about as a father, a father of three, right? So we have to have those conversations with our children a lot sooner than they had the conversation with you and I, probably, you the birds in the breeze and all that kind of stuff, because they just have so much more access. And all of that to me is about, you know, cybersecurity, digital security,

Paul Marco (23:17.366): It's getting, yeah, it's getting bad. Yeah.

Aaron Crow (23:39.744): availability, all those things are conversations and we need to be having those at home, at work, in everything that we do. It's something that, that cyber needs to be part of the conversation.

Paul Marco (23:50.430): absolutely. And like this is, this is the thing that I think most people don't understand. So like I used to give this talk, I would train up a bunch, like the code, the next cohort of, they call them CDPs. I don't remember what it stood for, but it was like development professional program, something like that. Right. And like, you know, these would be people who are just starting in the industry or people who just graduated college. And I was working for an org. They would spend 40 hours straight, like a whole week, like full on.

Paul Marco (24:19.318): Training folks. This is what this is about. This is how you do cyber security. These are the things we're concerned about Here's what a log file looks like. This is what normalization is parsing like like very in-depth. That was great A lot of people that went through the program. They're huge like industry, you know influencers now see SOS or founders or whatever else, right? So it's very cool to kind of watch that happen But one of the talks I would give when I was teaching these classes is that's all right, you know I'll make up the numbers because they've changed but you know, let's say

Paul Marco (24:48.534): $100 billion a year of loss occurs to some cyber element, whether it's fraud or whether it's ransom extortion or whatever else. Let's pretend 50 % of that gets written off because of insurance coverage. And then another 25 % of that doesn't get paid out because if it was fraud, the money might have gotten pulled back or recovered. We're still at like $25 billion, a lot of money. And I would ask the f-

Aaron Crow (25:12.942): billion.

Paul Marco (25:13.780): Right, this is, yeah, we're throwing around the B word here, but no, this is an un, it's probably low, if I'm being honest, right? I'm making up these numbers for a fact, right? But, like I would say, all right, so there's that much money that's out there that's going out to attackers that people are getting, recovering, and now have control over. And I would ask folks at this table, I'd be like, so, what would you do with that money? Like, what are these attackers doing with the money? And I would inevitably get answers like, they go on vacations, or they buy a yacht, or they buy sports cars, or they have...

Paul Marco (25:42.452): know, penthouses, or they save it, or they invest it. And part of that is right. Some of that is right. But the thing is, we were getting answers from people who are not evil, right? We were getting answers from good people, and those people were giving the good people answers. The vast majority of the money that's stolen and used from a cyber perspective is used for the terrible things you can't get bank loans for, like sex trafficking, like weapons trade, like paying suicide bombers, the families of those suicide bombers.

Paul Marco (26:12.328): Those are the things where this money goes toward, because you can't walk into a bank of America and be like, look, I need 100,000 bucks. I gotta move weapons from this country to this country. I gotta pay the guys off. Where do I sign the application? So when you start to understand that the dark side of this thing, the dark side of what we do is funding the things that are the truly evil elements of our world. Well, it kinda changes perspective on what we do from a cyber perspective. Every time we're able to stop that,

Paul Marco (26:41.962): we're able to provide some protection to that small and medium sized business that's going to fall victim to invoice fraud. Or we're going to help some company limit their fraud losses. Like, yes, are we helping shareholders? Are we keeping stock prices high? Are we making rich people richer? Sure. But we're also preventing that money from funneling to the things that are truly evil in this world.

Aaron Crow (27:2.924): Yeah, man. And I told the story on, on y'all's podcast about, you know, how I was hit by a, you know, fishing attack or, you know, basically somebody calling me. I think I've told the story on here as well, but kind of the bigger point is, is that it, I hear a lot of, why would they go after me? I'm a small, small, you know, sporting goods store in this small town. Like, why would anybody want my stuff? And, and what, people need to realize is it's, it's, it's.

Paul Marco (27:11.370): Right, yeah.

Aaron Crow (27:32.086): It's just an opportunity. If they can, they will. They'll ransomware you, they'll phishing attack you, they'll try to steal money, they'll try to get access, maybe you have access to somebody else. They don't care. These are not good people we're talking about, to your point. There is a lot of criminal organizations that are out there. There's state-sponsored ones, there's individual old-school mafia-style criminal organizations in other countries all around the world.

Paul Marco (27:57.375): yeah.

Aaron Crow (28:1.036): that we don't even have legal repercussions of. That's the other piece that's really scary is you call the police department, they're like, there's nothing I can do for you. Like you call the FBI, maybe if it's big enough, maybe they'll get involved. There are some repercussions, but for the most part, there's a lot that just goes with no repercussions, with no resolution other than rebuild. And that could be your personal finances. They can take out your credit.

Aaron Crow (28:29.030): They can take out loans, credit cards, they can take money out of your accounts, they can shut down your business, they can sell your house. There's all of these scams that go in and fraud and cybersecurity theft and all these different things. Nobody's immune to it anymore. So we have to be... That's why little simple things like password vaults and password managers are not using the same damn password across multiple sites. As simple as that sounds, that one thing would probably stop

Paul Marco (28:32.160): For sure.

Aaron Crow (28:58.382): a very large percentage. Now, does that mean that you're immune? No, because if you click the thing and you fill out the stuff, then they're going to get in and get your password vault too. But it at least helps in theory to slow it down, to stop the spread, to keep it isolated to one thing. Because if they have access to your email and your password, then they can get into your bank and then they can get into the next thing and the next thing and the next thing and then they're in your parent. The dominoes just

Aaron Crow (29:27.052): just fall so quickly and then they're into your work. Like that's the other thing that people don't always think about is where do you work? Right, yeah, maybe they can't get, you well, you can't get blood from a turnip. Okay, maybe you don't have anything they can steal. But for them, five bucks, 10 bucks, 50 bucks, 100 bucks, because they're doing it at scale. They're doing it across to thousands, tens of thousands, millions of people, and there's zero overhead for them. They just keep banging away until they get, got one, got one, got one.

Paul Marco (29:53.494): It's all automated. Yep, exactly right. No, you're spot on and you're right. like, you know, I hear this a lot, like, I don't have any money, like there's nothing that I'm like, you like a small business, right? Here's a great example of small business. All right, maybe not, but if they get control of your email, they can start doing business, you know, email fraud, right? Or business email compromise. They can now go out to the people that are supposed to pay you and redirect payments and you really won't have anything. They don't have to steal anything from you.

Paul Marco (30:20.960): but they can use you as an opportunity. And that's true at the individual level as well. Coming back to what you were talking about, I'm sure your listeners know they're all cyber pros, but let's just reiterate, this stuff goes deep. North Korea funded its entire nuclear program on cybercrime. The Russian crime syndicates effectively operate in Russia under safe harbor, which is why the trick used to be if you set your secondary keyboard language to Russian,

Aaron Crow (30:25.240): episode.

Paul Marco (30:48.586): you would avoid getting hit by those organizations. That's one of the first checks that their software did. They would check to see if there's a Russian language keyboard, that's it. Shut the whole thing down and move on because that was the ground rule. Like, you can operate wherever you want, just don't do it in Russia, right? Like there are major implications that come to this stuff. I always try to, if I'm gonna get on my soapbox for a second, I always try to get people to remember that there are real people on the other end of these things.

Paul Marco (31:18.122): These are not just bits and bytes. These are not just strings of text. There are real players in this game. And this is the game that we have to stay diligent about.

Aaron Crow (31:28.396): Yeah, and there's real victims as well, right? And I've had a few folks, unfortunately, friends and family that have been greatly impacted financially and they didn't have money either, right? We're talking about retired elderly people that continue and they still believe it. They're giving away their money because they think it's like, well, if we just keep giving, I'm going to get the return. They got hit.

Paul Marco (31:31.510): for sure.

Aaron Crow (31:57.612): and they just don't see it. They don't wanna admit it, right? And sometimes you gotta cut bait, but it's hard. We grew up on this. We've been doing this for so long. Our kids' generation, the younger generations than us, they've always had technology, but the baby boomers and that generation haven't. So they're very susceptible to these. Some of them are better than others, obviously. It's a generality, but.

Paul Marco (32:22.518): Sure, of course.

Aaron Crow (32:24.568): You know, obviously they didn't grow up with technology. You and I grew up, I can't speak for you, I grew up, know, that Macintosh Plus back there was one of my computers. My first computer was a Tandy TRS-80, a Trash-80. So I mean, I remember, you know, AOL and dial-up and Juno email and, you know, all the things. So I mean, technology's kind of been part of me. I remember time before the internet. I remember the internet and I remember, you know, everything since. So I've kind of grown through all of those changes.

Paul Marco (32:33.085): amazing, that's cool.

Paul Marco (32:39.745): yeah.

Aaron Crow (32:53.998): So change to us is, or to me, has been, I don't know, simpler, I guess. But my wife is funny. Like she can't tell the difference between one version of an iPhone and an X. Like she doesn't know the new features that come out. like, I'll show her something. She's like, how'd you know that? I'm like, I don't know, I just do.

Paul Marco (33:9.822): Right, right, right. And we still get caught, right? Like this is the thing. Like I've trained my wife up on some of this stuff. And like what I've told her is I'm like, if you ever find yourself and you have to let your, causes pause, you're like, what is this? Stop. That's it. Like listen to that Spidey sense, right? Cause if you're just like, you don't understand, stop, call me, double check. Don't click links. Like if it's coming from, let's say, I don't know, credit card, go directly to the site, log in.

Paul Marco (33:39.210): Like, and like these are the things that, you you and I and our people in our cohort have figured out and like learned to train ourselves to do. But like to your point, not everyone knows this stuff and that's why these scams keep working. That's why victims keep growing.

Aaron Crow (33:54.146): Yeah. Yeah. And it's going to, it's going to get worse, right? It is a fishing hole that they have learned and they're getting better with it. And AI tools will help them be more efficient with it. There's so much that we can glean from. I I can write outreach for, let's say that I wanted to get Paul on my podcast. I can find Paul's email. I can find Paul's LinkedIn.

Paul Marco (33:59.883): Yeah.

Paul Marco (34:4.981): yeah.

Aaron Crow (34:22.636): maybe his Facebook or Instagram. And I can give that to, let's say, chat GPT and say, Hey, I want to outreach to Paul and have him come on to my, my podcast protected all. I want you to look at what you can find on him, make it personable, make it something that he would be interested in talking about something that would show value to him. And in five seconds it goes in it, it finds all those places, the information that it can, and it gleans a really good introductory.

Aaron Crow (34:52.576): outreach, whether I send that on LinkedIn or I send you an email or I send it through Facebook or Instagram, but it can glean quite a bit of information just on the things that it searches in a few seconds off of our our Facebooks or whatever. Right. And, know, and when we go out of town, how many people are checking at the airport? And then we check in when we're out of town and we check in, you know, you know, at the remote destination or, you know, our friends, our kids put their their GPS tracker on and their friends are tracking them as well. And how many, you know,

Paul Marco (34:55.829): Yeah.

Paul Marco (35:5.358): yeah.

Aaron Crow (35:20.514): There's just all of these things that we're being attacked from all these different directions and we don't all even have an understanding of where the risks are and how to protect it. And it's the same way in the business world, right? We have all these new things and we add this new tool, but we don't think about that I just added five vulnerabilities when I implemented that thing that I wasn't thinking about.

Paul Marco (35:38.718): More than that? more like think about how deep this goes, right? Like, here's the other thing you bring up, you know, AI and the outreach thing. Awesome, by the way. It would probably not recommend you lead with shampoo for me, but it may very well say something about, you know, talk about Woodford. did, had to shave my beard as getting too much. I couldn't keep up with, you know, the famous Aaron over here. But, you know, like the AI stuff is crazy. We talked about privacy or we talked about like the data we give away.

Aaron Crow (36:1.122): There you go.

Paul Marco (36:7.606): I randomly did an experiment. So I pay for the private instance of ChatGBT, right? Because I use it for business. I want to make sure it's not training models. Like, try to do the right thing. And it keeps the chat history. And it does that for everyone. It does it on the free version too, right? But I was like, all right, let me do a little experiment. Let me have some fun. I wrote a prompt one night. was like, hey, we've been talking for a year now, right? I've asked you a bunch of things. You've helped me with lot of whatever, X, Y, or Z.

Paul Marco (36:33.974): I was like, I want you to go back to the chat history and I want you to write a profile about me. Who am I? What do I believe in? Right. What is it that I do? And man, if this thing wasn't 85 % spot on and I'm not even talking about like, you know, the normal things I got knew I was a cybersecurity professional and knew like, you know, the ultimate my business that I've paced in there, but it made inferences on like personal beliefs, religion.

Paul Marco (36:58.750): It made inferences on like, you know, my childhood. Like it would. There were some wild things that I was able to figure out. And this thing had me pegged 85 percent. So like, yeah, that's a vulnerability. Like it knows these things. Right. And like, you you talk about we add new tech. Like one of the things I'm worried about, man, is like A.I. is as much as it's going to be a powerhouse, as much as it is a transformative tech in our space and in the world. Right. This is the next big thing. It's just as dangerous.

Paul Marco (37:28.214): It's just as dangerous.

Aaron Crow (37:30.894): The bad guys got it too. And they don't have, just like you talked about earlier with your example of what are they spending the money on, those bad guys don't have the same morals or foundational beliefs that good people, relatively good people, I pay my taxes, I stop at stop signs, I help old ladies cross the street type of thing, they don't have those concerns.

Paul Marco (37:50.352): yeah.

Aaron Crow (37:57.454): they are looking at what can I do to take advantage and get access to the thing that I want and I don't care the outcome or the consequence, right? In fact, I want the outcome and I want the consequence. we have the ability to use AI and a lot of these tools to benefit humanity, to benefit, streamline our processes, find gaps in our security policies and procedures. We have a custom

Aaron Crow (38:26.708): auto tabletop process that we use that uses AI. It's all offline, but it's really cool because you can make it. We did one and it was the, we were attacking the Death Star. So the rebels were attacking the Death Star and it was all using cybersecurity and it was using an actual incident response plan, but we were just, it was like playing Dungeons and Dragons, right? But using Star Wars or Battlestar Galactica or

Paul Marco (38:29.430): amazing.

Paul Marco (38:40.409): nice, nice.

Paul Marco (38:43.574): That's cool.

Paul Marco (38:48.320): You're changing the characters, right? Yeah, yeah, super cool.

Aaron Crow (38:55.646): know, Star Trek, whatever your thing is, you can make it fun. You can also gamify it. So there's a lot of good that comes from it. But think about actor that can take that same stuff and say, hey, this is what I found out about this company. These are, you know, I went to show Dan and this is what I found publicly facing for them. These are their IP spaces and how can they use that to get away in? And it doesn't have to be a technical in as we know, what is the biggest risk in our environments? People, right?

Paul Marco (39:24.291): yeah, yeah, always every time. I mean, if there were no people, there'd be no problems, right? But there'd also be no people. So right now it's you know, here's the thing like you triggered on something for me, because like this is part of the other issue of what it means to be a cyber defender is it's not a fair game. The game's rigged, man. Like these, you know, the cyber criminals that we're up against are well funded.

Aaron Crow (39:25.516): Always.

Aaron Crow (39:30.040): Correct.

Paul Marco (39:52.170): and they have no rules. We have change control. have systems we can't touch. We have to make sure we have other priorities. We have to support the business. There's all these other things we have to do. They have one mission, compromise. That's it. That's their mission. Whatever their benefit they're after, monetization, data theft, whatever, their mission is compromise. Our mission is defend, as long as it's not between these freeze periods.

Paul Marco (40:19.926): And as long as you put in the proper paperwork and as long as you're not going to cause any business impact and also make sure you get to you partner with these business units. Also, don't forget to let folks know about the thing that you have to do. And oh my God, we have to change the website. Hold on. I'm to need at least three weeks review. Like these are all the stumbling blocks we have to deal with. And like the reality is like, you know, I've talked about this before. You think about game theory and the types of games that are out there. Right. And there's the finite game, the games that have a clear end.

Paul Marco (40:47.222): And then there's the infinite game, the game that you just keep playing until you fall over, right? Defenders, we're playing the infinite game. We don't stop. Cyber doesn't end. We have to keep going. Cyber criminals, they're playing the finite game. They have an end. They either move on because they couldn't compromise, or they win and they monetize in some way. But those rules are completely different. So it gets portrayed as this cat and mouse game or this chess game, but it's not.

Paul Marco (41:12.416): We're in totally different realms and we have to like find that sliver in the Venn diagram. We have a benefit to in some cases not even properly defend an organization. Just get the attacker to move on. Find an easier target. I tell my clients that I'm like, look, your goal is not to be perfect. Your goal is to be good enough that an attacker is like, fuck this. I'm out. There's an easier one out there. moving on, you know?

Aaron Crow (41:36.044): Well, and I think I see it a lot as well and it's less about probably 10 years ago, at least from my perspective, it was all about, I'm gonna make it really hard to get in. I'm gonna be so impossible. We're never gonna be hacked. I think it's shifted over now. Like it's not a matter of if, it's a matter of when. So what else can I do? Now, obviously I need to remediate. need to still do my protections there, but I also have to focus on what happens, worst case scenario. They get in.

Paul Marco (41:52.980): Yeah. Right.

Aaron Crow (42:4.162): and they lock my stuff down, can I recover? And what does that recovery look like? How quickly can I recover? And what does that recovery process look like? So the sooner that we start understanding, cyber is about risk. It's about mitigating risk. Just like you talked about on the insurance policy, people are okay with paying money and hoping it never happens. And that's what cyber is. It's really mitigating my risk about something that hopefully never happens. I hope that nobody ever hacks a nuclear power plant

Aaron Crow (42:33.760): and causes a meltdown. I really hope that never happens. There's a reason why we have so many controls that redundant, triple redundant systems to make sure that type of thing doesn't happen, right? Same thing in our fighting forces and submarines and all the things. Like we have all these protections for all these reasons. And it's about that whole motto of defense in depth, right? So it's not just about keeping

Aaron Crow (43:2.838): the bad guys out of my network, I always assumed they are already in. I always assumed corporate network was compromised. It was already done, right? I don't trust it. I don't trust any other network other than a device that I specifically configure and I own. And every other device I assume is bad.

Paul Marco (43:9.440): Yeah. Yep.

Paul Marco (43:21.142): Absolutely, absolutely. like that, I mean, that's the change in the framework is it is not if it's one and it's being comfortable being uncomfortable. And the reality is it's can you minimize that blast radius? All right. Like, you know, if a workstation gets popped, yeah, it sucks. Like they got in, someone clicked the wrong thing. Cool. But could we contain it to that? Or did the attacker, was the attacker able to dump creds and pivot and set a foothold on a server or a cloud PC that doesn't turn off?

Paul Marco (43:48.084): Right. And then were they able to like enumerate the network and then figure out like, you know, what, the data stores were and then start exfiltration over socks, proxies or encrypted channels. Like it keeps going. Like it doesn't stop. So if you can minimize that blast radius, that's a win. If you can make your controls layered enough that even if something fails, the next control kicks in, that's a win. Right. This is, this is about that long game.

Aaron Crow (44:14.028): Well, it brings up a funny story. I think I was telling somebody at RSA, you know, I did an assessment at this power plant one time and we did, did, you know, scanning on devices. They were having some problems. It wasn't just a random, a red team or a pin test. So we pin tested it, but we were also doing, you know, asset level, you know, investigation because there was just something hinky going on and we weren't exactly sure what come to find out, which had nothing to do with the original problem they had.

Aaron Crow (44:42.168): But as we were doing these scans, we found Stuxnet in their environment, sitting on their devices, just sitting there, just dormant. Now, the cool thing is, is Stuxnet was not dangerous to them, because they didn't have the targeted devices that Stuxnet works on. it couldn't have, exactly, it wasn't an Iranian centrifuge and all the things. So it really, it didn't even have Siemens equipment in there. So there really wasn't any risk to it.

Paul Marco (44:47.654): Yeah, Yeah, yeah, yeah, of course.

Paul Marco (44:55.944): Right. They weren't located in Iran, right? Like, yeah, exactly.

Aaron Crow (45:9.826): But still, it's not something good we want on the environment. But there's a prime example. What did they want to do? The site said, yeah, we'll wait till outage and we'll rebuild the systems in there. Right. We didn't we didn't rip them out. We didn't, you know, rebuild the new ones, anything like that. So we left them with a documented, hey, you guys have Stuxnet running in your environment. Like, yeah, we're good. And they're right. That was the right decision. Like they didn't need to shut down the plant because Stuxnet was right or they're dormant because the risk was super low.

Paul Marco (45:31.978): Yeah, yeah, for sure.

Aaron Crow (45:39.270): almost zero, not zero, it's never zero, but it was really, really low. So they made a decision to move and we came back during their outage and we wiped it out and cleaned it up and all that kind of stuff. But again, that's the kind of conversations we have in these spaces. It's not just all about having the latest, greatest, most capable, all the things, because that availability is more important. And then the other thing that's not on that CIA triad that needs to be there is that dollar sign, right? Because availability is important, but so is the business.

Paul Marco (45:39.286): Sure. Never zero, right?

Paul Marco (46:5.118): Right, right.

Aaron Crow (46:9.006): I can put a million dollar cyber program at a site that only makes a thousand, you know, $100,000 a year. But why would I do that?

Paul Marco (46:16.758): Right. Yeah. And this is the thing that

Aaron Crow (46:20.780): because then I don't make money.

Paul Marco (46:23.542): Well, this is exactly the thing that actually dilutes a cyber professional's cloud. And what I would say to anyone listening, especially if you're early in your career, you're kind of just budding and you're trying to learn, learn the business. Figure out what the business is doing that you're actually trying to protect. Because if you can reconcile that story, if you know that this is how the business operates, this is how they make money, and now I can layer in how I'm going to defend it that aligns with those business goals, you're going to be infinitely more successful.

Paul Marco (46:53.526): Right? Because to your point, like these are, you know, these are not zero sum games. This is not like, you know, on or off. Like there are levels of risk that are acceptable that the business does have appetite to. Now it's your job to coach them, right? Coach them into what the appropriate risks are and are not. Right. This is not a roll the dice. Like we'll see how it goes. But the reality is like there is an element of understanding what those tolerances are and applying those tolerances in the appropriate way.

Aaron Crow (47:22.424): Yeah, I mean, it's the same in all things that we do in business, right? We're constantly making that decision and analyzing. And to your point, like, you I talked to lot of cyber folks that are in cyber and, know, I think I'm gonna go get a master's in cyber. I'm gonna go get this or that. And I'm not, again, talking anything negatively about that. But the biggest question I have is, okay, you're already in cyber. You already have a degree or certification or you've already got the job. What is the thing that would benefit you the most?

Paul Marco (47:39.924): Yeah, sure.

Aaron Crow (47:51.978): More than likely, usually that is something else, a different set of skills that you don't currently possess. Like maybe you know 80 % or you have your bachelor's or whatever and that got you in the door. How much more benefit do you think maybe a business degree or finance or something like that? Business acumen, like that's the thing in my career, I started out my career in the technology hands-on. I started out as an engineer.

Aaron Crow (48:20.288): I'm going to engineering school, electrical engineering, and then really pivoted into this technology space. But all those years, I hit this limit by being hands-on keyboard until I got to a place where I was like actually doing business stuff. And obviously at EY when I was there, you know, I had a lot of different conversations and it really opened my eyes. But even before that at the previous company, like we did this thing called Leadership Circle where they really came in and they brought in the leaders, the future leaders of the space. And they taught us.

Paul Marco (48:30.250): They're right.

Aaron Crow (48:49.358): public speaking and we did book reports and we did use cases and we did business justifications and we were, absolutely, right? We were doing all these things and at first I was like, this is stupid. I don't wanna do this. I don't understand. But man, made, it really ended up opening my eyes and obviously changed the trajectory of my career from going to EY, being senior manager, CTO of a software company. Like I never imagined, yes, I was still very technical.

Paul Marco (48:55.616): Business cases, yeah, right, nah.

Aaron Crow (49:17.026): But without that business side and that business acumen, I would have never been valid or any good in any of those other roles. I would have never been considered for a CTO role just for my technical seal sets. Because you need a lot more than technology to be able to get to those C-suite levels and a CISO or any of that type of stuff. You really have to understand the business before, the technology is important, but the business is as important, if not more, especially at those higher roles.

Paul Marco (49:44.054): Yeah, I like we I talk about this all the time It's about storytelling if you want to be a good storyteller you got to understand the story You have to be able to speak the same language as the people you're telling the story too Like one of my one of my you know favorite stories is you know was doing I was I was running security operations large fortune 500 financial and it's Christmas Eve I'm shit you not it's Christmas Eve get a call. It's like seven o'clock family sitting down for Christmas dinner and

Paul Marco (50:13.302): It's like, we have a pretty critical cross-site scripting vulnerability on the main site. We see evidence the attacker is testing it. Like, we got to spin up a P1 right now. All right, can't be mad. This is what I signed up for, right? So get on a call, right? Spin up a bridge. Do what we got to do. Get on. And you start paging people out, and they're pissed, of course, right? Because that's not what they signed up for. They didn't sign up to leave Christmas dinner. And then they're just like, we're not doing this. I'm like, no, no, here's our options.

Paul Marco (50:42.842): disable this part of the site, take away the search box, we've to change this, or we've to patch that, or change the web server, whatever. There was a bunch of different options, a couple of levers we could have pulled. And they're like, no, we're not doing any of this. You kidding me? It's Christmas Eve. We don't have any changes, 14-day waiting period, blah, blah, And at first, I was being the shitty cyber guy. was like, we have cross-site scripting. We have to do a patch now. Listen to me. I'm smart, right? And that didn't work, right? So finally, I had to pull back. I had to kind of like, you know.

Paul Marco (51:12.342): swallow my pride and take a step back. like, let's just tell the story, right? And a very simple shift in the tone was, hey, do you know how attackers use this? And they're like, what? What do you mean? So we have a cross-site scripting vulnerability on our site. Do you know what the attacker is going to do with it? And they're like, no. I was like, OK. So here's how they're going to weaponize this particular thing. This search box has a vulnerability in it. So if you put in a very particular code, what will happen is it will put a pop-up on the screen.

Paul Marco (51:41.354): That'll be from our site and they can make the pop-up say whatever they want. So what they're gonna do is they're gonna craft phishing emails that are gonna have a link that is gonna link back to our site, put a piece of code into that church box and it's gonna cause our site to pop up a box to our customers that says your account has been compromised, please click here to verify. And they're gonna harvest credentials and commit fraud. yeah, you're right, we probably gotta take that search box down, right?

Paul Marco (52:7.508): Like once you put it into a simple communication so that people can speak the same language and tell that same story, that becomes impactful. They made the tactical change. We didn't shut any web servers down. They did the tactical change. And then a week later, the whole thing was fixed and everything was up and running. But it's about telling that story. It's about using those skills of being able to communicate with other people in the business to your point, right? And then have that to propagate what your mission is, which is defense.

Aaron Crow (52:35.438): Yeah. Yeah, I had a mentor tell me during that leadership circle thing, one of the things that really stuck with me was all business is a people business. He's like, I don't care if you're the janitor or the CEO, right? You have to be able to work with people, like run through them. But if you can't convince the person sitting across from you that this needs to be done, it doesn't matter that you're the smartest person in the room.

Paul Marco (52:48.923): I love that.

Aaron Crow (53:5.943): Like being intelligent and having a high IQ and being able to get something done are not necessarily the same thing. I'd take somebody that has that high EQ, you know, emotional information, right? And that can read a room and connect with people. And I'm not saying that the high IQ person is not valid. I'm just saying, being the smartest guy at the firewall is a great thing, but it's only gonna get you so far.

Aaron Crow (53:33.474): Right, you still need someone. If you can't do it, somebody else is gonna have to do it. And the bad thing for you is they're gonna get more, more light shined on them because they're the ones having those conversations. And it's why salespeople get paid so well. It's why that, know, salespeople are usually the ones that, you know, they turn into CFOs, that turn into CEOs and all these different higher roles.

Paul Marco (53:44.406): Mm-hmm.

Aaron Crow (53:58.388): And even in CISO roles, you look at those people and yes, many of them come from technology backgrounds, but almost all of them, the reason they got where they are is because they stepped outside of just that technical track and added these other skill sets where they were lacking in public speaking and being able to win friends and influence people, being able to sell and pitch a story, public speaking.

Paul Marco (54:16.042): Right.

Aaron Crow (54:23.542): If you're at that role, you're talking in front of the board. You're talking to regulatory agencies. You're talking to who knows whom, and you have to be able to pitch your idea and get that across, that thing, the hacker would have got it on Christmas Eve and nobody would have, and then they'd have been screaming at you because you didn't fix it. And all because, not because you didn't know how, but because you couldn't win, not push them, not bully them.

Paul Marco (54:44.086): All right.

Aaron Crow (54:49.634): but win them over so that they're willing to do the work and understand people wanna be hurt. They don't wanna be beat up over the head. They don't wanna be forced to do things. When you bring them along with you instead of trying to force them, it's like dragging a dog as opposed to a well-trained dog that just walks beside you. There's a big difference between the level of effort it takes to walk a dog between those two animals.

Paul Marco (54:55.732): Absolutely.

Paul Marco (55:13.728): Yeah, you're 100 % right. The best leaders are the leaders who can get people to follow them because those people want to, not because those people have to. Right? If you can, if you can align mission and if you can align purpose with what you're trying to do, you can move mountains. Right? And that's a, that's a powerful, powerful thing. And you know, I'm sure there's definitely some fraction of folks that are listening to this that are still hands on keyboards, right? Pulling packets apart. And that's amazing. Those are amazing skillsets.

Paul Marco (55:42.378): But don't forget about the other side of this, the ability to communicate, the ability to tell that story, the ability to get people to follow you because they want to. Those are the things that are going to really propel change in your organization and get things that you want done, done. Right? Because that's the other thing we struggle with. We know how to defend the place. We just got to get it done. We just got to figure out how to get it done now. Right? That's the other hard

Aaron Crow (56:0.878): Yup. Yup. Yeah, I mean, most of my career, I mean, especially in the later part of my career, the reason I was successful is that exact skillset, being able to win over people, to be willing to do what needed to be done in the timeframe, in the way, all that kind of thing. It wasn't a technical difficulty. Like that wasn't the differentiation. Yes, I'm smart. Yes, you know, the hard hats and my experience in the OT space, all those things buy me credibility.

Paul Marco (56:15.764): Right.

Aaron Crow (56:28.524): But even with that, wasn't enough. I had to win those folks over and make sure that they were brought along. And that is priceless in the marketplace. And no matter what you're doing, so the new folks that are out there that maybe you're just now getting into cyber or you're fairly new to your point, they're hands on keyboard for every five technical classes or trainings that you take, take a non-technical one. Take one in business, take one in public speaking, do something else.

Paul Marco (56:54.112): Hell yeah! Learn something fun! Yeah! Right.

Aaron Crow (56:58.082): that's outside of your current capacity and current skillset that will also help you in your career trajectory. Because you will differentiate yourselves from your peers very fast. Everybody can be taking the technical stuff when you ask to, hey, I'd like to go do public speaking, you're gonna start being noticed.

Paul Marco (57:18.774): Absolutely, man. What a good conversation

Aaron Crow (57:21.656): So we kind of went all over the place with it. So my wrap up question is always the same. I warned you about it, but all that we talked about, maybe some of this, we can bring it back around, but next five to 10 years, what's one thing coming up over the horizon that's maybe concerning and maybe one thing that's exciting that you see in the cyberspace?

Paul Marco (57:46.422): Yeah, you did warn me. So I appreciate that. Although I think I would have come up with the same answer anyway, because it has been on my brain a lot lately. And the things that I'm going to call out are both concerning and exciting. So it's definitely AI. And I love it. I love it. It's amazing. We joke on my podcast, right? Because it comes up every damn conversation. like, oh, again, we're going talk about it again. But the reality is like,

Paul Marco (58:14.134): This is the transformative tech, right? This is, you know, however long ago the internet came out and it transformed the world and then search came out and it transformed the world, right? Like this is the next thing. And for as much benefit as it's providing, I'm very concerned. And I'm actually not concerned for the things that you and maybe the others would think like, yeah, the attackers are gonna exploit it. It's gonna get used to weaponized stuff. I get that. I'm actually more worried for society. I think it's gonna make us lazy, right? I think it's, think unless people

Paul Marco (58:43.958): make a concerted effort to maintain critical thinking and really focus on building skills like writing skills or even just like, you know, pulling things together that you would have had to think about before that now it's just easy to just write a prompt and it gets done. Like over time, that's going to have a negative impact on our ability to think about things critically and to write those and to have those skills like writing, right? Or the ability to like, you know,

Paul Marco (59:12.850): Even just think about things in a way that you're not just taking for granted what's being presented to you So that's that's the thing that I'm a little worried about I hope that folks realize that this is a tool was not meant to replace thought process It's not meant to you know copy and paste things and pop them into whatever you're using it for like there's an element of Review and critical thinking that has to stay in place and I'm really concerned that this is so easy that that's not gonna be the case

Aaron Crow (59:40.130): Yeah, it's a muscle that especially the younger generation as they're coming up, I've got an 11 year old as my youngest. I can imagine how difficult it's or different it's going to be for them, for him and his peers as it was for you and I. Again, coming up, I remember a time before the internet. I've had to, I saw a meme yesterday and it was like, ask a Gen X or you wonder why Gen Xer is so angry.

Aaron Crow (60:6.722): We had to transfer our music from records to cassettes, from cassettes to CDs, from CDs to DVDs, from DVDs to MP3s, and now we have to pay for it on streaming.

Paul Marco (60:11.507): See this, right. Yeah, no, it's like this is the speed of the world.

Aaron Crow (60:20.298): We've seen all of those things, right? And, I remember even my parents or my dad had an eight track player. So my son just got a truck and he hasn't replaced the radio in it it's a 2004 vehicle and it has a six disc CD changer in it. And, you know, it doesn't have an aux. Yeah, it doesn't have an aux connector. It doesn't have any way to plug anything in. So he was kind of annoyed having listened to radio and my wife found my old CD collection.

Paul Marco (60:34.869): Yeah.

Paul Marco (60:37.600): That was the hotness of the time, Yeah.

Aaron Crow (60:48.608): And he is just loving it because he's listening to, you know, my mixed CDs and, you know, Metallica and all these different things. And he's loving it because he's got a six disc CD changer in his dash. And I'm like, gosh, I haven't even played a CD and I can't remember how long.

Paul Marco (60:48.681): Nice.

Paul Marco (60:53.098): right. Yeah, yeah, yeah.

Paul Marco (61:2.358): I don't think I've seen a CD in years. So it's interesting because that leads me to the thing that I'm most excited about. And the thing I'm most excited about now is quantum computing. I geek out on quantum all the time. And I know that the conversation on cyber is very much about, well, it's going to break RSA encryption, and all the passwords are going to be exposed. And that's what everyone's worried about.

Aaron Crow (61:5.857): I know.

Paul Marco (61:25.600): But I'm on the other side of this thing, think to open up quantum computing to add an entire different dimension of computing and the processing power that that comes with, we're going to be able to do some amazing shit. The thing I'm waiting for over the next five or 10 years is just for it to get smaller, because that's what's coming. If you think about the first IBM computer that was delivered in the 50s or 60s or 70s, I forget what decade, that thing showed up on a frickin'

Paul Marco (61:52.520): flatbed truck and they had to take a portion of a brick wall out of a building to put it in the into the room, right? Well, we carry around computers that are tens of thousands times more more powerful than that thing in our pocket every single day. That's what's going to happen with quantum. They're figuring out cooling. They're figuring out power, right? Like it's going to become accessible. And when it becomes accessible, all the things that we worry about because the processing is too much or or there's too much data and we can't munch through the data.

Paul Marco (62:21.632): These things are going to not even think twice about it. It's a whole different way to compute data. It's a whole different way to think about things. And it's going to open up a world of possibilities. And we'll see things that truly only existed in the movies in the next five to 10 years for sure.

Aaron Crow (62:36.014): I agree. It's exciting. to your point, there's always a yin and yang. There's a good and a bad on both sides of the coin. It's the same coin though, right? You can't have the good without the bad. You can't have the bad without the good. So we have to know those things. Obviously, encryption is going to be broken just like that, which means we'll have to build new capabilities, et cetera. But to your point, like confidentiality, other than some of those examples that you gave and a few others, we aren't as worried about those things.

Paul Marco (62:53.141): Of

Aaron Crow (63:5.430): Again, everybody knows you can, there's entire products that go out there and find your information on the dark web. And yeah, man, I mean, it's there. Like if you don't believe it, search for your name, like yellowpages.com, which it's funny they even call it that, because most people don't even know what the hell yellow pages are anymore.

Paul Marco (63:12.534): Yeah. Data brokers.

Paul Marco (63:19.850): Yeah.

Paul Marco (63:25.366): I didn't think about that. That's hilarious, right? What's a yellow page? Why did this a weird company name? Why did they come up with that? That's so strange.

Aaron Crow (63:32.524): the days of the big ass books being delivered to your door once a year and just dropped off on your front porch so that you could find the, the, the pizza place and the phone number to the pizza place. Cause that's what we used to have to do people. And then you could beat someone with it.

Paul Marco (63:35.153): my god.

Paul Marco (63:39.862): That's right. Yup. All right.

Paul Marco (63:47.346): All right, so for the younger generation, that's why so many companies would be called like AAA, right? AA this or AA that because they wanted the first listing in the yellow pages which was listed alphabetically. Doesn't matter now, right? There's no alphabetical listing, but that's why if you look back, like a lot of these companies had A names and it was A this, AAA that. That's right, that's right. It was all because of the phone book. man, I'm gonna geek out all night thinking about this shit.

Aaron Crow (63:54.190): Correct.

Aaron Crow (64:5.876): AAA bail bondsman.

Aaron Crow (64:13.922): Well, and so that like, I remember this is complete tangent and then we can wrap up. But I remember in kindergarten, they put us in order of our first name and I'm a Aron, right? So I'm always very first. And then I think it was like second grade, they transitioned from first name to last name and I'm Crow. So I was still close to the front, but there were people that were ahead of me and I did not like that because I liked being first.

Paul Marco (64:24.872): Okay. Ay, ay, yeah.

Paul Marco (64:34.486): Brut row.

Aaron Crow (64:41.674): and now I'm not first? Like, wait, who voted to change this? And I was not included because I used to be first and now I'm not.

Paul Marco (64:46.218): That's so funny.

Paul Marco (64:51.606): That's hilarious. These are the things in life that happen and we just keep the names and culturally they get adopted. It's incredible stuff. Well, Aaron, thank you so much. This has been a blast. I appreciate you hosting me for an hour. I appreciate you letting me bullshit with you and hopefully your listeners had some fun and we got some stuff out of it.

Aaron Crow (65:1.272): percent.

Aaron Crow (65:12.418): Yeah, man. I appreciate you taking the time. Tell everybody how to find your podcast and where to listen to it. All the things.

Paul Marco (65:18.166): Oh my God, I'm the worst. I'm the worst at this. All right, so Cyber After Hours. I'm pretty sure if you Google it, you'll find it. We're on all the major podcast outlets, right? Wherever you, wherever podcasts are sold. Is that the right way to say it? I don't know. We're on, yeah, we're on YouTube, we're on Spotify. So check us out. Cyber After Hours is myself and Evan. The thing with that podcast is we have no idea what we're going to talk about, right? That's why I was kind of psyched to come on here and not have a topic, right? Just kind of see where the world takes us.

Aaron Crow (65:29.847): Yeah, yeah.

Aaron Crow (65:42.178): Yep.

Paul Marco (65:43.766): And the way that works is every week, sometimes we have a guest, right? Aaron, you were on an episode. Sometimes we don't, but every single time we pull a random cyber topic out of the fishbowl and that's what we're talking about. Sometimes it's amazing and sometimes we're making a bunch of shit up, but every time it's fun. So appreciate you, appreciate your listeners and yeah, go ahead.

Aaron Crow (66:0.096): And absolutely. Yeah, I was just gonna say, and all the while they're drinking bourbon or whatever they happen, whatever spirits they happen to have in their glass. It was a lot of fun. So definitely check out that. I'll make sure to put it in the show notes links so you can go check those guys out. Really great content guys. We talked about this on the podcast when I was on theirs. Like I don't see this. I want more people doing this, having these conversations. Everybody needs to hear these things.

Paul Marco (66:26.134): Yeah.

Aaron Crow (66:28.398): I don't see my friend Paul and Evan as competition. I see it as more value and more volume out there, right? So I want to lift these guys up. They do a great job. I had a blast being on their podcast. Had a blast today, Paul. So had a blast. Evan was on my podcast as well. So love, love getting that message out and supporting good people in the space and definitely put all the links out there. So thank you again for your time today. Great job today. I really appreciate it, sir. And until next time.

Paul Marco (66:40.025): thank you, yeah.

Paul Marco (66:55.766): Until next time, appreciate your bow, take care.

Aaron Crow (66:57.602): Yeah, man.

Transcript lightly edited for readability.