Bridging Military and Civilian Cybersecurity: Leadership, Skills, and Lifelong Learning with Christopher Ross

Aaron Crow (0:1.414): Thank you for joining me today on the Protect It All podcast. I'm excited to have my friend Chris here today. So what I really want to dive into today is, and Chris had some hesitation when I asked him to be on this podcast, and I get this a lot. And I really want to kind of showcase this as like there's, you don't have to have a 30 years experience or a certain title or any of that type of stuff. I truly believe that everybody that has worked in this space, no matter what their background is, no matter if it's a year, five years, a hundred years.

Aaron Crow (0:30.554): I think there's value that everybody can bring to this community and lessons that you've learned in your career, whether that's you were prior military and you transitioned and what does that look like? Or, you you're directly out of college and you got your first job at a sock. Like all of those things are value add. So this is not a gatekeeping thing. You don't have to have a certain title to be sitting at this thing. That's not what this whole podcast is about. The whole intention of this is to let everybody have a voice, to bring the value and the experience and the knowledge that you have.

Aaron Crow (0:59.568): to the forefront where you may, others may not be able to hear you at the same scale as coming on something like this. So obviously you'll get to the benefit, my guests will be, or my audience will get the benefit of hearing your experience. And you'll also open up folks that are in your network to the podcast as well. So anyways, thank you, Chris. I appreciate you trusting me. I know it can be a little overwhelming to come on a podcast and all the things, but like I told you, like my intention is not to,

Aaron Crow (1:28.910): not to get you, it's just to have a fun conversation. Like you said, like we were sitting around having a beer, even though this is an energy drink, not a beer. And you know, next time when we meet in person and we're at a conference, we'll have that beer together. So with all that to say, thank you for taking the time today, Chris. I appreciate you accepting. And why don't you tell the audience who you are a little bit about your background.

Chris Ross (1:48.111): Awesome. Well, thank you, Aaron, for having me and talking me into doing it. Impostor syndrome is something we all have, right? So name is Chris Ross. I've been doing cyber. Well, I guess I started in IT, turned into cyber about eight years ago, but it all started by joining the military. I didn't know what I was going to do after high school. And the military was like, you like computers? We have a computer job. So that's how I actually ended up joining.

Aaron Crow (1:51.484): You

Aaron Crow (1:54.396): 100%.

Chris Ross (2:17.162): I'm in the guards, which is a little different than active duty. We have a state and federal mission, so we do both. I actually hit 18 years next month, so kind of excited about that. Thank you. Thank you for the support. So yeah, I grew up doing IT stuff as a system admin, systems engineer, kind of got more into vulnerability scanning and intro to, you know, security policies and those wonderful things.

Aaron Crow (2:26.428): Wow. That's awesome, man. Congratulations. Thank you for your service.

Chris Ross (2:47.383): did that for a few years, climbed some radio towers, doing network engineering for the guard, which one of the coolest jobs I've ever done. also terrible because, know, climbing in winter, your hands get frozen. Yeah. it was, was an experience. but then, yeah, the military started transitioning to kind of defensive cyber, and stood up the cyber unit for all guard.

Aaron Crow (2:54.758): Yeah.

Chris Ross (3:14.542): in 2017 and I've been doing that since on the civilian side. Again, IT admin, sys admin, kind of mimicking what I was doing in the army. security engineer did that for about five, six years and then kind of transitioned to leadership. And I've been doing that for the past six, seven years. Time is flying, right? And now with the guard, I'm the threat hunt.

Chris Ross (3:42.895): team lead for our critical infrastructure team, which I'll talk about later. And yeah, love it. I get to tell leadership all the fun stuff and bad stuff and help guide where we're going. that's about me. Oh, my dad, best job ever, by the way. And I have three little rugrats. I had three under three. So yes.

Aaron Crow (4:5.180): Three under three. Wow. Okay. I've got three kids, but mine are 11, 13 and 16. So I'm in a different stage than you and man, they were there, uh, obviously a little bit further apart in age differences. So three under three, God bless your wife.

Chris Ross (4:21.346): Yes, my daughter just turned four, my son's turning three soon, and my youngest just turned four.

Aaron Crow (4:29.798): Wow, that's awesome. Yeah, so all that to say, I just wanna highlight really quick all the things that you just talked about, like you've been doing this for 18 years, you've got all these credentials, and yet we still have this imposter syndrome, right? And I don't highlight that to call you out or to make a big deal about it, other than to say, go and double clicking on what I initially said, right, is we all have value to bring, right? You've...

Chris Ross (4:31.928): Yeah.

Aaron Crow (4:56.656): got all this experience and all this capability and understanding and training and done it in both a civilian and in the guard role, right? And that's two different perspectives. You may be doing the same task, but you're probably do it, you go about it different ways in your civilian life than you do on the guard side, right? It's just, even if you're doing the same task, there's different processes, there's different checkpoints and there's different responses and all of those things are different. It's no different than like an IT and OT.

Aaron Crow (5:25.838): I may be doing the same thing, but I'm going to approach it differently. My run books are gonna be different. How I react is gonna be different, right? And if I'm reacting in a nuclear power plant, it's gonna be different than if I'm reacting at a milk company, right? It's just different. They're both important, but they're not the same level of importance, right? So all that to say, all the things that you've done, are, give me some things that stand out for you.

Aaron Crow (5:52.158): Maybe even along that path of I did the same thing on both sides of the fence and it was vastly different or my experiences were different. Is there anything like that that comes to mind over your career?

Chris Ross (6:4.686): Unfortunately, I have to say I've had, I don't want to say more fun, but I've had more adventure with the military, right? I mean, I've been overseas multiple times, both for deployments and also doing cyber exercises and working with state partners. Again, I've flown in helicopters to get put on top of a mountain to go climb a 400 foot tower and screw in a line of sight, you know, radio on a tower. You don't.

Chris Ross (6:33.580): get those opportunities in the civilian side. Yes, you get to work with cool technology. You get really good teams. You get to go all these awesome events, but the military also allows you to go to those events too. like you said, they're different systems, different missions, different objectives, right? And in the civilian side, it's mostly about providing a service to a customer, Pleasing stakeholders.

Chris Ross (7:2.254): and making money, right? We're capitalists, right? That's what we do. We want money so we can continue to grow and continue to spread our products and develop them. In the military, you're saving lives, protecting things that are running lives or protecting your fellow soldiers, right? You don't think about it, but radio communications, if those are intercepted by the bad guy and they know where our food lodging and where we're going, loss of life, right? So

Chris Ross (7:32.175): It's a little different. I would say like the skills to get there are very similar. You still need to understand basic IT systems. You still need to understand networking. You still need to understand security and how to protect them. You have frameworks, right? DoD is great. This is one of the biggest frameworks that everybody uses. Military, you have to use it, right? You can't go and say, yeah, I don't want to do that. Civilian side, you can use.

Aaron Crow (7:55.452): All right.

Chris Ross (8:1.260): It's in pieces. Yes, there's other regulations, but you're going to have to abide by unless you want to get fined. But in the military, it's you will use these things because they've been vetted and they don't move as fast as civilian side. So yeah, you're stuck with operating on something that's almost end of life and it's finally to a usable, stable state, right? Whereas on the civilian side, it's, hey, we just developed this. Let's play with it.

Chris Ross (8:30.348): Like I said, training and getting up to there, same skill sets. How they're utilized.

Aaron Crow (8:34.876): How much are you noticing the difference? So I hear a theme coming through there and beyond just, obviously the tech stack may be the same. Like you're using firewalls, you're using tools or similar on both sides, but you hit something there that's interesting from, the uniqueness that you bring to this perspective is because you have experiences on both sides of that fence. How much of that is different in far as you talked about using a framework?

Aaron Crow (9:3.816): You talked about, you know, in the military there's obviously rank. So if you're, if you're, you know, if you tell your subordinates to do something, they don't have a choice. Like they just have to do it, right? And on the civilian side, it's not always that clear, right? Sometimes, yes, you may work for me, but there's a lot more pushback. There's a lot more argument. There's a lot more of that. So how do you see that? And how do you, how do you kind of disciple through that as far as teamwork and leadership and, you know, the mindset of just how you

Aaron Crow (9:33.680): deal with the same problem in different perspectives. Again, from the military side where I can just say, go do it and you, thou shalt. And on the civilian side, it's more like, please, this is really important. I think this is the right way to go and you have more of a dialogue and debate.

Chris Ross (9:48.662): Yeah. I mean, again, military, they teach us to drive risk mitigation across everything we do. Right. You need to do lose no supplies. You know what I mean? Bring people home, complete the mission. For that to be successful, your team trains and practices and they know each other inside and out. Right. Like they go through very uncomfortable times together. You don't necessarily have that on the civilian side, but what you do have is a commonality, right?

Chris Ross (10:18.239): You know, the business is aligning to said tasks because this is their focus. This is what they're doing. How do you take that who, what, when, where, why, and apply that to your team? Why are we protecting systems? How are we protecting the systems? What do we do if those systems go down or there's issues with them or something happens to them? You have same concepts. You just need to approach them, like you said, differently and tactfully, right?

Chris Ross (10:48.511): You're, you're, you're on a sock, right? Your job is to figure out if things are coming in, if you have visibility into everything, if there's logs, how does that align to that mission set? Right. Or sorry, the business alignment, right? They want to make sure that their data is safe. Okay. Well, there's one thing that we know. We know the why we want to keep that. Okay. How do we do it? What are we doing to do that and align to that? So when you kind of break down those things, they're very similar.

Chris Ross (11:18.283): Obviously you're not getting shot at, obviously you're not, you know, overseas, right? Or, or even stateside now. mean, things are crazy in the world. but you still have fundamentals. You still have that who, what, when, where, why, right? It's, it's the most common thing, but it works. Right. And when you break it down to that fundamental state, a each person on that team, yes, there's, there's a rank structure, you junior analysts, senior analysts, engineers, team leaders, your, your leader.

Aaron Crow (11:47.696): Yeah. Right.

Chris Ross (11:47.929): their leaders leader, they have different responsibilities at that level. So as long as they understand yours, right, as it goes down and they're helping you apply it to theirs, you have a common language and the who, what, when, where, why the five Y's right and H. So that's, that's kind of how I approach my teams is again, communication is the number one downfall. That's where all the misses happen. If you're not communicating or talking the same language or achieved.

Aaron Crow (12:5.371): Yeah.

Chris Ross (12:16.782): attempting to achieve the same goals, that's where everything falls.

Aaron Crow (12:21.286): Well, a hundred percent. love that. And, and, and it's so powerful and understanding and that, and it all really comes, always comes back to communication, whether it's a relationship with your wife, your kids, you know, your peers, your boss, your employees, whatever that may look like. It really comes down to communication, setting expectations and being clear on those. But it also, I think it also, it really ties to the mission, right? So obviously if you're in the military and you're serving this role, everybody understands what the mission is.

Aaron Crow (12:50.170): Right? We know that we're trying to save lives, et cetera, et cetera. I find in the civilian world, sometimes that mission isn't always clear. Right? It's not always clear on what are we trying to do? Yes, I'm in a cyber role, but am I trying to hunt and find things? Am I trying to defend? Like, what am I protecting? You know, all the, like sometimes that mission, especially again, I keep going back to OT because a lot of my, half of my career has been spent there, but I've been in those positions where in the IT world, so at a place that has,

Aaron Crow (13:20.016): they build their manufacturing facility or it's a power company or whatever it is. The OT is the thing that really is the reason the business exists. But many times the IT organization is 10 X the size of what the OT side would be. And they sometimes seem to forget the mission is to protect the OT, not to just do cyber things on the IT side because it's fun and exciting and sexy and AI and all the things. And sometimes that mission gets missed.

Aaron Crow (13:48.513): And it doesn't mean that they're not doing good things, but if the good things that you're doing don't help towards the mission, then what's the point of them?

Chris Ross (13:57.548): Exactly.

Aaron Crow (13:59.175): So it's, it's, it's that bigger picture of making sure that not only are you communicating, but everybody understands what the fricking mission is so that we can all be walking in the same direction.

Chris Ross (14:7.841): Yes, agreed. that honestly, that comes down to two things. A leadership and B as an individual contributor, why are you contributing? Is there a place that I can go to understand that mission? Every policy you read, every time you go and onboard to a company or you research a company, they have a statement in there and what they do, why they do it. Right. This is their product or this is, the things that they service.

Chris Ross (14:35.947): You need to make sure that you understand that. And as a leader who was in charge of this team, you need to verify that you need to make sure they understand why. And if they don't. You as the leader or the person who's supposed to take a step back and go, okay, why don't they? What were my failing or what am I not communicating correctly? And if it's at that level, then fine. But if it's at a higher level, then that leader needs to either go higher or to their leader and say, there's, there's a fundamental problem here.

Chris Ross (15:5.579): have these people working towards something and they don't understand why they are, or you have them working way over here, but they were hired to be over here and work on these things and secure these things. So why are they over here now? There's, there was a drift. got to get them back on, back on the road to the mission. Right. and that conversation is never easy, but as a leader, right. My mentors have always taught me to be a servant leader. You're there.

Chris Ross (15:33.697): to protect, provide and get them whatever they need. That's what a good leader does. You're missing stuff. Okay, how do we get it? Why do you need it? How do we afford it? And then when things go bad, you're that shield. Listen, they did this because that's what they've been trained to do. This is what my objectives to them were. And if you're going to yell at somebody, you yell at me. I'm responsible for them, not them.

Aaron Crow (15:55.325): Correct, Yep, and that is not a common, unfortunately, not a common thing that I see in a lot of organizations is that it's easy, I don't wanna name names, but I'm dealing with, I do some events, some cyber events, and we do fun stuff. shoot guns and shoot out of helicopters and.

Chris Ross (15:57.655): So.

Chris Ross (16:19.457): Yeah!

Aaron Crow (16:22.470): beer and bourbon and food and all the things, right? And one of the venues that I'm working with or was working with, I'm no longer working with because it's partly that lack of leadership and that lack of ownership really is what it comes down to. That Jocko mindset of everything is my fault. It's the leader's fault. If somebody working for you fails, it's because you didn't lead them.

Aaron Crow (16:51.374): If your kid fails, it's because you didn't lead them well. And then people argue that, well, it's that whole extreme ownership, right? And it's, how is that true? Because I gave it to Bobby and Bobby didn't do it well. Either Bobby's not in the spot that he can be successful. You weren't clear in what you expected of him. He wasn't right for the role. Like any one of these things should be tied back to you. Now, obviously Bobby still has a hand in it, but ultimately it's the leader's responsibility to understand, do I have the people in the right spot?

Aaron Crow (17:17.564): can do the job and can be successful and they know what their mission is and they know what success looks like and I've communicated all that I've given them the right tools and like if any one of those things are wrong and they fail it's because of you and you didn't lead up right so it's a hard lesson to do but I see so few organizations do that and for and like I said the organization I was just talking about like they had it excuse after excuse after excuse and pointing fingers at this person or that person and

Aaron Crow (17:43.803): And it's all the subordinates. It's just like, well, Bobby didn't do anything or Susie messed this up or, know, they didn't give me this. I, know, it's not our fault. Like we're, it's just like, no, no time out. You're the leader. It's your responsibility. And the fact that it didn't get done is you, it's not them. It's you. Right. And, and the fact that they haven't recognized that or stood up to the plate and we've given them multiple opportunities. So we stopped working with them because I don't have time for that. Right. Nobody expects perfection. I do expect you to step up and own it and not make them make an excuse and say, yep.

Chris Ross (18:6.894): Nobody's here.

Aaron Crow (18:14.042): My bad, I did not give him the instructions. I didn't give him the tools. didn't give him, I didn't understand the expectations, whatever those things are, and then fix it. And here's my path to fix that for the next time. Like, we'll make sure this is done differently the next time, right? And that's never done. Nobody wants an excuse, right? Nobody expects perfection, but nobody wants an excuse. Because that doesn't do anything but tell me, okay, so you're not actually gonna fix it. You're just gonna continue to make excuses every time you make a mistake. Gotcha. So I don't wanna work with you anymore.

Chris Ross (18:40.546): Yeah. And I, you know, to, go on that, right. That's the difference between civilian and military. You have a bad leader gets people killed. No one's going to want to work with them. Right. Here, they just either get rid of the people, right. And it becomes toxic leadership because they know they can get away with it, or they get rid of the leader and put hopefully somebody better in. So there's not really as much of a, you know, justification to work on.

Aaron Crow (18:49.744): Yeah. Yeah.

Chris Ross (19:9.574): to have that monitored. And I think, you know, with military leadership, that's one of the strong suits that they have is that's how they're trained. And it's just one of those veterans or reservists that are in leadership positions that are transitioning, they just they have these skill sets and capabilities and mindsets. And it's hard to translate that into civilian terms, like everyone I talk to, like, you know, they

Chris Ross (19:37.611): Mention off their code. Hey, I'm a 17 Charlie. Nobody knows what that is. So let's, let's break that down, right? That's a cybersecurity, you know, operator. So, okay. Cyber security analyst or engineer or network analysts, right. And in the military, they're getting better at it. They're, you know, there's lots of like skill bridge and all these transition sites that are helping and interning with companies. have all these built in.

Chris Ross (20:5.582): MOS translators now and it's great to see. It's getting better every year. Like I hear from Vietnam guys from, you know, the Veterans Association that I talk with, they didn't get any of this. They get new support. They got spit on. So like the fact that those things are getting better is great for us. I still feel bad for them, but they're seeing the change. They're excited about it. And it's

Chris Ross (20:30.444): It's a great thing because there's so many things that you learned from being in the military that you can apply to the civilian side that somebody who hasn't gone through that is never going to know or can even appreciate that sometimes. And this is exactly one of those conversations.

Aaron Crow (20:46.192): Yeah, so what other kind of so you talked about your training that you went through. So did you get most of your training and certifications? Anything like that on the military side and were able to use that on the civilian side as well?

Chris Ross (21:0.280): So basically, and this is a great plan, right? I think it's great. So the military, again, breaks all of their job positions by codes. They call it MOS, Military Operational Specialty. So like a 25 series is all radio signal satellite. 17 is cyber operations, whether that be defensive, offensive, forensics, et cetera. And again, that goes, they have like,

Chris Ross (21:28.846): 70 of them. no, I don't know them all. But again, right? each position, so you have enlisted who are basically your doers, your worn officers like me who are, you know, technical smeeze and advisors to leadership. And then officers who are product managers, people managers, and they get, you know, the mission sets and everything that is required to perform them.

Aaron Crow (21:31.972): Hahaha

Chris Ross (21:57.015): And again, they're ultimately responsible for things. So, you can have good leaders or you can have bad leaders, but it's up to the senior enlisted and the warrant officer to create those good leaders. Right. so, you know, each level of either working or advising or being the leader, there's different training things and tasks that you have to do in order to be qualified. Right.

Chris Ross (22:25.658): and that goes for, you know, every role, whether it be a leadership task that you have to go through and learn, Hey, now you're you're an E six. You're not managing just three people anymore. You could be managing up to 15, right? or you might have to step into that leadership of the next level because that person's pulled away for something. So now you have 30, 40 people under you. so you have to go through training for leadership and then you also have to go through training for your job, your job role.

Chris Ross (22:53.454): Um, so again, it's you have your basic when you first center, they call that, you know, advanced, uh, advanced individual training, and then you go through all these courses that are specific to your job. Um, and those go all the way through your career. Uh, I mean, I'm, I've been in for 18 years, I've gone through four different pipelines and I still have things to do for the next 20 years if I want. So, you know, that's one thing. And again, when.

Aaron Crow (23:17.386): Hehehehehe

Chris Ross (23:23.192): Like for my unit, and I'll talk a little bit about it in a second, but like you have a certain job role, whether you're a host analyst, a network analyst, or you're on like the threat hunting team, every year they have this thing called the joint qualification. You have to go and perform all these tasks to pass and keep your certification.

Chris Ross (23:46.349): If you don't, you basically not necessarily get kicked off the team, but you won't be able to go on a mission. You won't be able to do response and you'll be in basically retraining until you know, you get it. Yes, exactly. And again, they have different levels. So you have your basic, your intermediate, your advanced. And so that's how you know, you have the right people that have the capabilities. We don't do that necessarily inside or let me rephrase that.

Aaron Crow (23:56.485): It's a, it's like a PT test for your, for your cyber skills.

Aaron Crow (24:2.480): Yeah. Yeah.

Chris Ross (24:14.552): We don't do that often in the civilian side. It's, I have a degree. I have these certifications. Yeah, those are great. I mean, don't get me wrong. I have tons of them. But when you get hired by a company, you get a certain skill set of tools to use, and then you get really good at those. What happens when those tools go away? Do you still have those capabilities to do scripting to pull up things?

Aaron Crow (24:29.478): Mm-hmm.

Chris Ross (24:41.056): on various different systems, right? Or do you have playbooks that are developed in order to know those codes or commands or whatever, to pull that information. We're so heavily reliant on all of these vendors and tools nowadays. If those go away, I mean, look at what happened during the CrowdStrike outage. Case in point, those that are good know the stuff. They're not reliant on these fancy tools. I mean, yes, the fancy tools are great.

Chris Ross (25:11.086): But if you don't have the basic understanding of what these tools are doing or know how to do it, that's where you should focus your stuff first. And that's, that's, I'm not saying that as an individual, I'm saying that as a team leader, right? You should have your people be focusing on these skillsets because yes, tools are great and they make things fast. But when you lose that tool, and again, that's what adversaries are going after are the tools. Um, and they're installing their own and you might even think.

Aaron Crow (25:34.704): Yep. Yep.

Chris Ross (25:39.330): You're using your tool, but you're now using theirs. So again, the.

Aaron Crow (25:43.645): Well, it's so funny because I'll get emails or I'll have recruiters call me, because once your resume gets in a database, they keep it there forever. So I'll get a phone call from a recruiter and be like, hey, I see you're a whatever, Novell NetWare or a Unix Admin or this particular firewall or whatever. I'm like, yeah, like 15 years ago.

Chris Ross (26:9.361): Yep.

Aaron Crow (26:10.684): I haven't touched those things in 15 years. Yes, technically I'm certified Cisco certified network engineer and I'm a sonic wall engineer and I'm a Palo Alto this and a Microsoft MCSE. Like I have all these credentials, but I haven't done any of that. Most of those things in a while, like I still dabble in firewalls and that kind of stuff, but you don't want me configuring your firewalls. Like it's been long since I've been that is my daily keyboard warrior dime.

Aaron Crow (26:38.522): Like if I'm configuring your firewall, there's a problem. Like could I figure it out? Yes. Am I good at it? Sure. But it's like, haven't, I'd have to dust off, you know, the rusty parts to remember the commands and best practices and surely things have changed in the last 10 years since I last really did that full time. So it just goes to show like to your point, we need to be doing these. And again, it's not to, I'd say the same thing about driving, honestly.

Chris Ross (26:52.248): Yeah.

Aaron Crow (27:7.648): You know, you get your driver's license, you're 16 years old, you never take another driver's test until you die. And there's so many people that should be taking driving tests because they have no right being on the roads. And that's a prime example of that. Like we need to be doing a regular check of our skill set. Not again, not to gotcha anybody, but you wanna make sure that you, just because you got a degree in something 20 years ago doesn't mean like, I used to be super good at math.

Chris Ross (27:7.874): Yeah.

Aaron Crow (27:35.345): electrical engineering, calculus, all that kind of stuff. If you put calculus in front of me right now, I wouldn't have a fricking clue what to do with it. And I was really, I could do it in my head back in the day, but I don't do that anymore. Like I haven't done calculus in 30 years. Like how would you expect me to, could I figure it out? Sure, I'm sure it would come back to me as I started doing it. But you compare me to some kid that just took calculus last semester. There's, mean, I can't help my 13 year old do her math sometimes. I'm like looking it up like,

Chris Ross (27:42.839): I'm just gonna go on the fire.

Chris Ross (27:51.118): Mm-hmm.

Aaron Crow (28:4.986): wait, order operations, how do I do this again? And it's just little things like that. And it's no surprise that that's gonna happen in all things that we do. If we don't practice something, you're gonna lose that skillset. So it's awesome that the military does that. It's surprising that we don't do something similar to that. We have that with continuing education with like the CISSP. You have to show some stuff of, I'm doing some continuing education, but.

Chris Ross (28:8.298): And then.

Aaron Crow (28:34.372): It's so broad, doesn't really, it's not specific enough for my job role. But if I was a threat hunter, I would want to make sure my threat hunting team was constantly polishing their skills and every year, and you could gamify it, you could have leaderboards, there's all sorts of ways to do it that benefits the team and doesn't make them think that you're just trying to fire them or find something that they did wrong, but it's really for their benefit.

Chris Ross (28:59.651): Yeah. that's, you know, my, my team is, there's a lot of smart people on my, my military team, my, my cyber team, right? We're, we're mostly focused on critical infrastructure. but that hasn't always been the case, right? We've, we've done more infrastructure to support cyber operations for the past, you know, seven, well, I'll say five years. We just kind of switched over like a year or two ago to more critical infrastructure and how we're going to, you know, protect nuclear power.

Chris Ross (29:28.515): you know, all those wonderful utilities, right? but like one of our things that we do when we get in there is ranks off, like, you know, cause this person might be an amazing coder, but knows nothing about security. This person might be amazing at security, but there's nothing about network engineering, but this network engineer can't do either of those other two things. like the collaboration on our team is, is, know,

Chris Ross (29:57.816): smartest person in this area is the one who's teaching everybody else, right? It doesn't matter what your rank is. If you come in and you're, you know, four days into the army, you're coding Python, like things, right? And developing all this stuff. Guess what? You're going to teach class, right? I'm going to give you ample time, but you're going to teach a class because one it's fresh, one it's new. Yeah, we might know how to do basic things and

Aaron Crow (30:2.150): Yeah. Yeah.

Aaron Crow (30:16.144): Yeah.

Aaron Crow (30:20.752): Right, yeah.

Chris Ross (30:27.215): and stuff, like, are the changes? Like, how does it integrate with all these other things now? Right? So you're going to teach a set. One is going to show that you know your stuff. Two, it's going to give you teaching. Right. And, and presentation skills and three, I might have already said three, but the next thing, right. Is it's going to build your confidence. Right. You, you, everyone comes in like me coming into this, right. You come into a new environment, you go into a new role. What are the first thing you do in the first 30 days? Learn everything you do.

Chris Ross (30:57.103): Learn all the tools you work with, learn who you need to coordinate with, and kind of the personalities of people. It's the same aspect here. We just force you to do things a little bit better because we know you're good at that. And that's part of the nicety of coming into our unit is we do the background check. We do almost like a job hiring. So when you come onto our team, we already know what your skill sets are, and we make you use them. And it's nice because...

Chris Ross (31:26.423): Obviously we give you the onboarding. We give you like, use the MITRE, we use NIST, we use CSF and we use DCWF, is the DoD Cyber Workforce roles. This is what you're going to be training to. How do you apply your skills to that? Now that you know what this is, obviously don't answer now, but in six months you're doing a presentation on it. So, you know, that's, that's kind of how we do that. You don't necessarily get that with all the companies now, right? Like you get hired, they say you should know what to do because it was on your job description.

Aaron Crow (31:56.454): Good luck.

Chris Ross (31:57.500): Right. And that's, think that's one of the biggest problems. And then the other thing too is, is not revalidating every year. This goes from individual contributors to like what your team's doing. one of the things that we used to do, or I do as a leader in a sock is we do IR tests or sorry, scenario walkthroughs, sometimes tests. It's, it's a, at least once a year. Right. And I think that is a terrible model.

Chris Ross (32:26.957): I think you should be doing it at minimum twice a year. You should realistically be doing it quarterly and that's with other stakeholders, right? Because things change too fast. And again, communication, the technical team might know what they're doing, but once that becomes a breach or things have to be paid or whatever, does executive leadership, does legal, does HR, do they know all the processes?

Chris Ross (32:55.855): Play with these all the time. Do you know how to talk to them? Do you know their language? So again, it's the revalidation and we don't do that well enough as leaders, as defenders, individual contributors.

Aaron Crow (33:10.140): 100 % agree. I talk about this pretty frequently. I look at the tabletop exercise, the instant response planning and exercises. I look at those as like a fire drill. The reason you do those is because you don't want the first time, you don't want the first time somebody thinks about what to do in a fire is when there's an actual fire. You want them to understand, okay, where's the muster point? Where's my exits? What is the process? All that type of stuff. You want them to just be something I've done 50 times

Aaron Crow (33:40.165): It's annoying every time you do it. And then when it comes time, like you just know what to do. Right? So that's why like we've done and partnered with a company called ThreatGen here. And they have this auto tabletop thing that they built and it uses AI. the cool thing about that is it's a license. So you can buy it for your team and it helps you. You can ingest your instant response plan, your desk recovery plan, your networking.

Aaron Crow (34:8.022): of architecture, things like that. And then you can build a scenario. Hey, this, I want to use it for my team. So it's an instant response team. These are the people in it and the roles that they are. And then you do an instant response plan for those people. Well, then you do a bigger one. And I want to have the CISO there and I want to have, you know, the product manager or whatever those roles are. And it'll go through those scenarios. And the cool thing about it is, is it scores your response. And if you do it twice in a row with the same scenario,

Aaron Crow (34:35.804): You shouldn't have the same problems the first time because you should have learned. You should have had an after action review and said, Hey, you did this and you should have done that. So the second time you do it, you should get a better score than the first time. And then you can make it more complex. And you know, the other thing that I always see in these tabletops is, is people just go through and they check the box. They don't care. They're not actually going through and trying to find things. They're just trying to check the box to say, yeah, we did our tabletop. Okay. See you next year. And they got free lunch and whatever, right? It's just a compliance box.

Chris Ross (35:1.484): It's compliance.

Aaron Crow (35:4.582): but they're not actually using it to the benefit and what it should be to your point. It should be quarterly at least. I think it should be, you know, more frequently. And especially if you do it like what I'm talking about with the Auto Tabletop, you can actually use it as team building. You could have it be a skills bridge type thing that you're talking about where this is a requirement that people go through this process. And then when you find things, you come back together, you fix the process and you run it back through the system again and you see if it fixes everything.

Aaron Crow (35:32.879): if it fixed my responses and then you can work with multiple teams. Anyway, I'll get off my soapbox, but that's what I think it should be, right? It should be something you're constantly, you want to find the problem before the bad guy finds the problem. You want to find the problem. You want to, you want to know, you want everyone on the team to understand what the role is in an incident before there's an incident. Cause you don't want them to be going back to like, Hey, what, what, what should I do now? Like you don't, that's, that's the wrong time. Seconds matter in those moments.

Chris Ross (35:56.611): Yeah.

Chris Ross (36:2.628): Yes. Yes. No. And again, I like that platform sounds very interactive and you're taking your lessons learned with the, know, the issues that you have and then coming up with something less like an actionable plan to make it better to protect the environment. And I, know, you don't get that type of training unless you

Chris Ross (36:23.696): Go to training or do training or do certifications or learn about the latest and greatest. And, know, one of the things I wanted to talk about today was, you know, I've done a lot of certifications. I've done a lot of hands-on, tons of CTFs. And again, with the guard every single year since 2014, I've done some sort of two week training with industry partners, going through a red team, blue team, purple team exercise, right? Those are important to do because again, it goes back to the revalidation.

Aaron Crow (36:24.892): Correct.

Chris Ross (36:54.220): Sans has a holiday hack challenge every year, which is really fun, right? And it hits a whole bunch of things. And I always tell people, like, you don't need to pay to do these. Like there's free things out there. Go do them. Obviously there's paid things, but you should, you should be mixing education with certifications and hands-on experience. Like that's how you get a whole, you know, rounded person, not just, yeah. And like for me, for example, if I didn't do all those other things that I talked about and I just showed up with, I have a master's degree and you

Aaron Crow (37:4.624): Yeah. Yeah.

Chris Ross (37:24.240): whatever 20 something certifications, this guy's a good test taker. Cool. Let's see what he actually does. Right. Um, and I get that cause I, I'm part of my imposter syndrome is I'm like, that, know, that's what I would think. Right. I'm a hiring manager. Um, but again, like, you know, there's all these training opportunities out there. Uh, you know, I'll talk about sans just a little bit because that's what's familiar to me. And I've been using it since like probably about 10 years now.

Aaron Crow (37:53.574): Yeah, I love sands.

Chris Ross (37:54.973): Yeah. World-class leaders that are teaching these classes, have, you know, net wars where you can go against your classmates. They have CTS where you individually work on things by yourself. I mean, the material is always refreshed. They're expensive. They are. But now, you know, the past, I think, 2017, they came out with, actually, it might have been 2015. They came out with, you know, the master's degree.

Aaron Crow (38:2.588): Mm-hmm.

Chris Ross (38:22.064): Now they have a bachelor's degree and I think they have a associate's degree now. You're getting a degree and certifications from an accredited school, one that's approved by NSA. And it's half the cost if you were to go take like, again, the master's program, need nine certifications. That's $90,000 right there. The course is only, I'm not going to quote how much it is, but again, it's like 30, maybe 40, right? Why not?

Aaron Crow (38:40.016): Right. Yeah.

Chris Ross (38:51.866): But again, right? You know, offensive security, they're known for pen testing. They're known for offensive security things. Great stuff. I'm not great at that stuff, but I still go play around and I learn, right? What do we call it? Fumble effing through it, right? But you have to do that, right? You have to be able to go into something uncomfortably and try to learn. And then as you're learning, you're going to go, Hey, light bulb.

Aaron Crow (39:7.034): Yeah.

Chris Ross (39:20.750): This is how I could bypass my thing or bypass this that I've set up. And then that's where you start to get into that, you know, adversarial mindset. And that's why I think purple teaming is such a great idea is you have that red team person or offensive person, sitting with you going, all right, this is how I would bypass that control. Okay. Well, how do we break that down? Well, there's a framework for that minor attack, right? Or loss.

Chris Ross (39:49.413): or CIS controls and all these other things that you can use that go, hey, what he just did was, you know, privilege escalation. Well, how does that occur? Well, first they come in, right? that's another tactic. Then you take all these tactics and then you can map them to actual threat actors and what they're doing and then go, okay, who do they attack? They attack manufacturing. I'm a manufacturer. Maybe I should start looking into these things.

Aaron Crow (40:14.832): Right.

Chris Ross (40:17.242): You know security isn't that hard. It's just I feel like the communication of where to get all this stuff is kind of like held tight right and we're getting better at it as a community but. Not everybody knows where to go like there's websites and I'm actually might add these to the to the thing I send you but like ransomware dot live right it's it basically tells you all the IOC's hashes TTP's. It gives you a quadrant of who's been the most active.

Chris Ross (40:46.096): It also gives you Yara rules. So like if you don't have a sophisticated seam or sore, you can take that and go, OK, here's some stuff. Now, how do I apply and change a couple of things? And you have a basic detection rule there. Obviously, you make it better. You want to make it better. But you don't have to reinvent the wheel. It's there. And there's tons of sites like this. And that's, I think, the biggest problem with a lot of these smaller

Aaron Crow (41:1.148): All right. Sure.

Chris Ross (41:13.006): teams is that they have to reinvent the wheel or they're so reliant on going there. Go home, get a VM or a couple of VMs, they're free now. Build yourself a seam, build yourself some detection rules, test them. That's them, right? It's the only way you're going to. Exactly. And that passion is definitely something you need to be successful in this field. And I just.

Aaron Crow (41:23.056): Yeah.

Aaron Crow (41:30.896): See what you see, see what it looks like, yep.

Chris Ross (41:43.066): Some people go because, Cybers pays a lot. Let's do it. But yeah, as a leader, you got to learn to find who those people are.

Aaron Crow (41:46.373): It does.

Aaron Crow (41:53.181): Well, and one of the things I see, and this seems to be universal and there's something about it, you know, and it doesn't matter what it's in, but it's that being in that lifelong leader or learner, excuse me, leaders also, but learner. And what does it take to be a learner? And what does it take to learn a new skill or do something you've never done before? That means the first time you do it, it's gonna suck. You coming here today, right? You were anxious and it was like, oh, I don't know if I should be on a podcast.

Aaron Crow (42:22.928): But why? Like, even if the first time, what is the worst thing that can happen if you came on today and you bombed? Which you haven't, by the way. You've done great. but again, what's the worst case, what's the worst thing that can happen? Okay, you can improve. You can get better. You do another one. You get a little bit better. You do another one. You get a little bit better. That's what we have to look at. You know, when I started Jiu-Jitsu, was the same way. was in my, you know, 40s and walked into a Jiu-Jitsu place and had never done it before. Like, that's pretty intimidating.

Chris Ross (42:29.232): Thank you.

Aaron Crow (42:51.388): the first time you walk in. And honestly, it's intimidating every time I go there, because there's always somebody better than you. And no matter how good you are, you're still going to have to learn. But I tell my kids this as well, like your kids are younger, but you know, I've got a 16 year old and I'm constantly telling my kids to try new things and it's okay to suck. Like if you want to get good, good at something, you have to be willing to suck at it first. Cause nobody, Michael Jordan didn't walk out on the freaking basketball court and become Michael Jordan without sucking a lot first.

Chris Ross (43:19.802): Yeah, millions of shots.

Aaron Crow (43:20.796): Everybody does millions of shots, right? And the difference is, is, you willing to stick through until you don't suck as much anymore? And you get a little bit better and you get a little bit better and you get a little bit better and you don't always see it when you're looking in the mirror. It's like losing weight or gaining weight or, or gains or anything like you don't see it every day, but somebody that you like go away for six months and come back. You may not notice the big transformation, but you see somebody else and they're like, wow, like how did you do that? Like, where did you, how did you learn that? How did you.

Aaron Crow (43:50.631): transform your knowledge, your body, like whatever that thing is, we have to be willing to do those things and cybersecurity is no different, any skill set, you know, and the other side of this that I've heard today and I preach a lot as well is there's really two, like more than two, but you know, kind of two main themes that I see to be successful in your career. Obviously in this cyber career, there's a technical side, I need to be able to understand

Aaron Crow (44:19.000): and maybe be a player in that I'm gonna have to be hands-on. I'm gonna have to be a programmer or I'm gonna have to be a firewall guy or whatever that thing is, whatever your vertical is that you wanna be in. But even those people, when I'm super technical, you still have to have some kind of leadership. You still have to have public speaking. You have to have those softer skills. So that's the second thing that so few people work on, right? And it's easy to go get the Cisco certification or the

Aaron Crow (44:48.308): certified ethical hacking or whatever, the SANS course, but we don't always focus on, and primarily, I know in my career, it was because if I'd go get this technical certification, I could get a bump in pay. There was a clear line of A plus B equals C. What I didn't realize is eventually I'd have, to your point, I'd have enough certification stack behind me that the next one doesn't really change much. Like you've already got 30, 31.

Chris Ross (45:1.339): Mm-hmm.

Aaron Crow (45:15.760): I don't really care. It's not gonna really make that big of a difference in your career, buddy. So then it's like, okay, well then I go get the masters. Well, what does that masters do? It's not just technical. There's other things that they're teaching in there. You're understanding business acumen, you're understanding public speaking, you're understanding how to write, how to understand case studies. There's all sorts of other things, soft skills that are in that thing. And that's what that's really telling people is not, it doesn't exactly even matter what your masters is in. If it's in business or cyber or whatever.

Aaron Crow (45:45.853): Part of that is because they understand that there's those softer skills that go into those things, right? And that's the thing that differentiates and it's gonna level up your career. And again, even if you wanna stay super technical your entire career, you still have to convince your boss that your idea is good. You have to convince your teammates that your idea is good. And that's selling, that's public speaking, that's being able to influence people. Being the smartest firewall guy, because I've had a lot of those guys, guys that are just so smart.

Aaron Crow (46:15.910): that you can't even understand the words that come out of their mouth half the time. But they also talk over people. They aren't able to sell their idea or explain without intimidating or putting people off of why their idea is important and why their point of view is the correct one. And sometimes a worst, somebody with not as good at a role, I'd rather have a team player that can learn and is willing to suck and willing to have those softer skills.

Aaron Crow (46:45.190): than the smartest, now, don't get me wrong, it's nice to have that the smartest guy or gal in that particular thing and have them tucked away in a dungeon somewhere where they don't have to talk to anyone. You always want those types of people, but if you don't wanna just be that person that has to do that for the rest of your career and you wanna grow and change, like that soft side of the skillset is super important in growing and continuing your career, even if you don't wanna be a leader, even if you don't wanna be a manager.

Chris Ross (46:54.320): you

Aaron Crow (47:14.298): and you want to stay technical, it's still super important in my opinion.

Chris Ross (47:18.448): Yeah. Cause I mean, even at the highest technical levels, you will be brought in to speak to high levels, you know, stakeholders to under, you know, give them the understanding of what you're developing, you're doing and working on. you saw skills are important. And I think one of the things that gets lost, right. Is, like, you know, we went back to kind of the certifications and the degrees are not a lot of people plan out what they want to do or where they want to be in the next five or 10 years. Right. and.

Aaron Crow (47:23.228): Correct.

Chris Ross (47:47.722): you know, is, if I do one big ladder thing, right, I made this huge promotion or, I did this one thing that it's going to change everything. And, you know, everything's going to move forward. But if you take smaller steps, right, you take 10 more steps to get there, you gain a lot more experience. And if you fall down, you go down one step that's minuscule versus one large step. Right. And, know, you're both both pass or go into the same place. But

Chris Ross (48:17.489): The more steps you take, the more knowledge, the more repetitions you're gonna get, right? And that's one of the things I always tell my soldiers and any person that's on my team is, make sure you have a plan. How you get there, that can differ, but like, you should have milestones on what is success to you and where you wanna be in that timeframe. And then the ultimate position, right? When I was younger, CISO, I was like, those guys are cool, they're badasses.

Chris Ross (48:46.033): As I got higher up, I'm like, they deal with a lot of politics. I don't get to be hands on anymore. They have a lot of bricks decisions to make. It's not as sexy as I thought it was. And one of the things that I tell everybody is don't be afraid to fail, right? Use your mistakes as lessons learned to move you forward. What not to do next time or how to do it better next time.

Aaron Crow (48:51.345): Right.

Chris Ross (49:12.517): And again, to be successful in this field, you're gonna fail multiple times, but you need to have the passion to continue on and educate yourself and do the research to continue down the path.

Aaron Crow (49:23.420): Yep, 100 % man. That's so very true. I'll move on after this last point. But through my career, I've been doing this a long time. I got grays in my beard. So I've been doing this a long time. And one of the reasons I think I succeeded so fast and moved in my career path, went the way that it did, was because I was willing to almost take a step back. And there's multiple times in my career where technically I took a step down or maybe a lateral move.

Aaron Crow (49:51.933): because I wanted to learn something that I didn't know how to do. So I went from being maybe the leader on a team to being the junior person on a team, having no responsibilities and just being the grunt, you know, the F and G. And it was, those things were so valuable to me because I was able to diversify my knowledge and experience and it helped me along the way. Like my career is different. You know, I have a lot of technical things, but I've also done a lot of business stuff.

Aaron Crow (50:20.156): I've had a real estate license since 2006 and I owned and ran a real estate office and did bank on foreclosures and bought and flipped houses and did construction things all while I was doing cybersecurity and networking and all the other stuff too. But all those things have helped me understand business acumen, be able to have those conversations with the boardroom and understand ROI and some of that language that I didn't get in my technical upbringing because it was all about routing and DNS and

Aaron Crow (50:48.272): you know, server protocols and, you know, know, all packets and all the different types of stuff. And yeah, I could talk packets too, but I can also talk to the business team and that it ended up being one of my superpowers along the way was I was able to have conversations with both with a non-technical person and explain a really complex thing in terms that they understand without making them feel stupid. And also taking the thing that they're asking and translate it down to the technical people that don't speak anything except highly technical and say, no, no, no, that's not what they want. This is what they want.

Chris Ross (50:48.836): Thank

Aaron Crow (51:17.372): Well, that's not what they asked for. I don't care what they asked for. I'm telling you, this is what they want. And just believe me, this is it. And then being able to put those two things together, right? And that's, that's hugely powerful. So all that to say, I think it's, I love the fact, you know, again, I've got three kids, my oldest wants to go, he wants to be a green beret. So, you know, that that's his path. He's 16 and he's been lazy frontside focused on, on that his, his uncle was a green beret in Vietnam. And, you know, he's got a couple of mentors.

Aaron Crow (51:46.781): I hang around with a lot of military folks. So everything from, uh, uh, Marsau, you know, Raiders and, and Navy SEALs and everything, but he wants to be a green beret. So, but I've told all of my kids that military is a, is a great option for them because of all the training, all the benefits that you get. Um, it doesn't mean you have to go be a war fighter, um, but you know, you can be national guard. There's all sorts of these paths that you can, cause any job that you have in the civilian world, they probably have a military equivalent. Somebody has to cook food. Somebody has to drive the trucks.

Aaron Crow (52:16.774): Somebody has to fix the trucks. Somebody has to do the accounting. Like there's literally a one-to-one relationship almost to almost every job that you wanna do here. And the military will train you to do it, right? And you get real job experience. And then you also get those other intangible skills, leadership and being part of a team and having a mission and all that kind of stuff too. Not to mention all the other benefits of being a veteran as well. So, you know, I really push my kids to consider it and not to mention.

Chris Ross (52:18.416): Nope.

Aaron Crow (52:43.888): the other ancillary things of having service and doing something for other people and what that looks like, right? And so all those things. So I think it's a great value. think more and more people should consider that, especially with the rising costs of college and all the things that are going on with all that. Like, you know, a college degree today will cost you three, $400,000 to get a bachelor's degree. And then people are coming out the other side and can't get a job, right? Because they have no on the job training. They went to school for four years and they actually didn't do any of the stuff that they learned about.

Chris Ross (53:4.634): It's.

Aaron Crow (53:13.702): Whereas in the military, they're teaching you it, but you're also implementing it at the same time and you're learning leadership and you're like, it's a different skillset. I go back to, I'd rather have a kid right at a high school that has some basic skillsets and I'd rather have an intern with me and let me teach that. Cause I can teach you the technical stuff. That's easy. As long as you're willing to learn, I can teach you, right? I'm not worried about that. I need the right person that fits in on the team and is willing to learn, right? If you're that, I'll teach you the technical stuff. Like the other stuff is the harder.

Chris Ross (53:17.295): Yeah.

Aaron Crow (53:43.044): right? So I'd much rather have a kid that's willing to work and bust his butt than somebody that just went to school for four years partying and then came out with a degree and was like, I deserve this job. Like, okay, no, you don't.

Chris Ross (53:54.802): Agreed. And I think that that's one of the biggest problems right now is all these junior roles are like, junior, no experience. But then you need like three years in this and that and that's like, how are they going to get that experience? You don't teach them like that's exactly. Exactly.

Aaron Crow (54:3.356): Yeah.

Aaron Crow (54:7.088): Yep. Entry level job, but you have to have three years experience. Like those don't make sense. So you, you said the key word a minute ago and I'm going to throw it back at you the next five to 10 years. What's one thing come up over the rise and that maybe concerns you and maybe one thing that's exciting that you see that could be coming over. could be anything in the scope of whatever, right?

Chris Ross (54:30.481): think as attacks become more frequent, most of that is due to the bad guys or adversaries using AI, just like we are, or five coding, like we are to defend. I think it's going to come down to who's faster, but also who has the better skill sets to see stuff. Defenders have to protect everything. Bad guys need one crack in that armor, and they're in. So once they're in, do you have the visibility across your entire enterprise to see them?

Aaron Crow (54:37.712): Yep. Yep. Yep.

Aaron Crow (54:52.166): Yep. Yep.

Chris Ross (54:59.665): Find them, mitigate them, or quarantine them before you can make a decision or before it spreads. It's at some point where it's going to be a battle of AI versus AI and who has the faster AI. And it scares me. I am excited because I'm excited to see what these tool sets can do, both from both aspects, honestly. And I'm excited because.

Aaron Crow (55:12.304): Yeah. Yeah.

Chris Ross (55:29.541): We're at a time now where we're evolving so fast that like, kind of have to get into a certain field to be good at, because if you're trying to do like what I do and try to know everything, you can't, unless you get one of those storage devices into your brain, right? But the other thing too is, right, I'm excited. I just actually got promoted to state VP of the MCPA, which is the Military Cyber Professional Association. And yes, I'm wearing the shirt.

Aaron Crow (55:44.102): ships.

Aaron Crow (55:58.096): Hahaha!

Chris Ross (56:0.483): And so one thing that we do is we're veterans, current serving reservists, National Guards, DOD civilians. And again, you can join those that I just named, get in for free. For what we know, we're a 503C educational program, right? So what we do is we...

Chris Ross (56:23.186): cool our resources together and we go to schools K through 12 and teach cyber, teach programming, teach all these wonderful things. And I don't think it's, you know, I like the fact that they have it at K kindergarten might be a little crazy to, you know, start programming, but you know, going in there and teaching those things. Cause kids have iPads, right? Hey, don't click this link or this bad thing. And just giving them kind of a base level or again, you have an iPad, don't connect to this weird looking wifi or, know, something like stuff like that.

Chris Ross (56:53.295): and so that's, that's, I'm excited to be a part of that and where that's going to kick off to, this year, they just have their fourth year, hammer con, which a lot of educational, a lot of DOD private sector, lots of, you know, public companies like Microsoft is a very big supporter of us. there's again, apologies for anyone listening. I don't remember all the sponsors. So, yep. So if you go on the website,

Aaron Crow (57:17.766): Sure.

Chris Ross (57:21.082): You know, if you're a veteran or currently serving and you want to be in this field or contribute to the community, please join. It's free. If you're not the fee, I don't think is that expensive. It's great networking opportunity. We have chapters all throughout the United States. and it's just, it's a good thing to give back to the community and network with people. And again, we're going to train the next generation. I think that's extremely important. Like I've already started reading my kids' cyber books and I bought them that like.

Chris Ross (57:51.027): Diagram over the buttons. I forget the name of it. So apologies to that author Yeah, it's not too early. It's never too early anymore. Like my three-year-old knows how to operate an iPhone It's already too late for me. So, you know, I just want to Oh, yes

Aaron Crow (58:2.928): Yep. Yep. And they pick it up so quickly. It is so quick. My kids, again, they're older now, but my kids were able to swipe on the iPad before they were able to do anything. Again, they had full functionality so fast and they pick it up so quickly. And just teaching them little things like using password vaults. So we use a password vault and all our passwords are unique and all that type of stuff.

Aaron Crow (58:32.892): something that comes difficult for my wife because she didn't grow up in this way and she's not technical. It's a little bit of a struggle to her. But now I don't even have to help. My kids will help her. So they know enough like, mom, this is how you do it. she'll like, she's just like, she's super capable. She's super intelligent. But it's just not something she does on a daily basis because she doesn't work in technology. But it comes so naturally to the kids. Like I show them one time and like, yeah, okay, I got it. I know how to do that now. Thank you. Okay.

Chris Ross (58:57.532): Yeah, that took me like seven times.

Aaron Crow (59:3.408): Yeah, man. That's awesome. Well, Hey dude, I appreciate it. This has been an awesome, awesome thing. We'll definitely put the link in there. it sounds like a great organization, to, share, be part of a gift back. know that the skills bridge stuff is so big. You know, one of my buddies gunnery sergeant is, from the Marine Corps, is doing that on the logistics side. He works at a data center company and he's taking guys directly from the army, you know, as we're getting ready to retire and logistics type roles.

Aaron Crow (59:28.998): to come in to do data center type stuff as they're building out all these data centers with the AI stuff. So it's super exciting to see. And I think that's the difference. Kind of my perspective on the whole AI thing is yes, I think AI is going to display some people, but I think it's going to make some of the stuff that we do more important. And that human difference is going to be the difference, right? We see what AI can do and what chat GPT can do, but it still takes the right person putting in the right prompt, knowing what to look for.

Aaron Crow (59:57.127): You know, that kind of stuff. AI is a tool. I see it. No, nothing else. Just like any other tool that we have, it's going to make us more efficient. It's going to make us faster, but it's still going to take the human to know what to attack, what to, what to defend, what to look for. And, and going through that purple team example you gave earlier, having both the red team and the blue team sitting together, like this is how I would do it. But now you just have AI adding as part of that purple team. It's one of the team members at the table. Hey, how AI knowing this configuration and all that you see here, how would you attack this?

Chris Ross (60:9.138): Thank

Aaron Crow (60:26.970): and then you work together with it to start defending against it. That's my point of view of how we do all this stuff and make it faster, more capable. And I don't think Skynet's gonna take over anytime soon.

Chris Ross (60:37.618): Yeah. One thing that we did in our unit is we took all of our rule books, playbooks and all that stuff. And we created a localized chat, GBT version for training so that we could go, Hey, you're going to be a host analyst. Here's your checklist. Here's how you perform stuff. Here's all the rule books that you have. Do you want, you know, to display this task that you're doing? And then it would go through and tell you basically, okay, this is the command you use. This is what you should look for, have a picture and stuff. So we built that out for like a training platform that.

Chris Ross (61:7.280): you can utilize whenever you want to play around.

Aaron Crow (61:9.584): Right. And it's super capable. Now you can run those LLMs, Lama, all sorts of them on, on not, you don't have to have super computer hardware to do it. there's all sorts of things you could do in your day. Didn't go anywhere. Obviously people, hopefully everybody listen to this podcast. You should not be putting any, you know, anything that's sensitive into chat GPT or any place. Cause all that stuff is used. and, and you're, basically leaking your information. but that doesn't mean you can't use those things. Just be intentional about what you do.

Aaron Crow (61:38.901): but if you're going to do anything sensitive, make sure it's local, and it's not going outside your environment. It's only staying in your, in your world. So.

Chris Ross (61:46.096): read your business policies on AI. That's all I can say.

Aaron Crow (61:49.841): Yeah, exactly. And if you don't have one, you better write one people out there that are writing policies. So that's definitely a policy that you need to, you need to consider. So anyways, man, Hey dude, thank you so much. It's been right at an hour. I told you it'd be an hour and you would be like, it's see it was, it wasn't, know that's the thing is, is man, you know, I go back to what I opened this up with is everybody out there has a voice and, my entire intention of

Chris Ross (62:5.230): I know, it's so much fun to talk about.

Aaron Crow (62:17.240): of doing this is to make sure that everybody's voice is heard and everybody that wants to and has some value, they want to give back. That's what this is for, right? So again, it's not about a title. It's not about a, you know, where do you work or who are you or what degrees or certifications or anything like that. I think the one year, you know, the analyst with a year of experience behind their belt has something to give back and has a message and a story and value to bring back. Cause I haven't ever worked in it as an analyst. So I guarantee you that analyst can teach me things cause I've never been in that role.

Aaron Crow (62:45.678): I understand it from a high level. I've designed systems to dive into them, but I've never sat in that seat. So that's something that's perspective that I don't have. So it doesn't matter. It just goes back to all the things that you were talking about, right? Is really make this, whether you're the military guy trying to come out, get into this space, you're a civilian trying to get in, whatever it may look like, reach out. This community is so amazing with people like Chris that are willing to give back.

Aaron Crow (63:13.276): There's so many resources out there for people to build labs in your backyard, in your own environment, or even online virtual labs that cost almost nothing and sometimes free. There's all sorts of things. Reach out to people. Every one of us are willing to give as much time as we can, reasonably, with the amount of overwhelmingness that we have sometimes. But that doesn't mean that you can't ask, because we will absolutely get back to you as soon as we can. So again, Chris, thank you for your time. Great job today.

Aaron Crow (63:40.624): Good luck in all that you do and eventually we'll meet in person and have that beer together,

Chris Ross (63:45.403): Appreciate it, Aaron. Thank you again. It's been a pleasure and hopefully the listeners get something out of this and take that step forward like I did. It's scary, but you got to do it.

Aaron Crow (63:57.167): Absolutely. All right, brother. Thanks a lot.

Chris Ross (63:59.517): Take care.

Transcript lightly edited for readability.