100 Episodes of Protect It All: Aaron Crow’s Journey Through IT, OT & Cybersecurity

Aaron Crow (0:1.580): Hey everyone. Thank you for joining me on another episode of the protected all podcast. today's a little different. this is the hundredth episode of the protected all podcast. So instead of, the normal journey, bear with me, but I, I wanted to kind of dive into, a little bit of my backstory, my history of, you know, how I got into technology, how I got into podcasting and, and this whole, you know, 30 plus year career I've, I've spent getting to the place that I'm at.

Aaron Crow (0:32.014): Um, you know, if you'd, if you'd have told me that, you know, uh, when I sat down to start recording these, that I'd be a hundred episodes in, and that's just counting this podcast, the previous version of the podcast, I think I had a 50 or 60 episodes. I don't remember exactly the number. Um, so, you know, I'm probably 150, almost 200 episodes into podcasting and, man, I just, I really, really enjoy it. Right. What started as a.

Aaron Crow (1:0.942): as something for marketing, has really turned into something that I think has made a real impact in the community and the knowledge and folks that listen to it to hear somebody they may not have access to somebody that has a story and an example, a use case that those lessons learned, whether it be from a recruiter or from a veteran in the OT space, that they get to hear those stories and

Aaron Crow (1:29.448): share some of those lessons that shape who they were, how they got to where they were, the lessons learned, all that kind of stuff. So anyways, with all that, just wanted to kind of give a heads up. So this is not going to be a vastly new, sour, secure talking about AI, talking about any of that type of stuff. It's really just a kind of a history lesson of how I got to where I'm at. So I drew I grew up around power utility.

Aaron Crow (1:55.886): I've worked in the industry for about half my career, but growing up, my father worked for a power company and he was a controls engineer. He helped build power plants, set up the control systems. was a INC guys, what they call them instrumentation and controls back in the day. But that was all hardwired. know, the, the, the, well, yeah, you can't see it. I don't guess. yeah. There you go. The PLC that's behind me. If you're watching.

Aaron Crow (2:22.638): You know, it's got digital and analog inputs and outputs. Back then, everything was hardwired, right? was physical wires going around. There was no ethernet in any of this stuff. So it was running wires from end to end, labeling everything, understanding how to build the ladder logic, all that kind of stuff. But I grew up around that. There were PLCs sitting on the kitchen table and computers. there was part of the power plants that I grew up around. There was also an associated mine.

Aaron Crow (2:52.586): I would see those mines. I would see the bigger Earth moving equipment. I would, you know, I had lumps of coal on my on my kitchen counter. I remember my sister doing a science project around, you know, coal and having, you know, big pieces of coal around the house during that time. So I was lucky. I kind of grew up around critical infrastructure before it was called OT. But you know that that controls an operation side of things. So I probably asked by osmosis kind of took in a lot of that stuff as

Aaron Crow (3:21.516): my dad and his friends and I'd go to fishing trips with him and his coworkers, things like that. And they're just talking about things and I just kind of pick it up. For me, I've always really enjoyed the tech side of things. My first computer was a Tandy TRS-80. I'm looking behind me. you've seen me on the video, any of the YouTube shorts or anything, you see some technology in the background. There's a Macintosh Classic in the corner over here.

Aaron Crow (3:50.382): And right above me is a is a an Atari 2600. But my first computer was a Tandy TRS 80, a trash 80. And man, that thing, I was constantly playing video games on it. It had an old tape recorder thing. You had to rewind and fast forward and hit play to to launch the program. I was programming new capabilities and building my own programs on that. Had no idea what the hell I was doing, but had a lot of fun doing it all the way up to

Aaron Crow (4:20.204): you know, learning to type on typewriters and even in high school, even before I graduated high school, kind of my first job was taking the library from the Dewey Decimal system and actually implementing and building a barcoding system with a barcode scanner, putting labels on all the books that had the location and the barcodes. could scan it and

Aaron Crow (4:46.798): and check a book out and know where it was in the library and really did away with the Dewey Decimal cards that were in there. And that was a summer project that I worked on. I can't remember my sophomore or junior year or something like that. So I just really always took off to technology. I got a scholarship through the Instrumentation Society of America. My dad was a long time member of that.

Aaron Crow (5:14.154): And even, think even served as president at one point. and I started, I went to college my freshman year, went to a small engineering school in, in East Texas and Longview called Luterno. and my intention was to be an electrical engineer, to work in a power plant or, know, any of that type of field. and the funny thing is, is, is this very, very small engineering school. They, I stayed in the dorm and my roommate, that, that first semester was a senior.

Aaron Crow (5:44.269): And he had one semester of school left before he graduated and all he was doing was working on a senior project. And he's senior project was building a, basically a control system. And he built a big city, similar things to what you see at ICS village. If you've come and seen me or Tom van Norman or Dylan Lee or any, any of the folks at the ICS village, a lot of the tiny towns and things like that. But he was building that.

Aaron Crow (6:11.946): Using old computers, we went dumpster diving for old companies that were throwing away their computers, old 386s, old 486s and getting components off of that, soldering things together. And again, that was just another step in my love and just diving off the deep end in technology. Another fun story and

Aaron Crow (6:39.456): And, and college was probably my first real dive into quote unquote security. It wasn't, I guess we definitely didn't call it cybersecurity back then, but, in college, my dorms were old army barracks and they were, they were brick cinder block walls. So we drilled holes and ran coax cable between all the floors and between the two buildings so we could network our dorm.

Aaron Crow (7:9.790): With that, it was obviously a coax network with, you know, the terminals on the end of it, all that kind of stuff. each everybody had to have our own network card to plug into the network into their computer. But it made it so that we could share assets, we could share plotters and printers and we could also play video games. We played, you know, computer games together. But I had a version of AutoCAD. Again, my dad had all this stuff from from the company. I was able to use AutoCAD.

Aaron Crow (7:37.807): and one of my engineering projects that my freshman year was a CAD drawing for the final. And it got turned in and I came back from my, I think it was Christmas break, I don't remember. When I came back from break, the professor pulled me into his office and said, hey, somebody cheated and there's a couple of them and all the drawings are too similar and we don't know who it is and we're not gonna accuse anybody.

Aaron Crow (8:7.340): But what we're gonna do is make everybody that their drawings are too similar, we're gonna make you redo it. And it's gonna be a lot harder and it should be pretty obvious who was the ones that know how to use CAD and who's the ones that not. Again, they didn't wanna accuse anybody, they're just basically making us redo it. So the next drawing was way, way more difficult. I redid it day to day, have no idea who it was that cheated, they didn't tell us who the other people were, you know that stuff didn't really matter to me.

Aaron Crow (8:35.630): It really was my first kind of dipping my toe into, hey, I need to make sure that I'm protecting my environment, you know, putting security around my folder structure on Windows. That would have been what probably NT 351, maybe NT 40 back then. Maybe Windows for work groups. I don't even remember. It was, it was a long time ago, back in the nineties. So that was definitely my first cyber security lesson in the space.

Aaron Crow (9:5.870): Um, I got my first job in technology, uh, really early on in college as well. I was working at a, a, it was a computer training company in Dallas, Texas. Um, and they had different, they had like 10 classrooms and each classroom was set up a little bit differently, but they would train Microsoft office, Excel, word, PowerPoint, all these different.

Aaron Crow (9:33.825): corporate or company enterprise level type classes as people are sending their employees off to start training on word processing and Excel spreadsheets, things like that. So they would pay for these trainers and they had these week long classes. Well, each week was a new class. So classroom one, maybe Microsoft Word this week, it may be Lotus Notes next week, it may be Novell NetWare the week after that. So my job was to set the classroom up for whatever class was coming in.

Aaron Crow (10:2.755): this next coming week. So I was constantly flipping those things around and that was a lot of, you know, imaging hard drives. And I would have an image for the Lotus notes class or the windows class or the Novell class or whatever it is and swapping those things out. So when they showed up on Monday morning, everything worked. And I loved it so much. I ended up working there for, I don't know, probably over a year. We did a large network upgrade, went from token ring

Aaron Crow (10:32.547): to ethernet and very, very basic. I don't even think there were managed switches. think they were just ethernet based switches, Cisco old green Cisco box, probably 10 megabit using using cat five or whatever copper ethernet connections were back then. But I just remember how much I loved it. And also during that time, because again, I, and maybe it was because of working at that, that training company.

Aaron Crow (11:1.497): certifications were huge back in that time in the, in the nineties and in early two thousands, everybody was sort of certificate happy. Right? So you had MCSE and Novell netware and Cisco and Oracle and all these different certifications. And man, even without a degree, without any experience, if you got one of those, those certifications, it would get you a job. if you had an MCSE, like there was a good paying job at the end of that, right? There was,

Aaron Crow (11:31.427): good paying jobs then to Cisco CCNA or CCNE, Oracle SQL Server, like whatever those certifications were. So I remember there was a bookstore in my city and I don't remember what it was called. It's something like everything under five bucks. But I remember going in there and they would have, you know, I have a lot of books behind me here, but they would have all of these Microsoft certification books and Cisco certification books. And they would be last year's version or the previous version of the test.

Aaron Crow (12:0.813): So it's not really worth anything to anybody because everybody wants the newest version. Well, I would go get all those books and I would come home with a stack of 20 or 30 books and I would read through them. I would study them. I would go take the test. Most of that time, most of the times if you had an employer, most of them had a certification kind of program. And if you would, if you passed a test, they would pay for it. And then also many times at the end of that, there would usually be a bonus and or maybe a pay raise. And then sometimes even a career.

Aaron Crow (12:29.871): you know, kind of a role adjustment. Or you could jump to a different role, a different job, a different company, a different opportunity. A lot of that time I was consulting and contracting, those certifications mattered when they were choosing who they were gonna put on an engagement. Your certifications really, really mattered. It still matters today. I would argue probably less so. Those certifications, you know, I have lots of certifications even now.

Aaron Crow (12:55.619): You know, CISSP, it's kind of one of the check boxes that folks ask for, especially in cybersecurity. but yeah, back then it was very, very big. I don't remember how many certs I had, but there, it was a lot at one time, maintaining and getting my MCSE and, my, my Novel Netwear and Cisco and, there were hacker courses at all, all the things back in the day. you know, from there, I, I really had a great opportunity working in contracting and consulting.

Aaron Crow (13:24.027): I worked across so many industries from, you know, some of the largest companies in the world on the on the enterprise and IT side. But also one of my early roles was was at a power company and and working in supporting actually rolling out SNA servers across their power plant so they could connect terminal green screens back to the mainframe to be able to do work orders. God, that's a mouthful and also really, really old. So I would.

Aaron Crow (13:52.353): I built these racks full of servers and equipment and we rolled them out, literally put them in the back of a U-Haul. Me and another intern drove them across the country to these five different places, physically unloaded them, rolled them into the server room and plugged them in. When I say server room, I really mean closet that had power, plugged them in so that the operators could do maintenance and work orders using the terminals in the mainframe.

Aaron Crow (14:22.509): doing that and follow the sun engineering architectures worldwide architectures. But every job and every role really, really pushed me and opened the door for the next one. There's lots of opportunities. And I've talked about this when I talked to folks about, you know, kind of career advancement and how do you get into certain places or certain areas or certain jobs, capabilities. I would take a job that would be a pay cut.

Aaron Crow (14:51.383): because I wanted to learn whatever skill set that that job was. So maybe it was a, maybe I was a senior, know, Microsoft person, but I really wanted to get into Cisco. So I would take a junior level Cisco role so that I could learn that capability and step up. So then I would get to a senior level and now I'm senior level Microsoft and Cisco. So then I would kind of use that to my benefit, whether it be from certifications, but also on the job experience.

Aaron Crow (15:19.223): with programs and projects with credentials and references of that work. So it really did me well across my career. Again, it was as a consultant. So I was doing project work. So a year doing this work, a year doing that, six months on this engagement, that kind of thing. Very much like consulting is today, but just as a contractor. So basically I hired a guy.

Aaron Crow (15:44.995): You hire somebody, you've got a project, you hire people, they come in, do the work. And at the end of the engagement, maybe there's more work, maybe there's not, and you roll into the next thing. Somewhere along the way, I reached back out. I can't remember exactly how it happened, but one of the guys at the power utility that my father actually worked for reached out because they needed somebody that could kind of bridge the gap between

Aaron Crow (16:12.321): understanding network and technology and architecture and things like that, but do it at a power plant. And they kind of saw me as having that ability because again, I grew up in power utility. I'd worked in the space. I spoke the language, but I also understood the technology side of things. So that took me back to Vistra in Texas and where it ended up becoming, spent about 10 years there, was a quote unquote asset owner.

Aaron Crow (16:39.947): responsible for, eventually responsible for, you more than 40 power plants across the state of Texas, mines, nuclear power plants, fossil plants, kind of a lot of the things, anything at the plant, anything in OT, what we call OT now, which we didn't at the time, was, under, you know, my, my team's kind of vision. Had a great manager, great leader there, really cool things happened. And it was kind of my first

Aaron Crow (17:8.263): a real deep dive into, you know, cybersecurity and technology. I had always done network security on the Cisco side. Again, I did a lot of Cisco work and network architecture and implementation, but the cybersecurity side of things, you know, again, I was a exchange admin and a domain admin and active directory was a lot that I did at, know, AT &T and State Farm and all these other places.

Aaron Crow (17:34.787): but it was always very compartmentalized. was, you're, you're in charge of exchange mailboxes or you're in charge of active directory and group policies and, all that, that entails a disaster recovery backup, whatever. it was never the end to end. And when I got into OT, I was, I had to be fortunately my, my experience in having such a broad brush of experiences from

Aaron Crow (18:0.523): servers to virtualization and networking and kind of everything because of the way that my career had happened. I had to be that kind of jack of all trades. Everybody on the team had to. So the team that we recruited and built there, they had to understand networking and firewalls and virtualization and antivirus and all of the things that go into like a business unit. We had to support it all.

Aaron Crow (18:28.577): end to end, top to bottom, all layers of the OSI model, like all the network layer, the routing, firewall creation, like everything in between. So it was a lot of fun designing and architecting. And we had to do that in a power utility space, working with vendors, working with asset owners, working in a space where this is new, right? These vendors have just now started converting things to ethernet. They just now started bringing firewalls and network segmentation and active directory and

Aaron Crow (18:56.281): there was literally a control vendor that had a secure or an insecure version of their control system. And that was what they, as they offered, they pitched the proposal to do a control system upgrade. They said, do you want the secure version or do you want the insecure version? That was like their pitch. Obviously the secure version was more expensive. So we ended up obviously choosing that one. And then I told them they should not call it that anymore. And all the reasons why that was a bad idea.

Aaron Crow (19:25.251): And I don't think they call that it at that anymore. So, after, after years with, with luminance, Vistra rolling that out across power plants and doing, you know, earning those hard hats and working outages and, seeing firsthand why OT is different, how is different, how to have conversations with plant managers and also how to have conversations with executive leadership, CISOs, et cetera, and how different those conversations are trying to convey the same.

Aaron Crow (19:54.187): endpoint, right? I got an opportunity to go work at Ernst & Young, one of the largest consulting firms in the world, and help build their OT practice, right? I was one of, I think, 20 when I first started there. And we grew that to, I think, 300 before I left. Awesome, awesome experience really pushed me to grow those softer skills of

Aaron Crow (20:22.797): communication and presentation and PowerPoint. Who everybody that's ever worked with a big four consulting knows that PowerPoint 101 is kind of part of our, our, our skillset. So it was, it was definitely not my, in my wheelhouse. A lot of the things were outside of my comfort zone. And I'm very, very fortunate to have had the experience and opportunity to work there in addition to being able to.

Aaron Crow (20:49.325): you know, when I worked at an asset owner, had one customer and it was my own company. And yes, we did this across multiple power plants and substations and mines and things like that, but it was still just that one place. So the cool thing with working at a consulting firm, especially one like a large big four is that you get the opportunity to work across not only multiple customers projects, but it's also multiple verticals.

Aaron Crow (21:14.863): I wasn't just in power utility. was in power utility and critical manufacturing and transportation and all of these different verticals doing the same type of thing. And from the outside looking in, yeah, I mean, the way I create a tire is different than how I generate electricity, but the process and procedures in an OT world and the operational side and how all that thing works together, um, is very similar, right? So OT is OT. Um, and, and I still care about my process. I still care about the,

Aaron Crow (21:45.411): the way that it works, the way that it flows, the risks, all that kind of stuff. And me being able to understand that and, and sitting in those spaces really helped me to get to those places. Right. Anyway, so worked, worked for a Y for a number of years, awesome experiences, did a lot of work, rolled out OT cyber stuff instead of at 40 sites, rolled it out for one customer for 3000 sites over three years, like huge.

Aaron Crow (22:14.467): like one of the larger larger if at the time, think it was the largest OT cybersecurity program in the world. That was more than a few years ago, but it was a lot of fun, learned a lot. I think I've made a big impact on that and helped that that thing still exists. The thing at Vistra still exists today. The thing at these other places still exist. And I was literally talking about one of my friends, Scott Rosenberger, who's still at, he was just on my podcast not too long ago.

Aaron Crow (22:44.605): you know, he's still there fighting that mission at Vistra, right? I love that, right? It's so amazing. The things that we built, obviously they've matured. They're not the exact same things that we built, but the foundation that we put in is still there and they're growing that. And that's what like excites me. It makes me happy and amazed to see that the progress that he's made in and organizations across industries have made. Right. So, lefty Y, got an opportunity to be CTO of industrial defender.

Aaron Crow (23:13.859): which was another amazing experience of, you know, again, stepping out of my comfort zone, stepping into a role that I hadn't done before, facing new challenges, having more, you know, difficult conversations and different challenges that I have to face and hurdles we have to get overcome. Amazing time at that, you know, took it a long ways. Just really awesome time that was also when they pushed us to

Aaron Crow (23:43.811): Hey, we need some new marketing and the marketing team reached out. Hey, we've been really wanting to do a podcast and I'd been already talking about a podcast. In fact, I already had this mic, this exact mic actually. And you know, some of the podcast gear that I use, I had already started it because I was considering starting a podcast. And I was like, I'll do it. And that was the first one. The first podcast was called the, I think it was the protect OT cybersecurity podcast.

Aaron Crow (24:13.067): and again, I think we did 30, I don't know, maybe even 50 episodes of that podcast. Very similar to this, but obviously dedicated a hundred percent on OT. and it was amazing and a lot of fun. And when I left industrial defender, I rebranded the podcast, and, really wanted to expand it to protect it all, which is why you see in the logo, it's protect with a capital O T.

Aaron Crow (24:39.425): and it with a capital I T. So operations technology, informational technology, and protecting it all with a really a bigger concept of all the things that need to be protected in the space. So there's physical, there's cyber, there's cloud, now there's AI, there's all of these different things. And that's really where this podcast grew from. Now I'm at Morgan Franklin, which is now Arcova, rebranding the podcast, name change, all that.

Aaron Crow (25:8.559): It's, it's, it's been an amazing, amazing journey. I'm looking back on, you know, a hundred episodes. Um, the first thing that really stands out is, as this community is incredibly generous, um, almost everybody that I've met in the space is, is, is willing to give back to the community. They're willing to have conversations. It really did pour in. don't pay anyone to be on my podcast. Um, I also don't have sponsors, right? So, um, it is, it is a, a,

Aaron Crow (25:37.423): passion project. And it is one that everybody that's sat in the chair across from me, whether it's virtually or physically in the same room, they've all been just as passionate about their thing as I am, right? And my, my entire goal with this episode or this podcast is to, to showcase that, right? Not everybody has the opportunity or the desire to have a podcast episode every week. But they're more likely to be able to sit down with for one episode.

Aaron Crow (26:3.647): on mine and share their knowledge, share their brilliance, share their experience with the audience. And it's amazing cause I'll go to these conferences. And, when I remember the first time somebody actually said, yeah, Hey, I know you, you're Aaron. have, you have protected all podcasts, right? And, I'm like, yeah, I do. Right. I'm this small person, podcast wise, and in this very niche,

Aaron Crow (26:32.619): industry as far as podcasting goes. and the fact that somebody knew who I was, right? Not like I'm a celebrity. It's just cool to see, Hey, people are listening, right? It does. People are enjoying it. so thank you for that. Thank you for the listeners. Thank you for folks that have, that have been there, whether this is your first time listening, if it is, man, I appreciate you being here. If you're still here now at the end of this podcast, but, and if you've been here all along, like I appreciate you. Like I,

Aaron Crow (27:1.795): it's, it's, it's such a, again, like I said, passion project for me, to, be here, and do this. I enjoy it so much. My kids, the irony of I've got three kids and youngest is 12. Oldest is 17, but you know, my younger kids, know, they, they look at me like I'm a celebrity, like I'm Joe Rogan or somebody just because I have a podcast and they see me on YouTube and my youngest listens to my podcast, which is hilarious. Cause I talk cybersecurity, but still.

Aaron Crow (27:31.124): It's really awesome for that. So where do we go from here? My mission hasn't changed. I want to keep inspiring people. I want to keep having amazing conversations, important conversations. The goal is not to push a product or a service or anything. It's really to push the envelope as far as having important conversations. What are the things that we're missing in the industry? What are the things that we're missing in a certain vertical? What are the things that products are?

Aaron Crow (27:58.607): or where are the gaps that we need to be looking at from people, process or technology. Like those are the things that I want to continue to have those conversations and push further and further and further. I wanna continue giving a platform for folks to come and share their brilliance, share their product, share their vision, their experiences. Cause not everybody has a desire to step on the stage. It can be overwhelming. I try to make this podcast so that anybody sits in the seat.

Aaron Crow (28:25.537): It's not overwhelming. It's just like we're sitting down having a conversation. That's sometimes more approachable than jumping on stage at RSA or Black Hat or DEFCON or any of these conferences just because being on stage is something that is really uncomfortable. But having a video conference, we do that all the time with work. So a lot of folks are more comfortable with that. And if that leads to them also then getting to step on stage, that is awesome too. There's been a lot of folks that have been on here, been on stage.

Aaron Crow (28:54.143): Not saying this is a reason they got on stage because their brilliance is the reason they got on stage, but sometimes the comfort level of, that wasn't so bad. I I'm very good at what I do. I'm, I'm knowledgeable at what I am. I'm passionate about what I know. and I want to share that. and the more people that can see that the better. Right. So, so if you're out there listening and you're thinking about getting an OVT cyber or it cyber or cyber security at all, or, or any, any realm of the conversation around protecting it all, you know,

Aaron Crow (29:23.693): hear me on this, like it is doable, right? You know, take baby steps, get into a sock job, get into those entry level positions. Again, taking from my experience, gain the knowledge that you can that can get you to that next step, that next role, that next opening. You're not gonna jump right in to do an OT cybersecurity right out of college, more than likely. There aren't a whole bunch of places that are teaching ICS or control systems or OT cybersecurity. There are some out there. In fact,

Aaron Crow (29:51.169): I see us village. I'm pretty sure is doing a course for Harvard, which is freaking awesome. I love the fact that that, you know, obviously sans is out there that does amazing courses and Rob Lee and, and, and all that, all those guys do, it's incredible. So there's so many courses. There's so much out there. My Colcomb is out there talking all the time, sharing free resources. there's so much out there podcasts and YouTube videos and training courses and

Aaron Crow (30:19.939): You can set up labs. You know, I've got stuff behind me. Obviously that's the OT wall. It's a little bit more fancy, but you know, you don't have to have a bunch of money. You can buy small stuff. you can do a lot with virtualization. There's a lot of open source type stuff you can do. You can download packets off of, you know, get hub that, that are example OT traffic. There's a lot of things that you can do to get started, but also just reach out to folks, reach out to folks like me, reach out to Mike Holcomb, reach out to others that are into the industry that are more than willing to have a conversation, grab a coffee.

Aaron Crow (30:49.219): Bring some value though, right? Don't just ask for their time and take. What can you do to help? Like how can you help them? How can you help me share my podcast, like subscribe, like make recommendations for guests to come on the podcast, make recommendations for, for, for episodes, get to a place where you've done a cool project and you want to come talk about it. Hey, reach out to me. I'm have the conversation with you. those are always fun things to have. Right. So.

Aaron Crow (31:16.249): thank you for a hundred episodes. thank you for listening, sharing, thank you for sharing the podcast, with your colleagues and your teams. I don't take any of that for granted. I'm very thankful and appreciative. so here's to the next hundred. Let's keep being, keep protecting the things that matter, protect it all. and until next time.

Transcript lightly edited for readability.