Trust Is Not a Security Control: Blast Radius and the Management Plane

Aaron Crow (0:01) Thank you for joining me on another episode of the Protect It All podcast, where I get the great opportunity to sit across from, even virtually across from, people from all different perspectives, experiences, focuses. So I greatly enjoy all of these conversations. For those that haven't listened very often, just so you know, a little bit of the ground rules of my podcast.

Aaron Crow (0:28) I usually don't prep for these. And that's not because I'm lazy, it's not because I'm too good for any of that. But I really want this to feel like an organic conversation, like the first time that my guest and I are sitting down, like we're sitting down having a beer or a coffee or a cookie. That's really the focus of that. And for me, it's the type of podcast I want to listen to. It's not scripted. I don't give the guests a preset of questions. They don't know what we're going to talk about, I don't know what we're going to talk about. I just really take it from there.

Aaron Crow (0:56) I appreciate the fact that my guest today is willing to come on without much knowledge of, hey, what are we going to talk about. Because that could be a little overwhelming, could be a little scary, but I try to make it as not scary as possible and just be a fun kind of thing. So with all of that, Zach, please introduce yourself, tell the audience who you are, anything you want to share, background, et cetera, to get you where you're at today on the podcast.

Zach Miller (1:05) Yeah.

Zach Miller (1:24) Yeah, thank you, Aaron. Hey, my name is Zach, and I'm based out of Colorado Springs. I got my start working in IT. I was originally a switch and route nerd, worked for K through twelve education, and really got to enjoy and appreciate the IT budget on a string. Making ends meet teaches you a lot about the technology, and I think it helps break you from the "we always use these three tools together."

Zach Miller (1:53) Sometimes it can be an open source tool instead of the other two. That really helped me a lot. And then I had some really great mentors and some people that pulled me along. Now I work in defense contracting, did some consulting, some MSP. And now I work for a company in Colorado Springs. Just excited to be here today. I read your book this last week and appreciated it.

Zach Miller (2:21) I'm excited to tie a lot of things back to it, but my wife advised me not to do it too often. So I'll try to temper my excitement about that.

Aaron Crow (2:28) Ha ha ha.

Aaron Crow (2:31) Well, I appreciate it, man. It took me a long time to put that together, we talked about that a little bit before. But yeah, I really appreciate that. It's a labor of love, all of these things together. The fact that you're talking about the K through twelve and the education and the moving in, all of us, and I talk about myself as well. I started out in IT, I started out as a desktop support many, many years ago.

Aaron Crow (2:56) And then moved into network administration and server administration and virtualization, that whole trajectory. About half my career was spent in IT, and then I transitioned over into critical infrastructure and OT, where, I say this all the time, OT's not different and it is, right? We're using the same type, we're not using a different router. Most of the time it's a Cisco switch, it's a Cisco router, it's a Palo Alto firewall.

Aaron Crow (3:22) We're using very similar tech to what we use in the corporate enterprise world. We just do it a little differently. The use cases are a little different, the rule sets are different, I don't patch, there's just different things that I do or don't do depending on what we're looking at. But it's so funny how the value that you bring from that IT experience, you go into defense contracting, you go into K through twelve, all those things make you a better person, a better engineer, a better cyber person.

Zach Miller (3:49) Yeah.

Aaron Crow (3:52) For your current role, because of all those things. Those aren't bad things, those are great things, because those experiences that you learned, you bring forth into the other roles and the problems that you face today.

Zach Miller (4:03) Do you have anything that you look back on real fondly from the introductory part of your journey, not on anything specific? Could have been a dumpster fire or a mountaintop.

Aaron Crow (4:11) Man, there are so many along the way, but I remember working at a large company like AT&T, and I was a server administrator, and they had basically laid off all of the technology people. There were two data centers, one in Texas and one in Washington, and I was the only person left in the Dallas, the Texas office. And I remember we were doing an Exchange upgrade.

Aaron Crow (4:39) Exchange 5.5 to Exchange 2000, which tells you how long ago that was. If you even know what that is, it was way long ago. I remember sleeping in the data center because I was doing upgrades of servers and you'd kick something off and there wasn't enough time to go home, you needed to be there to check it. So I'd go to a conference room, go underneath the conference table. I had pizza and drinks and a cooler.

Zach Miller (5:08) Well.

Aaron Crow (5:08) And I remember sleeping there, I was the only person at the data center other than the security guard, sleeping there and working, insane. This was for like three months, every weekend of my life was spent upgrading, because you could only do it on the nights and weekends, they wouldn't let you do it during the week because everybody was using their email server during that time. It was a nightmare, but I had a blast at it too, and I learned so much. Because to your point, there was nobody to

Zach Miller (5:13) Man.

Aaron Crow (5:36) Nobody else was going to help me. I had to figure it out. You talked about shoestring budget, AT&T has money, but there was no people, so I couldn't throw money at it. I just had to do it. And man, it was some life lessons for sure.

Zach Miller (5:46) Yeah, man.

Zach Miller (5:52) That's wild. Well, you definitely earned your stripes on that one.

Aaron Crow (5:57) That's right. Learning the hard way. And you know, there's a lot of times in my career where you don't realize it when you're in it. You don't realize the lesson that you're learning, or the experience and how it's going to help you in the future. Whether that's, you're in the middle of an incident, or going through a troublesome team member or a difficult boss, whatever those things are.

Zach Miller (6:08) Ooh, that's insightful.

Aaron Crow (6:26) All of those skill sets, because that's the other piece to this along my career that I focused on, or that I didn't realize until later in my career, because nobody ever told me. I always focused on books, I would be the MC, whatever certification, I'd be the smartest in a certain discipline of things, which were great, right? Be the best hacker, be the best firewall guy, be the best server guy, the networking guy, CCNA, all the things. But

Aaron Crow (6:54) There's so much more to being really good at this thing that we do in cyber. Like you talked about consulting, to be a good consultant, yes, you've got to be really good at all the technical things, but you also have to be able to understand and talk to people that don't understand the things you do in a way that doesn't make them feel stupid, in a way that makes them see the value in what you're trying to tell them and why they should care. You're basically a salesman.

Zach Miller (6:58) So true.

Zach Miller (7:11) Man, so well put. Yeah.

Aaron Crow (7:19) And you don't think about it as a technologist, a cyber person doesn't think about themselves as a salesperson. But you are, you're selling every person you talk to on why it's important that they do the things that they're doing. Whether you're writing a book or you're telling them in a conference room, it's all about making them understand in a way that doesn't make them feel stupid that, hey, this is important and this is why you should care.

Zach Miller (7:19) Yeah.

Zach Miller (7:22) Insightful.

Zach Miller (7:41) That's super articulate. It sounds like you've done this before.

Aaron Crow (7:44) That's right, a few times. Yeah, a hundred percent. How about you? What's some lesson along the way, like in the K through twelve time, what is one of those stories that comes up that you're thinking back and, man, that was a big lesson learned that really helped me get where I'm at?

Zach Miller (7:49) Yeah.

Zach Miller (8:03) Yeah, you know, I think probably one of the biggest ones was we had one of the clients had a proxy server set up, and they had it set up in such a way so that they could monitor traffic, and eventually they moved into SSL decryption. But for a while it was unprotected and it was open on the web. And as you know, when you have an unprotected proxy, it works really great for the people who are intending to use it, but it also works really well for people who are not supposed to use it. And so we real quickly experienced

Zach Miller (8:33) A functional DDoSing of that proxy server. And that was one of the really early experiences I had of, man, you know, technology, we always worry about how technology is used in an incorrect way. But sometimes when it's used like it's supposed to, it still can cause tons of trouble. And that was a harsh eye opener to why, man, we have no bandwidth after lunch, but we have it now, and then we don't have it on Tuesdays, but on Wednesdays we do, and it was just whoever was borrowing our proxy was

Zach Miller (9:02) Playing a video game or listening to music or eating it up with YouTube. So I'd say that was a really stressful one from early on.

Aaron Crow (9:11) Yeah, you know, it's amazing how many times, again, being from a networking background and a cyber background as well, when you're having issues with bandwidth and you start looking at the traffic, you start seeing the security guard is watching Netflix and playing PS5, and there's your bandwidth right there.

Zach Miller (9:33) Yeah, totally.

Aaron Crow (9:36) They're streaming stuff at three o'clock in the morning that's on the same network as your process control network. So maybe let's take a look at that.

Zach Miller (9:44) Classic, classic. Man, that's amazing.

Aaron Crow (9:48) So how was the biggest difficulty as far as a transition going from the K-12 to defense contracting? Because obviously those are completely different use cases, different budgets, different things that you care about, the things that your clients care about, and obviously the focus and attacks that could come at them. What were the bigger lessons or bigger hurdles that you had as a practitioner coming into those different spaces?

Zach Miller (10:16) Man, that's really good. You know, I think people skills are pretty important. And I know soft skills are touched on a lot, but being able to work in a situation where you're uncomfortable and someone else is uncomfortable is pretty big. And I think that might look a little bit different in a defense contracting environment where there's a lot of red tape and you need access to a resource and it's not available to you, or there's someone who's not responding to your tickets. But I think the groundwork was laid.

Zach Miller (10:46) I think the benefit for me was that being in a K through twelve environment, you were handed the kitchen sink. It was systems and networks and the microwave dish and pulling cable. It was everything, you were the catch-all. So I think moving into an environment where there's boilerplate templates for roles and they just throw it out there and say, hey, this is what we need.

Aaron Crow (11:02) Yeah.

Zach Miller (11:15) And you don't know who's going to interview you or what they need for the role. I feel like I was able to just talk through things and demonstrate the breadth of my skill. Some of it was having a friend on the inside. I'm a really sappy pay-it-forward person. I've had a lot of people help me out over the years, so I try to do my best to do that for others. So I got in the door because of VMware vSphere experience.

Aaron Crow (11:17) Sure. Yeah.

Zach Miller (11:44) That's what pulled me in the door. It was not at all what I was expecting, right? I had my Linux+ and I'm thinking I'm a Linux guru, and I've got my switching and routing down and I could talk VLANs, and they're like, we just need you to clone stuff. I'm like,

Aaron Crow (11:44) Okay. Yeah.

Aaron Crow (12:03) Okay, well, I can do that too. No, that's perfect, right? That's what this is, man. I get so many of these. I go to conferences, I speak at conferences, I volunteer with ICS Village, so I'm talking with a lot of folks that are in higher education, going after their bachelor's or their master's or many times even their PhDs.

Zach Miller (12:08) So a little bit of a long-winded answer, sorry.

Aaron Crow (12:31) In cyber and all these spaces, I get so many questions like, how do I get into XYZ field? Obviously, usually it's on the OT side, but the answer is usually the same. It's networking. I've been working for thirty years in technology, I turn fifty in a year and a month or so, and

Aaron Crow (13:00) I've been doing this a long time, basically right out of high school. I can count on

Aaron Crow (13:08) probably one finger how many jobs I've gotten in my career that I just applied for and didn't know someone. Almost every single job over a thirty year career has been because I knew someone. Now, knowing someone's not enough, that gets you in the door, it gets you the interview. But you still have to deliver, I still had to do the work, all that kind of stuff. But I tell my kids this all the time, as they're going out looking for jobs,

Zach Miller (13:17) Dang.

Zach Miller (13:24) Person. Well put. Yeah.

Aaron Crow (13:38) My son's seventeen, as he's applying for normal jobs, I tell him, hey, have you applied for a job? He says, yeah, I filled out X number of applications online. I say, okay, what else could you do? He says, I don't know, what do you mean? I say, well, have you thought about just going into the store and trying to talk to the manager? He says, well, why would I do that? I say, because every other kid your age is just filling out the application online, and all I'm looking at is a resume with a bunch of words on it, I don't know anything. But when you walk in the door,

Zach Miller (13:56) So good.

Zach Miller (14:06) Yeah.

Aaron Crow (14:07) And I see you and I put a name to a face, I'm at least going to go look at your resume. It's not going to guarantee you're going to get the job, but I'm at least going to say, hey, that kid did something different. So it's always that thing with almost every job I've ever gotten. Again, I think maybe one in my career that I just blindly applied for on their website and got the interview. Almost every one of them, I'm reaching out saying, hey, Zach, I know you're at this company, would you mind making an introduction to somebody?

Zach Miller (14:12) Yeah.

Zach Miller (14:35) That's cool.

Aaron Crow (14:35) Can I put you down as a reference? Because almost every company will put you to the top of the list of whatever the job is. Again, you still have to have the credentials, you still have to have the experience, you still have to do the work, but at least it gets you a conversation where, especially now with AI and all of these tools, I talk to recruiters all the time and they say, we'll publish a job posting and we'll get 3,000 applications.

Zach Miller (14:42) Yeah.

Zach Miller (14:46) Yeah.

Zach Miller (14:49) Yeah.

Zach Miller (14:55) Man.

Aaron Crow (15:03) How do you deal? You can just filter out 90% of those right off the top and they never even get considered. So if you're not doing this and you're not getting jobs, that's why. Because you've got to use the system to your advantage and know you've got to do something that everybody else is not doing. You've got to find a way, make a connection, find somebody on LinkedIn. Just like you, Zach, I tell people all the time, hey, if I'm connected with somebody,

Zach Miller (15:10) Man.

Zach Miller (15:19) Yeah.

Aaron Crow (15:33) That you need to be connected to, I'm happy to make that introduction. I'm not going to say, hey, Zach and I worked together for ten years and he's awesome, I'm not going to lie. But I have no problem making an introduction saying, hey, Zach was on my podcast, we had a great conversation, I'd like to introduce you to Bob. Bob, this is Zach, Zach, Bob, et cetera. Because that takes nothing out of my day and it can absolutely help you or somebody else. So I love that you focus on that. I think the more you give back, I truly believe in that whole karma idea of.

Zach Miller (15:36) That's cool.

Zach Miller (15:40) Yeah, that's cool.

Zach Miller (15:48) That's cool.

Aaron Crow (16:02) If you give good into the world, that good comes back to you. It doesn't mean the only good things will happen, but for sure more good things will come at you than not when you're willing to do that and go out of your way for those things. So that was a long-winded answer, but I'm very passionate about that piece too. So what keeps you up at night? What are you focused on, what do you like the most, what are you working on, what do you want people to know about the space that you're in, the things that you're doing?

Zach Miller (16:06) Yeah.

Zach Miller (16:16) That was good, man. Thank you, I appreciate that.

Aaron Crow (16:32) All that type of fun stuff.

Zach Miller (16:34) Man, that's a good question. I think maybe starting with the thing that keeps me up at night, I'm just real excited how fast technology is moving, how much is coming into play, the cool things that are coming out of empowering people who are not traditional software engineers, who can make a demo, maybe not put it into a sales channel, but demonstrate something really cool. And the Wayne Gretzky

Aaron Crow (16:53) So awesome. Sure.

Zach Miller (17:02) Gretzky quote, like you skate to where the puck is going, not where it's been. I want to be, I'm trying to be that observant. Where's the puck going? There's only so many places where I feel like you can go and see what's happening in the cyber world at a traditional URL. But if you spend time looking at blogs and you read some of the less common news, or you have a cyber community,

Zach Miller (17:30) You can start to pick up on some things that aren't in the news yet. That's one of the things I'm trying to hone and get better at, is where do I look at the right time, and what can I take from this information, and is it valid, vetting that information. And that was maybe a pretty boring answer, but it's really along the effort of I want to continue to advance my career.

Zach Miller (17:59) And develop skills, because I feel like so many of us are the byproduct of time. I'm at this job for five years, so my skill set is the culmination of what happened at that job for five years. But if I'm willing to learn a little bit outside, go to some networking events, watch over someone's shoulder who's way smarter than me once a month, it has a compounding interest on who you are as a professional. So that's what I'm trying to focus on. I do home lab a lot, I'm a space nerd.

Aaron Crow (18:23) Sure. Yeah.

Zach Miller (18:29) I picked that up from my last job, amateur satellites, a ham radio guy. One of the things I feel like, especially from my last job we learned, is that some of the really cool RF stuff that happens in the world right now is treated like black magic because it can do some really cool things. So I'm playing with SDRs in my home lab, trying to experiment with that. I think that's maybe a good place for me to stop.

Aaron Crow (18:34) Mm-hmm.

Aaron Crow (18:45) Right. Sure.

Aaron Crow (18:55) No, those are all awesome things. I'm right there with you. So I think the point, and what I hear in that and what I want people to gather on from that, is you have to be a lifelong learner. I've got a whole shelf of books over there. I just did a post today because I actually moved my lab that was right behind me before, into the other room, because it was just too hot, too much heat in this room. I guess I need to put a mini split in here or something if I want to keep it in here.

Zach Miller (19:07) Mm mm.

Aaron Crow (19:24) But I moved it all out because I've just got so much stuff, because I'm always tinkering. I'm a ham operator, have been for, I don't know, fifteen years or something. I don't use it as often as some of my friends want me to, but I've done it because I dabble in all of these different things. And I'm constantly working on, and to your point now, obviously with AI, I can take something, and my limitations before, where I needed a developer, because I was a CTO of a company.

Zach Miller (19:29) Nice.

Zach Miller (19:36) Yeah.

Aaron Crow (19:52) It's not that I can't code, I can, it's just not my strength, I don't really love doing it. I can read it, I can do it, I've built thousands of scripts and all that kind of stuff in my life. Scripting is definitely different than product development. But the point is, now, because of AI, because I know what I want to build and how it works and how it functions, I can build something, at least as a prototype, really quickly.

Zach Miller (20:16) Yeah. Yeah.

Aaron Crow (20:17) Get something stood up and say, does this work, and what would be the problems of this. Then you could hand this off to, okay, if this makes sense, this is the idea, how do I do those. But even beyond that, I helped, my son was going back and forth on whether he was going to go to the Army, he wants to go to the Marine Corps now, he's made his mind up. But when he was going through that decision, I said, okay, what MOS, what job do you want to be? Well, I want to do this. Okay, well let's think about that.

Aaron Crow (20:46) Not because I was trying to change his mind, I was just trying to make him understand. So I built an app that helped him understand: if you went into this MOS, what was the bonus they were going to give you, what is your rank going to be, how much are you going to make, what is a normal progression. Almost like a choose your own adventure book, that followed the path. What happens if you get hurt here and you can't go this path, what would be your option, where are you going to pivot to. So it just helped him

Zach Miller (20:52) Amazing.

Zach Miller (20:58) Yeah, it's cool.

Zach Miller (21:05) Solid.

Aaron Crow (21:14) I started out doing that on a whiteboard, and he was kind of like, and then as I built it into an app, he played with it. It had everything from, if I put away a hundred bucks a month in investment, in twenty years how much money would you have, just little things like that. I did it over a weekend, it didn't cost me that much, but it was a huge thing to help him and have this conversation about him choosing a path for his career.

Zach Miller (21:16) That's cool.

Zach Miller (21:33) That's cool.

Zach Miller (21:38) That's awesome.

Aaron Crow (21:41) So you could do that for all sorts of things, but to your point, you've got to skate where the puck's going to go. AI is going to be here, we have to work with it, it can be a benefit to us. Like you said, I did talk about it in the book that I wrote. It's one of those things that so few non-technologists probably don't get it, they're probably not sure what they're building with it. I think more and more people are

Zach Miller (21:51) Mm-hmm.

Zach Miller (22:07) Yeah.

Aaron Crow (22:10) Starting to kind of grasp the concept of it. But I spend a lot of time with AI and I use it on a daily basis, for work, for personal stuff. I don't Google, that used to be the term for searching on the internet, right, Googling. I don't Google anything, I put everything into an AI, I use Perplexity for that. And I'm not sponsored by Perplexity, but if they'd like to sponsor me, definitely reach out.

Zach Miller (22:27) Yeah. Yep.

Aaron Crow (22:39) I'll put it into Perplexity because I tell it what I'm looking for and it goes out and starts filtering those things down and builds me a narrative more than just a list of websites. That's the difference, it saves me time. I still have to check the root results and make sure I agree with them and check multiple sources depending on what it's for. If I'm looking for a dentist, I'm probably going to do more than just a simple Perplexity search, I'm going to go validate, I'm going to go to those sites and check other sources.

Zach Miller (23:07) Yeah.

Aaron Crow (23:09) But if I'm just checking for a restaurant, like, hey, how many burger restaurants are within a five mile radius of my address, I can just put that in there and, hey, which of these, according to Yelp reviews, are the best, which one should I try. I have no problem giving that over to AI and giving it a shot and seeing what comes up with it. What's the funnest thing you've built since doing this path as you've

Aaron Crow (23:33) Done technology, AI, what have you built that's the funnest thing? Work related or personal, whichever.

Zach Miller (23:40) You got me really excited talking about burgers. The most exciting thing I built is not necessarily work related, but I took the heat map of my smoker and it allowed me to put in different sizes of meat, and what meat it was, and it helped me figure out where to put meat and for how long, so I could have friends over.

Aaron Crow (23:42) Okay.

Aaron Crow (23:47) Okay.

Aaron Crow (23:51) Okay.

Aaron Crow (23:54) Okay.

Aaron Crow (23:58) Like physically in the smoker, like where the hot spots in the smoker are, that's really cool. Yeah.

Zach Miller (24:02) Yeah, I took bread, put it in there, turned it on high, then flipped it over and took pictures so I could see how dark the bread was. So then I had my heat map, and I did temperature and whatnot. I had some wings, some ribs, how can I stack this so that half of it doesn't turn out dry. Of the four uses I tried, three of them were pretty good. The fourth one was just a disaster, and I still don't know why.

Aaron Crow (24:10) Sure.

Aaron Crow (24:20) Yep.

Aaron Crow (24:22) Sure.

Aaron Crow (24:31) It got skewed somehow. See, that's a great example of something, how would you have done that other than thousands of experiments over time, which is, you look at these guys that do this competition stuff, they've got their smokers, they know exactly all of those things. But it took them years to get to that level of experience and thousands of pounds of meat that didn't work out, that turned out dry.

Zach Miller (24:39) Yeah.

Zach Miller (24:54) Yeah.

Aaron Crow (24:56) The trial and error of those things, you fast track that by putting it in some low cost bread, which is a heck of a lot cheaper than a brisket or a rack of ribs or something. And you were able to use a tool to really get you there. Again, it's not even most people's primary use case of what AI would do for them, because it's not a fancy app, and it didn't have to be, but it helped your use case, which is the whole point.

Zach Miller (25:04) Yep. Yeah.

Aaron Crow (25:25) Be careful what you put in there, don't put your social security number in there. But that's a really great example of how to use AI for good.

Zach Miller (25:27) Yeah, yeah.

Zach Miller (25:35) Yeah, thank you. My heart was sure not happy with the cholesterol I got from those couple of months, but I sure appreciated it.

Aaron Crow (25:43) No, that's all, I mean you're going to eat it anyway, you might as well have it be better quality. So what about work stuff? How have you seen AI being integrated? Are your clients asking for more, are they pushing it, are you guys using it more in your daily processes? What does that look like for you on that side?

Zach Miller (25:48) So true, so true.

Zach Miller (26:03) Yeah, you know, I think maybe I'd like to start at it from a unique angle before giving a traditional answer. I've recently, over the past two months or so, had some really weird, hokey mistakes that some of the agents have been making with some of the questions that I've been asking. I've had several hard-learned lessons of: I can give it all the guardrails I'd like, I can give it a clear prompt, and I still have to verify the work that it does.

Aaron Crow (26:28) Okay. Yep.

Zach Miller (26:33) And it gets harder to do when it's a lot of data, or it's a lot of work, or it's tracking a ton of IP addresses. Sometimes that context doesn't last well between sessions, or it doesn't jump topics super well. So I think I'm maybe a little bit more apprehensive about it just because I've been burned. I'm no less excited about it, it's still a really great tool for me.

Aaron Crow (26:35) Sure. Yeah.

Zach Miller (27:01) And I use it for personal and for work a lot, every day. I think the big thing that I've seen is, documentation: writing documentation, processing documentation is pretty big, pulling out important parts, being able to ask it questions has been awesome. Of course, data processing is big. I have an awesome book that's

Aaron Crow (27:14) Okay. Yep.

Zach Miller (27:30) Data analysis, cybersecurity through data analysis. At first pickup it's pretty boring, it's like, what things do you glean from a lot of data. But that's at the heart of it, what I enjoy now in some of what I do is being able to take a large chunk of data and pull things apart. When done well, I think it makes it harder for bad guys to hide in data. Which I also feel like was a pretty boring answer.

Aaron Crow (27:43) Sure. Okay.

Zach Miller (27:59) Unfortunately. But I do see a lot of early adoption in it, I feel like people are pretty excited about it. My son uses it to make memes, cartoons about dogs. So we've got some good adoption at home too.

Aaron Crow (28:08) Yeah.

Aaron Crow (28:11) Yeah.

Aaron Crow (28:14) Those are the good use cases there. Yeah, I do those as well, my kids will send all sorts of stuff. And that's the cool thing, you don't have to be an expert technologist to use it, it can meet you where you're at. And the data answer is a great one, data's always been where it mattered, but before we were having to buy a really good analyst, knowing what good. If I take a step back and I look at

Aaron Crow (28:44) An operator at a power plant, or at a manufacturing facility, or whatever. You're paying for somebody with gray in their beard who has been working that process, and they can literally walk up to a machine and put their hand on it without any sensors, without any electronics, and they can tell, well, that's not running right, there's something wrong, like vibration, it sounds different, the temperature's off. They can just tell because they've experienced it so much.

Zach Miller (29:03) Yeah.

Zach Miller (29:10) Heck yes.

Aaron Crow (29:11) Going back to the brisket we were just talking about, that experience, that repetition, seeing it, like a good person that's smoked a thousand briskets and is at that level, it's going to be really hard, that doesn't mean you can't compete with them. The difference between you and I is like every once in a while we'll have a really great one. Every time theirs is going to be at that level. Every once in a while we're going to be like, wow, that was really amazing, and then sometimes you get one just like, I don't know what happened, I did the same thing as I did last time,

Aaron Crow (29:40) And the same thing didn't come out. That's where the data comes in, is when you're with AI, and to your point you've got to be careful with it, but that's where the hidden, the needle in the stack of needles is, and you've got to know what you're looking for. AI is really good at finding those needles in the haystack. Now, they don't really know what's good about it or bad or indifferent, that's where it takes somebody that knows.

Zach Miller (29:58) Mm-hmm.

Aaron Crow (30:08) How to train it and say, hey, this is what good looks like. And when they show you that thing, that's the bigger problem: I can tell AI to write me a report on George Washington, and it'll write a report. But if I don't know enough about George Washington when I read it to know if the things it put in there are true, it could say he was born in 1248. And if I don't know that's not right, then I'd be like, yeah, that sounds good, sure.

Zach Miller (30:37) Yeah.

Aaron Crow (30:38) So we still have to understand the outputs that it's giving us. You talked about IP addresses, you talked about it building reports, and I use it a lot for building reports, and then I'll also have a peer review me. I'm looking at it, my AI is looking at it, but then I'm like, I don't see what I don't see. It is listening to me, so we're probably close together. And I have some random third party that comes in that I'll say, hey, can you review this, does this make sense?

Zach Miller (30:54) That's smart. That's cool.

Zach Miller (31:05) Gold.

Aaron Crow (31:07) What is it? Obviously that's part of consulting, but we do that a lot because I want to make sure that I remember it. I did the assessment, I walked down the plan, I did all those things, I put all the notes into the thing, I understand what is there, I gave it the things and then it's building this report. Did I miss something because I'm too close to it and I need to step back? So you can do that by giving it different agents. So for your barbecue example, you could give that same result,

Zach Miller (31:17) Yeah.

Aaron Crow (31:37) Or the same data points to multiple agents, ChatGPT and Claude and Grok, and see what they come up with. And I'll do that a lot of times, where I'll give it to all three of them, and then I'll give each one of them, okay, I gave all three of you these things, this is what they all came back with, and let them understand the thought process of each one and say, okay, well, it's seeing if I can get a more consolidated finding, the mistakes in their logic, the assumptions they made incorrectly.

Aaron Crow (32:06) Because that's the other piece with AI, a lot of times it makes a whole bunch of assumptions for you because it wants to make you happy. So you have to really be careful that it's not telling you what you want to hear, and that it's not making assumptions you're not aware it's making. Because a lot of times that's the thing I see, it makes a lot of assumptions, and you're like, no, no, no, I don't want you to do that, that's not what I want, I didn't say that, my bad, let me take a step back and re-give you this information without making the assumption that you want to.

Zach Miller (32:11) Yeah.

Zach Miller (32:14) Guide.

Zach Miller (32:24) Yeah. Yeah.

Zach Miller (32:29) Yeah. Yeah.

Aaron Crow (32:34) Burn your meat. You want your meat to be blackened and hard, right, that's what you wanted. No, that's not what I want. That's right. So what are the things on that side that's kind of scary? You talked a little bit about what keeps you up. What's on the scary side of all of that being used in these spaces? What keeps you up at night for that side of it?

Zach Miller (32:40) No, that's well put. That's a good example.

Zach Miller (33:00) Yeah, you know, I really like the adoption of O365 in environments and how it's equipping small and medium businesses. You can now join devices to the cloud, basically to an Active Directory in the cloud, you don't need a traditional server in-house anymore. The downside of that is now anyone can sign into your domain from anywhere.

Aaron Crow (33:08) Yep.

Aaron Crow (33:17) Sure. Yep.

Zach Miller (33:30) With all of the amazing tools offered in Microsoft's wheelhouse, you now have a ton of logs to watch. Just in March the FBI released a memo saying, hey, be warned that bad actors are going to start trying to pop you through your own network. So there's no longer this, I think, "let's look for the Russian IP address."

Aaron Crow (33:40) Mm-hmm.

Zach Miller (33:59) "Let's look for the North Korean IP address" in our logs, it's not there anymore. In some places I'm sure it still is, but the more finesse attacks are things that are coming from an Azure address. There's something being done in an Azure instance, done during the workday when someone else is working with stolen cookies that make it look like it was being done by a person. So I'd have to wrap it up and say that this quick adoption

Aaron Crow (34:02) Yeah. Yeah.

Aaron Crow (34:20) Yeah.

Zach Miller (34:29) Of this technology that empowers people is also doing just as many good things for the bad guys. That's what stresses me out, we have all these SIEM tools and SIEM logs, and we have SOAR, and we have all these things that are good, they really are good and they're watching a lot of the attack surface. But where they don't watch, we don't know until there's a fire. And if there's no firewalls

Aaron Crow (34:51) Yeah. Yeah.

Zach Miller (34:57) Then that fire spreads really quickly through a house. So that's my stressor right now.

Aaron Crow (35:05) Well, and I hit on this in the book as well, but we bring these devices home and plug them into my home network because everybody works remote. Even if they don't work full-time remote, you're still bringing your laptop home with you, because everybody has a laptop, very few people have a desktop anymore. So you take your laptop wherever you go, whether it's the hotel or at home. I bring it home and I plug into my home network. Well, now it's sharing the same network as my kids' Roblox or whatever else they have.

Aaron Crow (35:32) So now I've put it on there, so now it's an easier attack path. The bad actors can get to my kid's device because maybe I don't have protections on those things, or my kid installed something and I didn't know about it. Well, now it's sitting on the same network, so it's hitting my device from the same network. And if it gets in, it's coming across that path, it's not coming across from a Russian address, it's coming across from Aaron's network. I expect to see traffic from Aaron's network, so I'm not thinking about it. So there's

Zach Miller (35:36) Yeah.

Aaron Crow (36:02) To your point, we're introducing all these problems. And I get it, it's a hard problem. We have clients who actually want, we're doing cyber services for the company, let's say Acme Corporation, and Acme Corporation's C-suite wants us to protect their homes, which is weird, but it's not, if you think about it. If I got access to the

Aaron Crow (36:31) CFO's home computer, and they're on that computer, and it has credentials, VPN, whatever, into the corporate network, that's really risky. So as an attacker, would I rather go to the corporate headquarters and have to break in physically, with all the security things that are there, or go to the guy's house when his housekeeper's there and nobody else is home, and have all day long. It's the Terminator thing, they didn't go to the scientist.

Zach Miller (36:49) Yeah.

Aaron Crow (37:00) To get into where the robot stuff was, they went to the guy's house so that he would get them in, they convinced him to do it. That's the attack path, that's so much easier than the other. And now with AI and everybody working remote, COVID really pushed us to everybody working remote, and instantly everybody had remote access, whereas you had to request it before, everybody has it now, it's just expected. So we've widened our attack vector.

Zach Miller (37:07) Yeah.

Zach Miller (37:25) Yeah.

Aaron Crow (37:30) Exponentially, and we are not able, and AI can help us with this, but it's also hurting us, because there's just so much data. To your point, how do you know everything that's happening is good and not bad, even if it looks like errand traffic.

Zach Miller (37:32) Yeah.

Zach Miller (37:49) Sounds like it stresses you out too a little bit.

Aaron Crow (37:51) It does.

Aaron Crow (37:55) And it's happening everywhere, man. It's happening at power plants and pharmacies and manufacturing and the corporate headquarters, and you look at something like a FedEx or a large company, I'm just throwing out a big company name, if something happens to them, they've got insurance policies and big budgets and they can sustain it. But what if this happens to a small business, a medium-sized business, that's doing all the things right,

Zach Miller (38:15) Yeah.

Aaron Crow (38:24) Monitoring stuff, whatever, but if they get their systems taken down by ransomware and they can't do business for a week, they may or may not make it, and they can't pay the ransom, they don't have millions of dollars. And even if, everybody knows by now, just because you pay the ransom doesn't mean you get your stuff back, it's not guaranteed, you're dealing with criminals, so they may or may not release your stuff. So it's a big problem.

Zach Miller (38:32) Yeah.

Zach Miller (38:37) Yeah.

Aaron Crow (38:53) Critical infrastructure is a big one, obviously water utilities, we've seen a lot of things here recently hitting the water utility districts. It's the path of least resistance, I'm not going to attack the big guy, the one that's got all the defenses and the security and a gate and a guard and dogs and all the things. I'm going to go to the house next door that's got a screen door, and nobody's home, and there's no lights on, and

Zach Miller (39:11) Yeah.

Aaron Crow (39:22) I'm going to go the easy path, I'm going to go in that door instead of the front door that's barricaded. It's just, yeah, I mean that's what you're going to do. So yeah.

Zach Miller (39:24) Yep.

Zach Miller (39:27) So smart.

Zach Miller (39:32) It makes me think a little bit about the old adage, the humorous adage of course, that if you're outrunning a bear, you don't have to outrun the bear, just your friend.

Aaron Crow (39:40) That's right. You don't have to be the best or the fastest, you just can't be the slowest. You don't have to outrun the bear, you just have to outrun your friend, that's your buddy you trip on, but whatever you've got to do. And it's sad, but it's true, we're at that space where, and this is the other piece I think people are starting to understand, or hopefully they are: you're never secure, there's no such thing as secure.

Zach Miller (39:51) Yeah.

Zach Miller (40:08) Yeah. Ouch. Yep.

Aaron Crow (40:10) You're never done, it's never, there's never not a hole. There's a zero day you don't know about. If we've seen anything from Hugging Face and all the different examples out there, there's an infinite number of zero days that we just don't know about yet. So we're never secure. And even if you are, the analogy or the example I've given a hundred times, and people talk about the Terminator one we just talked about, I don't have to.

Zach Miller (40:15) Yeah.

Aaron Crow (40:38) Hack you, I can just walk up to you and say, if you don't walk me in, I'm going to hurt your family. It's very graphic, I'm sorry to say that, but if somebody did that to me, I'm going to give them whatever they want, because it's my work, it's not, that's my family. All they want is my login. So nothing is going to stop somebody from doing those things.

Zach Miller (40:44) Ooh.

Zach Miller (40:55) Yeah. Yeah. Yeah. Yep.

Zach Miller (41:01) Yeah. Yep.

Aaron Crow (41:07) We've got to make sure that we understand risk is, you can never get risk to zero. You've got to understand that risk is never zero. You want to monitor it, you want to mitigate. You talked about firewalls, I want to isolate and segment, so the risk is, I don't want my entire organization to burn down, let's compartmentalize. So if something does happen, Aaron doesn't have access to everything, so they'd have to do that to a hundred people or five people or twenty people, whatever that is.

Zach Miller (41:12) Mm-hmm.

Zach Miller (41:26) Yeah.

Zach Miller (41:30) Yeah.

Aaron Crow (41:36) I can segment those responsibilities. There's a reason we have delegation of authority. If you took an accounting class in college, there's a reason why your financial officer doesn't have the ability to do the books and make the payments. You separate those tasks so that one person can't cook the books, because if he's the one writing the bookkeeping and he's also the one making the payments, he can pay himself.

Zach Miller (41:57) Yeah.

Aaron Crow (42:03) And write it off the books so nobody sees it's happening until it's, wait, that's how people embezzle money, it happens all the time. But there's a reason why you have that delegation of authority in a larger organization, it's the same concept in technology and cyber and all the things we do, it's segmentation. That segmentation concept is not something we built in cybersecurity, it's been designed for eons, segmenting our environment, our neighborhoods, our

Zach Miller (42:03) Yeah.

Zach Miller (42:08) Yeah.

Zach Miller (42:21) Yeah.

Zach Miller (42:25) Yeah.

Aaron Crow (42:31) Houses, fire blocks. Firewall didn't come from a network device, that term existed before networking adopted it, because it meant the same thing. I want to segment so that if a fire happens on that side of the road, I've got a block that stops the fire from coming over here. That's literally what a firewall is.

Zach Miller (42:36) Yeah.

Zach Miller (42:49) Yeah.

Aaron Crow (42:54) I go down these rabbit holes of deep dives. It's fun in that it helps people understand, or the goal is to help people understand, you're never good, it doesn't matter where you're at, you can always get better. You could spend a ton of money, have a team of a hundred people, and you can still improve, or you can be a one-man shop doing the best you can, and

Zach Miller (43:00) Thank you.

Zach Miller (43:20) It's true.

Aaron Crow (43:22) That doesn't mean you can't win. You can still win with a one-man shop and do great things. Don't get discouraged because you don't have a huge budget, don't get discouraged because you're not able to get the product that you want. Do the best that you can with the resources that you have.

Zach Miller (43:24) Yeah.

Zach Miller (43:27) That's true.

Zach Miller (43:36) No, I totally agree. And I feel like that's one of the benefits of AI right now, we have the ability to champion ourselves. I think the place where I'm starting to see that maybe pull ahead too far is we have this desire to streamline things and save on labor, and that's a good thing, like saving on labor.

Aaron Crow (43:47) Yeah.

Aaron Crow (43:59) Yeah.

Zach Miller (44:02) Enables new jobs and provides bonuses at the end of the year, hopefully, depending on the role you're in. But as soon as we start to streamline that work so that we have fewer eyes on sensitive processes or systems, we can end up in a situation where that fire starts and we're not able to catch it before it gets too big. I get a little, I don't know if surprised is the right term, but

Aaron Crow (44:20) Yeah. Yeah. Yeah.

Zach Miller (44:30) Kaseya and SaltStack were in like 2020, 2021, we saw that management plane abused. And you touch on Stryker in your book really nicely, I really enjoyed that section. We've had five or six years to see what happens when we give too much concentrated authority to a system. And then we have Stryker and Intune hit, you know, five, six years later. It's like, my goodness. And it was treated

Aaron Crow (44:33) Mm-hmm.

Aaron Crow (44:41) Yeah, yeah.

Zach Miller (44:58) Depending on who you were talking to, it's like, wow, this is really unprecedented. And so we have all these attacks that have, I think, a similar shape, but people are like, that's unprecedented, almost as if we shouldn't be surprised, but we are. So this is one of the things I've been working on in some of my free time, this concept of blast radius. It's real similar to zero trust, but not quite the same, in that zero trust might say, should this be allowed?

Zach Miller (45:26) Where some of the blast radius that I've been trying to experiment and play with at home is, if this is allowed and something blows up, how far does it go. For example, Kubernetes, you might have namespace scoping that can help control that blast radius. Microsoft came out with the fix for Stryker, multi-admin approval, which is great, but

Aaron Crow (45:42) Sure.

Zach Miller (45:53) If you have a global admin, you can make yourself another account to be the multi-admin approval. So it's like the fix came after it was already exploited. And for a lot of people, going back to your segmentation thing, we've all known about segmentation for a long time, it's a hard sell to tell an organization, hey, break up your MDM plane, let's make it so you need seven accounts to administer 20,000 devices. But

Aaron Crow (45:58) Yeah.

Zach Miller (46:22) Had they, we might have had a different outcome, depending on how that global admin account was compromised. So I feel like now's the time. We just had that Stryker event, now's the time to talk about, hey, how are we delegating trust, how are we delegating authority. Some of the ways I've tried to experiment with that in my own role is reach, authentication, scope crossing, standard privileges, human concentration,

Aaron Crow (46:25) Correct. Yeah.

Zach Miller (46:51) Automation visibility and recoverability, as a way of looking at the shape of infrastructure. Because Splunk is centrally located and can see even the entire environment, but Splunk can't go and automate or touch 20,000 devices to brick them. So I'm trying to look at infrastructure as more than just vulnerability and configuration and compliance, but what happens when this catches fire.

Aaron Crow (47:01) Mm-hmm.

Aaron Crow (47:10) Right.

Zach Miller (47:21) What does it do to the organization?

Aaron Crow (47:23) Yeah. You know, the analogy I give on that use case: I could have two devices, let's say they're a Windows machine or a PLC or whatever they are, the analogy I usually give is a PLC, programmable logic controller. One of them is controlling the turbine, like in a power plant, or controlling a train, something really important. The other one's controlling the ice machine in the break room.

Aaron Crow (47:49) They're the same version, the same hardware, the same firmware, the same vulnerabilities. As a cyber practitioner, it's really easy to see those two devices on a list and say, hey, I've got all these vulnerabilities, they're both risky. But from a business organization standpoint, it goes back to what you were just saying: one of them, if it goes down,

Zach Miller (48:14) Yeah.

Aaron Crow (48:10) Somebody doesn't get ice in their water, it's not the end of the world. Somebody's upset, frustrated, whatever, but my plant doesn't shut down, I'm not losing money, I've just got an annoyed employee, and we can bring ice in, that's an easy answer for that. If the turbine goes down, completely different conversation. If the train crashes, if the plane crashes, those are big problems. So just because they're the same vulnerability, the same risk at the vulnerability level,

Aaron Crow (48:40) That vulnerability score, all that stuff that comes up, does not factor into what the impact to the business, life, availability, all those other factors that are not just a technology score. That goes along with kind of what you're saying, mirrors what you were just saying: you need to understand what is the blast radius of, if this thing breaks, what is the impact of that. If it's, we can bring it back up, I've got a spare, if it breaks, I'll just

Aaron Crow (49:08) Grab another one and put it back in, takes me ten minutes, we don't lose anything, okay, I'm okay with that. No, this thing, we're down for a month and we can't run the plant, okay, we need to really make sure we're protecting that device.

Zach Miller (49:20) Yeah.

Zach Miller (49:23) So well put.

Aaron Crow (49:23) Two different problems.

Zach Miller (49:26) Sounds like you've had a couple turbines go down. Metaphorical.

Aaron Crow (49:28) Yeah, for sure. That's right. And an ice machine too.

Zach Miller (49:35) Which is a serious issue if you need ice in your bourbon.

Aaron Crow (49:39) Correct, correct, yes, and they don't like that to go down. But again, compared to the turbine going down, it's a lot less frustrating, a lot less paperwork. What else? So how do people find out about you, what do you want, kind of a call to action, what do you want people to know?

Zach Miller (49:48) Yeah, yeah, sorry, yes.

Zach Miller (49:53) So true.

Zach Miller (50:00) Yeah, you know, I think the thing that I've been excited about is I've been researching trust, and in this blast radius, we have all these tools and we spend a lot of time making Splunk queries and detection rules for the guy from Russia to log in and pull from the finance database. And it doesn't always look like that, and for an obvious reason, it's almost like the dog chasing its tail. Where

Aaron Crow (50:28) Mm-hmm.

Zach Miller (50:29) There's opportunity, the criminals go. So you build up a really good section of your wall, like you talked about, and then you find that next section of the wall that needs to be stronger, because you're almost inviting it, because that's the section of the wall that's the weakest. So I think the big thing I've been trying to practice with people is, when you go to tabletop, and tabletopping is gold, think about not

Zach Miller (50:58) What will this look like when this goes wrong, but what will the logs look like when the tool is being used with the proper authority, from the proper account, at the proper time of day. How do you write a query for that? It gets a lot more challenging. Even context is harder to do now. I think maybe I'll skip past that part. I think a lot of people see trust as a control

Zach Miller (51:27) Or a boundary. But if you have Ansible crossing three trust boundaries, they're not really a trust boundary, but on some Visio diagram they are, and that's what gets approved. So I feel like it's rewarding, but it's also stressful, to sit down and have to go back through, okay, what does our SOAR detect, you know,

Aaron Crow (51:41) Yep.

Zach Miller (51:56) Had Stryker done the same thing, would the outcome be the same? I don't know, I don't want to make a blank check promise on that. So yeah, I think that would be a good place to end my answer. What happens when it all goes right?

Aaron Crow (52:08) Yeah. Well, and that's the hard part, right, and that's anytime I'm building these things out or having that conversation, I never start with the worst case scenario. I start with, how do you know what good looks like, what does good look like here, what does a successful process look like, if this was going end to end, no bad things are happening, everything's a perfect day, the sun's up,

Zach Miller (52:21) Mm. A baseline.

Aaron Crow (52:32) Woke up on time, had great coffee, no traffic, all green lights, all the things happen, what does good look like, because then that's your baseline. Then you start understanding the things that go wrong and which of these things are big problems, which are not so big problems. Can I still run my process if this thing happens? Yep, I still can, good. What about this one? Nope, process stops with that one, okay, so we need to circle that on the list, that's one we need to think about and continue down that path.

Zach Miller (52:48) Well said.

Aaron Crow (53:00) You should be looking at the total process, not just the cyber, not just the Ansible or the firewall or whatever, because to your point, it's the same thing, back in my networking days, a firewall is not a firewall if it's got an any-any rule, that's just a router. It's on the drawing as a firewall, but it's not a firewall if it's got an any-any rule, because then it's just routing anything that comes through. I had an argument with a guy about that because I was

Zach Miller (53:17) Yeah.

Zach Miller (53:23) Yeah. Yep, man.

Aaron Crow (53:30) Assessing their cyber posture, and the firewall had 478 rules, and he said, man, my rules are really good, I'm like, yeah, they are, except the one, he says, which one, I say, that any-any, and he says, well, yeah, but all my other rules are good, I say, but none of your other rules matter, because that one's there. If I can get to that one, none of this matters. And he argued back, but it'll get blocked by,

Zach Miller (53:43) No.

Aaron Crow (53:57) I said, no, man, I'm sorry, but no, you can't have an any-any rule ever on a firewall. That should never be, security zero, it should decline by default, and then you peel back the onion, you don't go the opposite direction. Same thing on identity, I remember back in my Active Directory administration days,

Zach Miller (54:13) Yeah.

Aaron Crow (54:25) It's really easy to solve the problem by being a schema admin and an enterprise admin, because you have God rights, you can do whatever you want. But you don't need that. And obviously there's pass-the-hash and all sorts of reasons why you should not be an administrator logging into anything other than a domain controller, and if you don't know that, that's old hack capability. But there's all these reasons why you should only have the rights that you need.

Zach Miller (54:54) Yeah.

Aaron Crow (54:54) And if you need that extra admin rights, you shouldn't be using it for anything other than administration. You should really log in as a separate account for normal email and surfing the web, and a different account for administration. I know that's a pain in the butt, people, but I'd much rather be a lower risk to my organization than logging in from Starbucks as domain admin. That's just me.

Zach Miller (55:12) Yeah.

Zach Miller (55:18) You're not alone.

Aaron Crow (55:21) And checking the logs to your point: Aaron just logged in and he's doing things, and if I don't know that's not normal, how would I know? So, this has been a great conversation, I love all this, I think you've hit some really awesome points, lots of things for people to think through. How do people reach out, find more about you, maybe see about doing work with you, or finding where you're going to be, all that kind of stuff, man?

Zach Miller (56:06) Yeah, you know, the best place I think probably would be to reach out through email or through the side project website that I have, Skip to Secure, because that's where I do a lot of my independent research, or am able to do some things that I'm not able to do during my day job, which is still very important to me and rewarding. So I think that's maybe the best place to reach out. And I have some of my research that I've been talking about that's there, some stuff on GitHub, some white papers that people can read.

Aaron Crow (56:29) Awesome.

Zach Miller (56:36) So if they want to explore and go dabble with blast radius stuff, and punish themselves, it's there for them.

Aaron Crow (56:42) Awesome. I think the thing I love about the people that listen to this podcast is everybody's out there wanting to tinker and learn more and go through those types of things. So definitely we'll include all those things in the show notes, guys, just check out the show notes for those details, the website and email, all that kind of stuff. So if you didn't catch it, we'll have all those things there, and go check out the things that Zach's doing. And man, thank you so much for taking time out of your day today and joining me and having a conversation.

Zach Miller (57:10) Heck yeah, thank you.

Aaron Crow (57:11) It was a great conversation, I appreciate you being here.

Zach Miller (57:14) Heck yeah, thank you to you. I've been, sorry, that was a little short, I just got a little nervous. I'm grateful to be on the show, enjoyed your book, I'm a newcomer to your podcast and I've been enjoying it as well. So you've got a new fan, and hopefully we'll stay in touch with you.

Aaron Crow (57:16) Awesome, thanks, Zach.

Aaron Crow (57:36) Awesome, hey, yeah, absolutely, man, I appreciate it for sure. And always enjoy, again, I really mean it when I say it: I do this because I want to give people a platform. I've been doing this a long time, I've spoken on stages and all the things, but I didn't start there, I started out as a technologist in a basement, I wasn't public speaking, all these things did not come naturally to me. And I think it's really important for people, if you want to continue your career,

Aaron Crow (58:04) You've got to get good at those softer skills. And you mentioned that earlier, and sometimes that's doing things that are uncomfortable, like coming on a podcast with a guy you don't know and you don't know where it's going to go, and being a little nervous. And that's okay, you did a great job, man, I had a great conversation. So anybody out there listening, sometimes I don't share all this, I think I will today, and the reason for that is, wherever you are, submit for the talk, go to the conference, get on stage, if you,

Zach Miller (58:15) Right on, thank you, agreed.

Aaron Crow (58:35) Every one of us that has done that and been there, we've all been there. I remember sweating profusely the first time I got on stage, and I remember being all anxious and nervous and worrying about it, and now it doesn't bother me, not because I don't care, but because I've just done it so many times now, I don't have to worry about it, because I know what I'm going to say, and I'm not worried that somebody's going to ask me something, I've just gone through that muscle. It comes with repetition. So man, I

Aaron Crow (59:02) I'm thankful that you were willing to take the risk to be here today. Thank you for trusting me in that process. And anybody out there, I definitely challenge everyone to get on a podcast, go out and do the YouTube, get out there and post on LinkedIn, network, get on conferences, get up on stage, BSides, any of these things. You don't have to go talk at DEF CON, go talk at BSides, go do something local.

Aaron Crow (59:29) Start flexing that muscle and getting better and better at those things. So again, man, I applaud you for being here today, thank you for the time, and I think you did a great job.

Zach Miller (59:36) Thank you.

Zach Miller (59:38) Right on. Well, thank you, I appreciate it. I hope you have a

Aaron Crow (59:40) Absolutely.

Transcript lightly edited for readability.