Aaron Crow
speaker
79 appearances
1 recordings
1 series
first heard Aug 2024
last heard Aug 2024
Aaron Crow’s voice in public audio — every appearance, attributed to the second.
Trend
recordings per month · last 12 monthsNo recordings in the last 12 months.Older appearances are listed below; set an alert to hear about the next one.
Appearances
Awesome. Hey, thank you for joining me. Kristen, why don't you introduce yourself? Tell us who you are and what it is that you do.
Very cool. Well, and for your listeners that maybe don't know me, my name is Aaron Crow. I've been in cybersecurity and network security and this OT thing before it was ever called that. I grew up in working in critical manufacturing, power utility, a lot of those critical infrastructures. I actually do have some experience in the ag side as well. I'm from Texas.
So, you know, there's a lot of plants and things like that in this space from chicken plants and a lot of, you know, ranchers, et cetera. Right. So, you know, I've I also have a podcast, Protect It All, and emphasizing OT and IT. I do emphasize a lot of that in the OT space. But as we talk about this stuff, I had this conversation. This is, what, the 14th of August when we're recording this.
And I just came back from Black Hat and DEF CON. And I had so many questions and I work in the ICS Village. I'm a volunteer in the ICS Village, which is a nonprofit. If you don't know about that, definitely check it out. ICS Village is great. They do a lot of training and nonprofit things to kind of spread the word for operational technology and the importance of it.
But a lot of the conversations I was having at DEF CON, I've got this really cool blinky light OT wall that's got a PLC and secure mode access and a firewall. And it's really just a conversation piece to help people understand and I got so many people, this is 2024. And there's so many people that came up to me and were like, what is this? So I said, oh, well, this is OT in a box. What's OT?
And I'm like, oh, okay. Like we still, many of them, and I love the question. Like I'm very glad that they said, I don't know what that is. Like, or some of them were like, I've heard of it. I don't exactly know what it is. So it was great to just be able to have that conversation, explain it. And there was one gentleman that he was going for his PhD, his dissertation.
And he was he was writing this dissertation from an IT OT convergence. We hear that all the time. I know my face did the same thing when he said it. And we had this conversation. He's like, well, I think OT and IT have already converged. And I'm like, really? Like, explain that to me. He's like, well, the technology is the same. OK. I'm like, he goes, it all OT now all has IP.
So that means it's IT. And I'm like, oh, no, no. So I had a 30 minute conversation with this gentleman about why I feel that OT is different than IT. The technology is the same. Like we see VMware and network servers and switches and all that kind of stuff that we have seen in IT now in OT. But the difference is, is what we do with it and what it impacts, right? And the implementation of policies.
I can't just take an IT policy and push it into OT because it breaks stuff. It just doesn't work. And we've seen that and it doesn't matter the vertical. You're in agriculture, in power utility, in oil and gas, in wastewater. It doesn't work to push it down in that way because it breaks stuff. And it's just a different way. Like we just saw this CrowdStrike.
I talked about the CrowdStrike incident a thousand times this week. That's a great example of I should not be patching or pushing updates to my OT systems. Just, hey, send it all. I should be sending to one at a time so that I can test and make sure like, We should all have a testing plan. And it's not a CrowdStrike issue. It's a policy.
It's the people and process side of people, process and technology that are really the biggest difference in OT versus IT. So that was my long rant of who I am and what I do and why I'm so passionate about this thing that we talk about.
Well, and it's always been that way. Even back when I was an IT person, my first job in IT was like a desktop support. And, you know, our joke was always like, if we take the users away, my job would be easy, right?
yeah because because i can make the technology work it's the people that cause my problems like they they're clicking on something you know this is way back in the day dating myself but you know the the old school desktops the big tower things and we would literally have people use the cd-rom as you know coffee cup holders and then their cd-rom tray would break off and you know we don't have cd-rom trays anymore or even cds for that matter um
Yeah. And it's the same in any industry, right? But speaking of, so I know you spend time and a lot of time in the agriculture. Before we started recording, we kind of talked about how it doesn't get as much limelight as some of the other more popular, I guess is maybe not the right term, critical infrastructure, power utility, oil and gas, even wastewater and water. But
There are 17 critical infrastructures in our country deemed by DHS and Department of Homeland Security. So why do you think, two things, why do you think that agriculture doesn't get the attention that it may deserve?
And secondly, what are some of the common problems and maybe even unique problems that agriculture has in the space that we need to make sure that we're thinking about from an OT cybersecurity perspective?
Well, and we saw so many supply chain issues during COVID like it really brought to it. It brought to bear how bad our supply chain in general was. We're already concerned with global warming and population and all of these things. You know, the way that we do farming today with, they talk about how our topsoil is, we have limited... Yes, we're limited in how we can do that.
And regenerative farming is the way of the future. But how do we feed everybody with that method? And there's just so many things that go into that. You hit on something that I repeated probably a hundred times this week in all the conversations in Vegas, talking at Black Hat and DEF CON. And it's OT a lot of the times. It's not sexy.
The things that I need to do in the very beginning are not AI and quantum computing and all of these fancy buzzwords. Most of the time, it's very basic. You know, do I have a recovery plan? Do I know where my critical assets are? Do I have an asset list? Do I have a recovery option? Have I executed that thing? Does everybody know what part they play? It's usually basic, basic things.
tackling, right? And it's not all technology-based. Maybe, let's say it's 50%, which I don't even think it is that. Less than half of it is finding a technology solution, which there's some of the vendors that I work with that don't like it when I say that. I'm sorry, but it's the truth, right?
Showing 1–20 of 79 · page 1 of 4
Next →