Aaron Crow
speaker
79 appearances
1 recordings
1 series
first heard Aug 2024
last heard Aug 2024
Aaron Crow’s voice in public audio — every appearance, attributed to the second.
Trend
recordings per month · last 12 monthsNo recordings in the last 12 months.Older appearances are listed below; set an alert to hear about the next one.
Appearances
There is no product I can grab off the shelf that's going to take away all the risk if I install it in an OT environment. I wish there were, but there's not. There's just not.
We have droughts, global warming, fun times. Well, a friend of mine is I won't name the name, but a friend of mine works at a social media company with a very large data center. There's there's there's quite a few of them. It doesn't matter which one it is, but they have millions of PLC's millions.
controlling all sorts of things from temperature to pressures to, you know, lights and air conditioning and valve. Like there's so much there's halon systems and all these different things. Buildings have OT like any skyscraper, even not even a skyscraper, just a normal building you walk into. There's controls around sprinkler systems and all these different things. OT is everywhere.
We just didn't always classify as such. Like it's a new term, relatively new term. It's been around forever. We've been doing automation since the fifties. and before really, but automation has been around. We've just started putting the technology side and putting IP addresses on it.
So we brought these other risks into this space, but the OT's been here for, I mean, my dad worked in power utility for 40 something years. He's in his mid seventies now. He's been doing this this whole time. He was never cyber related. It was always control systems and control engineer and automation and instrumentation and even continuing emissions monitoring as that came in to be a thing.
But all of these things have been around for decades. We're just solving new problems to old, adding new problems to existing and older problems.
Absolutely. And the talk I gave it at DEF CON actually in the ICS Village was about cyber informed engineering, which came out of a term came out of Idaho National Labs, which is a DOE sponsored laboratory. And the whole concept around it is we need to build cyber as part of the overall system. and integrate that when I'm designing the system, cyber needs to be considered, right?
We've got old equipment, we've got legacy equipment, we've got new equipment. Anywhere in there, we need to be considering cyber as a risk and as a part of our remediation. How are we going to recover?
When we say cyber, people that are outside of this or even people at DEFCON and Black Hat, when I had this conversation, they immediately think, well, I'm a nation state, North Korea, China, whatever. It doesn't necessarily mean that. It can be simple ransomware. It can be misconfigured hardware. It can be an insider threat.
There's a lot of things, and it's not always bad actors from another country that are trying to attack us and start World War III. Some of them are, but not all of them.
Well, and there's so many, again, we mentioned it, but there's 17 critical infrastructures. And the reason that they've been categorized as critical is because they're critical to human condition as Americans in our country. And if any one of those go down, it is going to impact our lives. All of our lives, not just yours, not just mine, but everyone's.
Like if the power goes down, you can't pump gas. You don't get water. You don't like everything tumbles down.
Don't even bother going. So the reason these things are critical is because really smart people sat in a room and they said, hey, what are the things that if they go down are going to impact society? Like the bigger society. So there's 17 of us. And I would argue, and I've worked in many of them, not all of them, but many of them.
And I would say almost all of them, at least the ones that I've been in, underfunded, people don't understand the risk, including the asset owners. And they don't have the right people and processes. And unfortunately, cyber is not... designed and engineered into the system. And it's an afterthought.
And unfortunately, usually an afterthought after something bad happens, like the example you just gave about the peanut, right? So they start looking at these systems when there's an attack, when there's a breakdown of physical or cyber incident. And then they have to because the spotlight is on them and they're required to. And then everybody else may be hopefully around them that are similar.
Say, oh, it happened to them. It could happen to us. We should we should look at that, too. Or there's regulation that comes down. So unfortunately, that's where we sit a lot of times in this industry. And it's not because the companies are bad companies. These are some of the best people I've ever worked with. They want to do the right thing, but they are strung behind.
They can only do what makes them money. And unfortunately, cyber and all this stuff is not a revenue center. We're not creating revenue value. My power plant's not more efficient. I don't create more wheat because I put in cybersecurity. It's more almost like an insurance policy. And nobody likes paying for insurance. It's just like this, ugh.
The one thing I'll say on that is you look back and we do have a couple of examples of that in America. And you go back to Katrina when we had the hurricane that came through in New Orleans. And we saw martial law in two or three days and people that were committing crimes and going at gunpoint. And these are not bad people. These are everyday people like you and me that are dying.
desperate because their family is starving. Their baby is starving. They don't have food. They don't have water. They don't have a way to evacuate. There were basic needs in our country. And that was with FEMA and with the National Guard and the amount of public services that we have. And it was one small area. Imagine that on a large scale. Imagine that across our country.
When we can't just, you know, rally the troops from all over their country to this one geographical area. Imagine if that was on the East Coast, in the center and on the West Coast all at the same time. It would be we wouldn't even recover as well as we did at Katrina. And we all agree that we didn't recover well then. Like it was really not our best time.
Showing 21–40 of 79 · page 2 of 4
← Previous
Next →