Couverture de PrOTect It All

PrOTect It All

PrOTect It All

De : Aaron Crow | Operational Technology & Cybersecurity Host
Écouter gratuitement

Offres de saison | 0,99 € par mois pendant les 3 premiers mois

5,99 €/mois par la suite. Des conditions s’appliquent. Annulation mensuelle possible.
PrOTect IT All with Aaron Crow delivers weekly episodes focused on cybersecurity and operational technology, tackling emerging threats across industrial control systems, AI security, and IoT threats. The show emphasizes enterprise risk management, manufacturing security, power grid security, and threat intelligence, providing listeners with authentic conversations from security leaders and practitioners. It’s a resource for those committed to real-world IT operations security and understanding AI risks in critical infrastructures.© 2024 Economie
Épisodes
  • They Deserve to Be Defended: OT Defense, Transitioning Vets and Weaponized Sneaker Net

    They Deserve to Be Defended: OT Defense, Transitioning Vets and Weaponized Sneaker Net
    Oct 26 2026
    Work with Aaron: https://protectitallpod.com/work/ The book: https://protectitallpod.com/book/ This episode: https://protectitallpod.com/ep129/ The OT Security Starter Kit: https://protectitallpod.com/starter-kit/ The small water utility down the road cannot afford a big consultancy, and it still has to be defended. Erin Burns is building a company around that problem. Erin is an Army veteran with roughly two decades in cyber operations and the founder of EVR:RDY Defensive Operations Group. He and Aaron take on the question every transitioning veteran asks, how do I get into OT, and the problem behind it: automation is closing the entry-level door just as small utilities need defenders most. They get into hiring troubleshooters instead of job reqs, engineering a low-cost data diode, why a tool nobody runs is worse than no tool, the air gap myth, and how Erin's team weaponized sneaker net to get packet capture out of sites that will never allow remote access. Key takeaway The utilities that cannot afford a big consultancy still have to be defended. If you mandate a standard, fund it, and build the people pipeline the same way you build the product: with problem solvers, hands-on apprenticeship and tools small operators will actually use. A tool nobody uses is worse than no tool. Chapters 0:00 Cold open0:25 Intro0:46 Meet Erin Burns2:26 The question every transitioning vet asks3:23 Hard hats and factory floors5:43 Automation is closing the entry-level door8:03 Ignore the job req11:06 A pilot with local water sites12:17 Automate to lower the noise floor14:19 No juniors means no seniors16:36 The operator wearing every hat17:55 Engineering a low-cost data diode19:28 Dave's network and the XP box21:44 School lunches, police cruisers and cyber26:19 A tool nobody runs27:11 Why investors hate this model28:53 The cellular modem nobody questioned30:51 How many air gaps have you seen?34:38 The historian under the tablecloth36:31 What do you do with packet capture?39:50 The air gap myth46:04 Two different runbooks49:50 Who defends the sites that can't pay?53:57 Where to find Erin and EVR:RDY55:20 Outro About the guest Erin Burns is an Army veteran with roughly two decades in cyber operations and defensive work, and the founder of EVR:RDY Defensive Operations Group, a company focused on affordable OT/ICS defense for critical infrastructure operators with limited budgets and resources. He came up through special forces support and early military cyber, became a cyber warrant officer, and by his account spent five years on an Army cyber team defending OT environments, on factory floors and in hard hats. He is now building EVR:RDY around that experience, with a focus on water utilities and other sites that cannot afford commercial tooling. EVR:RDY: https://evrrdy.comEVR:RDY pilot program: https://evrrdy.com/pilotsErin on LinkedIn: https://ww... Chapters (00:00:00) - Cold open: they deserve to be defended(00:00:25) - Intro(00:00:47) - Meet Erin Burns(00:02:26) - The question every transitioning vet asks(00:03:23) - Hard hats and factory floors(00:05:43) - Automation is closing the entry-level door(00:08:03) - Ignore the job req(00:11:06) - A pilot with local water sites(00:12:17) - Automate to lower the noise floor(00:14:19) - No juniors means no seniors(00:16:36) - The operator wearing every hat(00:17:55) - Engineering a low-cost data diode(00:19:28) - Dave's network and the XP box(00:21:44) - School lunches, police cruisers and cyber(00:26:19) - A tool nobody runs(00:27:11) - Why investors hate this model(00:28:53) - The cellular modem nobody questioned(00:30:51) - How many air gaps have you seen?(00:34:38) - The historian under the tablecloth(00:36:31) - What do you do with packet capture?(00:39:50) - The air gap myth(00:46:04) - Two different runbooks(00:49:50) - Who defends the sites that can't pay?(00:53:57) - Where to find Erin and EVR:RDY(00:55:20) - Outro
    Afficher plus Afficher moins
    56 min
  • Trust Is Not a Security Control: Blast Radius and the Management Plane

    Trust Is Not a Security Control: Blast Radius and the Management Plane
    Oct 19 2026

    Work with Aaron: https://protectitallpod.com/work/
    The book: https://protectitallpod.com/book/
    This episode: https://protectitallpod.com/ep128/
    The OT Security Starter Kit: https://protectitallpod.com/starter-kit/

    Zero trust asks whether something should be allowed. Zach Miller asks a different question: if it is allowed, and something blows up, how far does it go?

    Zach is a cybersecurity engineer in Colorado Springs who came up through K-12 network support on a shoestring budget, defense contracting and managed services. On the side he runs Skip to Secure, where he publishes research on trust concentration and management-plane abuse, including his Blast Radius framework.

    He and Aaron trace one pattern through five years of incidents. Kaseya and SaltStack in 2020 and 2021, then Stryker in 2026: each time the management platform itself became the way in, and the authority it already held decided how far the damage went. Segmentation is the fix everyone already knows. It is still a hard sell.

    What you will take away
    • Why trust is something you delegate, not a security control, and how to put a limit on it
    • What Zach's blast radius framework measures: reach, scope crossing, standing privilege, human concentration, automation visibility and recoverability
    • Why the same PLC with the same vulnerabilities is not the same risk on a turbine as it is on an ice machine
    • Why attacks now look like a normal workday from a cloud address, not a foreign IP in the logs
    • Why one any-any rule undoes 477 good ones, and why a firewall starts from deny
    • Why you verify every piece of work an AI agent hands back, however good the prompt was
    In this episode
    • 5:03 Sleeping under the conference table
    • 8:30 The open proxy everyone borrowed
    • 10:24 From K-12 to defense contracting
    • 12:59 How careers really get built
    • 16:36 Where is the puck going?
    • 23:22 A heat map for the smoker
    • 25:41 Verify everything the agent does
    • 32:31 Attacks that look like a normal workday
    • 34:33 The work laptop on the home network
    • 39:15 Security is never done
    • 41:39 Where the word firewall comes from
    • 43:33 The same failure, five years apart
    • 44:21 What blast radius measures
    • 46:28 The turbine and the ice machine
    • 49:43 When the right account does the wrong thing
    • 51:53 A firewall with one any-any rule
    • 54:08 Where to find Zach's research
    About the guest

    Zach Miller is a cybersecurity engineer based in Colorado Springs. He started as a network and switching specialist supporting K-12 education, then moved through defense contracting, consulting and managed services into cybersecurity engineering. Through Skip to Secure, his independent research and training effort, he publishes white papers on trust concentration and management-plane abuse, including the Blast Radius framework and the LOLMgmt paper on living-off-the-land management attacks.

    • Blast Radius white paper and scoring workbook: https://github.com/ridgestoneco/blast-radius
    • LOLMgmt white paper: https://zenodo.org/records/21255394
    • Zach on LinkedIn: https://www.linkedin...
    Afficher plus Afficher moins
    58 min
  • A Guardrail, Not a Stop Sign: Securing AI at Business Speed

    A Guardrail, Not a Stop Sign: Securing AI at Business Speed
    Oct 12 2026

    Work with Aaron: https://protectitallpod.com/work/
    The book: https://protectitallpod.com/book/
    This episode: https://protectitallpod.com/ep127/
    The OT Security Starter Kit: https://protectitallpod.com/starter-kit/

    Three months ago Ben Wilcox's company was running roughly 200 AI agents. When he checked the day before we recorded, it was 900. Nobody stood them up on purpose, and every one of them runs under somebody's identity.

    Ben Wilcox is CTO and CISO at ProArch, which means he carries both sides of the argument: the pressure to adopt AI and move fast, and the job of answering for identity, governance and compliance when the moving fast gets ahead of the preparation. Most conversations about AI risk are one of those two people talking about the other. This one is held by somebody who cannot pass the problem across the table.

    His position is not that AI is dangerous. It is that AI security does not start with securing the model, it starts with securing the environment you drop the model into: identity, access, data scope, logging and ownership. All things security teams already know how to do.

    What you will take away
    • Why agent sprawl is already here, and why the real question is who owns an agent when the person who built it leaves
    • How to say no to a risky request and still give the business a path, so the work does not go to shadow AI
    • Why you fork a community MCP server and keep only the 20 of its 107 tools you actually need
    • The vendor due diligence question the questionnaire never asks: who can read the key, and can you get the log
    • Why physical segmentation is coming back for truly critical systems, and why OT never left it
    • How security review can finally run at the speed AI-built code is written
    In this episode
    • 2:42 Plan for when something breaks
    • 6:31 The risks people are ignoring
    • 10:03 Build it yourself and you support it forever
    • 12:51 200 agents to 900 in three months
    • 20:40 Defending at machine speed
    • 21:46 Physical segmentation is coming back
    • 24:06 107 tools and you only need 20
    • 26:46 How the conversation changes by industry
    • 30:11 Still working on the fundamentals
    • 31:17 Third parties and the weakest link
    • 36:25 A guardrail, not a stop sign
    • 41:46 Bring only the data you need
    • 49:30 Did AI write the book?
    • 51:20 Security finally at development speed
    About the guest

    Ben Wilcox is the Chief Technology Officer and Chief Information Security Officer at ProArch, a global technology consulting and services firm specializing in cybersecurity, cloud, data and AI, and software development. With more than 25 years of experience in technology, Ben has led enterprise architecture, cybersecurity strategy, regulatory compliance, incident response and large-scale business transformation initiatives. In his dual CTO and CISO role, he helps organizations balance innovation with security, evaluating emerging technologies from both a business and a risk perspective.

    • ProArch: https://www.proarch.com
    • Ben on LinkedIn: https://www.linkedin.com/in/ben-wilcox/

    Learn more about PrOTect IT All:

    Work with Aaron: https://protectitallpod.com/work/
    Afficher plus Afficher moins
    58 min
adbl_web_anon_alc_button_suppression_t1
Aucun commentaire pour le moment