UnHacked

Welcome, everybody, to episode 44 of Unhacked. I am Justin Shelley, CEO of Phoenix IT Advisors. I do, listen. I I protect businesses from the Russian hackers, from the damp government. We're gonna deep dive on that one today.

And the attorneys that wanna come around and sue us if we get breached, that's what I do. I do work in the Dallas area, Northern Nevada, and Utah. And I'm here with my faithful and loyal cohost, my ride or die, Mario. Mario, say hi. Tell people what you do and who you do it for.

How's everybody doing? My name is Mario Zacke, CEO of Mastech IT located in New Jersey right outside of New York. And we protect small to medium sized businesses and their owners from cyber attacks and keeping them safe on the the web.

Alright. Mario, we're we're a little short handed today. We usually historic I mean, we've recently we've had three and even four people on and today it's just the two of us. So we're gonna have to bring our A game to try to make this a little bit interesting, exciting, informative. And we're gonna talk about something that has my attention.

I'll be honest Mario, I get up in the morning and I scroll, don't judge me, I scroll social media and mostly what I see on there is doom and gloom. Like Jesus Christ, what is going on in the world? Everybody's pissed off at everybody. People love Trump, they hate Trump, there's like no middle ground and I just usually want to go back to bed and say I'll come back out, I'll poke my little head out when the world's done burning down and just kind of see how this all lands but unfortunately that's not an option to live under a rock. So here we are and today we are going to break down these tariffs, the tariff wars and here's what I'm not going to do today Mario, you can do as you please but I am not going to take a position on any political subject whatsoever.

I want to talk about what are these tariffs, this change in the landscape, the trade landscape, the economic landscape, what is that doing to business and in particular, what is it doing to cyber security and what do we need to be aware of and potentially afraid of. With that Mario, I'm gonna punt this to you. What are your thoughts? Just let's just kinda spitball here. What are your thoughts on all these tariffs?

Well, I mean, it's getting messy. And the problem is people don't know what's gonna happen next. Right? You know, he's Yeah. He's putting a tariff on Canada, putting a tariff on Mexico, and putting a a tariff on China.

Well, and guess what? You know, a lot of our stuff that we're getting in, look at the bottom of the label. Most of it says made in China, you know, and especially the tech stuff, you know, the chips Right. Keyboard, you know, all that stuff. That's that's what's getting scary.

And even though it's only a 10% tariff, we're pissing them off. You know, like

I I listen. I I said I don't I'm not gonna say much and honestly, it's because I don't I don't follow this that closely. Yeah. But I saw a number that said something like 60%. So I don't know what it is.

I know it's significant enough that it's pissing a lot of people off like you said. It's going to drive up the prices right, so let's kind of dive into that. Number one this is really shitty timing because Mario what happens towards the end of this year that's going to impact almost every business in the world?

It is the end of life of Windows 10.

Windows ten's been a good solid operating system. It has. I have recently upgraded to Windows 11 but I will tell you I had no need to, I wasn't interested, I didn't want to make the change. So there's no sense of urgency other than the security ramifications. Right?

And so talk about that for a second. What if I don't upgrade to Windows 11, I stay on Windows 10, why is that a problem if it does everything I need it to do?

Well, because I believe it's October 31 or October 25, something like that, the October, Microsoft is no longer going to be supporting it. So they're not going to release any security patches, any updates, anything for It they're gonna treat it just like the way they treated Windows seven, Windows eight, Windows XP. So in the IT world, we have to treat it the same way. Like, you you walk into an environment, and if you see a Windows 10 after October, we're like, alright. This is a security breach.

This is no longer allowed.

And Just the existence of it is

a security breach. Right? Exactly. And what's gonna end up happening is, you know, shortly after that, the security companies that we work with, the, you know, the the the antiviruses and the, you know, stuff like that, they're going to no longer support updates for that as well. So, you know, it's it's you know, for people that are familiar, like, imagine walking to a place and seeing a computer that's Windows XP or Windows seven.

It it, you know, it's

We're ahead

of there. Security. Yeah.

Now there's and so there's there's a good and bad to this mandated upgrade. Like, it has to happen if you're regulated at all. HIPAA for example, you have to have Windows 11, you can't have out of date unsupported operating systems. The good news is it's a free software upgrade. The bad news is terms and conditions apply.

Yes. Let's talk about those terms and conditions. What what would prevent somebody from taking the free upgrade?

So with the so when people went to, like, from Windows XP to Windows seven or from seven to eight, eight to 10, you know, a lot of times it was also free. And as long as you're able to install it and run it, no problem, everything was fine. Now there's some security things that go along with this upgrade that are prerequisite, rec requirements for you to install Windows 11. So the three major ones are has to be a recent processor, like an Intel processor. So it has to be, like, eighth or ninth generation or higher.

It has to have a TPM chip in it, and we're gonna be talking about chips in a minute. This chip pretty much lets you put in the bit bit what is it? Not the Bitdefender. What's the encryption? The Windows encryption.

Why am I drawing a blank here?

Oh, now you said BitLocker, so that's where I'm at BitLocker. BitLocker. It's because there's another name that's too damn close to it guys. BitLocker. Better naming

Exactly, so BitLocker which lets you securely, you know, encrypt your hard drive in case it gets stolen or something like that. And the third thing that, that I'm aware of is it needs to have an SSD hard drive. Alright? Most computers probably right now have an SSD hard drive, but the TPM link and the processor are big ones because you so for example, a computer that is, like, seven years old, it will not take Windows

11. Right. So it's a free upgrade and the conditions are you have to have pretty recent hardware to make it all work. Right? And here's the thing, I don't know about you, don't know what you see when you're out there in the wild, I don't see generally speaking a lot of businesses being proactive on keeping their hardware up to date.

Do you see that? Is it just me, Mario, or my clients and prospects just cheapskates?

You know what it is? It's a lot of people now are going with the whole mindset of if it's not broken, don't fix it.

Yeah. Cause honestly for a while in the world of technology, we had two things, we had excitement, right? Because things were getting better and better and they could do more and more. Right now, computers pretty much do everything we need them to do. I mean, there's a few exceptions to that, but generally speaking, I'm not sitting here waiting for the next processor update so that I can do more stuff.

I'm doing everything I need to do. That's the number one, we don't have that excitement that we used to have around it and number two, prices used to drop. It used to be that when I got my new computer it was cheaper than the one I got before and better and now that's not true at all. You out to buy a new computer and it's up ten, twenty, 30 percent from the last time you bought one. I mean it's just a whole different world we're living in.

That's the situation, Windows 10 is ending. This was gonna become an immediate violation of regulations in some cases and best case scenario, it's a risk to your business. That's the best case scenario is it's only a risk. Worst case is

you

can get fined or whatever sued. Like, don't wanna get into that too much, but it's true. It's real.

You know, the one thing too, and I I was talking to somebody about this, what's happening is when when Windows, 10 is no longer supported, shortly after that, like I said earlier, Microsoft is not releasing any updates for. If you I I do remember, after Windows seven was no longer supported. A few months after that, there was a huge problem where there was, like, a zero day attack that was discovered that some hackers knew about it before Windows stopped supporting it. So sometimes what they're doing is hackers know of something, but they're waiting until Microsoft is out of the picture. Right.

So come, say, December of twenty twenty five, there could be a security breach, and Microsoft is gonna tell you, well, we told you to switch, we're not doing anything about it.

Right. Now there's another little bit of fine print. Like, usually Microsoft will offer paid support for unsupported operating systems and this is because some software and some hardware won't run on newer operating systems. You've got legacy stuff out there that just you can't upgrade it which is really frustrating. So I guess you know worst case you can maybe weigh that risk but no matter what you have an out of date operating system, have an out of date hardware and the security patches become less and less effective even though you know even if you do pay for them and try to extend it.

So this poses a problem back to tariffs we've got a case where already demand is going to go up and now we're going to the perfect storm of supply going down at the same time we can't get the chips manufactured or at least we can't do it for the same price, we can still bring them over from China, right, but they're 10 times as much, because that becomes exponential, it's not just the percentage of the tariff, then you've got everybody's cut as a percentage on top of that. Let's just say it's 10% but every sales rep everywhere in the chain gets his commission as a percentage. Every business owner or every industry, they take their cut as a percentage and so that 10% can become a %. Mean it's just I'm not trying to be specific with the numbers but I am saying that this is an effect it's like a snowball effect that we're gonna not see a small percentage increase it's gonna be a fairly dramatic increase probably according to the crystal balls that I'm looking at. And not only is the price gonna go up, supply is gonna go down at the same time, it's just gonna be harder to get this stuff.

Like somebody could come in and say hey Mario, need 100 PCs and I need them by October 14 and by the way, today's October 12. Well guess what, SOL, it's not happening.

Exactly.

Okay, so let's about, let's move out of the world of PCs and workstations. And I mean by the way, Apple, you're not immune from this. Apple people, they're like a cult of their own, they love to think they're exempt from I love my Apple people, I live with them. Anyways, and they'll be listening later. So beyond the workstations, beyond the, you know, I mean, while I'm talking about Apple iPhones, The phones and this is going be another issue there.

But what other problem does this pose as far as, technology goes?

So, I mean, it it's the the chips itself, you know, that that not only go inside the computers, but other stuff as well, like hardware, and, sorry, sorry, like firewalls and stuff like that. Okay. And and the chips that I mentioned earlier, the TPM link, you know, there a lot of the stuff that we are getting from, especially China, is going to be subject to a lot of this stuff. You know? Even, appliances and stuff like that is gonna start getting a little more expensive.

Yeah, mean you mentioned firewalls, let's talk about that for a second. Is an interesting subject actually because it used to be, security used to be so simple, You just put a firewall in place and you put an antivirus on your workstations, that was it. Now we've got so much work from home and we've got smaller offices, one to five user companies. A lot of times they don't have a good firewall to begin with, they're just using what the ISP puts into place which is not recommended. So there's already resistance to getting the adequate, the correct equipment in place to secure a network.

But now we've got, once again, we're gonna have higher cost, lower supply and that resistance is gonna go up. Mario, if I'm a bad guy, I'm sitting around with a bag of popcorn watching this shit show with a great big grin on my face.

Yeah. Yeah. Because people are going to start you know, because the reason we have it even though that we're a lot of the stuff that we're getting from China is because it's so much cheaper to get it from over there than do it here. Right? And when the whole reason, you know, behind these Trump tariffs is that he brings more jobs and more manufacturing back in the country.

K? Well, the reason it was outsourced is because it's cheaper. So we're gonna in you know, bring it in here, and now it's gonna be a lot more expensive, you know, to to pay somebody even if it's minimum wage. Here, it's probably 10 times more than paying somebody overseas. So people are gonna say, well, you know what?

I am not you know, when when I bought a new firewall four years ago, it was x amount of dollars. Now it's three times that price. I'm not doing that. I'm sticking with my old one even though you're saying it's no longer gonna be updating or I'm just gonna go to Best Buy and just grab a Linksys off the shelf.

Yeah. You know? And and, again, bad guys are sitting here with a bag of popcorn just thinking, yeah.

Yeah. Like go ahead, go get

that Let's do that. Let's do that. And you know and and you talk about the that it'll be higher prices to build this stuff here in The States. That's the end game. That's true once all the dust settles.

The big problem we have in the interim is it's gonna take us a while to get there. Let's just say everything works out And in the end, it stabilizes and stuff's a little bit more expensive because it's manufactured here. How long does it take to ramp up to get there?

I mean, they they have to, you know, build a facility, they have to get the machines, they have to train people, they may have to do some trial and error testing and all that stuff. I mean, we're talking years.

Yeah, right, right. So in this gap here's what I fear is going to happen, let's say and I'll pick on my vendor, use, actually I won't use names, I use XYZ brand of firewall, I've standardized on it. And let's just say that these prices go up, well it'll be nice and just say they go up 30%. And I go to my clients and I'm like hey that thousand dollar firewall you bought last year, five years ago whatever, with inflation with everything else now we're looking at $1,500. 13 hundred whatever.

So you know what happens a lot of times and maybe again maybe I'm the only one, I'll get an email back that says, hey wait I found this exact same thing on Amazon, is it okay to buy that? Okay well if it was the exact same thing, yes, the answer is yes. The problem is we get a lot of counterfeit equipment. Now here's something I learned a while back, just for Black Friday sales, have you heard that manufacturers will build specific equipment for Black Friday sales? That is not the same.

So you think you're getting a deal, a discount, what you're getting is cheaper shit and so we're run into that as well where not just cheaper but actual counterfeit. They take the box of XYZ firewall, gut it, put their own stuff in there, slap a new sticker on it and this is hypothetical, I'm just saying these are the potential things that I'm a little bit concerned about right now.

Yes. I mean, there's definitely going to be, you know, things that, you know, people are gonna try to make up, you know, make up somewhere else, you know, and, you know, it it could be either because they're they wanna save money or because they can't get the the the product that they need or because it just there's too many hoops to run through to get it. You know, I'll like, the firewalls that we use, you know, with the exception of, you know, some of them you can get on Amazon or eBay, you know, the the basic customer is not gonna be able to go and just say, I want one of these. You know? They they only work with, like, certain channels and and IT providers, you know, so, there's gonna be a lot of hoops and it's going it's gonna even make it harder for us to get some of the stuff as well.

Right. Yeah. Absolutely. Let's so let's pivot a little bit and we'll we'll put hardware, we'll put a pin on that for a minute and let's talk about war, let's talk about cyber war Mario because like I said I wake up and all I see is rage, I see it between people in our own country, I see it between people in our country versus Canada, Us versus Mexico, Canada versus Canada, you've got Canadians on there bad mouthing Canada, you've got Canadians bad mouthing America, you've got America bad, this absolute, it's just rage, like over and over the best thing, one of my favorite things to do is to take a headline, newsworthy topic and I just like to go and read the comments and I live in that dumpster fire world see how people are handling it and you can just kind of get a feel for where people are at emotionally this way. In good times it's nice, there's only a little bit of nonsense in these comments but right now it's just straight up hate there's no middle ground for it and that's amongst us.

Now we're gonna expand that to the hate that's going on, we've already got countries that hate us and that are attacking us. What what are your thoughts here? Are are we at risk of a cyber war?

Yeah. I mean, honestly, I I think, you know, like, for example, you know, talking about China, like, you know, they're going to, you know, it's not just a tariff war. You know, they're they're, you know, we're putting a tariff on their stuff. They're putting a tariff on our stuff. They're gonna stop, you know, providing us with certain things altogether even if we're like, alright.

Forget it. We're not even selling you this stuff. And then on top of that, you know, some of these countries and we've mentioned in previous podcasts, some of these countries, like, the the cyber attacks that they're doing, it's allowed. You're allowed to to do some of the, you know, like, attack, you know, as long as you're not attacking, you know, within the country, you're attacking outside of the country, you're protected. Right.

You know? So this is going to start ramping up, you know, because it may come down from the higher above of there. Like, you know what? Let let's ramp it up. We will, you know I don't know.

They may they may give out, like, tax exemptions or something. I don't know what they do over there, but they're going to get the green light to pick up pick up the notch. You know? I mean, you you saw what they you know, what happened or you've heard about, like, what happened with, you know, x, which is formerly Twitter. You know, they they were under attack hard.

Yeah. I I mean, tell us a little bit about that. So it's a denial of service, a distributed denial of service, DDoS attack. What does that mean? Tell tell our audience a little bit about what that means.

So

it pretty much what it is is a hacker or or an organization will gather networks or computers. Like, they'll create an army of computers, and it's not just coming from one place. It will be coming from multiple places, different countries, all around the world.

And verify these are computers that they have breached. Correct? They've they've gotten some version of malware on there where they now can use that computing power unknown to the actual owner. Right? Yeah.

So they got this network of these, and then what do they do?

Yeah. And yeah. It's exactly like what you just said, Justin. It's not just like, their computers, and we're not talking about, like, a dozen here in China, you know, in The United States and a dozen in China. We're talking about thousands of systems throughout the world from different IP addresses.

They all form like this this army, and they try to attack one specific website or, you know, group. And in this situation, it was x.com. And what they're doing is they're sending it a bunch of commands all at one time, and the website or the, you know, the server can't handle all that at one time. It's not built for an, you know, an excess of these commands all at once. Right.

You know, put it this way. You know, you ever go to, like, Ticketmaster when there's a new, you know, let's just call it WrestleMania

Good example.

Coming out. You know? Yep. And you go to the store or actually even better Apple.com when the new Apple's coming out and they want you to go and preorder, and it says it's gonna be open up mid diet on this day. What ends up happening?

All these thousands of people are going to that website all at once trying to preorder, and the website either freezes, crashes, or it goes, you know, nobody can can even access their account.

Or the Mike Tyson fight on Netflix, did you try to watch that?

Yeah, exactly.

I mean, just glitchy bad resolution, it was terrible experience. So, yeah, you're exactly right. This is an intentional overload of a server and in this case it was x.com. They intentionally overloaded it through this network of bad guy owned and operated network of stolen computing power and the distributed part of this, what makes these so hard to prevent against is that it comes from legitimate computers as far as the server can tell so it's really hard to say. If I just took my computer and sprayed an attack all over x.com they could say fuck that Justin Shelley guy and they blocked me right and then I'm done.

This is coming from all kinds of computers all over the world so very difficult to defend against a DDoS attack. Yeah.

In most situations, the like the IT, you know, people department that that's handling that, they there's nothing that they can do about it. So all they all they can do is shut down. Like, alright. We we can't do anything about so we shut down. And, you know, in a way, they the the bad guys have won because they took down I mean, they took down yeah.

That that's their goal. They're just trying to hurt people. So, we're there there's a good chance we'll see more of that. And and, you know, X.com, we can argue that that's not super important but these attacks start happening on our power grid, they start happening to financial institutions, education institutions, healthcare institutions and now we have real world life and death scenarios. So it is definitely something that we've got to keep our eyes open for, be aware of and now what I want to do is kind of bring this home with now what?

We just laid out all the problems, what can we do about it? What are your thoughts there Amaya? Because just to sit here and be afraid, I shit you not, I get up every morning and my blood pressure goes up. That's not a good strategy in life, so what do we do to mitigate these risks and maybe prepare for the inevitable? How we make life just a little bit more manageable while we go through this?

Well, I mean, it it it's you know, we always say the first step, you know, is is awareness. You know, you have to learn and train your employees, you know, for the right things that they need to do. You know, if you if your employees are properly educated, you're about 90% there. Right? Because the you know you know they're gonna ramp up, you know, the the attacks.

You know they're gonna ramp up these malicious links and malicious websites and stuff like that. You know, they they they have to proceed with caution, be on high alert. That's step one.

Yeah. No, I agree completely. Most of what we talk about on Unhacked is the technology side of this and what we need to do from a technology standpoint to protect against attacks. But what is often overlooked is culture, it's the human aspect of this and like you said, we've got to be aware of it, we've to be training for it and then I don't know if you sell cyber security awareness training or if you try to promote that to your end users it's very hard to get adoption. People have enough to do it so we can't just email a link to people and say here take this training and think we're done.

That is not cyber security awareness training, that is spam. So what we really have to do is create a culture around awareness. Like guys this is what's going on in the world, let's talk about it. Let's talk about what we need to be watching for as a team, as a company and then we reward good behavior and we punish bad behavior and that bad behavior by the way is not participating. Okay I gave you a link and we did talk about and we've offered incentives and you're still not doing it I'm sorry but you've got to go.

You can't work here if you're going to be the reason we get breached. Like we have to get very serious about cyber security in our organizations. This can't be an afterthought.

And that one person can be can you know in a in a big situate or in in a most possible scenario is he can be the reason that takes down the entire network. And guess what? Now everybody's out of work because now worst case scenario, company has to close down. So eve everybody that has that company as their lihood and may have family can be all taken down by that one person that just refuses on on cooperating and listening to what they're told.

Yeah. Absolutely.

You know, I I have a a good example of this. So we we recently changed our cybersecurity awareness company that we we work with, and we switched over to a system that I think is a little more advanced. And we launched it, and we had a couple companies right away call, you know, open up a bunch of tickets and, like, hey. We just got this

We got spam.

Email, you know, that it looks like it's coming from our IT department, and it's asking us to reset our password. Nobody has clicked anything, but should we do this? You know? And guess what? You know?

We told them, like, you know what? That was a test.

Good job.

You guy you you guys, you know, you passed the test. You brought it to us because you didn't just click and say, okay. Those damn guys, they need me to change my password. You you brought it up to your higher higher ups. The higher up reached out to us to say, hey.

All my guys are getting this email. What what do we do? I'm like, did they click on it? No. No.

Nobody clicked on it. I'm like, then award them because they passed the test.

No kidding. Yeah.

Yeah. You know? So that's that's the type of culture that, you know, these business owners need to put into place. It's like, hey. You know?

It's like that saying, see something, say something. You that's exactly what they need to do.

I agree, I agree completely and Mario we're gonna go ahead and wrap this up, you're further illustrating my point, culture is absolutely critical and it sounds like you're doing that, that's not just a stamp of approval on your client for bringing that to you but kudos to you as an MSP for creating that awareness and just letting them know what they should do in those cases. So that says a lot about who you are as an MSP as well so I don't know if I had a trophy, I would give it to you. That said Mario, let's go ahead and we're gonna wrap with key takeaways, like I say if somebody just listened to a few minutes at the very end of the podcast, what is the most important thing you would want them to do to deal with this tariff war that we're you know that's that's just freaking havoc?

I mean, try to get, you know, ahead of the curve as much as possible. You know, don't wait until September, October, and say, hey, Justin. You know, all those emails that you've been sending me, okay. We're we're finally ready because it's going to be hard to really do much, you know, in in a couple of months. You know, take advantage of things that you have in place now, or at least have a plan.

You know, if you have to replace nine computers, then do three a month or something like that. You don't have to do it all at once, but you have to, you know, like Brian says, get better every day, work towards that, you know, end goal, but don't wait. If you don't have some of this play stuff in place now, get another set of eyes. Have somebody come in and say, hey. You know, by the way, you know, all your computers are not going to take Windows 11.

You're going to have to replace every single one of them. Or better yet, all these are capable, and we need to schedule a time to just update them, you know, which Right. We said is free of charge.

Okay, I love it. Yeah, for sure. I mean the plan ahead, That's what I boiled that down to what you just said, plan ahead, have a plan and it ties into what I would say, I've kind of been preaching for a while now ever since we had Joseph Brunsmann on here, the insurance guy. Plan of action and milestones which is a term stolen from the world of regulations, the regulatory frameworks like NIST and stuff like that. But here's what I would say, things are going to get more expensive, this is not going to be good financially in the short term, so we are going to have to make decisions and I don't want to use the term cutting corners, but I'm going to.

Like if you have to cut corners, if you can't do x y z, you can't replace your firewall this year, you can't replace all of your windows 10 workstations, like do that, PS, don't take this as permission to not do it. But I'm telling you if you simply can't, you simply don't have the budget to put all this in place because the costs are up and because your business is down, then do what you can and I'm really gonna push cyber security awareness training for everybody and building a culture around that. That is cheap, it takes effort, but it doesn't take a whole lot of money. And then the next thing I would say is measure, like know your weaknesses, so have these regular assessments internally, assess your vendors, know what they're up to, spend some time, you know, making sure that they're being secure and their, you know, their high cybersecurity hygiene or cybersecurity posture is where it should and then document it. Know where your weaknesses are and build awareness around it, and then, like you said, put a plan in place.

Right? Mhmm. Because that that we can do. As long as we have a plan, we're working towards it. It's better than sitting here with our head in the sand.

So that's kind of my key takeaway. Mario, as always, thank you for being here and kudos to you also for the topic. This was you throwing this out there and I really appreciate that. No problem. Love having you on here And, I I miss our other guests and other cohost, but, that's alright.

We'll have we'll have them back next week. So alright, guys. That's it for this week. Thank you for being here, and we'll see next time.