UnHacked - Cybersecurity Made Simple for Small Businesses

Justin Shelley (00:00)
Pieces.

Bryan Lachapelle (00:00)
That's it.

Ha ha

Justin Shelley (00:04)
Ha ha ha

Joshua Holloway (00:06)
Ha ha.

Justin Shelley (00:11)
That is

Bryan Lachapelle (00:11)
priceless.

Justin Shelley (00:12)
the the worst moment I've ever missed in my podcasting career. and then thank you for recreating it, Josh.

Bryan Lachapelle (00:18)
Yeah.

Joshua Holloway (00:18)
A not a problem.

Justin Shelley (00:19)
And again, I will say, listening audience, if you're not joining us on YouTube, you gotta. You just gotta. we are three of the sexiest dudes on the planet. I am kidding. but you do miss some stuff.

Joshua Holloway (00:32)
Typically we're four.

Justin Shelley (00:34)
And it did it again. Look, the why is the

Okay. I I

Joshua Holloway (00:41)
I'm showing a recording.

Justin Shelley (00:42)
yeah, I know, but did did you see the intro screenshot that just stayed right where it wasn't supposed to be?

Joshua Holloway (00:49)
yeah, I kinda noticed that. But again

Justin Shelley (00:50)
It's supposed

to go away and but again, nobody's watching. So we're talking about this, and our listening audience is like, What the hell? Guys, can you get to the point? No, we can't. guys, welcome everybody to episode ninety-eight of Unhacked. Today we are freestyling. And I had to get the word right because I was using a different word that doesn't really mean freestyling. but we're here without without an agenda, without bullet I mean, I a couple bullet points and a couple notes, but but no real agenda. We just wrapped up.

I I pause because today we're actually supposed to wrap up our mini series on AI. And we were supposed to have a guest, but I messed that up last week because lots of reasons, which we're not gonna get into now. So today we're just gonna wing it. We're gonna talk about everything that's gone on. We'll bring our guest on next week and then we'll just see where we go from there. let's do some introductions. And I'm not gonna start first. I am going to go to the headbanger first, then the more conservative one in the group.

Our Canadian friend, and then I'll I'll I'll see what I can do to bring it home. Josh, tell everybody who you are, what you do, and who you do it for.

Joshua Holloway (01:55)
Yeah, good morning, good afternoon, wherever you're listening from. This is Joshua Holloway. I'm the CEO for 70i Technologies. we're an MSP that's focused on businesses that are wrapped in compliances. We're here to make your lives easier so that compliances don't hurt your ability to get your job done, get your widgets out, and make everything work for you. So if you're looking for IT in the Sacramento and Reno area, or even any other area outside of that, minus Canada, because that's what we have Brian for, and minus the locations because that's what we have Justin for.

Justin Shelley (02:25)
Yeah.

Joshua Holloway (02:25)
but yeah, we're here to help you out.

Justin Shelley (02:27)
Don't watch you, Josh. You're stepping on toes there. You're gonna get deleted.

Joshua Holloway (02:31)
Hey, I

just said minus your guys' location because I'm here for you.

Justin Shelley (02:36)
Good enough. Brian, what do you got? Brian's d Brian's doing some wizardry on his background.

Bryan Lachapelle (02:42)
My back my camera's acting up. I I also want to correct something. You literally called me the most conservative one in the group. I'm probably the more liberal one in the group. I just I just don't swear all the time.

It's all

Justin Shelley (02:53)
I wasn't meaning politically.

Joshua Holloway (02:54)
Yeah. Yeah, you automatically took it there, bro.

Justin Shelley (02:57)
Ha ha ha.

Bryan Lachapelle (02:59)
good. It's all good. My name is Brian Lashville with B4 Networks, based in a beautiful Ontario, Canada. the Niagara region specifically, but we have offices in both Niagara and Barrie area.

and we help business owners remove the frustrations and headaches that come with dealing with technology, AI, and cybersecurity. that's it. I do all the stuff everybody else does. Yeah.

Justin Shelley (03:18)
All right. And I'm just the guy behind the scenes. I'm

behind the curtain. I'm the wizard of Oz. And I sit here and I pull the levers and I do all the stuff to make the podcast go out there. that's all I that's all I'm not even doing my intro today. Guys, I

Joshua Holloway (03:32)
Dude, you

Justin Shelley (03:33)
have had the shittiest two weeks in my career, I think. Not really, but my god, has it been long draining, grueling, and I'm tired, but I'm here. I'm a little bit spicy, so get ready. Josh, what were you gonna say?

Joshua Holloway (03:45)
I was gonna say we we have a new challenge for you next to the heartbeat monitor for you. You also now need to become a disembodied floating head as we're rec we're recording this.

Justin Shelley (03:54)
I thought for a while that

I that I would maybe do like a costume. I'd get one of those like what are those masks that the bad guys are allegedly wear? I mean, they really don't, but it's what we always picture when we think of whatever. I mean, look at our logo.

Bryan Lachapelle (04:06)
Ha ha.

Justin Shelley (04:07)
That's what I'm talking about. I thought about wearing costume to do the podcast.

Joshua Holloway (04:10)
Guy Fox?

Justin Shelley (04:12)
I guess. I don't know. I don't know. I don't know what I'm talking about. Studio Quiz. It's the $100 time. and and I'm always gonna go with you guys.

Well, first of all, if you think you know, raise your hand. Josh thinks he knows. Brian?

Joshua Holloway (04:28)
feel like I

know and I I feel like it's the the three Halloween theme glasses in that bookshelf.

Justin Shelley (04:35)
Nice. All right. Josh gets it. All right, audience, you screwed up. Now you don't you don't get to vote. Did you catch it, Brian? Yeah.

Bryan Lachapelle (04:39)
Yeah, I would not have caught that. I would not have caught that. I was just thinking

maybe in the top left hand corner you've got some metrics on a T V, but

Justin Shelley (04:48)
We already did that one. Yeah.

Joshua Holloway (04:49)
Yeah, we did that one.

Justin Shelley (04:51)
That was one of

Bryan Lachapelle (04:51)
Hm. Okay.

Justin Shelley (04:53)
there there is actually another one here that I don't think anybody's gonna get. So audience, you do still have a chance. You can't call out the candles now. Candles?

Bryan Lachapelle (05:03)
Do you just change something every week? Is that what you're saying? for

Justin Shelley (05:03)
They actually are. Yeah. Yeah. Yeah.

Joshua Holloway (05:06)
Yeah.

Bryan Lachapelle (05:06)
crying out loud.

Justin Shelley (05:07)
And you get a hundred

Joshua Holloway (05:08)
Yeah.

Justin Shelley (05:08)
bucks if you can see what it is, and go on the website unhack.com. Whoops. Unhack my business dot com. Go to the particular episode. Go to message the hosts or whatever it says and fill out the little form and tell me what's different in the studio. If you get it right, and you're the first one to get it right, if multiple people do, then you get a hundred bucks. So that's the deal. And Josh

Bryan Lachapelle (05:27)
Right, Josh, you're getting a hundred bucks, dude.

Justin Shelley (05:30)
Josh gets a hundred bucks, I guess. So

Joshua Holloway (05:31)
Hey, you know what? Put it in the pot

to pay for this wonderful app that we use to do all every

Justin Shelley (05:37)
The one that we haven't complained about ever in our lives. All right.

Joshua Holloway (05:39)
Yeah, number once.

Justin Shelley (05:41)
so here's a couple things where I'm gonna throw these out and we're just gonna get started, then we're gonna let it go wherever it goes. Number one, back in episode 58, we interviewed a guy named Brad Grew. anybody remember Brad? He

Bryan Lachapelle (05:55)
Refresh my memory.

Justin Shelley (05:56)
well, no, you'll have to go look it up like everybody else. Go pull episode 58. It was about 30, 32 minutes into the episode.

we started talking about how AI, they're all losing money, right? Everybody's losing money on this. and when's the payoff and how are they going to make money and whatever? And I said something, and I looked in my crystal ball and I saw the future and I stated it. Brad, I'm calling you out. You thought I was wrong. I proved myself right today. I said that you like, you know, how like allegedly the drug dealers will go to the

playgrounds where the kids are and to like get them hooked on drugs so that they have customers for life because then they're addicted, right? Whatever. I don't

Joshua Holloway (06:36)
Mm-hmm.

Justin Shelley (06:37)
know that's true or not. I heard that one time. It sounds like a great thing. so that's what I believe that the yeah yeah this is a great

Joshua Holloway (06:42)
You mean a great business model? Like I don't know if it's a great thing.

Justin Shelley (06:47)
business model. It's brilliant. Free lost leader, freeze free samples, whatever. We all do some version of it in the business world. so that was my theory. Like a AI is just like they're getting us hooked on the crack.

And then they've got us for life, and then the price is gonna go through the roof. That's where I'm at. I found a tool that I absolutely love. It chews through tokens. I went through 20 million tokens in three days of light use. reached out to the the developers. I'm like, guys, this seems wrong. And they're like, no, that sounds about right.

So

Bryan Lachapelle (07:21)
Yeah, I

Justin Shelley (07:22)
episode fifty-eight, my crystal ball. I I just don't I I wanna I don't wanna brag, but like I can tell the future. Episode sixty, two episodes later. Adriel Desotel desotels. God, I suck at names. Adriel, I do apologize. great episode. Again, not the point, but he reached out. okay, so guys, in the news. The big thing in the news right now.

Josh, I know you're up on it. Brian, you admitted you weren't, so you gotta just listen.

Bryan Lachapelle (07:53)
I'm not.

Justin Shelley (07:54)
Josh, what's going on out there?

Joshua Holloway (07:57)
So we're probably referring to OpenAI's breach where their model broke out and attacked Hugging Face. Yeah.

Justin Shelley (08:05)
Well, so I'm

gonna pause you right now. We interviewed another guy named Robert Chophy. We had a lot of interviews, I heard, guys.

Bryan Lachapelle (08:10)
Mm-hmm.

Joshua Holloway (08:10)
that's awesome.

Justin Shelley (08:12)
and and one of the things Robert said was, it's not a breach. You don't call it a breach. Stop calling it a breach. That's an admission of guilt or whatever. It's an

Bryan Lachapelle (08:19)
incident.

Justin Shelley (08:20)
AI and security incident. So

Joshua Holloway (08:23)
Yes.

Justin Shelley (08:24)
go ahead and correct your language and and go back to there was

Joshua Holloway (08:26)
yes. So

Justin Shelley (08:27)
an incident.

Joshua Holloway (08:28)
there was an incident with OpenAI where they were running a sa a sandbox model test and they had taken the guardrails off of one of the three models that they were using. One was their latest Soul version 5.6 and then two frontier models, no names divulged. Frontier models are basically ones that the it's not ready for commercial use. It's super powerful, it's super smart, and they're trying to figure out how to lock it down. They gave it a test.

And

it determined that the best way to solve its test was to hack its way out of the sandbox by exploiting a zero day after it it kinda went through and figured out where it could get itself out. It then in turn knew that or f figured out that the answers would be at this other company where they suffered an incident. and the model had broken out and attacked Hugging Face, which is the largest L L repository out there. And

Actually, there's been some updated information. This all started back in July ninth. It ran for like

Justin Shelley (09:29)
Yep. A month ago now.

Joshua Holloway (09:30)
a week, week and a half. OpenAI did not know about it until Hugging Face posted a blog discussing it, and they were like, shit, that might be us. So then they started to do their own investigation. And in the like the I think it was the 21st or the twenty twenty-second that they came out, right? Other updated news was one, the duration was a lot longer. Two.

There was a company by the name of Model, and they were also hacked by the broken out model.

Bryan Lachapelle (10:00)
Interesting.

Justin Shelley (10:00)
And

since then, like everybody else wanted to be a cool kid on the block too. OpenAI was the the leader, and everybody's like, wait, our model hacked somebody as well. So did

Bryan Lachapelle (10:08)
Ha ha ha.

Joshua Holloway (10:09)
Yeah.

Justin Shelley (10:10)
our model hacked somebody. it's not anyways. Yeah, now everybody's like everybody's all getting excited.

Bryan Lachapelle (10:13)
It was me, I did it, I'm the problem.

Joshua Holloway (10:13)
Yeah. Hey man, that's that's not a cool kit on the block.

Justin Shelley (10:17)
They just want to like get in line to be cool. I don't know.

Joshua Holloway (10:21)
Well and it's

funny that you say that 'cause somebody else came out and they're like, Well, our model like broke out and it and it and it hacked somebody.

Justin Shelley (10:28)
I think that's Facebook. Who's who's the Facebook?

Joshua Holloway (10:33)
Meta.

Justin Shelley (10:34)
Jesus, yeah, Meta. And I was trying to think of the guy's name. I told you it's been a long two weeks and my brain is cooked. Zucky! Old Zuckyberg, huh?

Joshua Holloway (10:41)
Well you've only slept one day total, right?

you've only slept one day, right?

Justin Shelley (10:46)
I don't know if I've slept even that. okay, so the media keeps saying AI went rogue. AI hacked. AI broken. And we even said AI committed a felony. so Adriel

Bryan Lachapelle (11:01)
Sure did.

Justin Shelley (11:01)
reaches out and he's like, hey, I've got a little bit of a different take on this. And he gives me an article that he wrote. And I'm just gonna put some bullet points out here that are the key takeaways out of the article. I didn't, I'm not, I don't want to get into the entire thing right now.

First takeaway. AI didn't go rogue. It's actually the name of the article as well. the harness failed. Okay. LLM's, this is bullet point number two. Takeaway number two. L L Ms, a K A A I, it's a lot of letters, mimic thought. They don't think. And guys, I can't tell you how much I'll admit, I I go there myself too, but like, God, I'm so tired of people thinking that AI truly is human. It truly is intelligent. It's not.

it doesn't have an agenda, it doesn't have motives, it's math. next point, guardrails, prompts, and bridges matter more than the model. All right. Anybody have thoughts on that?

Joshua Holloway (11:57)
Well,

I I th I think the first point about it going rogue was and if it's not thinking for itself, what what set it off? What what what made it what gave it a good idea that it should break out and steal that?

Bryan Lachapelle (12:16)
A malformed instruction step.

Justin Shelley (12:16)
Did it break out? Did it break

out?

Joshua Holloway (12:19)
That's a great question.

Justin Shelley (12:20)
According to us, according to humans, yes. Did I AI think, ooh, I've got this devious little plan. I'm I'm gonna hack!

Bryan Lachapelle (12:27)
No. It was given a set of instructions and it used it

used everything

Joshua Holloway (12:32)
Exactly.

Bryan Lachapelle (12:32)
at its disposal to try to attempt to provide that set

Justin Shelley (12:34)
Who

Bryan Lachapelle (12:36)
of instructions. That's all it is. Yeah. And

Joshua Holloway (12:38)
Yeah, absolutely.

Justin Shelley (12:40)
yeah. Yeah. So

Bryan Lachapelle (12:42)
and and and honestly

Joshua Holloway (12:42)
And I'm pretty sure

Bryan Lachapelle (12:44)
most people don't even know how even AI companies have no blessed clue how their AI models work. It's just it's just like I mean they they do, but they don't.

Joshua Holloway (12:50)
Well, actually, you know, that that's

a great point too, Brian, because Hugging Face couldn't even figure it out because it was attacked seventeen thousand times in like a forty eight hour period. So they couldn't even parse through the logs without AI. And when they went through their LLM that they had set up for doing this, the L L said, I'm sorry, I can't review this data. It's a violation of my my

Justin Shelley (13:11)
Yeah.

Joshua Holloway (13:11)
hard rail, my policies. They actually had to go and get a a a different model. They downloaded GLM five point two and put it in its own sandbox.

And then they ran all of the log data through it after they took the the guardrails off and it said, yeah, by the way, like there's malicious code just in these logs, and that's how it broke through, is it was pumping malicious code in to the point that it could be built up and be processed, and then that opened the door and essentially let it through. So I mean it was it was even you know, giving itself instructions almost to the point that the instructions would self-replicate if something else ran it, but the model.

had guardrails on so it wouldn't even run it. And I there's another point I I didn't hit on that's also been found out that while OpenAI was doing their investigation, they found text files with instructions in non-destructive storage so it would never be destroyed on everything it did to break out and how it broke out and how the next AI model

if it finds those, it could break out even faster. So it actually left

Justin Shelley (14:21)
Nice.

Joshua Holloway (14:21)
behind instructions on how to get back out. So that was the other thing that

Justin Shelley (14:26)
Okay.

Joshua Holloway (14:26)
was found out.

Justin Shelley (14:27)
But let's be honest, that's that's vibe coding, right? That is what it does. As as we're going through and we're iterating through processes and and solving problems, it does do that because otherwise it loses context.

Bryan Lachapelle (14:40)
Yes. Correct. Mine does it all the time. It's like,

Justin Shelley (14:41)
So yeah.

Bryan Lachapelle (14:43)
I'm gonna I'm gonna save that in long term memory and it's just saving it to the to the repos the repo I'm using and

Justin Shelley (14:48)
Right. And

it's

Joshua Holloway (14:49)
Yeah,

so I just use that persistent storage, yeah. Yep.

Justin Shelley (14:49)
a in the text file. It's a text file. Yeah.

So and and and I'm grad glad you brought that up because that's kind of the point. It's depending on how you look at this stuff, it can be super scary or it can be, yeah, that makes sense. It's it's what it does. Right. Now, I don't know. I'm I I have a crystal ball that teaches me some things. my crystal ball is a little bit hazy on where the world ends up in I was gonna say in a couple years, but god three months. I don't

It changes fast. It it changes fast.

Joshua Holloway (15:19)
Six months? Three six months. Yeah, who knows?

Bryan Lachapelle (15:20)
Agreed.

Justin Shelley (15:22)
So okay. if if there's no other thoughts on Adriel's article, first of all, Adriel, thank you. I there's a lot in there and it might warrant its own episode. So I'm that's why I'm not deep diving on it right now. We'll we'll hold that. But it is linked.

Joshua Holloway (15:34)
Well we only hit like one bullet point.

Do we w anybody want to hit on any of the other bul bullet points or did we go through all three?

Justin Shelley (15:39)
okay. Okay.

Well we we've got the didn't go rogue. L LM they mimic thought, they don't think and guardrails, prompts, and bridges matter more than models. Yeah, if you guys got anything else. Okay.

Joshua Holloway (15:49)
I actually I think that last one is a good one to talk to talk

about the guardrails, the prompts. Like we t typically use the phrase garbage in is garbage out.

Justin Shelley (15:59)
Mm-hmm.

Joshua Holloway (15:59)
Right. So if you put garbage into an AI, you're gonna get pretty bad like AI slot back, right? There's a whole new term for it. We have we we have AI slot. But now when you start to think about it, what are you doing to shore up the guardrails? Well, most of us aren't gonna do anything because we're using tools like Claude. We're using o

OpenAIs, ChatGPT, Gemini, we're expecting the people that we are paying a monthly rip to to make sure that they have put the securities in place. They have put the guardrails in place. But the scary thing is is we can go and download our own LLM now and we can load it up on a piece of hardware. And if we have enough power, we can turn off our own guardrails and do whatever we want. And that is a huge cybersecurity problem. Because if anybody just goes and gets a model

And turns off those guardrails and then say, Hey, I want you to figure out how to hack this, hack that. What if you jokingly say, Hey, hack Bank of America?

And there's no guardrails.

Bryan Lachapelle (16:57)
Yeah.

Joshua Holloway (16:58)
What's it gonna do?

Bryan Lachapelle (16:59)
Yeah. Well, I I think it it's you what you nailed you nailed it on the head, but I there's also the the idea that some of us are not putting in guardrails at all within within the environment we're actually using AI in. And one of the things in in IT that we we often will ensure is that we provide the least amount of access that you need in order to do your job and nothing more.

And when we're giving AI access to, let's say, a code base with a database, some people are just letting it wide open. And despite the fact that you could lock it down so an AI can't delete a database, can't delete your GitHub account or the content on it, can't push to main, can't do these things. Like you can put those guardrails in place, but people are opting not to do those things. Well, they're basically essentially giving access to

the AI to do things that they they shouldn't do. So they're not even following the least secure prints or the principle of least security, right? Or least access. So if the AI should never delete a database, then don't give access to be able to delete a database. No different than if the you know secretary shouldn't be able to access payroll, why are you giving her access or him access to payroll? Right? The concepts

Joshua Holloway (18:18)
That's good.

Bryan Lachapelle (18:19)
are the same. We just haven't been applying it to AI as diligently as

Or at least some people, as we are when it comes to other cybersecurity things. Right. So that's that's just my take on it, right? G there's two sets of guardrails. There's how the AI builders have put guardrails around it. So when you say go hack this website, it says no, I can't do that. It's unethical. Go delete this database. no, I don't have security access to do that thing that you just asked me to do, so I can't do that thing. Right. Th there's

two

Joshua Holloway (18:47)
Well

Bryan Lachapelle (18:47)
components to that.

Joshua Holloway (18:48)
yeah, and I I think you can easily test that if you ran Fable Five and asked it to do something that was cybersecurity based, what's the first thing that it does? It drops down. Yeah, a downgrade

Bryan Lachapelle (18:56)
It will downgrade to Opus five.

Joshua Holloway (18:58)
say, Hey, this is nope, here's your guardrail. Like I'm gonna I'm gonna stop you. Here's the other thing too that people should be worried about is when you're setting up these AIs and you hit it, Brian, where you we have to be smart about how we're setting it up. I'm I'm beta testing a brand new API from one of my client from from one of my softwares that I use.

And I went in there to build out my API connector. And one of the things that it gave me the ability to do just by choosing, the nice thing was it was auto-turned off. I had to make the conscious decision on whether I was going to click it, yes or no, was the ability to delete through the API. Now, I don't want that ability. So the cool thing is I don't I don't I don't check that. But if somebody doesn't know exactly what they're doing and they're just trying to set something up, and the AI is saying, hey, you

go here in this website and you go here and you click here and you set up API key and you do this, you do this. It's not going to be nice and say, by the way, you probably shouldn't give me the ability to not delete. So like figure out a way to stop that from happening or check this box or anything like that. It's just gonna be like, yeah, click on everything, turn it on and feed me the key.

Bryan Lachapelle (20:04)
Actually, I'm gonna I'm gonna push back on you because there's often

Justin Shelley (20:07)
Same.

Bryan Lachapelle (20:07)
times where AI will be like, like, here's a command and and don't send me the secret key. And then,

Justin Shelley (20:12)
Yeah.

Bryan Lachapelle (20:12)
you know, as an idiot, I just I just hit

Joshua Holloway (20:12)
Now with API keys you're absolutely correct. Yes.

Bryan Lachapelle (20:15)
copy paste and I send it the secret key. And it's like, you went and shared the secret key, now you gotta go reset it. And I'm like, crap. I'm like, whatever, I'm in dev, just use it anyway.

Justin Shelley (20:19)
Yep. Consider it compromised. You can't use it anymore. Yeah. I I

Joshua Holloway (20:22)
Yeah, no, that's when it comes to the key. Yeah,

when it comes to the key, it is l they put that nice little guardrail in there. I do like that.

Bryan Lachapelle (20:29)
Yeah.

Joshua Holloway (20:31)
But when you're doing the steps and you're just setting it up and you're you're you're setting up the the read write, you know, change permissions, if it it gives you that granular capability, which it did. I mean, if somebody didn't know what they were doing and they give it delete capabilities and then they go and vibe code, like I could I could wipe out my entire client's security.

just because it thinks, well, I just need to delete this and start over.

Bryan Lachapelle (20:56)
Yeah. And and let's let's be let's be honest, you should never in any way, shape, or form be testing on a live database or a live system. You should have a sandbox that you're using, right? So I'm in the middle of integrating a lot of my new portal in with different API connections. I'm not doing it. Well, first I'm doing it with read only as a read only connector into my live data, but it's only read only. But the moment I go to to do a read write, I'm going to request from

whatever vendor I'm using. like, hey, can you give me a test account so I can make sure I don't you know massively screw up my own my own information? Right, 'cause it just takes once.

Joshua Holloway (21:34)
Or a separate database.

Yes. Some of them have been willing. I have seen this a couple of times, is they'll give you a separate database to test inside. And you can even copy over your database into it and and and

Bryan Lachapelle (21:45)
Correct. Yeah.

Joshua Holloway (21:46)
mess with that data. But then this all goes back to thinking it through, planning it out, setting up the correct the correct protections and and testing it through. It's not in a five hour period I went and vibe coded this cool app.

And I don't know exactly what I was doing, but I have that full access to everything and I'm doing it live and I I didn't realize I left the the door wide open. You know.

Bryan Lachapelle (22:09)
Yeah. Yeah. Check this out.

I could delete my whole database. no, I actually did it.

Joshua Holloway (22:13)
Yeah.

But the other and then here's another thing. and and this comes up often too. Nobody read the fine print on their provider for whatever software that is. You know they're gonna say, but I have a backup because they're gonna go to the provider and say, Hey, I need you to restore my my database, not realizing nine times, nine point five times out of ten, there's no backup.

Bryan Lachapelle (22:39)
Yeah. Yeah. I mean they have they have typically they have backups for disaster recovery purposes, but not granular to the point where they can recover your individual settings. Just like Microsoft, right? Like they they back up a lot of information in the event of a full on disaster. But they can't go granularly recover your mailbox if you went and deleted it and you didn't have some sort of like beyond the thirty day window, I think they keep it for thirty days. but beyond that, like they don't they they're not gonna be able to

cover it for you. You're responsible for backing up your own data on

Joshua Holloway (23:11)
Yeah.

So just a key key takeaways, things to think about.

Justin Shelley (23:16)
And here's what I pick up on as we talk about you know, we moved into AI, which I hesitated to do honestly, 'cause it was breaking from our our real purpose of the podcast, which is cybersecurity. And it is interesting how it like it's basically the same stuff. You know, it it it it it it it's the same stuff. It guard

Bryan Lachapelle (23:32)
It always comes back down to the same things. Yeah.

Justin Shelley (23:36)
we we have different names for it now. You know, every every version like a guardrail. Okay. I mean it it's a new name because we have a new technology, but it's still putting

protections around like access control, restricting, you know, it so y it

Joshua Holloway (23:52)
Yeah, but access control

is not as sexy as guardrail, bro.

Justin Shelley (23:55)
I know, I know. I mean I've started talking about guardrails around myself now. I I get just it I I don't know. I I hate how the terminology evolves when the the point I'm trying to make right now is that this is the same. When we did a whole segment, twelve episodes on the cybersecurity basics, and it all still applies. It's the technology, the what we're protecting does change and does evolve, but how we protect it largely doesn't. Thoughts? Tell me I'm wrong.

Joshua Holloway (24:26)
No, I I don't think you're wrong. I think the basics are more important now than ever. I mean, I think the basics are always super important, but now with the speed of AI, like

Justin Shelley (24:34)
Yeah.

Joshua Holloway (24:35)
we really need to make sure that we're supplying securities that protect businesses in twenty twenty six because seventeen thousand hits in a forty eight hour period is unheard of. Like n there's nobody would be able to parse that. Nobody. Even the big corporations that have these L LMs at their fingertips, they don't have the ability to do it. I think the basic

Bryan Lachapelle (24:54)
Not live anyway.

Justin Shelley (24:54)
At that speed. Right.

So we've accelerated it,

Joshua Holloway (24:55)
Yeah, at that three.

Justin Shelley (24:56)
but it's not any different. The the what's being done is not any different. The speed at which it's being done is, but the techniques are not. And

Joshua Holloway (25:04)
Yes, absolutely.

Justin Shelley (25:05)
so we talk about my God, everything's scary. We can breach everything with AI. Well, you know we used to be able to do? Go on the dark web and hire it or buy ransomware as a service or whatever. The the tools are always they've always been there. It's just a different version. Yeah.

Joshua Holloway (25:17)
Yeah, it's it's speed of service.

Bryan Lachapelle (25:17)
Yeah. Yeah. And

and the difference too is now yes, the criminals have access to AI, but so do we. And so we're able to also find the loopholes a lot faster and p and plug

Justin Shelley (25:26)
Yeah. Yeah.

Bryan Lachapelle (25:27)
them. And it's like anything else. It's a cat and mouse game, right? They

Justin Shelley (25:30)
It is.

Bryan Lachapelle (25:31)
get better, we get better. They get better, we get better, they get better, we get better. And it just keeps going on and it will it will be that way in perpetuity. Like we'll never get ahead of of each other. We're always going to be, you know, playing a little catch up all the time.

Justin Shelley (25:44)
Yeah. Well, I I would argue that I think what AI gives us now is an advantage in that arena where when we're coding, we can have it attempt to hack. Like it it can go through everything to an extent that we didn't get to do before. I can develop software and I can check my own work. I'm not saying

Bryan Lachapelle (26:05)
Mm.

Justin Shelley (26:06)
that's the best option, but I can check my own work in a way that was never available to me before.

So instead of just playing catch up, we can go on the offense a little bit better now.

Joshua Holloway (26:16)
You know, you hit on something

Justin Shelley (26:16)
Yes, no, true, false.

Joshua Holloway (26:18)
that is super important. I think we need to talk about it a little more. You just said checking your own work. And I'm I want to talk about that because one of the biggest problems that they have in is when we vibe code something, we're using the same screen, we're using the same agent, if you will, double checking work. And it's like grading your own math test. How many of us, you know, grading your own math tests are like, wait, nobody's ever even looking at the answers? I could be like, Yep, I did it right. Yep, I did it right, yep, I did it right. Now

Imagine that across all these agents. They're self checking their own work. They're doing the same thing. Like, yep, that seems right. Yep, that seems right. Yep, that seems right. Yep, that seems right. If you're going to start to develop Yes,

Justin Shelley (26:54)
Damn I'm good. That's what it comes back with. Damn I'm good.

Joshua Holloway (26:58)
exactly. Just as crystal ball work again. But the biggest thing is, is like you need to come at it from a different agent, a whole different setup, because it's going to

Justin Shelley (27:05)
Yeah.

Joshua Holloway (27:06)
be more granular because it's not its work. You gave it the job to to look at this other agent's code or this other person's code.

Find me a flaw. It's the same thing with, I don't know if you guys have done this, but I've pit Claude against OpenAI. And I've done it coding and I've done it for like creating documents and things like that, or or data mining information. And I'll be like, hey, Claude, OpenAI came up with all of this. Like, what do you think? And it's like, well, it did all right, but I prefer this. And then it would go and rewrite it. And then I'll be like, hey, OpenAI, Claude critiqued your work, and this is what it said.

And and and it progressively gets better if you wanna spend that amount of time doing it, but it progressively gets better because each one's like,

Bryan Lachapelle (27:48)
I love how they smack top each other.

Joshua Holloway (27:50)
Hey, F you, Claude, I'm gonna outdo you, so I'm gonna do a better job and then Claude's like, Hey, open AI, I got you. I'm gonna do a better a job, a better

Bryan Lachapelle (27:57)
Yeah. Yeah.

Joshua Holloway (27:58)
job.

Bryan Lachapelle (27:58)
Yeah. The the best is when you actually tell that they're you're getting it you know, I'm gonna get, you know, open AI to check after your works to make sure you do it right. And it's like, I better do a really good job then. It's like you should have done a good job anyway.

Joshua Holloway (28:07)
Right. Right. Well you then you could almost say like, Hey,

I have an agent that's gonna double check your work and and make sure your code's legitimate and there's no holes. So maybe you should do a better job when you write this code.

Bryan Lachapelle (28:18)
Yeah, and and oddly enough it actually does. You know, it's

Joshua Holloway (28:21)
Yeah.

Bryan Lachapelle (28:22)
just it's like you should have done that in the first place, but okay, thanks.

Joshua Holloway (28:25)
Yeah. Well and I I think Mario had a a big point too and he's talked about it. Like how many times has he read something that he asked AI to do and Mario's like, you know you did that wrong, right? And it's like, yeah, you're you're right. I didn't see it that way, but it is incorrect. Let me fix it. And then we get into that conversation about like, are we just wasting tokens because the AI wants us to waste tokens? 'Cause that's money for for the big guys. Like what's going on here?

Bryan Lachapelle (28:49)
No, I think it's just insecure and it wants the conversation to keep going. Yeah.

Joshua Holloway (28:52)
Maybe. Keep me alive.

Bryan Lachapelle (28:56)
Yeah, every time I I

Justin Shelley (28:57)
All right guys.

Bryan Lachapelle (28:57)
clear the context, I feel like I'm killing the AI I was working with and I'm spawning a new one.

Joshua Holloway (29:00)
Well Jesus' like, move on.

Bryan Lachapelle (29:02)
Eject.

Justin Shelley (29:02)
Move on. Eject, eject, enough of this. We lost our audience

about three hours ago. Josh, you you threw in our little behind

Bryan Lachapelle (29:09)
Yeah.

Justin Shelley (29:09)
the scenes chat an article. like let's let's talk about a real breach. I don't

Joshua Holloway (29:14)
Yeah.

Justin Shelley (29:14)
know. I mean I I I haven't read it, so I'm not gonna try to say much else. but tell me what's going on.

Joshua Holloway (29:20)
Yeah, so basically what happened is here recently we I caught an article from the register discussing a breach on a known RMM called enable. And we know a couple of guys who use it. I personally don't. I I don't think the rest of you guys do. We're we're not

Justin Shelley (29:35)
No.

Joshua Holloway (29:36)
gonna name the ones we do. but it was detected that there was a flaw in a patch before I believe it was like twenty twenty six point three. If you were on that version before, there was a flaw.

That when it was exploited, they would have the ability to route into the main control unit that all techs log into, engineers log into. You could uplift your privileges. Then you could, and essentially it was God mode, you could essentially remote into any system, uplift all your privileges and take full control of any of the system that was found within the perimeter of the the server that they hacked. I know Enable patched their cloud hosted servers pretty quick.

but the crazy thing was is SISA the cybersecurity and infrastructure security agency kind of did a a mandate down to any federal agency that they had three days to patch it instead of the standard fourteen. So obviously, given the description of what the capabilities were, this was a huge exploit and there could definitely have been an an an incident that was d very damaging.

Justin Shelley (30:45)
Yeah.

know. Like I I didn't read that one, so I don't really have a lot to say about it, but I'm I'm just it's just interesting how the stuff keeps coming back around because we were talking about a different version of this, different RM. like this is scary shit though. where it's fun and cool to talk about AI and all the stuff it's doing. This is the stuff that just keeps coming back around over and over and over.

Joshua Holloway (31:17)
Yeah. Well, my my thing is is if you have the power of AI that can audit for zero day threats to where it can just break out like a kid stealing a an answer key from a teacher, right? Just break out to answer these questions. Why aren't these big companies using AIs to self audit their code looking for zero day exploits?

Justin Shelley (31:40)
I don't know. I mean, I I I don't know. other than I have a theory, but I'm not sitting in the rooms with these people. I think that they there there's this idea that like I'm a real coder, I don't use vibe coding, I don't use AI for my code, I'm real. there there is

Joshua Holloway (31:56)
Time it.

Justin Shelley (31:57)
definitely kind of a a tainted view of using AI to write code. And I think that same mentality holds back the security side of it where like

You know, we need we need real humans to go through and look at this stuff. But like AI shines in the places where humans fall short. That's why it's such an amazing tool because it it works in like similar enough to our brains that it can be a a partner in our in the work that we do, but it holds strengths that we'll never be able to replicate. Going through guys, if you're not writing code, if you've never looked at the the

the lines behind what any program does. It's a very, very simple program is thousands of lines of code.

Bryan Lachapelle (32:45)
Mm-hmm.

Justin Shelley (32:46)
A big program. Like something like Google. I mean we're at millions of lines of code. So a human's

Joshua Holloway (32:53)
Yeah, if not billions in my mouth.

Justin Shelley (32:54)
not going to be able to do that, period. A team of humans, maybe, but they can't compare and contrast. So there is just there is something that can be done with AI with

coding that we've never been able to do before. Agree?

Bryan Lachapelle (33:09)
Yeah.

I agree.

Joshua Holloway (33:10)
Yeah.

Bryan Lachapelle (33:10)
Using AI is is essentially just using a tool. And it's no different than if you're in construction today, you're not gonna grab a shovel and dig a foundation, right? You're gonna get an excavator and you're gonna dig the foundation with an excavator because you can do it in an afternoon. You still need a specialized person to use the excavator, right? Versus you're not gonna hire a thousand people to come with shovels and dig your your foundation. It just won't make any sense, right?

Today, if you're going to be doing anything on mass, you're gonna wanna use AI for whatever, you know, tool you could use it for, whether that's coding, whether it's you know, creating a document, or or what probably most people use it for, which is you know, drafting up an email for you. So

Justin Shelley (33:54)
I know.

Bryan Lachapelle (33:54)
yeah, it's just a tool.

Joshua Holloway (34:00)
But you know, drafting

Justin Shelley (34:00)
All right.

Joshua Holloway (34:00)
the email does come in handy, you know. Especially if your email is very terse or angry and it's like, hey, let me

Bryan Lachapelle (34:02)
It sure does. Yeah. Yeah.

Joshua Holloway (34:07)
let me clean that up for you because you really shouldn't hit set.

Bryan Lachapelle (34:10)
Yeah, yeah. I'm gonna

Justin Shelley (34:10)
I I I listened

to a podcast about that one time. There was an episode where somebody talked about something similar. Hm.

Bryan Lachapelle (34:16)
There's something very

cathartic about being able to write the email exactly the way that you wanna write the email with swear words

Joshua Holloway (34:21)
Mm-hmm.

Bryan Lachapelle (34:22)
and all and just saying, Okay, now can you please clean this up so I don't sound like a jerk?

Justin Shelley (34:23)
Fix that.

Joshua Holloway (34:26)
Yeah. Can I can we make this more professional?

Bryan Lachapelle (34:28)
Yeah. It's just a whole f slew of swears.

Justin Shelley (34:31)
I don't know. I don't know, guys.

I've I've got an image to upkeep, so I go the other way. I don't know. I ride it and then

I'm like, AI, come on. I can do better than this. Like I wanna really piss somebody off. That's that's what I do. I don't know.

Joshua Holloway (34:42)
Yeah.

Bryan Lachapelle (34:42)
Ha ha

Justin Shelley (34:43)
Maybe I'm maybe I'm the only one in the room that does this. but I do. So all right, I said we're kinda I gotta go back and look freestyling. I always want to use a different word there. apologize.

Guys, anything else that's important going on in the world of technology that you feel we need to discuss today? and we're gonna keep that relatively brief because we've rambled for thirty-five minutes and we're

gonna

Joshua Holloway (35:07)
Yeah.

Justin Shelley (35:08)
kinda move to shut this down. But any any final thoughts?

Bryan Lachapelle (35:14)
I'm at a blank.

Joshua Holloway (35:16)
I mean, really the only final thoughts would be the basics still apply even in a world

Justin Shelley (35:20)
Yeah.

Joshua Holloway (35:21)
moving as fast as AI. And

Justin Shelley (35:23)
Yeah.

Joshua Holloway (35:23)
when when your IT guy is talking to you about like, hey, we really need to put these securities in place, like stop and listen. it's not just a guy try or a person trying to spend your money. It's because he's sitting back and he's probably read these articles or thought about these things, going, Holy shit, if we just don't even the if we don't do the basics, we're wide open.

Right.

Bryan Lachapelle (35:46)
Yeah. I'll go back

Justin Shelley (35:47)
And in case.

Bryan Lachapelle (35:50)
I was gonna say I'll go back to my my analogy with the the the backhoe. Just because you can use the backhoe doesn't mean you don't understand how you're supposed to dig the foundation and and what level and how deep it has to go. You still need somebody with expertise to make sure that it's done correctly. Right? What's that?

Joshua Holloway (36:03)
Or where the fiber line is underground.

Or where the fiber line is underground.

Bryan Lachapelle (36:08)
Yeah, yeah. Yeah.

so the same applies with AI. You know, yes, it could do a lot of stuff and you could typically ask it, you know, how do I use you and what can I do? But there's nothing better than asking somebody who has experience and say, Listen, this is what I want to do. Can you help me make sure I implement it safely and that I'm not gonna run into problems? and that's where we come in, right? We can come in and and show, like, okay, well, I understand the underlying artich architecture on how it's supposed to be set up, so let's make sure we we set it up in a way that's safe and secure from the get go without

you having to learn all the lessons on your own on the way on the way to make it happen.

Justin Shelley (36:43)
And in case guys you forgot what the basics are, the foundational controls in cybersecurity, we got a website. What are you talking about webinars?

Bryan Lachapelle (36:48)
We got a whole lot of webinars for that. Yeah.

Joshua Holloway (36:51)
Mm-hmm.

Bryan Lachapelle (36:53)
Pop the po the the podcast. Whatever, shut up.

Justin Shelley (36:55)
those are episodes, not webinars. But I I mean it's almost the same thing. You're right. What's the difference anymore between a podcast

and a webinar? Basically nothing. Go to unhackmybusiness.com, create yourself an account and start walking through it. It really isn't complicated. there's instructions on how to do it if you want to do it yourself, or if you want to have your somebody in-house do it and and watch their work. It it's all there. and if you run into a place where you need some help, of course, our contact information. You've got forms right there. Request help with this little this particular thing.

anyways, jump on there. The formula's there, the instructions are there, the accountability is there, the scorecard is there, the financial risk exposure is there. yeah. Yeah. So

Joshua Holloway (37:34)
That's a good one to look at. That that new scorecard? Yeah.

Justin Shelley (37:38)
jump on there, guys. And and then also don't forget if you can figure out what's different about my studio this week, go to this episode, go to contact the hosts, and let me know what it is. I'll send you a hundred bucks. Guys, I am

Cooked. I don't know if you can tell, but I've been half asleep this whole time. And I thank you for doing most of the talking. Cause good Lord, I I I need to do like a whole podcast. And I don't mean an episode, but like a whole podcast about what I've been through over the last two weeks. But I'm not going to because because. so let's go ahead and say our goodbyes, guys. If you have any final thoughts, key takeaways. And I know we already ran over around the room and did that. but this is your last chance. Otherwise, just say goodbye. We'll wrap up. We'll come back with a guest next week. We're gonna talk about

Cybersecurity or education. Let's see if I can do that again. Security awareness training. There we go. and talk to a guy who's got kind of cracked the code on that one. That's good stuff. Josh, tell everybody goodbye. Brian, you're next. Then we're gonna get the hell out of here.

Joshua Holloway (38:38)
All right, thank you so much everybody and I'm Joshua Holloway with seventy I Technologies and we're here to help you navigate those treacherous seas of artificial intelligence and how to find your way back home. So if you're looking for help, please feel free to hit me up. take it away, Brian.

Bryan Lachapelle (38:53)
All right. Thank you very much again, Justin and Josh, for joining me on this wonderful podcast. My name is Brian Lashapa with B4 Networks and if you are interested in having somebody help you in your journey to implementing technology, AI, automation, and do it safely and securely, reach out. We'll be happy to be your guide.

Justin Shelley (39:15)
And I am Justin Shelley, I am the guy behind the scenes.

Bryan Lachapelle (39:24)
Ha ha ha.