1
00:00:00,000 --> 00:00:02,041
There was a big, big hack a few years ago.
2
00:00:02,041 --> 00:00:05,875
I think it was Equifax, and they had to
like, testify in front of Congress,
3
00:00:06,291 --> 00:00:09,083
and they threw one of their engineers
under the bus and they said, well,
4
00:00:09,083 --> 00:00:12,083
one of our engineers
misconfigured an S3 bucket.
5
00:00:12,166 --> 00:00:17,291
And I found that to be so irresponsible,
because I would argue that
6
00:00:17,291 --> 00:00:19,583
if someone in your organization
made a mistake
7
00:00:19,583 --> 00:00:23,208
that has a material effect on your
business, that's a process problem.
8
00:00:23,208 --> 00:00:26,208
That's not an individual problem.
9
00:00:29,000 --> 00:00:30,750
Hello
10
00:00:30,750 --> 00:00:34,166
and welcome to the AI Master
Group podcast,
11
00:00:34,583 --> 00:00:37,500
featuring the people who are building
the future
12
00:00:37,500 --> 00:00:40,500
of AI in their work today.
13
00:00:40,708 --> 00:00:43,333
I'm your host, Jim Griffin.
14
00:00:43,333 --> 00:00:48,291
Today
I am very happy to have as a guest Dave
15
00:00:48,291 --> 00:00:54,208
Stern, who’s a fractional CTO
and DevOps engineer
16
00:00:54,208 --> 00:00:57,583
with over 25 years of experience
17
00:00:57,583 --> 00:01:00,750
in systems and software engineering.
18
00:01:00,750 --> 00:01:03,833
He's the president and Senior Solutions
19
00:01:03,833 --> 00:01:07,083
Architect of Stern DevOps Group,
20
00:01:07,375 --> 00:01:12,458
which is a consultancy
that's focused on early stage companies
21
00:01:12,833 --> 00:01:17,416
providing technical leadership,
infrastructure and automation.
22
00:01:18,250 --> 00:01:21,291
He's also the author of a new book,
23
00:01:21,791 --> 00:01:26,291
Hackproof Your Startup,
which is described on Amazon
24
00:01:26,541 --> 00:01:30,666
as the ultimate cybersecurity resource
for startups
25
00:01:31,125 --> 00:01:36,375
with practical strategies for early stage
engineering teams.
26
00:01:36,833 --> 00:01:38,625
Welcome, Dave.
27
00:01:38,625 --> 00:01:40,458
Thank you. It is a pleasure to be here.
28
00:01:41,750 --> 00:01:44,916
So you've got a long history there.
29
00:01:44,916 --> 00:01:48,375
We know from your introduction
that it's 25 years of experience.
30
00:01:48,750 --> 00:01:52,041
Can you summarize that
in about 2 or 3 minutes?
31
00:01:53,583 --> 00:01:55,125
I can, I can.
32
00:01:55,125 --> 00:01:57,958
So I started back in the mid
33
00:01:57,958 --> 00:02:01,375
90s, doing software
development way back when.
34
00:02:01,375 --> 00:02:05,750
It was a much simpler time
and much simpler skill set.
35
00:02:06,291 --> 00:02:10,708
Progressed through,
you know, a couple of organizations
36
00:02:10,708 --> 00:02:11,708
doing that
37
00:02:11,708 --> 00:02:15,416
eventually got very interested in
the systems and operations side of things.
38
00:02:15,416 --> 00:02:19,583
So in those days, you know, we had system
administrators and we had developers
39
00:02:19,583 --> 00:02:22,583
before DevOps was really a thing.
40
00:02:23,250 --> 00:02:25,208
Ended up managing a couple of teams.
41
00:02:25,208 --> 00:02:28,250
I worked at one point for a company
42
00:02:28,250 --> 00:02:31,708
that did, that had its own data
center and website development.
43
00:02:31,708 --> 00:02:32,916
So I got a lot of experience
44
00:02:32,916 --> 00:02:36,250
on the network side,
as well as doing things like, you know,
45
00:02:36,625 --> 00:02:41,041
debugging Cisco switches and JavaScript
in the same day.
46
00:02:41,625 --> 00:02:45,666
And then eight years ago,
I started my, my consultancy
47
00:02:45,666 --> 00:02:49,500
doing, started out as outsourced
DevOps engineering.
48
00:02:49,666 --> 00:02:54,625
I had been working at AWS every day
and, enjoyed it very much.
49
00:02:54,625 --> 00:02:58,833
And also we do
I operate as a fractional CTO,
50
00:02:58,833 --> 00:03:00,291
so I provide technical leadership
51
00:03:00,291 --> 00:03:03,416
to early stage companies,
and those things go hand in hand.
52
00:03:03,416 --> 00:03:05,583
A lot of companies are focused early.
53
00:03:05,583 --> 00:03:09,083
You know, startups are focused
on pushing features and doing software
54
00:03:09,083 --> 00:03:13,791
development and infrastructure and process
and things like that aren't always
55
00:03:14,125 --> 00:03:15,208
aren't always at the forefront.
56
00:03:15,208 --> 00:03:17,541
So that's what that's what I do now.
57
00:03:17,541 --> 00:03:20,083
So you've written this new book.
58
00:03:20,083 --> 00:03:21,666
It's just come out.
59
00:03:21,666 --> 00:03:24,541
What motivated you to write that?
60
00:03:24,541 --> 00:03:26,875
So I think that a lot
61
00:03:26,875 --> 00:03:31,250
of early stage companies either
don't know how to
62
00:03:31,250 --> 00:03:34,458
or don't have the resources
to focus on security.
63
00:03:35,000 --> 00:03:37,500
And I also think that there's
this prevailing,
64
00:03:37,500 --> 00:03:41,333
or at least in my experience, what
I've seen, there's this prevailing idea
65
00:03:41,333 --> 00:03:46,250
that it is either difficult or it
it is an afterthought, or it's something
66
00:03:46,250 --> 00:03:49,958
you worry about once you've deployed
all your, you know, software.
67
00:03:50,458 --> 00:03:55,375
And I have worked with many,
many teams as an advisor.
68
00:03:55,625 --> 00:04:01,500
And I saw the same things
over and over again, where again,
69
00:04:01,666 --> 00:04:05,750
out of just simply not knowing or not
70
00:04:06,083 --> 00:04:10,708
having the time to, you know,
the pressures of an early stage startup
71
00:04:11,000 --> 00:04:14,583
don't always allow a technology team
to focus on something like security.
72
00:04:15,083 --> 00:04:18,500
And so I wanted to collect
73
00:04:18,500 --> 00:04:22,250
a lot of the things that I've seen
and produce something that I felt.
74
00:04:22,250 --> 00:04:24,208
And, you know, this is remains to be seen.
75
00:04:24,208 --> 00:04:30,250
But I felt that could be, reasonably easy
to walk through,
76
00:04:30,541 --> 00:04:34,583
get an idea of the bigger picture
and the ways that that early stage
77
00:04:34,583 --> 00:04:38,125
companies could look at security
as an integral part
78
00:04:38,125 --> 00:04:42,000
of what they're doing, as opposed to
an afterthought or an add on.
79
00:04:42,583 --> 00:04:46,625
So yeah, that was the motivation
to empower these teams to understand
80
00:04:47,250 --> 00:04:51,250
that a little bit better, and,
and secure their businesses.
81
00:04:51,250 --> 00:04:53,875
You know, these people
have put their lives of work into it.
82
00:04:53,875 --> 00:04:56,125
The investors are putting
in millions of dollars.
83
00:04:56,125 --> 00:04:58,625
It's a it's a huge asset
and it's a huge risk.
84
00:04:58,625 --> 00:05:00,083
And it doesn't take
85
00:05:00,083 --> 00:05:04,125
that much to get, you know,
it's like the 8020 rule, 80% of the,
86
00:05:05,875 --> 00:05:07,250
of what you need to do
87
00:05:07,250 --> 00:05:10,375
doesn't require a ton of work
to get most of the way there.
88
00:05:11,666 --> 00:05:13,125
Is really well done, by the way.
89
00:05:13,125 --> 00:05:14,750
So it's a really good book.
90
00:05:14,750 --> 00:05:17,375
I really enjoyed it
and it flows really well.
91
00:05:17,375 --> 00:05:19,041
It's very logical, the flow.
92
00:05:19,041 --> 00:05:22,583
And I also like the way you kind of
summarize the end of each chapter.
93
00:05:22,583 --> 00:05:25,791
Like if somebody wanted to cheat,
they could just read the last page of each
94
00:05:25,791 --> 00:05:29,125
chapter and get through the whole thing
in about three minutes.
95
00:05:30,666 --> 00:05:32,958
Well, having been a developer myself, I,
96
00:05:32,958 --> 00:05:36,166
you know, we all Google it,
we go to Stack Overflow.
97
00:05:36,166 --> 00:05:38,833
We we just want to look
at the implementation details,
98
00:05:38,833 --> 00:05:41,166
get it working
and then figure out why later.
99
00:05:41,166 --> 00:05:44,666
So yes, if you need to go straight
to the action items please feel free.
100
00:05:46,791 --> 00:05:49,166
So but there's so much in there.
101
00:05:49,166 --> 00:05:52,750
And one of the things
that I was fascinated by,
102
00:05:52,916 --> 00:05:56,250
as you were really kicking off the book,
you talked about
103
00:05:56,666 --> 00:05:59,666
the Codespaces hack,
104
00:05:59,750 --> 00:06:05,041
and it's been a while since then,
but I remember that was a big deal.
105
00:06:05,041 --> 00:06:08,041
Can you refresh my memory
a little bit about what happened there?
106
00:06:08,333 --> 00:06:09,166
Sure, sure.
107
00:06:09,166 --> 00:06:12,208
So I think this is probably,
at least in my experience,
108
00:06:12,208 --> 00:06:17,666
one of the more extreme and, well known
stories of the dangers of getting hacked.
109
00:06:18,083 --> 00:06:22,750
So Codespaces was a company
that I believe they provided some type of . . .
110
00:06:22,750 --> 00:06:25,875
But again, I don't know the exact details
of what they did, but I know
111
00:06:25,875 --> 00:06:30,083
they provided some type of online
repository for people to store their code.
112
00:06:30,083 --> 00:06:32,375
I think similar to like a GitHub.
113
00:06:32,375 --> 00:06:36,166
But the key point in
that is they're a SAS business.
114
00:06:36,166 --> 00:06:38,666
Their business was their AWS account.
115
00:06:38,666 --> 00:06:41,208
They had databases,
they had S3 buckets, they had,
116
00:06:42,291 --> 00:06:44,458
EC2 instances running their code.
117
00:06:44,458 --> 00:06:47,625
And these days we do a lot more
with containers, but still very valid.
118
00:06:48,250 --> 00:06:51,000
And there was a compromise
of their account,
119
00:06:51,000 --> 00:06:54,083
I believe that someone gained credentials.
120
00:06:54,083 --> 00:06:56,666
And this is still,
unfortunately, too common.
121
00:06:56,666 --> 00:06:59,875
Someone gained access to a developer's
credentials that had,
122
00:07:00,125 --> 00:07:04,791
administrative permissions,
and they got into the AWS console.
123
00:07:05,333 --> 00:07:07,875
And when they did,
124
00:07:07,875 --> 00:07:11,458
they, locked out
125
00:07:11,458 --> 00:07:17,000
everyone else, all the other
login accounts, and then they, except,
126
00:07:17,000 --> 00:07:20,958
I believe they left some capability
for them to read an S3 bucket,
127
00:07:20,958 --> 00:07:24,375
and they put a ransom note
in the S3 bucket and said, give us
128
00:07:24,958 --> 00:07:28,041
X amount of Bitcoin,
or we're to start deleting your resources.
129
00:07:28,625 --> 00:07:31,125
And so the company scrambled.
130
00:07:31,125 --> 00:07:34,291
They tried to get back
in, they couldn't do it.
131
00:07:34,791 --> 00:07:39,416
And the attackers
started deleting databases and S3 buckets
132
00:07:39,416 --> 00:07:43,208
and irreplaceable data to the point
where within
133
00:07:43,208 --> 00:07:46,916
I believe, 48 or 72 hours,
it was all gone.
134
00:07:46,916 --> 00:07:50,375
They had no backups, they had no recourse,
and they had to shut the company down.
135
00:07:50,458 --> 00:07:53,416
And it's a sad story. Unfortunately.
136
00:07:54,458 --> 00:07:55,500
Oh my goodness.
137
00:07:55,500 --> 00:08:00,000
Those are the kinds of moments when you
just say, if only, why didn't I focus?
138
00:08:00,000 --> 00:08:03,000
You know, that's so obvious.
139
00:08:03,083 --> 00:08:04,291
How could that happen to me?
140
00:08:04,291 --> 00:08:06,000
I'm a smart person.
141
00:08:06,000 --> 00:08:07,083
Yes, yes.
142
00:08:07,083 --> 00:08:10,916
And it's the kind of thing
where you don't think about it, you know?
143
00:08:10,916 --> 00:08:14,125
You just don't think of that
as a potential, a catastrophic
144
00:08:14,125 --> 00:08:15,166
risk to a company.
145
00:08:15,166 --> 00:08:17,833
And one of the reasons
going back to your question
146
00:08:17,833 --> 00:08:20,541
before that, I wrote the book, is
there are still a lot of companies
147
00:08:20,541 --> 00:08:24,750
out there that are, vulnerable
to this sort of attack.
148
00:08:24,750 --> 00:08:27,750
And the solution
is relatively straightforward.
149
00:08:27,916 --> 00:08:29,416
Yeah.
150
00:08:29,416 --> 00:08:32,791
So, you know, picking up on that,
one of the things that I noticed
151
00:08:33,250 --> 00:08:36,000
in the book is that you position
152
00:08:36,000 --> 00:08:39,833
cybersecurity as an asset,
which I found interesting,
153
00:08:40,500 --> 00:08:44,666
and as an asset
that could be sort of incorporated
154
00:08:45,000 --> 00:08:49,166
as part of the early stage infrastructure
rather than as an afterthought.
155
00:08:50,000 --> 00:08:51,541
And you touched on that already.
156
00:08:51,541 --> 00:08:53,333
I wonder if you could expand on that
a little bit.
157
00:08:53,333 --> 00:08:56,333
The idea of cybersecurity as an asset.
158
00:08:56,583 --> 00:08:58,250
Yeah. Yeah.
159
00:08:58,250 --> 00:09:01,916
So cybersecurity
is in the news everywhere these days.
160
00:09:01,916 --> 00:09:04,250
You hear about hacks on a regular basis.
161
00:09:04,250 --> 00:09:08,458
And, one of the things that I say,
162
00:09:08,458 --> 00:09:12,791
paraphrasing myself, is your competition
is probably already doing this.
163
00:09:12,791 --> 00:09:16,958
So if they're not and you can sell
164
00:09:17,458 --> 00:09:22,583
your commitment
to the security of your users’ data
165
00:09:23,041 --> 00:09:27,041
or their, their data
or what they're doing in your product,
166
00:09:27,500 --> 00:09:31,875
then you're either going to be ahead of
your competitors who don't focus on that,
167
00:09:31,875 --> 00:09:34,291
or you're at least going to be competitive
in a marketplace
168
00:09:34,291 --> 00:09:37,041
where other people are using
that as a selling point.
169
00:09:38,000 --> 00:09:41,000
So I think these days you sort of can't
170
00:09:41,666 --> 00:09:44,666
you can't overlook that, particularly
if you're in an industry
171
00:09:44,666 --> 00:09:48,750
that's either regulated or that does deal
with personally identifiable information
172
00:09:48,750 --> 00:09:51,750
or personal health information,
like you really can't,
173
00:09:53,458 --> 00:09:56,166
slack on this type
of, of this type of thing.
174
00:09:56,166 --> 00:09:59,875
So it can be a
and I make some other points, about
175
00:10:00,333 --> 00:10:02,916
you know, like, for example,
selling it to investors
176
00:10:02,916 --> 00:10:06,083
like this is a first class
citizen of our development.
177
00:10:06,083 --> 00:10:07,416
We do think about security.
178
00:10:07,416 --> 00:10:09,458
So your investment is secure.
179
00:10:09,458 --> 00:10:12,041
If you're ever going to go
for compliance,
180
00:10:12,041 --> 00:10:13,916
you're going to have to do this
stuff anyways.
181
00:10:13,916 --> 00:10:17,000
And if you just follow best practices,
you're most of the way there to begin
182
00:10:17,000 --> 00:10:17,916
with.
183
00:10:17,916 --> 00:10:21,666
Things like that
I think are very, strong selling points.
184
00:10:22,916 --> 00:10:23,666
That sounds good.
185
00:10:23,666 --> 00:10:25,125
That makes a lot of sense.
186
00:10:25,125 --> 00:10:28,500
You also talk about what you refer
to as a data
187
00:10:28,500 --> 00:10:32,666
insurance
policy against ransomware attacks.
188
00:10:33,291 --> 00:10:35,458
So what do you mean by that exactly?
189
00:10:35,458 --> 00:10:36,958
And how does that work?
190
00:10:36,958 --> 00:10:40,500
Yeah, I love talking about this
because this is like the meat.
191
00:10:41,125 --> 00:10:45,458
I hope people who watch
or listen to this podcast buy my book.
192
00:10:45,458 --> 00:10:49,583
But if you don't, this is one of the main
things I want you to get out of this.
193
00:10:49,583 --> 00:10:53,333
So what a company
like Codespaces could have done
194
00:10:53,333 --> 00:10:57,916
and what existing companies can do
is, you know, you don't.
195
00:10:58,250 --> 00:11:00,958
You can do everything possible
to secure your account.
196
00:11:00,958 --> 00:11:04,250
But if you assume that there is some
197
00:11:04,916 --> 00:11:06,291
minuscule chance
198
00:11:06,291 --> 00:11:09,625
and maybe more than minuscule,
that someone can get in to your account,
199
00:11:09,625 --> 00:11:11,500
then you have to assume
they can do the same thing.
200
00:11:11,500 --> 00:11:16,416
They can encrypt all your data and,
blackmail you for the encryption key.
201
00:11:16,875 --> 00:11:18,833
They can just delete all your data.
202
00:11:19,791 --> 00:11:20,333
Just to be
203
00:11:20,333 --> 00:11:24,208
malicious or again,
as a as a blackmail, method.
204
00:11:24,708 --> 00:11:28,375
So what we always set up for our clients
and what we recommend is
205
00:11:28,375 --> 00:11:32,541
you and I'm going to speak in terms
of an AWS or cloud account right now.
206
00:11:33,041 --> 00:11:35,291
But this could apply to on prem.
207
00:11:35,291 --> 00:11:37,000
It could apply to bare metal.
208
00:11:37,000 --> 00:11:41,666
You need an isolated separate environment
that has separate credentials.
209
00:11:41,666 --> 00:11:44,916
So it's getting into the technical weeds
here for a moment.
210
00:11:44,958 --> 00:11:49,666
I don't want to get too technical,
but typically you either have a company
211
00:11:49,666 --> 00:11:52,166
with one AWS account
in all their environments,
212
00:11:52,166 --> 00:11:54,166
their development,
their staging, their UAT,
213
00:11:54,166 --> 00:11:56,583
their production,
whatever are in that one account
214
00:11:56,583 --> 00:12:00,291
or and what we see more of in what
we build as a best practice
215
00:12:00,291 --> 00:12:03,625
is a multi-account environment
where each environment is its own account.
216
00:12:04,291 --> 00:12:07,625
But in order to access all of those,
just for the ease of modern use,
217
00:12:07,625 --> 00:12:09,875
you'll typically have one log in an SSL
218
00:12:09,875 --> 00:12:13,583
solution,
a single sign on, either like Okta or AWS.
219
00:12:13,875 --> 00:12:16,708
And then from that login
you can switch accounts.
220
00:12:16,708 --> 00:12:17,833
You know, you can switch roles.
221
00:12:19,166 --> 00:12:19,833
You want to
222
00:12:19,833 --> 00:12:23,416
set up something outside of that system
223
00:12:23,666 --> 00:12:29,083
because of a single,
login credential is compromised or leaked.
224
00:12:29,583 --> 00:12:31,958
Then an attacker has access
to all those environments.
225
00:12:31,958 --> 00:12:35,916
So you want something separate
and then what you want to do, I say you
226
00:12:35,958 --> 00:12:41,750
what what one wants to do is all of the
critical data that can't be replaced.
227
00:12:41,750 --> 00:12:45,750
You want to do a one way backup
to the separate environment.
228
00:12:45,750 --> 00:12:50,000
So if you set up a separate backup
account, you set up separate credentials,
229
00:12:50,541 --> 00:12:53,333
and then you set up, you set up
230
00:12:53,333 --> 00:12:56,333
backups
that can all the, all the, the permissions
231
00:12:56,333 --> 00:12:59,541
you give that backup system, they can just
write to the new environment.
232
00:12:59,541 --> 00:13:02,416
They can't read from it.
They can't get data from it.
233
00:13:02,416 --> 00:13:05,958
That other environment has no access
into your existing environments.
234
00:13:11,125 --> 00:13:12,250
You're listening to the
235
00:13:12,250 --> 00:13:15,250
AI Master Group podcast
236
00:13:24,708 --> 00:13:26,333
You set up backups
237
00:13:26,333 --> 00:13:29,458
that can only . . . all the permissions
you give that backup system.
238
00:13:29,458 --> 00:13:31,458
They can just write
to the new environment.
239
00:13:31,458 --> 00:13:34,333
They can't read from it.
They can't get data from it.
240
00:13:34,333 --> 00:13:37,875
That other environment has no access
into your existing environments.
241
00:13:38,500 --> 00:13:41,750
And so the idea is you have this
backup account that's regularly
242
00:13:41,750 --> 00:13:45,958
getting snapshots of your database
where you're replicating your S3 buckets.
243
00:13:46,958 --> 00:13:51,000
And so if your account were compromised
or unavailable for whatever reason,
244
00:13:51,000 --> 00:13:54,250
let's say there was a malicious attack
and they deleted everything.
245
00:13:54,750 --> 00:13:56,125
You have your data.
246
00:13:56,125 --> 00:14:00,291
As long as you're using infrastructure
as code like Terraform or CloudFormation.
247
00:14:00,291 --> 00:14:02,250
Most people use Terraform these days.
248
00:14:02,250 --> 00:14:04,708
Then you can rebuild
all the infrastructure.
249
00:14:04,708 --> 00:14:06,875
And as a side note,
I talk a lot about infrastructure
250
00:14:06,875 --> 00:14:10,375
as code because being able to recreate
your environments
251
00:14:10,375 --> 00:14:14,083
is not only good development
practice, it's also good insurance.
252
00:14:14,541 --> 00:14:15,833
You recreate the environment.
253
00:14:15,833 --> 00:14:18,833
You can take the backup of that data,
which the attackers
254
00:14:18,916 --> 00:14:21,791
can't access
and probably don't even know exists.
255
00:14:21,791 --> 00:14:25,958
And you can be up and running again
as quickly as a couple hours
256
00:14:25,958 --> 00:14:29,666
if you haven't set up that way
and you know, at most 24, 48 hours,
257
00:14:30,000 --> 00:14:34,166
you're not it's not an existential
risk to your business anymore.
258
00:14:35,166 --> 00:14:36,291
Existential risk.
259
00:14:36,291 --> 00:14:38,458
That's really
what it would be otherwise.
260
00:14:38,458 --> 00:14:39,625
I see why you're saying that.
261
00:14:39,625 --> 00:14:43,583
That is like the one takeaway
from this podcast.
262
00:14:43,583 --> 00:14:47,916
Like if nobody remembers anything else
because that one do that.
263
00:14:47,916 --> 00:14:50,125
Right. Yeah. Right.
264
00:14:50,125 --> 00:14:50,583
Yeah.
265
00:14:50,583 --> 00:14:55,375
Talking now specifically about AI,
266
00:14:56,416 --> 00:14:59,166
there's lots of startups
that are feeling pressure
267
00:14:59,166 --> 00:15:02,291
to get out in front of the curve and,
and it's good.
268
00:15:02,291 --> 00:15:05,458
And to quickly innovate
with new technologies
269
00:15:05,458 --> 00:15:08,458
and especially with Generative AI.
270
00:15:08,708 --> 00:15:13,166
From your perspective,
is there any kind of methodology
271
00:15:13,166 --> 00:15:18,500
or framework that you recommend
so that the technology leadership
272
00:15:18,500 --> 00:15:22,250
can enable this while at the same time
protecting data?
273
00:15:23,666 --> 00:15:24,500
Yeah.
274
00:15:24,500 --> 00:15:28,416
And this is, you know, a lot of
this is still very nascent, you know,
275
00:15:28,458 --> 00:15:30,708
using Generative AI in businesses.
276
00:15:30,708 --> 00:15:36,750
But the old time tested,
methodologies still work.
277
00:15:36,750 --> 00:15:41,250
You know, in any business we have, you
278
00:15:41,333 --> 00:15:45,250
if your data isn't critical,
if it's not,
279
00:15:45,250 --> 00:15:48,625
if you don't have to worry about like GDPR
or regulations,
280
00:15:48,625 --> 00:15:51,416
where you have to protect user data,
if you're just sending,
281
00:15:51,416 --> 00:15:54,583
you know, statistics you've generated,
if you have a weather app
282
00:15:54,583 --> 00:15:58,583
and you're just sending weather statistics
to have the Generative AI do summaries
283
00:15:58,583 --> 00:16:01,041
for you or build models or whatever it is,
284
00:16:01,041 --> 00:16:02,541
you don't have to worry
that much about that.
285
00:16:02,541 --> 00:16:04,500
If it gets stolen. It's not proprietary.
286
00:16:04,500 --> 00:16:06,125
Nobody's going to sue you.
287
00:16:06,125 --> 00:16:07,583
But most of us don't have that. Right?
288
00:16:07,583 --> 00:16:10,541
We want to build recommendation engines
with customer data.
289
00:16:10,541 --> 00:16:13,541
We want to do something
a little bit more advanced.
290
00:16:13,916 --> 00:16:17,333
And so, as with anything,
if you have data that's
291
00:16:17,708 --> 00:16:21,833
sensitive or critical,
you either need to, well,
292
00:16:22,916 --> 00:16:24,125
traditionally you have to
293
00:16:24,125 --> 00:16:27,208
mask it and you have to make sure
that it is sent securely.
294
00:16:27,416 --> 00:16:30,416
So you're using encrypted
channels like https.
295
00:16:30,416 --> 00:16:35,666
You're storing it somewhere
with encryption at rest, you are masking
296
00:16:35,666 --> 00:16:38,666
any personal identifiable things
like email address or phone number.
297
00:16:39,083 --> 00:16:44,541
But also now we have the added risk
or the added factor that, you know,
298
00:16:44,541 --> 00:16:48,833
a lot of these Generative AI systems
are using our data to train their models.
299
00:16:49,375 --> 00:16:52,041
So you have to make the assumption
that if you're going to build,
300
00:16:52,041 --> 00:16:55,041
for example, a recommendation system,
and we've done this for clients
301
00:16:55,458 --> 00:17:00,083
and send the data to ChatGPT,
you can't just send raw user data.
302
00:17:00,083 --> 00:17:02,000
You have to somehow protect that.
303
00:17:02,000 --> 00:17:05,958
So masking there's so there's a couple
things I would say in a practical sense.
304
00:17:05,958 --> 00:17:07,750
(1) masking the data.
305
00:17:07,750 --> 00:17:11,166
So turning you know, just using
for example the user ID in your database
306
00:17:11,708 --> 00:17:14,958
and the descriptive information
where you can't identify
307
00:17:15,000 --> 00:17:17,958
who that user is or anything about them.
308
00:17:17,958 --> 00:17:21,625
And you're not giving away
anything proprietary to your company,
309
00:17:21,625 --> 00:17:25,375
like the secret sauce of your whatever
it is that your SAS business does.
310
00:17:26,750 --> 00:17:27,625
And sending that
311
00:17:27,625 --> 00:17:31,708
over, having the Generative AI
work on or the or the large language
312
00:17:31,708 --> 00:17:34,541
model work on that data
that's already been masked
313
00:17:34,541 --> 00:17:37,333
and then, you know, operating on that
314
00:17:37,333 --> 00:17:41,333
by matching your embeddings or whatever
is one thing I would recommend.
315
00:17:41,333 --> 00:17:44,541
And then the second thing
is, where possible, stay within the walled
316
00:17:44,541 --> 00:17:47,583
garden
of the of the provider that you're using.
317
00:17:47,583 --> 00:17:51,583
So you know,
as we speak things like AWS Bedrock
318
00:17:51,583 --> 00:17:54,583
or SageMaker or things like that,
they're internal tools.
319
00:17:54,708 --> 00:17:58,083
Bedrock in particular, promises
not to use your data to train a model.
320
00:17:58,083 --> 00:18:04,250
So if you can, staying proprietary
where none of the data leaves your VPC
321
00:18:04,291 --> 00:18:07,541
or your private network
or your account, is another way
322
00:18:07,541 --> 00:18:10,958
to make sure that you're
not, risking anything.
323
00:18:13,250 --> 00:18:14,208
So now we've been
324
00:18:14,208 --> 00:18:17,750
focusing on enterprise and enterprise
risk.
325
00:18:18,083 --> 00:18:23,250
But there's this interesting intersection
between people and enterprise,
326
00:18:23,250 --> 00:18:27,500
especially when we talk about startups
because startups actually end up
327
00:18:27,500 --> 00:18:30,583
coming down to being people
are not that many people.
328
00:18:31,333 --> 00:18:34,375
Sometimes one person.
Sometimes two, etc..
329
00:18:34,791 --> 00:18:38,375
And so maybe to close this out,
330
00:18:39,208 --> 00:18:42,416
talking about the way people think
331
00:18:42,416 --> 00:18:46,375
and the risks that people incur,
tell me what you think.
332
00:18:46,833 --> 00:18:49,666
If I had a laptop
333
00:18:49,666 --> 00:18:52,666
or a cell phone that got stolen somehow,
334
00:18:53,500 --> 00:18:56,291
what would I suddenly wish I had done
335
00:18:56,291 --> 00:18:59,291
before that had happened to me?
336
00:18:59,583 --> 00:19:02,458
Another good question,
and it speaks to broader
337
00:19:02,458 --> 00:19:04,250
topics that I talk about in my book.
338
00:19:04,250 --> 00:19:08,041
So if you don't mind if I digress
on a bigger picture for a moment
339
00:19:08,041 --> 00:19:12,041
to come back to this, we are all human.
340
00:19:12,041 --> 00:19:15,166
We all make mistakes. That's just a fact.
341
00:19:15,166 --> 00:19:19,375
Like you can't operate in any environment,
342
00:19:19,375 --> 00:19:23,416
and you know you can't train people enough
to not make mistakes.
343
00:19:23,416 --> 00:19:25,458
You know, I'm a senior engineer.
344
00:19:25,458 --> 00:19:27,125
I still make mistakes
after this many years.
345
00:19:27,125 --> 00:19:28,083
You can find
346
00:19:28,083 --> 00:19:31,625
the most qualified people out there,
who've been doing this for many years.
347
00:19:31,625 --> 00:19:34,375
And we make typos.
We do things without thinking.
348
00:19:34,375 --> 00:19:35,541
It happens.
349
00:19:35,541 --> 00:19:39,916
So and, you know, there was a
I think it was Equifax.
350
00:19:39,916 --> 00:19:42,000
There was a big, big hack a few years ago.
351
00:19:42,000 --> 00:19:43,041
I think it was Equifax.
352
00:19:43,041 --> 00:19:46,041
And they had to like, testify
in front of Congress.
353
00:19:46,250 --> 00:19:46,833
And they threw
354
00:19:46,833 --> 00:19:50,083
one of their engineers under the bus
and they said, well, one of our engineers
355
00:19:50,416 --> 00:19:53,875
misconfigured an S3 bucket, or I think
that's what it was, something like that.
356
00:19:54,333 --> 00:19:59,125
And I found that to be so irresponsible
because and I say this in my book,
357
00:19:59,125 --> 00:20:03,083
I would argue that if someone
in your organization made a mistake
358
00:20:03,083 --> 00:20:06,666
that has a material effect on your
business, that's a process problem.
359
00:20:06,666 --> 00:20:08,541
That's not an individual problem.
360
00:20:08,541 --> 00:20:11,666
That means that you didn't set up
the guardrails correctly in your business.
361
00:20:11,666 --> 00:20:15,375
You didn't follow things like principle
of least privilege,
362
00:20:15,375 --> 00:20:18,083
or you didn't
isolate your environments enough
363
00:20:18,083 --> 00:20:20,833
so that they just couldn't
make that mistake.
364
00:20:20,833 --> 00:20:25,416
Occasionally things will happen, but,
you know, we all . . . There's and
365
00:20:25,666 --> 00:20:29,125
and even if your people are perfect,
366
00:20:29,250 --> 00:20:31,291
they can still have their credentials
compromised.
367
00:20:31,291 --> 00:20:36,208
So you still want to have things like
isolation where if their keys are stolen,
368
00:20:36,458 --> 00:20:40,041
the attacker can only do so much,
you know, or and if they're like temporary
369
00:20:40,041 --> 00:20:43,125
keys, they can only do so much for so long
and then they expire.
370
00:20:43,583 --> 00:20:46,500
So circling back to your question, I could
371
00:20:46,500 --> 00:20:49,583
be doing everything right
with security and have my laptop stolen
372
00:20:49,583 --> 00:20:52,416
when I'm in a coffee shop
and all of that goes out the window.
373
00:20:52,416 --> 00:20:55,916
So what I would recommend people do
when I talk about this in the book
374
00:20:55,916 --> 00:21:00,625
as well, is, first of all, make sure
all your drives on your all your computers
375
00:21:00,791 --> 00:21:05,166
and your internal and external drives
are encrypted with a password.
376
00:21:05,541 --> 00:21:09,625
What people don't realize is,
even if my laptop is turned off
377
00:21:09,916 --> 00:21:13,125
and I don't have an encrypted drive,
they can just pull the drive out,
378
00:21:13,125 --> 00:21:16,125
plug it back into another computer,
and they get all the data.
379
00:21:16,416 --> 00:21:21,083
So you want to make sure
that your physical hardware is secured.
380
00:21:21,500 --> 00:21:26,666
Similarly, you want to have your screens
lock after a short period of time.
381
00:21:27,208 --> 00:21:28,208
Sometimes when I'm at home,
382
00:21:28,208 --> 00:21:32,125
I set them for a longer period,
but if I travel or take my computer out,
383
00:21:32,125 --> 00:21:35,500
I have my screen saver and the lock
go on after 5 or 10 minutes.
384
00:21:36,000 --> 00:21:39,958
So that way again, if my computer's
stolen, they've got about five minutes,
385
00:21:39,958 --> 00:21:43,375
they don't have any passwords
and then they can't do anything else.
386
00:21:43,833 --> 00:21:46,250
So that's another thing.
387
00:21:46,250 --> 00:21:49,875
And then use MFA with all your accounts
multi-factor auth.
388
00:21:49,875 --> 00:21:53,166
You know,
we all talk about that because, you know,
389
00:21:53,541 --> 00:21:56,250
if even if they can get into your systems,
390
00:21:56,250 --> 00:21:58,500
they won't be able to log in
with just having the passwords.
391
00:21:58,500 --> 00:22:02,041
They would need your phone to get your
authenticator codes or whatever it is.
392
00:22:02,416 --> 00:22:06,708
And then for an extreme level
paranoia and I do this, I will admit
393
00:22:06,708 --> 00:22:10,833
I don't use face ID,
I don't use the fingerprint unlock.
394
00:22:10,833 --> 00:22:15,625
I actually type a code
in every time I unlock my phone.
395
00:22:15,625 --> 00:22:20,250
Now, that's admittedly
another level of extreme security,
396
00:22:20,250 --> 00:22:22,708
but the way I look at it,
and this may apply to
397
00:22:22,708 --> 00:22:25,583
some of your listeners
or your audience, is
398
00:22:25,583 --> 00:22:28,166
if I have I work with a lot of companies.
399
00:22:28,166 --> 00:22:29,083
I have sensitive data.
400
00:22:29,083 --> 00:22:33,458
I have the, access to sensitive data
for other companies.
401
00:22:33,458 --> 00:22:35,250
It's my responsibility
402
00:22:35,250 --> 00:22:38,250
to practice what I preach
and do the things I say in my book.
403
00:22:38,333 --> 00:22:41,958
And this is going to sound extreme,
but this the example I always uses, is
404
00:22:42,250 --> 00:22:46,875
if I'm unconscious, they can still use
my face ID or my fingerprint
405
00:22:46,875 --> 00:22:51,250
to get into my phone or my accounts,
but if it's a passcode only, I know
406
00:22:51,500 --> 00:22:54,625
and I'm unconscious,
they still can't get in.
407
00:22:55,125 --> 00:22:57,541
So now there's all there's
things like coercion.
408
00:22:57,541 --> 00:23:03,541
And we could go to an extreme on this,
but I like to be extra, extra,
409
00:23:04,666 --> 00:23:07,666
careful in these situations.
410
00:23:07,791 --> 00:23:09,000
Interesting, interesting.
411
00:23:09,000 --> 00:23:10,916
We could go down that rabbit hole
all the way
412
00:23:10,916 --> 00:23:13,208
down to the middle of the earth.
413
00:23:13,208 --> 00:23:15,333
So. Very good.
414
00:23:15,333 --> 00:23:18,125
Well, this has been great, Dave.
415
00:23:18,125 --> 00:23:21,166
I learned so much,
and I'm sure that the listeners did, too.
416
00:23:21,208 --> 00:23:24,875
Can you tell me where to find your book
and how people can get in touch with you?
417
00:23:25,583 --> 00:23:27,958
Yeah. So the book is on Amazon.
418
00:23:27,958 --> 00:23:29,458
It's an Amazon Kindle book.
419
00:23:29,458 --> 00:23:33,208
So for digital download.
You can just search “Hackproof Your Startup”
420
00:23:33,208 --> 00:23:35,125
“hackproof” is one word. I learned
421
00:23:35,125 --> 00:23:38,125
it doesn't come up
very well if you if you do two words.
422
00:23:38,208 --> 00:23:42,875
My website is www.sternDevOpsgroup .com.
423
00:23:42,875 --> 00:23:45,875
And, yeah,
those are the best ways to reach me.
424
00:23:46,500 --> 00:23:49,250
Okay. Well, this was great.
425
00:23:49,250 --> 00:23:51,750
Dave, thank you very much
for spending the time with me.
426
00:23:51,750 --> 00:23:53,458
And more power to you.
427
00:23:53,458 --> 00:23:56,666
Just keep all those passwords safe
and keep us all a lot of trouble.
428
00:23:57,250 --> 00:23:58,041
Thank you.
429
00:23:58,041 --> 00:24:01,833
You've been listening
to the AI Master Group podcast.
430
00:24:02,083 --> 00:24:04,333
I'm your host, Jim Griffin.
431
00:24:04,333 --> 00:24:08,166
Until next time,
stay curious and stay in front.
00:00:00,000 --> 00:00:02,041
There was a big, big hack a few years ago.
2
00:00:02,041 --> 00:00:05,875
I think it was Equifax, and they had to
like, testify in front of Congress,
3
00:00:06,291 --> 00:00:09,083
and they threw one of their engineers
under the bus and they said, well,
4
00:00:09,083 --> 00:00:12,083
one of our engineers
misconfigured an S3 bucket.
5
00:00:12,166 --> 00:00:17,291
And I found that to be so irresponsible,
because I would argue that
6
00:00:17,291 --> 00:00:19,583
if someone in your organization
made a mistake
7
00:00:19,583 --> 00:00:23,208
that has a material effect on your
business, that's a process problem.
8
00:00:23,208 --> 00:00:26,208
That's not an individual problem.
9
00:00:29,000 --> 00:00:30,750
Hello
10
00:00:30,750 --> 00:00:34,166
and welcome to the AI Master
Group podcast,
11
00:00:34,583 --> 00:00:37,500
featuring the people who are building
the future
12
00:00:37,500 --> 00:00:40,500
of AI in their work today.
13
00:00:40,708 --> 00:00:43,333
I'm your host, Jim Griffin.
14
00:00:43,333 --> 00:00:48,291
Today
I am very happy to have as a guest Dave
15
00:00:48,291 --> 00:00:54,208
Stern, who’s a fractional CTO
and DevOps engineer
16
00:00:54,208 --> 00:00:57,583
with over 25 years of experience
17
00:00:57,583 --> 00:01:00,750
in systems and software engineering.
18
00:01:00,750 --> 00:01:03,833
He's the president and Senior Solutions
19
00:01:03,833 --> 00:01:07,083
Architect of Stern DevOps Group,
20
00:01:07,375 --> 00:01:12,458
which is a consultancy
that's focused on early stage companies
21
00:01:12,833 --> 00:01:17,416
providing technical leadership,
infrastructure and automation.
22
00:01:18,250 --> 00:01:21,291
He's also the author of a new book,
23
00:01:21,791 --> 00:01:26,291
Hackproof Your Startup,
which is described on Amazon
24
00:01:26,541 --> 00:01:30,666
as the ultimate cybersecurity resource
for startups
25
00:01:31,125 --> 00:01:36,375
with practical strategies for early stage
engineering teams.
26
00:01:36,833 --> 00:01:38,625
Welcome, Dave.
27
00:01:38,625 --> 00:01:40,458
Thank you. It is a pleasure to be here.
28
00:01:41,750 --> 00:01:44,916
So you've got a long history there.
29
00:01:44,916 --> 00:01:48,375
We know from your introduction
that it's 25 years of experience.
30
00:01:48,750 --> 00:01:52,041
Can you summarize that
in about 2 or 3 minutes?
31
00:01:53,583 --> 00:01:55,125
I can, I can.
32
00:01:55,125 --> 00:01:57,958
So I started back in the mid
33
00:01:57,958 --> 00:02:01,375
90s, doing software
development way back when.
34
00:02:01,375 --> 00:02:05,750
It was a much simpler time
and much simpler skill set.
35
00:02:06,291 --> 00:02:10,708
Progressed through,
you know, a couple of organizations
36
00:02:10,708 --> 00:02:11,708
doing that
37
00:02:11,708 --> 00:02:15,416
eventually got very interested in
the systems and operations side of things.
38
00:02:15,416 --> 00:02:19,583
So in those days, you know, we had system
administrators and we had developers
39
00:02:19,583 --> 00:02:22,583
before DevOps was really a thing.
40
00:02:23,250 --> 00:02:25,208
Ended up managing a couple of teams.
41
00:02:25,208 --> 00:02:28,250
I worked at one point for a company
42
00:02:28,250 --> 00:02:31,708
that did, that had its own data
center and website development.
43
00:02:31,708 --> 00:02:32,916
So I got a lot of experience
44
00:02:32,916 --> 00:02:36,250
on the network side,
as well as doing things like, you know,
45
00:02:36,625 --> 00:02:41,041
debugging Cisco switches and JavaScript
in the same day.
46
00:02:41,625 --> 00:02:45,666
And then eight years ago,
I started my, my consultancy
47
00:02:45,666 --> 00:02:49,500
doing, started out as outsourced
DevOps engineering.
48
00:02:49,666 --> 00:02:54,625
I had been working at AWS every day
and, enjoyed it very much.
49
00:02:54,625 --> 00:02:58,833
And also we do
I operate as a fractional CTO,
50
00:02:58,833 --> 00:03:00,291
so I provide technical leadership
51
00:03:00,291 --> 00:03:03,416
to early stage companies,
and those things go hand in hand.
52
00:03:03,416 --> 00:03:05,583
A lot of companies are focused early.
53
00:03:05,583 --> 00:03:09,083
You know, startups are focused
on pushing features and doing software
54
00:03:09,083 --> 00:03:13,791
development and infrastructure and process
and things like that aren't always
55
00:03:14,125 --> 00:03:15,208
aren't always at the forefront.
56
00:03:15,208 --> 00:03:17,541
So that's what that's what I do now.
57
00:03:17,541 --> 00:03:20,083
So you've written this new book.
58
00:03:20,083 --> 00:03:21,666
It's just come out.
59
00:03:21,666 --> 00:03:24,541
What motivated you to write that?
60
00:03:24,541 --> 00:03:26,875
So I think that a lot
61
00:03:26,875 --> 00:03:31,250
of early stage companies either
don't know how to
62
00:03:31,250 --> 00:03:34,458
or don't have the resources
to focus on security.
63
00:03:35,000 --> 00:03:37,500
And I also think that there's
this prevailing,
64
00:03:37,500 --> 00:03:41,333
or at least in my experience, what
I've seen, there's this prevailing idea
65
00:03:41,333 --> 00:03:46,250
that it is either difficult or it
it is an afterthought, or it's something
66
00:03:46,250 --> 00:03:49,958
you worry about once you've deployed
all your, you know, software.
67
00:03:50,458 --> 00:03:55,375
And I have worked with many,
many teams as an advisor.
68
00:03:55,625 --> 00:04:01,500
And I saw the same things
over and over again, where again,
69
00:04:01,666 --> 00:04:05,750
out of just simply not knowing or not
70
00:04:06,083 --> 00:04:10,708
having the time to, you know,
the pressures of an early stage startup
71
00:04:11,000 --> 00:04:14,583
don't always allow a technology team
to focus on something like security.
72
00:04:15,083 --> 00:04:18,500
And so I wanted to collect
73
00:04:18,500 --> 00:04:22,250
a lot of the things that I've seen
and produce something that I felt.
74
00:04:22,250 --> 00:04:24,208
And, you know, this is remains to be seen.
75
00:04:24,208 --> 00:04:30,250
But I felt that could be, reasonably easy
to walk through,
76
00:04:30,541 --> 00:04:34,583
get an idea of the bigger picture
and the ways that that early stage
77
00:04:34,583 --> 00:04:38,125
companies could look at security
as an integral part
78
00:04:38,125 --> 00:04:42,000
of what they're doing, as opposed to
an afterthought or an add on.
79
00:04:42,583 --> 00:04:46,625
So yeah, that was the motivation
to empower these teams to understand
80
00:04:47,250 --> 00:04:51,250
that a little bit better, and,
and secure their businesses.
81
00:04:51,250 --> 00:04:53,875
You know, these people
have put their lives of work into it.
82
00:04:53,875 --> 00:04:56,125
The investors are putting
in millions of dollars.
83
00:04:56,125 --> 00:04:58,625
It's a it's a huge asset
and it's a huge risk.
84
00:04:58,625 --> 00:05:00,083
And it doesn't take
85
00:05:00,083 --> 00:05:04,125
that much to get, you know,
it's like the 8020 rule, 80% of the,
86
00:05:05,875 --> 00:05:07,250
of what you need to do
87
00:05:07,250 --> 00:05:10,375
doesn't require a ton of work
to get most of the way there.
88
00:05:11,666 --> 00:05:13,125
Is really well done, by the way.
89
00:05:13,125 --> 00:05:14,750
So it's a really good book.
90
00:05:14,750 --> 00:05:17,375
I really enjoyed it
and it flows really well.
91
00:05:17,375 --> 00:05:19,041
It's very logical, the flow.
92
00:05:19,041 --> 00:05:22,583
And I also like the way you kind of
summarize the end of each chapter.
93
00:05:22,583 --> 00:05:25,791
Like if somebody wanted to cheat,
they could just read the last page of each
94
00:05:25,791 --> 00:05:29,125
chapter and get through the whole thing
in about three minutes.
95
00:05:30,666 --> 00:05:32,958
Well, having been a developer myself, I,
96
00:05:32,958 --> 00:05:36,166
you know, we all Google it,
we go to Stack Overflow.
97
00:05:36,166 --> 00:05:38,833
We we just want to look
at the implementation details,
98
00:05:38,833 --> 00:05:41,166
get it working
and then figure out why later.
99
00:05:41,166 --> 00:05:44,666
So yes, if you need to go straight
to the action items please feel free.
100
00:05:46,791 --> 00:05:49,166
So but there's so much in there.
101
00:05:49,166 --> 00:05:52,750
And one of the things
that I was fascinated by,
102
00:05:52,916 --> 00:05:56,250
as you were really kicking off the book,
you talked about
103
00:05:56,666 --> 00:05:59,666
the Codespaces hack,
104
00:05:59,750 --> 00:06:05,041
and it's been a while since then,
but I remember that was a big deal.
105
00:06:05,041 --> 00:06:08,041
Can you refresh my memory
a little bit about what happened there?
106
00:06:08,333 --> 00:06:09,166
Sure, sure.
107
00:06:09,166 --> 00:06:12,208
So I think this is probably,
at least in my experience,
108
00:06:12,208 --> 00:06:17,666
one of the more extreme and, well known
stories of the dangers of getting hacked.
109
00:06:18,083 --> 00:06:22,750
So Codespaces was a company
that I believe they provided some type of . . .
110
00:06:22,750 --> 00:06:25,875
But again, I don't know the exact details
of what they did, but I know
111
00:06:25,875 --> 00:06:30,083
they provided some type of online
repository for people to store their code.
112
00:06:30,083 --> 00:06:32,375
I think similar to like a GitHub.
113
00:06:32,375 --> 00:06:36,166
But the key point in
that is they're a SAS business.
114
00:06:36,166 --> 00:06:38,666
Their business was their AWS account.
115
00:06:38,666 --> 00:06:41,208
They had databases,
they had S3 buckets, they had,
116
00:06:42,291 --> 00:06:44,458
EC2 instances running their code.
117
00:06:44,458 --> 00:06:47,625
And these days we do a lot more
with containers, but still very valid.
118
00:06:48,250 --> 00:06:51,000
And there was a compromise
of their account,
119
00:06:51,000 --> 00:06:54,083
I believe that someone gained credentials.
120
00:06:54,083 --> 00:06:56,666
And this is still,
unfortunately, too common.
121
00:06:56,666 --> 00:06:59,875
Someone gained access to a developer's
credentials that had,
122
00:07:00,125 --> 00:07:04,791
administrative permissions,
and they got into the AWS console.
123
00:07:05,333 --> 00:07:07,875
And when they did,
124
00:07:07,875 --> 00:07:11,458
they, locked out
125
00:07:11,458 --> 00:07:17,000
everyone else, all the other
login accounts, and then they, except,
126
00:07:17,000 --> 00:07:20,958
I believe they left some capability
for them to read an S3 bucket,
127
00:07:20,958 --> 00:07:24,375
and they put a ransom note
in the S3 bucket and said, give us
128
00:07:24,958 --> 00:07:28,041
X amount of Bitcoin,
or we're to start deleting your resources.
129
00:07:28,625 --> 00:07:31,125
And so the company scrambled.
130
00:07:31,125 --> 00:07:34,291
They tried to get back
in, they couldn't do it.
131
00:07:34,791 --> 00:07:39,416
And the attackers
started deleting databases and S3 buckets
132
00:07:39,416 --> 00:07:43,208
and irreplaceable data to the point
where within
133
00:07:43,208 --> 00:07:46,916
I believe, 48 or 72 hours,
it was all gone.
134
00:07:46,916 --> 00:07:50,375
They had no backups, they had no recourse,
and they had to shut the company down.
135
00:07:50,458 --> 00:07:53,416
And it's a sad story. Unfortunately.
136
00:07:54,458 --> 00:07:55,500
Oh my goodness.
137
00:07:55,500 --> 00:08:00,000
Those are the kinds of moments when you
just say, if only, why didn't I focus?
138
00:08:00,000 --> 00:08:03,000
You know, that's so obvious.
139
00:08:03,083 --> 00:08:04,291
How could that happen to me?
140
00:08:04,291 --> 00:08:06,000
I'm a smart person.
141
00:08:06,000 --> 00:08:07,083
Yes, yes.
142
00:08:07,083 --> 00:08:10,916
And it's the kind of thing
where you don't think about it, you know?
143
00:08:10,916 --> 00:08:14,125
You just don't think of that
as a potential, a catastrophic
144
00:08:14,125 --> 00:08:15,166
risk to a company.
145
00:08:15,166 --> 00:08:17,833
And one of the reasons
going back to your question
146
00:08:17,833 --> 00:08:20,541
before that, I wrote the book, is
there are still a lot of companies
147
00:08:20,541 --> 00:08:24,750
out there that are, vulnerable
to this sort of attack.
148
00:08:24,750 --> 00:08:27,750
And the solution
is relatively straightforward.
149
00:08:27,916 --> 00:08:29,416
Yeah.
150
00:08:29,416 --> 00:08:32,791
So, you know, picking up on that,
one of the things that I noticed
151
00:08:33,250 --> 00:08:36,000
in the book is that you position
152
00:08:36,000 --> 00:08:39,833
cybersecurity as an asset,
which I found interesting,
153
00:08:40,500 --> 00:08:44,666
and as an asset
that could be sort of incorporated
154
00:08:45,000 --> 00:08:49,166
as part of the early stage infrastructure
rather than as an afterthought.
155
00:08:50,000 --> 00:08:51,541
And you touched on that already.
156
00:08:51,541 --> 00:08:53,333
I wonder if you could expand on that
a little bit.
157
00:08:53,333 --> 00:08:56,333
The idea of cybersecurity as an asset.
158
00:08:56,583 --> 00:08:58,250
Yeah. Yeah.
159
00:08:58,250 --> 00:09:01,916
So cybersecurity
is in the news everywhere these days.
160
00:09:01,916 --> 00:09:04,250
You hear about hacks on a regular basis.
161
00:09:04,250 --> 00:09:08,458
And, one of the things that I say,
162
00:09:08,458 --> 00:09:12,791
paraphrasing myself, is your competition
is probably already doing this.
163
00:09:12,791 --> 00:09:16,958
So if they're not and you can sell
164
00:09:17,458 --> 00:09:22,583
your commitment
to the security of your users’ data
165
00:09:23,041 --> 00:09:27,041
or their, their data
or what they're doing in your product,
166
00:09:27,500 --> 00:09:31,875
then you're either going to be ahead of
your competitors who don't focus on that,
167
00:09:31,875 --> 00:09:34,291
or you're at least going to be competitive
in a marketplace
168
00:09:34,291 --> 00:09:37,041
where other people are using
that as a selling point.
169
00:09:38,000 --> 00:09:41,000
So I think these days you sort of can't
170
00:09:41,666 --> 00:09:44,666
you can't overlook that, particularly
if you're in an industry
171
00:09:44,666 --> 00:09:48,750
that's either regulated or that does deal
with personally identifiable information
172
00:09:48,750 --> 00:09:51,750
or personal health information,
like you really can't,
173
00:09:53,458 --> 00:09:56,166
slack on this type
of, of this type of thing.
174
00:09:56,166 --> 00:09:59,875
So it can be a
and I make some other points, about
175
00:10:00,333 --> 00:10:02,916
you know, like, for example,
selling it to investors
176
00:10:02,916 --> 00:10:06,083
like this is a first class
citizen of our development.
177
00:10:06,083 --> 00:10:07,416
We do think about security.
178
00:10:07,416 --> 00:10:09,458
So your investment is secure.
179
00:10:09,458 --> 00:10:12,041
If you're ever going to go
for compliance,
180
00:10:12,041 --> 00:10:13,916
you're going to have to do this
stuff anyways.
181
00:10:13,916 --> 00:10:17,000
And if you just follow best practices,
you're most of the way there to begin
182
00:10:17,000 --> 00:10:17,916
with.
183
00:10:17,916 --> 00:10:21,666
Things like that
I think are very, strong selling points.
184
00:10:22,916 --> 00:10:23,666
That sounds good.
185
00:10:23,666 --> 00:10:25,125
That makes a lot of sense.
186
00:10:25,125 --> 00:10:28,500
You also talk about what you refer
to as a data
187
00:10:28,500 --> 00:10:32,666
insurance
policy against ransomware attacks.
188
00:10:33,291 --> 00:10:35,458
So what do you mean by that exactly?
189
00:10:35,458 --> 00:10:36,958
And how does that work?
190
00:10:36,958 --> 00:10:40,500
Yeah, I love talking about this
because this is like the meat.
191
00:10:41,125 --> 00:10:45,458
I hope people who watch
or listen to this podcast buy my book.
192
00:10:45,458 --> 00:10:49,583
But if you don't, this is one of the main
things I want you to get out of this.
193
00:10:49,583 --> 00:10:53,333
So what a company
like Codespaces could have done
194
00:10:53,333 --> 00:10:57,916
and what existing companies can do
is, you know, you don't.
195
00:10:58,250 --> 00:11:00,958
You can do everything possible
to secure your account.
196
00:11:00,958 --> 00:11:04,250
But if you assume that there is some
197
00:11:04,916 --> 00:11:06,291
minuscule chance
198
00:11:06,291 --> 00:11:09,625
and maybe more than minuscule,
that someone can get in to your account,
199
00:11:09,625 --> 00:11:11,500
then you have to assume
they can do the same thing.
200
00:11:11,500 --> 00:11:16,416
They can encrypt all your data and,
blackmail you for the encryption key.
201
00:11:16,875 --> 00:11:18,833
They can just delete all your data.
202
00:11:19,791 --> 00:11:20,333
Just to be
203
00:11:20,333 --> 00:11:24,208
malicious or again,
as a as a blackmail, method.
204
00:11:24,708 --> 00:11:28,375
So what we always set up for our clients
and what we recommend is
205
00:11:28,375 --> 00:11:32,541
you and I'm going to speak in terms
of an AWS or cloud account right now.
206
00:11:33,041 --> 00:11:35,291
But this could apply to on prem.
207
00:11:35,291 --> 00:11:37,000
It could apply to bare metal.
208
00:11:37,000 --> 00:11:41,666
You need an isolated separate environment
that has separate credentials.
209
00:11:41,666 --> 00:11:44,916
So it's getting into the technical weeds
here for a moment.
210
00:11:44,958 --> 00:11:49,666
I don't want to get too technical,
but typically you either have a company
211
00:11:49,666 --> 00:11:52,166
with one AWS account
in all their environments,
212
00:11:52,166 --> 00:11:54,166
their development,
their staging, their UAT,
213
00:11:54,166 --> 00:11:56,583
their production,
whatever are in that one account
214
00:11:56,583 --> 00:12:00,291
or and what we see more of in what
we build as a best practice
215
00:12:00,291 --> 00:12:03,625
is a multi-account environment
where each environment is its own account.
216
00:12:04,291 --> 00:12:07,625
But in order to access all of those,
just for the ease of modern use,
217
00:12:07,625 --> 00:12:09,875
you'll typically have one log in an SSL
218
00:12:09,875 --> 00:12:13,583
solution,
a single sign on, either like Okta or AWS.
219
00:12:13,875 --> 00:12:16,708
And then from that login
you can switch accounts.
220
00:12:16,708 --> 00:12:17,833
You know, you can switch roles.
221
00:12:19,166 --> 00:12:19,833
You want to
222
00:12:19,833 --> 00:12:23,416
set up something outside of that system
223
00:12:23,666 --> 00:12:29,083
because of a single,
login credential is compromised or leaked.
224
00:12:29,583 --> 00:12:31,958
Then an attacker has access
to all those environments.
225
00:12:31,958 --> 00:12:35,916
So you want something separate
and then what you want to do, I say you
226
00:12:35,958 --> 00:12:41,750
what what one wants to do is all of the
critical data that can't be replaced.
227
00:12:41,750 --> 00:12:45,750
You want to do a one way backup
to the separate environment.
228
00:12:45,750 --> 00:12:50,000
So if you set up a separate backup
account, you set up separate credentials,
229
00:12:50,541 --> 00:12:53,333
and then you set up, you set up
230
00:12:53,333 --> 00:12:56,333
backups
that can all the, all the, the permissions
231
00:12:56,333 --> 00:12:59,541
you give that backup system, they can just
write to the new environment.
232
00:12:59,541 --> 00:13:02,416
They can't read from it.
They can't get data from it.
233
00:13:02,416 --> 00:13:05,958
That other environment has no access
into your existing environments.
234
00:13:11,125 --> 00:13:12,250
You're listening to the
235
00:13:12,250 --> 00:13:15,250
AI Master Group podcast
236
00:13:24,708 --> 00:13:26,333
You set up backups
237
00:13:26,333 --> 00:13:29,458
that can only . . . all the permissions
you give that backup system.
238
00:13:29,458 --> 00:13:31,458
They can just write
to the new environment.
239
00:13:31,458 --> 00:13:34,333
They can't read from it.
They can't get data from it.
240
00:13:34,333 --> 00:13:37,875
That other environment has no access
into your existing environments.
241
00:13:38,500 --> 00:13:41,750
And so the idea is you have this
backup account that's regularly
242
00:13:41,750 --> 00:13:45,958
getting snapshots of your database
where you're replicating your S3 buckets.
243
00:13:46,958 --> 00:13:51,000
And so if your account were compromised
or unavailable for whatever reason,
244
00:13:51,000 --> 00:13:54,250
let's say there was a malicious attack
and they deleted everything.
245
00:13:54,750 --> 00:13:56,125
You have your data.
246
00:13:56,125 --> 00:14:00,291
As long as you're using infrastructure
as code like Terraform or CloudFormation.
247
00:14:00,291 --> 00:14:02,250
Most people use Terraform these days.
248
00:14:02,250 --> 00:14:04,708
Then you can rebuild
all the infrastructure.
249
00:14:04,708 --> 00:14:06,875
And as a side note,
I talk a lot about infrastructure
250
00:14:06,875 --> 00:14:10,375
as code because being able to recreate
your environments
251
00:14:10,375 --> 00:14:14,083
is not only good development
practice, it's also good insurance.
252
00:14:14,541 --> 00:14:15,833
You recreate the environment.
253
00:14:15,833 --> 00:14:18,833
You can take the backup of that data,
which the attackers
254
00:14:18,916 --> 00:14:21,791
can't access
and probably don't even know exists.
255
00:14:21,791 --> 00:14:25,958
And you can be up and running again
as quickly as a couple hours
256
00:14:25,958 --> 00:14:29,666
if you haven't set up that way
and you know, at most 24, 48 hours,
257
00:14:30,000 --> 00:14:34,166
you're not it's not an existential
risk to your business anymore.
258
00:14:35,166 --> 00:14:36,291
Existential risk.
259
00:14:36,291 --> 00:14:38,458
That's really
what it would be otherwise.
260
00:14:38,458 --> 00:14:39,625
I see why you're saying that.
261
00:14:39,625 --> 00:14:43,583
That is like the one takeaway
from this podcast.
262
00:14:43,583 --> 00:14:47,916
Like if nobody remembers anything else
because that one do that.
263
00:14:47,916 --> 00:14:50,125
Right. Yeah. Right.
264
00:14:50,125 --> 00:14:50,583
Yeah.
265
00:14:50,583 --> 00:14:55,375
Talking now specifically about AI,
266
00:14:56,416 --> 00:14:59,166
there's lots of startups
that are feeling pressure
267
00:14:59,166 --> 00:15:02,291
to get out in front of the curve and,
and it's good.
268
00:15:02,291 --> 00:15:05,458
And to quickly innovate
with new technologies
269
00:15:05,458 --> 00:15:08,458
and especially with Generative AI.
270
00:15:08,708 --> 00:15:13,166
From your perspective,
is there any kind of methodology
271
00:15:13,166 --> 00:15:18,500
or framework that you recommend
so that the technology leadership
272
00:15:18,500 --> 00:15:22,250
can enable this while at the same time
protecting data?
273
00:15:23,666 --> 00:15:24,500
Yeah.
274
00:15:24,500 --> 00:15:28,416
And this is, you know, a lot of
this is still very nascent, you know,
275
00:15:28,458 --> 00:15:30,708
using Generative AI in businesses.
276
00:15:30,708 --> 00:15:36,750
But the old time tested,
methodologies still work.
277
00:15:36,750 --> 00:15:41,250
You know, in any business we have, you
278
00:15:41,333 --> 00:15:45,250
if your data isn't critical,
if it's not,
279
00:15:45,250 --> 00:15:48,625
if you don't have to worry about like GDPR
or regulations,
280
00:15:48,625 --> 00:15:51,416
where you have to protect user data,
if you're just sending,
281
00:15:51,416 --> 00:15:54,583
you know, statistics you've generated,
if you have a weather app
282
00:15:54,583 --> 00:15:58,583
and you're just sending weather statistics
to have the Generative AI do summaries
283
00:15:58,583 --> 00:16:01,041
for you or build models or whatever it is,
284
00:16:01,041 --> 00:16:02,541
you don't have to worry
that much about that.
285
00:16:02,541 --> 00:16:04,500
If it gets stolen. It's not proprietary.
286
00:16:04,500 --> 00:16:06,125
Nobody's going to sue you.
287
00:16:06,125 --> 00:16:07,583
But most of us don't have that. Right?
288
00:16:07,583 --> 00:16:10,541
We want to build recommendation engines
with customer data.
289
00:16:10,541 --> 00:16:13,541
We want to do something
a little bit more advanced.
290
00:16:13,916 --> 00:16:17,333
And so, as with anything,
if you have data that's
291
00:16:17,708 --> 00:16:21,833
sensitive or critical,
you either need to, well,
292
00:16:22,916 --> 00:16:24,125
traditionally you have to
293
00:16:24,125 --> 00:16:27,208
mask it and you have to make sure
that it is sent securely.
294
00:16:27,416 --> 00:16:30,416
So you're using encrypted
channels like https.
295
00:16:30,416 --> 00:16:35,666
You're storing it somewhere
with encryption at rest, you are masking
296
00:16:35,666 --> 00:16:38,666
any personal identifiable things
like email address or phone number.
297
00:16:39,083 --> 00:16:44,541
But also now we have the added risk
or the added factor that, you know,
298
00:16:44,541 --> 00:16:48,833
a lot of these Generative AI systems
are using our data to train their models.
299
00:16:49,375 --> 00:16:52,041
So you have to make the assumption
that if you're going to build,
300
00:16:52,041 --> 00:16:55,041
for example, a recommendation system,
and we've done this for clients
301
00:16:55,458 --> 00:17:00,083
and send the data to ChatGPT,
you can't just send raw user data.
302
00:17:00,083 --> 00:17:02,000
You have to somehow protect that.
303
00:17:02,000 --> 00:17:05,958
So masking there's so there's a couple
things I would say in a practical sense.
304
00:17:05,958 --> 00:17:07,750
(1) masking the data.
305
00:17:07,750 --> 00:17:11,166
So turning you know, just using
for example the user ID in your database
306
00:17:11,708 --> 00:17:14,958
and the descriptive information
where you can't identify
307
00:17:15,000 --> 00:17:17,958
who that user is or anything about them.
308
00:17:17,958 --> 00:17:21,625
And you're not giving away
anything proprietary to your company,
309
00:17:21,625 --> 00:17:25,375
like the secret sauce of your whatever
it is that your SAS business does.
310
00:17:26,750 --> 00:17:27,625
And sending that
311
00:17:27,625 --> 00:17:31,708
over, having the Generative AI
work on or the or the large language
312
00:17:31,708 --> 00:17:34,541
model work on that data
that's already been masked
313
00:17:34,541 --> 00:17:37,333
and then, you know, operating on that
314
00:17:37,333 --> 00:17:41,333
by matching your embeddings or whatever
is one thing I would recommend.
315
00:17:41,333 --> 00:17:44,541
And then the second thing
is, where possible, stay within the walled
316
00:17:44,541 --> 00:17:47,583
garden
of the of the provider that you're using.
317
00:17:47,583 --> 00:17:51,583
So you know,
as we speak things like AWS Bedrock
318
00:17:51,583 --> 00:17:54,583
or SageMaker or things like that,
they're internal tools.
319
00:17:54,708 --> 00:17:58,083
Bedrock in particular, promises
not to use your data to train a model.
320
00:17:58,083 --> 00:18:04,250
So if you can, staying proprietary
where none of the data leaves your VPC
321
00:18:04,291 --> 00:18:07,541
or your private network
or your account, is another way
322
00:18:07,541 --> 00:18:10,958
to make sure that you're
not, risking anything.
323
00:18:13,250 --> 00:18:14,208
So now we've been
324
00:18:14,208 --> 00:18:17,750
focusing on enterprise and enterprise
risk.
325
00:18:18,083 --> 00:18:23,250
But there's this interesting intersection
between people and enterprise,
326
00:18:23,250 --> 00:18:27,500
especially when we talk about startups
because startups actually end up
327
00:18:27,500 --> 00:18:30,583
coming down to being people
are not that many people.
328
00:18:31,333 --> 00:18:34,375
Sometimes one person.
Sometimes two, etc..
329
00:18:34,791 --> 00:18:38,375
And so maybe to close this out,
330
00:18:39,208 --> 00:18:42,416
talking about the way people think
331
00:18:42,416 --> 00:18:46,375
and the risks that people incur,
tell me what you think.
332
00:18:46,833 --> 00:18:49,666
If I had a laptop
333
00:18:49,666 --> 00:18:52,666
or a cell phone that got stolen somehow,
334
00:18:53,500 --> 00:18:56,291
what would I suddenly wish I had done
335
00:18:56,291 --> 00:18:59,291
before that had happened to me?
336
00:18:59,583 --> 00:19:02,458
Another good question,
and it speaks to broader
337
00:19:02,458 --> 00:19:04,250
topics that I talk about in my book.
338
00:19:04,250 --> 00:19:08,041
So if you don't mind if I digress
on a bigger picture for a moment
339
00:19:08,041 --> 00:19:12,041
to come back to this, we are all human.
340
00:19:12,041 --> 00:19:15,166
We all make mistakes. That's just a fact.
341
00:19:15,166 --> 00:19:19,375
Like you can't operate in any environment,
342
00:19:19,375 --> 00:19:23,416
and you know you can't train people enough
to not make mistakes.
343
00:19:23,416 --> 00:19:25,458
You know, I'm a senior engineer.
344
00:19:25,458 --> 00:19:27,125
I still make mistakes
after this many years.
345
00:19:27,125 --> 00:19:28,083
You can find
346
00:19:28,083 --> 00:19:31,625
the most qualified people out there,
who've been doing this for many years.
347
00:19:31,625 --> 00:19:34,375
And we make typos.
We do things without thinking.
348
00:19:34,375 --> 00:19:35,541
It happens.
349
00:19:35,541 --> 00:19:39,916
So and, you know, there was a
I think it was Equifax.
350
00:19:39,916 --> 00:19:42,000
There was a big, big hack a few years ago.
351
00:19:42,000 --> 00:19:43,041
I think it was Equifax.
352
00:19:43,041 --> 00:19:46,041
And they had to like, testify
in front of Congress.
353
00:19:46,250 --> 00:19:46,833
And they threw
354
00:19:46,833 --> 00:19:50,083
one of their engineers under the bus
and they said, well, one of our engineers
355
00:19:50,416 --> 00:19:53,875
misconfigured an S3 bucket, or I think
that's what it was, something like that.
356
00:19:54,333 --> 00:19:59,125
And I found that to be so irresponsible
because and I say this in my book,
357
00:19:59,125 --> 00:20:03,083
I would argue that if someone
in your organization made a mistake
358
00:20:03,083 --> 00:20:06,666
that has a material effect on your
business, that's a process problem.
359
00:20:06,666 --> 00:20:08,541
That's not an individual problem.
360
00:20:08,541 --> 00:20:11,666
That means that you didn't set up
the guardrails correctly in your business.
361
00:20:11,666 --> 00:20:15,375
You didn't follow things like principle
of least privilege,
362
00:20:15,375 --> 00:20:18,083
or you didn't
isolate your environments enough
363
00:20:18,083 --> 00:20:20,833
so that they just couldn't
make that mistake.
364
00:20:20,833 --> 00:20:25,416
Occasionally things will happen, but,
you know, we all . . . There's and
365
00:20:25,666 --> 00:20:29,125
and even if your people are perfect,
366
00:20:29,250 --> 00:20:31,291
they can still have their credentials
compromised.
367
00:20:31,291 --> 00:20:36,208
So you still want to have things like
isolation where if their keys are stolen,
368
00:20:36,458 --> 00:20:40,041
the attacker can only do so much,
you know, or and if they're like temporary
369
00:20:40,041 --> 00:20:43,125
keys, they can only do so much for so long
and then they expire.
370
00:20:43,583 --> 00:20:46,500
So circling back to your question, I could
371
00:20:46,500 --> 00:20:49,583
be doing everything right
with security and have my laptop stolen
372
00:20:49,583 --> 00:20:52,416
when I'm in a coffee shop
and all of that goes out the window.
373
00:20:52,416 --> 00:20:55,916
So what I would recommend people do
when I talk about this in the book
374
00:20:55,916 --> 00:21:00,625
as well, is, first of all, make sure
all your drives on your all your computers
375
00:21:00,791 --> 00:21:05,166
and your internal and external drives
are encrypted with a password.
376
00:21:05,541 --> 00:21:09,625
What people don't realize is,
even if my laptop is turned off
377
00:21:09,916 --> 00:21:13,125
and I don't have an encrypted drive,
they can just pull the drive out,
378
00:21:13,125 --> 00:21:16,125
plug it back into another computer,
and they get all the data.
379
00:21:16,416 --> 00:21:21,083
So you want to make sure
that your physical hardware is secured.
380
00:21:21,500 --> 00:21:26,666
Similarly, you want to have your screens
lock after a short period of time.
381
00:21:27,208 --> 00:21:28,208
Sometimes when I'm at home,
382
00:21:28,208 --> 00:21:32,125
I set them for a longer period,
but if I travel or take my computer out,
383
00:21:32,125 --> 00:21:35,500
I have my screen saver and the lock
go on after 5 or 10 minutes.
384
00:21:36,000 --> 00:21:39,958
So that way again, if my computer's
stolen, they've got about five minutes,
385
00:21:39,958 --> 00:21:43,375
they don't have any passwords
and then they can't do anything else.
386
00:21:43,833 --> 00:21:46,250
So that's another thing.
387
00:21:46,250 --> 00:21:49,875
And then use MFA with all your accounts
multi-factor auth.
388
00:21:49,875 --> 00:21:53,166
You know,
we all talk about that because, you know,
389
00:21:53,541 --> 00:21:56,250
if even if they can get into your systems,
390
00:21:56,250 --> 00:21:58,500
they won't be able to log in
with just having the passwords.
391
00:21:58,500 --> 00:22:02,041
They would need your phone to get your
authenticator codes or whatever it is.
392
00:22:02,416 --> 00:22:06,708
And then for an extreme level
paranoia and I do this, I will admit
393
00:22:06,708 --> 00:22:10,833
I don't use face ID,
I don't use the fingerprint unlock.
394
00:22:10,833 --> 00:22:15,625
I actually type a code
in every time I unlock my phone.
395
00:22:15,625 --> 00:22:20,250
Now, that's admittedly
another level of extreme security,
396
00:22:20,250 --> 00:22:22,708
but the way I look at it,
and this may apply to
397
00:22:22,708 --> 00:22:25,583
some of your listeners
or your audience, is
398
00:22:25,583 --> 00:22:28,166
if I have I work with a lot of companies.
399
00:22:28,166 --> 00:22:29,083
I have sensitive data.
400
00:22:29,083 --> 00:22:33,458
I have the, access to sensitive data
for other companies.
401
00:22:33,458 --> 00:22:35,250
It's my responsibility
402
00:22:35,250 --> 00:22:38,250
to practice what I preach
and do the things I say in my book.
403
00:22:38,333 --> 00:22:41,958
And this is going to sound extreme,
but this the example I always uses, is
404
00:22:42,250 --> 00:22:46,875
if I'm unconscious, they can still use
my face ID or my fingerprint
405
00:22:46,875 --> 00:22:51,250
to get into my phone or my accounts,
but if it's a passcode only, I know
406
00:22:51,500 --> 00:22:54,625
and I'm unconscious,
they still can't get in.
407
00:22:55,125 --> 00:22:57,541
So now there's all there's
things like coercion.
408
00:22:57,541 --> 00:23:03,541
And we could go to an extreme on this,
but I like to be extra, extra,
409
00:23:04,666 --> 00:23:07,666
careful in these situations.
410
00:23:07,791 --> 00:23:09,000
Interesting, interesting.
411
00:23:09,000 --> 00:23:10,916
We could go down that rabbit hole
all the way
412
00:23:10,916 --> 00:23:13,208
down to the middle of the earth.
413
00:23:13,208 --> 00:23:15,333
So. Very good.
414
00:23:15,333 --> 00:23:18,125
Well, this has been great, Dave.
415
00:23:18,125 --> 00:23:21,166
I learned so much,
and I'm sure that the listeners did, too.
416
00:23:21,208 --> 00:23:24,875
Can you tell me where to find your book
and how people can get in touch with you?
417
00:23:25,583 --> 00:23:27,958
Yeah. So the book is on Amazon.
418
00:23:27,958 --> 00:23:29,458
It's an Amazon Kindle book.
419
00:23:29,458 --> 00:23:33,208
So for digital download.
You can just search “Hackproof Your Startup”
420
00:23:33,208 --> 00:23:35,125
“hackproof” is one word. I learned
421
00:23:35,125 --> 00:23:38,125
it doesn't come up
very well if you if you do two words.
422
00:23:38,208 --> 00:23:42,875
My website is www.sternDevOpsgroup .com.
423
00:23:42,875 --> 00:23:45,875
And, yeah,
those are the best ways to reach me.
424
00:23:46,500 --> 00:23:49,250
Okay. Well, this was great.
425
00:23:49,250 --> 00:23:51,750
Dave, thank you very much
for spending the time with me.
426
00:23:51,750 --> 00:23:53,458
And more power to you.
427
00:23:53,458 --> 00:23:56,666
Just keep all those passwords safe
and keep us all a lot of trouble.
428
00:23:57,250 --> 00:23:58,041
Thank you.
429
00:23:58,041 --> 00:24:01,833
You've been listening
to the AI Master Group podcast.
430
00:24:02,083 --> 00:24:04,333
I'm your host, Jim Griffin.
431
00:24:04,333 --> 00:24:08,166
Until next time,
stay curious and stay in front.
