Walter Haydock: Welcome to the Deploy Security Podcast, where we go deep on the cybersecurity, privacy, and compliance implications of using artificial intelligence. As always, I'm joined by Steve DeFour. Steve, good to see you.
Stephen Dufour: Thanks for having me, sir.
Walter Haydock: So yeah, here we are, September first, the end of summer. Fall starts early here. How are things in Texas?
Stephen Dufour: there's a giant heat dome.
Walter Haydock: yeah.
Stephen Dufour: yeah, it's like hundred and five degree heat. It's ridiculous.
Walter Haydock: Well, let's get right into it. I'll I'll turn it over to you for the first topic. We've got interesting source of information here and I think potentially something to to learn learn from it.
Stephen Dufour: And so word of caution here, this comes from one one W A N A E N. I'm sure that's some kind of farcy, farcy word. Scroll to the very bottom of the page, the contact us says Tehran. So we believe, well, I don't know about you, but I believe this is a small piece. propaganda from Iran saying it integrated artificial intelligence into its air defense system. this this particular news article goes into detail about the enhancements that the Iranian military has gone to integrate artificial intelligence into its defense systems. This may be propaganda, but at the same time you have to look at Iran being is with China and there's open source models that they can download. This is one of those to me, it's one of those nightmare scenarios where you have a supporter of terrorism integrating a highly advanced artificial intelligence system, or even not an advanced system, just artificial intelligence in general, to enhance their capability from a defensive standpoint. This The this article really doesn't go into detail about the offensive capabilities, but it does go into detail about some of the defensive capabilities where they they improved their time to respond down to two hours. It didn't really say exactly what the time was before, but they noted less than two hours for tactical response to their system. So just found this very interesting. specifically Because Iran and United States and I guess the re our regional partners are currently at war and it's all over the news, the Strait of Hormuz, it's a big deal. And I think Iran integrating artificial intelligence into their capability, whether it be defensively or offensively, is a pretty big deal.
Walter Haydock: Yeah, I mean, definitely makes sense that they do it on the autonomous weapon side of things or adding it to their existing systems. And then on the offensive side, I mean, Iran has a pretty well documented capability for offensive cyber operations, especially targeting things like financial services, critical infrastructure. They've gone after US targets over the past decade or so. I know they went again they hit striker early on in the in the most recent conflict and they're they're pretty aggressive in terms of their their offensive ops. So not surprising at all here. I imagine that they are going to be leveraging some of the open weight models to accelerate their capabilities, things that have the guardrail stripped off. And you know, for those companies that are talking about making open weight models illegal or heavily regulating them, I mean, you can do that, but the Iranians are not going to be impacted at all. by by those types of regulations. So I don't really think it makes sense. Anthropic notwithstanding their they're kind of the holdouts on on that on that topic right now. They're kind of just they're they're against AI being freely and openly available. They want to have the the the best systems and have it, you know, basically be a a state state recognized monopoly, which is, you know, understandable from from a business perspective, but I don't I don't think that's good for everyone else. And, you know, you're always gonna have malign actors who have those capab they're they're gonna ignore any laws that are on the books and do what they need to do or think that they need to do.
Stephen Dufour: You mentioned before like the I d I don't remember the exact words you said, but it's the Iranian backed ransomware group. Think you mentioned Striker, Striker earlier. There were there were numerous incidents. I think
Walter Haydock: Yeah.
Stephen Dufour: a couple of places up in Minnesota, maybe like an energy comp company and I'm gonna say like a handful of third parties to HIPAA regulated
Walter Haydock: Mm-hmm.
Stephen Dufour: entities where they had a ransomware event, or some something to that effect. When it comes to these particular groups potentially using artificial intelligence to both scale and detect. vulnerabilities like in in let's just say critical infrastructure. Do you have any tips or anything like that for your let's just say typical business, whether it be Minnesota, Texas, New Hampshire, where they haven't necessarily adopted any AI capabilities?
Walter Haydock: Well, actually I think that's a great segue for our next topic. that's that's a good segue because I don't know how many days ago this went OpenAI just put out a This call for collective cyber defense. And frankly, it's it's a lot of motherhood and apple pie, and not not stuff that anyone would argue with here. You know, saying every organization needs to raise standards, you know, fix the highest risk weaknesses, verify results without disrupting essential services, raise the security bar for what you buy, build and deploy, including AI-generated code. So yeah, a lot of a lot of kind of milk toast recommendations here that I think all all make sense. And for the individual companies that are struggling to implement this, I mean, I think the the really basic stuff is, you know, that that's gonna make you the most money, two factor authentication, patching vulner patching exploitable vulnerabilities quickly. You know, for for small businesses, I would say you want to rely mostly on software as a service to offload the responsibility for maintenance and things like that to bigger organizations and then focus on controlling access, understanding what the entitlements for users are, securing API keys, limiting permissions, those types of things are gonna scale, whether you're dealing with traditional cyber threats or with nation state actors using the near frontier open weight models. So yeah, I would say the the basics still still apply here. And I think there's a little bit of you know, I I was in a a group where some folks were talking about this and saying, Yeah, thanks, opening eye, because you kind of created the problem here. So with with their you know, things like GPT five point six soul and the undisclosed model that hacked Hugging Face, creating you know, raising raising the cyber threat level for for everyone. And yeah, I mean it's it's good to see good to see these these steps being recommended. But you know, these are things that you should have been doing. beforehand and and and continue doing so afterward. I think just multi factor authentication, strong forms of auth of authentication are gonna be useful until people stop logging into computer systems.
Stephen Dufour: Yeah, I think you nailed it. for me, whenever I do engagements with businesses, the number one thing that I focus on is access management. It's like how how does a user or let's just say an account identify itself, authenticate, and then what are the role-based access controls there? It's like you usually some kind of like privilege access management system for administrators or depending on how you manage access at your company you might use an Okta or Microsoft 365 active directory assigned to groups right and and it's so it's so simple that people don't believe that that can actually work. So I'm a I'm a big believer in treating things like a firewall. Deny everything. Somebody wants access, let's have a discussion. I mean, just think of what people are trying to get, right? They're trying to get access to your systems. They're trying to get access to your secrets. Right. So if you have a process of access management that goes through a change, a change management process as well, you're probably going to be in good shape. As as long as all of it's documented and working and exceptions are reviewed on a regular basis, you're probably going to be in really good shape. as far as the defensive capabilities go for artificial intelligence, I am real maybe maybe that should be a topic for for next month's podcast where there are some of those open source models where somebody's built out an MCP server for internal use at your company and you just go out there and scan and do all the things where it goes out there and tries to find the new thing that doesn't have a CVE. It's not even a known zero day yet, right? There's people out there who have dedicated their time to help let's just say the helping the community, the security community at large be better. And to defend against artificial intelligence, let's just say threats for lack of a better word. I really think this is the way of the future where internally you have your own AI powered red team. That goes in and tries to break stuff. And because it's artificial intelligence and you have a community up updating these particular systems, you could potentially automate it. Right. Like so every time a piece of code is checked into the repository, it runs a particular scan based on the context of the code. the the opportunity here is pretty exciting because as artificial intelligence from the offensive side, like People trying to break in increase, that means we have the opportunity to increase our capability from the defensive side as well. End rant.
Walter Haydock: Definitely. Yep. Well, well rants well taken. Would you like to move on to the next topic?
Stephen Dufour: Yes, which one was it? artificial intelligence scammers. Yeah, when I was working at that healthcare company, I saw this one firsthand. So this one has a video accompanying it. So old school phishing, right? There were what the what they call red flags, right? So the red flags, whenever you get a email, misspellings, overly proper, Let's say usage of the of the English language, right? Hello, good day, sir, ma'am, or whatever it happens to be. I am the honorable so and so. So over the top English usage, sometimes mispronunciations. sometimes it'll it you'll get a notification at the top of your email. This might be spam. So because artificial intelligence is now Let's just say a global capability. The scammers are also using it to fix their phishing emails. Right. So there can literally be no red flags in there, no misspellings, no improper use of the of the English language. the emails such as like im images that are typically embedded in the email are no longer broken. like anything you can think of. There there's probably now a workaround because of artificial intelligence. on the other side, well, another example is the voice fish phishing. So previously, you would get a call from some unknown number or something like that, and they'd claim to be like the CEO, or you you would get a SMS claiming to be the CFO or whatever it happens to be. Now they can clone. People at your company's voice. And I mean, like you and I record these podcasts, and I I have my own video series as well. Now the threat of voice cloning as well as on the fly video cloning of an individual makes it to where your everyday person, such as the mom and pops or the small businesses, or even some of the larger companies as well. Don't have the capability to detect some of these newer threats. So the email that comes in, it's it's really hard to actually detect that it's a fraudulent email. The phone call or the SMS comes through, everything's perfectly worded. It sounds like your CFO. So just based on all of this, it really seems like the artificial intelligence capability from the scamming side. Has really put to the forefront the let's say let's say the fragile nature of human behavior because the typical human wants to help and be helpful to the person making the request, especially when it happens to be your CFO or something like that. And what I would say for anybody that's really concerned about this, I would say document in your procedures exactly. what to do and train and refer people back to what they're supposed to do. So for example, if you get a text or you get a phone call, no matter who it is at your company is requesting bank account information, for you to make a transfer wire transfer, for you to divulge your password, keep in mind these scammers want access to the systems, right? And that means you need a a very a very solid access management system as well as a change management system. Would you agree?
Walter Haydock: Yeah, I mean, I think the traditional threats that we faced are just gonna have fuel poured on the fire with AI. Especially, I mean, the voice cloning thing is something that it's definitely concerning because, you know, if you ha hear a loved one's voice crying for help or asking you to do something, you're probably not gonna apply as much scrutiny as you would to someone who you don't recognize. And that can be a huge, huge issue. So having family essentially passphrase that you know that you can authenticate each other with. I think that would be a useful thing to have if you're, you know, talking over the phone or or video chat with anyone because that can help you to make sure that you're talking to the person you think you are.
Stephen Dufour: Yeah, yeah, a hundred percent. And the the example you gave about somebody calling like a loved one remind reminded me of a different article I read where grandma got scammed out of, you know, a hundred thousand dollars or something to that effect because she thought her granddaughter needed it for something, right? And got scammed out of there. And so it's a it's a really good opportunity for any anybody watching this video to go and have a chat with those. those people who might struggle with technology. And it it and it may and it may sound like it won't work, but it will. If you have any doubt, hang up the phone and call the person directly. Right? Like, like you said, have that passphrase, like, and it seems ridiculous, but we're also talking about potentially thousands of dollars, right? And a lot of time the vulnerable population that are up there in age That's their retirement. Right. And it it's really important and it's so simple to just have a have a conversation with these people and let them know. I still I still have my mom every once in a while contact me and and she asks me for advice. And then sometimes when I'm texting her, she'll call me and she say, Are you texting me? Like just to be sure that it's me because I might be short with her because I'm busy or something like that. So Yeah, the verification process of I identity, even at the personal level, is super, super
Walter Haydock: Absolutely. So the latest in the ongoing saga between Elon Musk and Sam Altman is that OpenAI is going to end model access for cursor after that company was acquired by SpaceX. And the alleged reason is that OpenAI says it cannot be confident SpaceX will comply with its terms, citing past disputes with Elon Musk's company. So I think that's we're We're gonna see we're gonna see a lot of shifting alliances as these companies jockey for market dominance and they're gonna be cutting each other off from access to certain technologies. And, you know, I think the there's some interesting kind of r history popping up here because essentially Anthropic said, Hey, yeah, we're gonna work closely with with Cursor, even though open AI is not, but It was it was actually Anthropic that blocked another company from accessing their models due to competitive reasons. So, you know, it's not a it's it's not a kind of a an isolated incident here. We're seeing lots of sharp elbows in in the space. And I think we're gonna continue seeing that as these companies jockey for position, especially because SpaceX just went public and OpenAI and Anthropic have their IPOs. lined up so they're not going to be pulling any punches in the lead up to those market offerings.
Stephen Dufour: Yeah, and the lesson here for me, the first thing that I thought of was third party risk management. So forget about these guys potentially not liking one another when one company acquires another company. And that company that's acquired is one of the third parties that you use. It could be it could be a bank, it could be cursor, it could be your cloud provider, whatever laptops. Just think of all the third parties where operationally, like this is how we either operate, meaning like HR, finance, rent, whatever, whatever it happens to be, or revenue generating products, right? You need a process defined. Whenever a company acquires one of the companies that you depend on, you have a specific process where you go through terms and conditions. potentially have a conversation with a representative of the company to make sure you're aligned on a path forward. Because if your revenue generating product depends on that third party and that particular product goes away, you have to plan for how you're going to actually deliver value to your customers, right? And that also includes operationally, so for example, like a hospital system or something like that. Let's say one one of the providers that you use to keep long term data storage gets acquired by another company. You need to make sure that they're gonna respect the privacy and security that your customers have become accustomed of having.
Walter Haydock: Yeah, I mean the especially in the generative AI space, because first of all, there are the competitive issues, like you mentioned, the privacy, security, compliance issues, and then there are the the business issues. So different companies will have the latest and greatest model. So moving over to a whole new provider might be something you need to do on a relatively quick basis. So something that that Stack Aware has done is we built a essentially a router to all our potential AI suppliers. So OpenAI, Anthropic, Google Gemini. And we route all our internal API calls to a single endpoint. And then that endpoint can route them to the desired target, which gives us some flexibility and lets us switch if if we need to for whatever reasons. And we we did that last summer when Opening I came under a court order to indefinitely retain all of its data, w including API queries, which I think was a little excessive, but nonetheless we had to react. So we moved over to the anthropic API for all of our confidential data processing for for the time that the order was in effect. And I would say all companies should have something like that in in place.
Stephen Dufour: Yeah, that's freaking neat the way you described it. That reminds me of Oracle Rack. When it back in the day when I was an Oracle DBA, you have multiple nodes set up and you have a listener on each node, but the address that you actually connect to is round robin in between the nodes. So like if one node goes down, the DNS name could potentially point to any number of nodes. So that's what it sounds like you have set up. Like that's a really good availability capability that you have there.
Walter Haydock: Yeah, it's the only thing is it's not automatic. It does require me to flip a switch to to shift providers, but we can move pretty quickly instead of having to rewrite all the, you know, individual functions.
Stephen Dufour: Yeah, human in the loop. There you go.
Walter Haydock: That's that's right. That's me. That's me.
Stephen Dufour: So talked previously about some negative ramifications of artificial intelligence in the world, defensive capabilities. We can't can't figure out who's scamming us, or like we can't even detect the scam anymore. Or Iran has now supposedly artificial intelligence embedded in its defensive networks. But now artificial intelligence is being used to help spot heart disease. Right. So a particular model was fed thousands and thousands of I I believe ECGs. Yeah. trained on millions of routine ECGs. And through that training and recognition process, it can now better spot heart disease in humans. So like I consider this a win for the human race. This is exactly what this type of technology is supposed to do. So first identify a problem, heart disease, right? Or lung cancer, whatever, whatever it happens to be as far as like medical conditions go, feed the artificial intelligence data, give feedback loops to know if a response or an identification is appropriate, and then continue with the training and testing until you have awesome results. yeah, I'm thoroughly impressed with this particular article. It says it in summary at the very bot bottom. Technology like the AI ECG in this research, which has the potential to identify high-risk patients early, will not detect everyone with heart condition, but it could be a solution to help fast track the patients who are most likely to have a heart abnormality. Right. So like grounded in reality, this isn't the end all be all of like identifying conditions, but it's helpful. Right. And because you have clinical staff helping out with the research. And because it is grounded in reality, my bet is they're going to have really good outcomes here. Like I'm super excited about the potential for artificial intelligence when it comes to a healthcare related task.
Walter Haydock: Yeah, this is exactly the type of innovation that I expect we're gonna see more of as time moves on. And frankly, I guess I'm a little disappointed in the progress that we've seen so far on on this end. I know healthcare obviously is a slower moving industry and it's a little more conservative for for obvious reasons. But with these types of things, especially diagnostic, I'd love to see more rapid proliferation of of these types of things because This is a great use case for AI and it has huge impacts and could be potentially relatively cheap compared to the the value that it would deliver.
Stephen Dufour: Yeah, absolutely. The other the other use case, and I forget the term. I went to some conference in Nashville regarding artificial intelligence and healthcare, and what and one of the presenters mentioned the process that we use for these things is identify the problem, feed the data, qual quality checks, right, rerun the stuff and then output and then whatever your output is and it Then it's there. that's great if you know what the problem is. with artificial intelligence, there's an opportunity. And I I think a lot of the big tech companies, as well as the advertising companies and those those let's just say data brokers, for lack of a better term, they're just compiling all of this data. And if we took a similar approach for healthcare, granting like terms and conditions and like Be respectful of the law and all of these other things. If we took the data and fed it to AI and didn't ask a question that was specific, as in the problem statement, what could AI come up with? I'll give you an example. In my weight loss journey, weighed myself every day, my weight varies up and down, and I could see a downward trend, like over time, like okay, I'm I'm losing weight. But then I was very, very curious. about what I wasn't looking at. Right? The opportunity to know more without actually knowing the question asked. So I fed I fed Claude all of my weight data. Said, tell me something interesting about all the data that you see, because it it's one of those fancy scales that actually like puts up an electrical pulse and stuff like that. and gives you a whole bunch of other other data data points. Claude said, it's funny you asked that because the first thing I saw Was that you weigh yourself more when you're losing weight. And I was like, Thanks, Claude. So like when I'm gaining weight, I'll miss a few days, but when I'm gaining weight or losing weight, then I'll weigh myself more often. It's like a positive reinforcement type of thing. I'm like, thanks, Claud, for verifying out.
Walter Haydock: Correlation or causation? Hard to tell. Hard to tell. Hard to tell.
Stephen Dufour: But it's it's those opportunities that I'm really looking looking forward to with artificial intelligence, right? the ability to sift through, let's just say, terabytes of historical data related to humans that does, you know, comply with the law and it is respectful of of people's privacy and and things like that for opportunities to better the individual, particular groups and even the world.
Walter Haydock: Well, I think that's an uplifting note on which we can wrap things up. So thank you to our audience for tuning in. This has been the Deploy Security Podcast, and we will see you next time.
Stephen Dufour: Thanks for having me, sir.
Walter Haydock: So yeah, here we are, September first, the end of summer. Fall starts early here. How are things in Texas?
Stephen Dufour: there's a giant heat dome.
Walter Haydock: yeah.
Stephen Dufour: yeah, it's like hundred and five degree heat. It's ridiculous.
Walter Haydock: Well, let's get right into it. I'll I'll turn it over to you for the first topic. We've got interesting source of information here and I think potentially something to to learn learn from it.
Stephen Dufour: And so word of caution here, this comes from one one W A N A E N. I'm sure that's some kind of farcy, farcy word. Scroll to the very bottom of the page, the contact us says Tehran. So we believe, well, I don't know about you, but I believe this is a small piece. propaganda from Iran saying it integrated artificial intelligence into its air defense system. this this particular news article goes into detail about the enhancements that the Iranian military has gone to integrate artificial intelligence into its defense systems. This may be propaganda, but at the same time you have to look at Iran being is with China and there's open source models that they can download. This is one of those to me, it's one of those nightmare scenarios where you have a supporter of terrorism integrating a highly advanced artificial intelligence system, or even not an advanced system, just artificial intelligence in general, to enhance their capability from a defensive standpoint. This The this article really doesn't go into detail about the offensive capabilities, but it does go into detail about some of the defensive capabilities where they they improved their time to respond down to two hours. It didn't really say exactly what the time was before, but they noted less than two hours for tactical response to their system. So just found this very interesting. specifically Because Iran and United States and I guess the re our regional partners are currently at war and it's all over the news, the Strait of Hormuz, it's a big deal. And I think Iran integrating artificial intelligence into their capability, whether it be defensively or offensively, is a pretty big deal.
Walter Haydock: Yeah, I mean, definitely makes sense that they do it on the autonomous weapon side of things or adding it to their existing systems. And then on the offensive side, I mean, Iran has a pretty well documented capability for offensive cyber operations, especially targeting things like financial services, critical infrastructure. They've gone after US targets over the past decade or so. I know they went again they hit striker early on in the in the most recent conflict and they're they're pretty aggressive in terms of their their offensive ops. So not surprising at all here. I imagine that they are going to be leveraging some of the open weight models to accelerate their capabilities, things that have the guardrail stripped off. And you know, for those companies that are talking about making open weight models illegal or heavily regulating them, I mean, you can do that, but the Iranians are not going to be impacted at all. by by those types of regulations. So I don't really think it makes sense. Anthropic notwithstanding their they're kind of the holdouts on on that on that topic right now. They're kind of just they're they're against AI being freely and openly available. They want to have the the the best systems and have it, you know, basically be a a state state recognized monopoly, which is, you know, understandable from from a business perspective, but I don't I don't think that's good for everyone else. And, you know, you're always gonna have malign actors who have those capab they're they're gonna ignore any laws that are on the books and do what they need to do or think that they need to do.
Stephen Dufour: You mentioned before like the I d I don't remember the exact words you said, but it's the Iranian backed ransomware group. Think you mentioned Striker, Striker earlier. There were there were numerous incidents. I think
Walter Haydock: Yeah.
Stephen Dufour: a couple of places up in Minnesota, maybe like an energy comp company and I'm gonna say like a handful of third parties to HIPAA regulated
Walter Haydock: Mm-hmm.
Stephen Dufour: entities where they had a ransomware event, or some something to that effect. When it comes to these particular groups potentially using artificial intelligence to both scale and detect. vulnerabilities like in in let's just say critical infrastructure. Do you have any tips or anything like that for your let's just say typical business, whether it be Minnesota, Texas, New Hampshire, where they haven't necessarily adopted any AI capabilities?
Walter Haydock: Well, actually I think that's a great segue for our next topic. that's that's a good segue because I don't know how many days ago this went OpenAI just put out a This call for collective cyber defense. And frankly, it's it's a lot of motherhood and apple pie, and not not stuff that anyone would argue with here. You know, saying every organization needs to raise standards, you know, fix the highest risk weaknesses, verify results without disrupting essential services, raise the security bar for what you buy, build and deploy, including AI-generated code. So yeah, a lot of a lot of kind of milk toast recommendations here that I think all all make sense. And for the individual companies that are struggling to implement this, I mean, I think the the really basic stuff is, you know, that that's gonna make you the most money, two factor authentication, patching vulner patching exploitable vulnerabilities quickly. You know, for for small businesses, I would say you want to rely mostly on software as a service to offload the responsibility for maintenance and things like that to bigger organizations and then focus on controlling access, understanding what the entitlements for users are, securing API keys, limiting permissions, those types of things are gonna scale, whether you're dealing with traditional cyber threats or with nation state actors using the near frontier open weight models. So yeah, I would say the the basics still still apply here. And I think there's a little bit of you know, I I was in a a group where some folks were talking about this and saying, Yeah, thanks, opening eye, because you kind of created the problem here. So with with their you know, things like GPT five point six soul and the undisclosed model that hacked Hugging Face, creating you know, raising raising the cyber threat level for for everyone. And yeah, I mean it's it's good to see good to see these these steps being recommended. But you know, these are things that you should have been doing. beforehand and and and continue doing so afterward. I think just multi factor authentication, strong forms of auth of authentication are gonna be useful until people stop logging into computer systems.
Stephen Dufour: Yeah, I think you nailed it. for me, whenever I do engagements with businesses, the number one thing that I focus on is access management. It's like how how does a user or let's just say an account identify itself, authenticate, and then what are the role-based access controls there? It's like you usually some kind of like privilege access management system for administrators or depending on how you manage access at your company you might use an Okta or Microsoft 365 active directory assigned to groups right and and it's so it's so simple that people don't believe that that can actually work. So I'm a I'm a big believer in treating things like a firewall. Deny everything. Somebody wants access, let's have a discussion. I mean, just think of what people are trying to get, right? They're trying to get access to your systems. They're trying to get access to your secrets. Right. So if you have a process of access management that goes through a change, a change management process as well, you're probably going to be in good shape. As as long as all of it's documented and working and exceptions are reviewed on a regular basis, you're probably going to be in really good shape. as far as the defensive capabilities go for artificial intelligence, I am real maybe maybe that should be a topic for for next month's podcast where there are some of those open source models where somebody's built out an MCP server for internal use at your company and you just go out there and scan and do all the things where it goes out there and tries to find the new thing that doesn't have a CVE. It's not even a known zero day yet, right? There's people out there who have dedicated their time to help let's just say the helping the community, the security community at large be better. And to defend against artificial intelligence, let's just say threats for lack of a better word. I really think this is the way of the future where internally you have your own AI powered red team. That goes in and tries to break stuff. And because it's artificial intelligence and you have a community up updating these particular systems, you could potentially automate it. Right. Like so every time a piece of code is checked into the repository, it runs a particular scan based on the context of the code. the the opportunity here is pretty exciting because as artificial intelligence from the offensive side, like People trying to break in increase, that means we have the opportunity to increase our capability from the defensive side as well. End rant.
Walter Haydock: Definitely. Yep. Well, well rants well taken. Would you like to move on to the next topic?
Stephen Dufour: Yes, which one was it? artificial intelligence scammers. Yeah, when I was working at that healthcare company, I saw this one firsthand. So this one has a video accompanying it. So old school phishing, right? There were what the what they call red flags, right? So the red flags, whenever you get a email, misspellings, overly proper, Let's say usage of the of the English language, right? Hello, good day, sir, ma'am, or whatever it happens to be. I am the honorable so and so. So over the top English usage, sometimes mispronunciations. sometimes it'll it you'll get a notification at the top of your email. This might be spam. So because artificial intelligence is now Let's just say a global capability. The scammers are also using it to fix their phishing emails. Right. So there can literally be no red flags in there, no misspellings, no improper use of the of the English language. the emails such as like im images that are typically embedded in the email are no longer broken. like anything you can think of. There there's probably now a workaround because of artificial intelligence. on the other side, well, another example is the voice fish phishing. So previously, you would get a call from some unknown number or something like that, and they'd claim to be like the CEO, or you you would get a SMS claiming to be the CFO or whatever it happens to be. Now they can clone. People at your company's voice. And I mean, like you and I record these podcasts, and I I have my own video series as well. Now the threat of voice cloning as well as on the fly video cloning of an individual makes it to where your everyday person, such as the mom and pops or the small businesses, or even some of the larger companies as well. Don't have the capability to detect some of these newer threats. So the email that comes in, it's it's really hard to actually detect that it's a fraudulent email. The phone call or the SMS comes through, everything's perfectly worded. It sounds like your CFO. So just based on all of this, it really seems like the artificial intelligence capability from the scamming side. Has really put to the forefront the let's say let's say the fragile nature of human behavior because the typical human wants to help and be helpful to the person making the request, especially when it happens to be your CFO or something like that. And what I would say for anybody that's really concerned about this, I would say document in your procedures exactly. what to do and train and refer people back to what they're supposed to do. So for example, if you get a text or you get a phone call, no matter who it is at your company is requesting bank account information, for you to make a transfer wire transfer, for you to divulge your password, keep in mind these scammers want access to the systems, right? And that means you need a a very a very solid access management system as well as a change management system. Would you agree?
Walter Haydock: Yeah, I mean, I think the traditional threats that we faced are just gonna have fuel poured on the fire with AI. Especially, I mean, the voice cloning thing is something that it's definitely concerning because, you know, if you ha hear a loved one's voice crying for help or asking you to do something, you're probably not gonna apply as much scrutiny as you would to someone who you don't recognize. And that can be a huge, huge issue. So having family essentially passphrase that you know that you can authenticate each other with. I think that would be a useful thing to have if you're, you know, talking over the phone or or video chat with anyone because that can help you to make sure that you're talking to the person you think you are.
Stephen Dufour: Yeah, yeah, a hundred percent. And the the example you gave about somebody calling like a loved one remind reminded me of a different article I read where grandma got scammed out of, you know, a hundred thousand dollars or something to that effect because she thought her granddaughter needed it for something, right? And got scammed out of there. And so it's a it's a really good opportunity for any anybody watching this video to go and have a chat with those. those people who might struggle with technology. And it it and it may and it may sound like it won't work, but it will. If you have any doubt, hang up the phone and call the person directly. Right? Like, like you said, have that passphrase, like, and it seems ridiculous, but we're also talking about potentially thousands of dollars, right? And a lot of time the vulnerable population that are up there in age That's their retirement. Right. And it it's really important and it's so simple to just have a have a conversation with these people and let them know. I still I still have my mom every once in a while contact me and and she asks me for advice. And then sometimes when I'm texting her, she'll call me and she say, Are you texting me? Like just to be sure that it's me because I might be short with her because I'm busy or something like that. So Yeah, the verification process of I identity, even at the personal level, is super, super
Walter Haydock: Absolutely. So the latest in the ongoing saga between Elon Musk and Sam Altman is that OpenAI is going to end model access for cursor after that company was acquired by SpaceX. And the alleged reason is that OpenAI says it cannot be confident SpaceX will comply with its terms, citing past disputes with Elon Musk's company. So I think that's we're We're gonna see we're gonna see a lot of shifting alliances as these companies jockey for market dominance and they're gonna be cutting each other off from access to certain technologies. And, you know, I think the there's some interesting kind of r history popping up here because essentially Anthropic said, Hey, yeah, we're gonna work closely with with Cursor, even though open AI is not, but It was it was actually Anthropic that blocked another company from accessing their models due to competitive reasons. So, you know, it's not a it's it's not a kind of a an isolated incident here. We're seeing lots of sharp elbows in in the space. And I think we're gonna continue seeing that as these companies jockey for position, especially because SpaceX just went public and OpenAI and Anthropic have their IPOs. lined up so they're not going to be pulling any punches in the lead up to those market offerings.
Stephen Dufour: Yeah, and the lesson here for me, the first thing that I thought of was third party risk management. So forget about these guys potentially not liking one another when one company acquires another company. And that company that's acquired is one of the third parties that you use. It could be it could be a bank, it could be cursor, it could be your cloud provider, whatever laptops. Just think of all the third parties where operationally, like this is how we either operate, meaning like HR, finance, rent, whatever, whatever it happens to be, or revenue generating products, right? You need a process defined. Whenever a company acquires one of the companies that you depend on, you have a specific process where you go through terms and conditions. potentially have a conversation with a representative of the company to make sure you're aligned on a path forward. Because if your revenue generating product depends on that third party and that particular product goes away, you have to plan for how you're going to actually deliver value to your customers, right? And that also includes operationally, so for example, like a hospital system or something like that. Let's say one one of the providers that you use to keep long term data storage gets acquired by another company. You need to make sure that they're gonna respect the privacy and security that your customers have become accustomed of having.
Walter Haydock: Yeah, I mean the especially in the generative AI space, because first of all, there are the competitive issues, like you mentioned, the privacy, security, compliance issues, and then there are the the business issues. So different companies will have the latest and greatest model. So moving over to a whole new provider might be something you need to do on a relatively quick basis. So something that that Stack Aware has done is we built a essentially a router to all our potential AI suppliers. So OpenAI, Anthropic, Google Gemini. And we route all our internal API calls to a single endpoint. And then that endpoint can route them to the desired target, which gives us some flexibility and lets us switch if if we need to for whatever reasons. And we we did that last summer when Opening I came under a court order to indefinitely retain all of its data, w including API queries, which I think was a little excessive, but nonetheless we had to react. So we moved over to the anthropic API for all of our confidential data processing for for the time that the order was in effect. And I would say all companies should have something like that in in place.
Stephen Dufour: Yeah, that's freaking neat the way you described it. That reminds me of Oracle Rack. When it back in the day when I was an Oracle DBA, you have multiple nodes set up and you have a listener on each node, but the address that you actually connect to is round robin in between the nodes. So like if one node goes down, the DNS name could potentially point to any number of nodes. So that's what it sounds like you have set up. Like that's a really good availability capability that you have there.
Walter Haydock: Yeah, it's the only thing is it's not automatic. It does require me to flip a switch to to shift providers, but we can move pretty quickly instead of having to rewrite all the, you know, individual functions.
Stephen Dufour: Yeah, human in the loop. There you go.
Walter Haydock: That's that's right. That's me. That's me.
Stephen Dufour: So talked previously about some negative ramifications of artificial intelligence in the world, defensive capabilities. We can't can't figure out who's scamming us, or like we can't even detect the scam anymore. Or Iran has now supposedly artificial intelligence embedded in its defensive networks. But now artificial intelligence is being used to help spot heart disease. Right. So a particular model was fed thousands and thousands of I I believe ECGs. Yeah. trained on millions of routine ECGs. And through that training and recognition process, it can now better spot heart disease in humans. So like I consider this a win for the human race. This is exactly what this type of technology is supposed to do. So first identify a problem, heart disease, right? Or lung cancer, whatever, whatever it happens to be as far as like medical conditions go, feed the artificial intelligence data, give feedback loops to know if a response or an identification is appropriate, and then continue with the training and testing until you have awesome results. yeah, I'm thoroughly impressed with this particular article. It says it in summary at the very bot bottom. Technology like the AI ECG in this research, which has the potential to identify high-risk patients early, will not detect everyone with heart condition, but it could be a solution to help fast track the patients who are most likely to have a heart abnormality. Right. So like grounded in reality, this isn't the end all be all of like identifying conditions, but it's helpful. Right. And because you have clinical staff helping out with the research. And because it is grounded in reality, my bet is they're going to have really good outcomes here. Like I'm super excited about the potential for artificial intelligence when it comes to a healthcare related task.
Walter Haydock: Yeah, this is exactly the type of innovation that I expect we're gonna see more of as time moves on. And frankly, I guess I'm a little disappointed in the progress that we've seen so far on on this end. I know healthcare obviously is a slower moving industry and it's a little more conservative for for obvious reasons. But with these types of things, especially diagnostic, I'd love to see more rapid proliferation of of these types of things because This is a great use case for AI and it has huge impacts and could be potentially relatively cheap compared to the the value that it would deliver.
Stephen Dufour: Yeah, absolutely. The other the other use case, and I forget the term. I went to some conference in Nashville regarding artificial intelligence and healthcare, and what and one of the presenters mentioned the process that we use for these things is identify the problem, feed the data, qual quality checks, right, rerun the stuff and then output and then whatever your output is and it Then it's there. that's great if you know what the problem is. with artificial intelligence, there's an opportunity. And I I think a lot of the big tech companies, as well as the advertising companies and those those let's just say data brokers, for lack of a better term, they're just compiling all of this data. And if we took a similar approach for healthcare, granting like terms and conditions and like Be respectful of the law and all of these other things. If we took the data and fed it to AI and didn't ask a question that was specific, as in the problem statement, what could AI come up with? I'll give you an example. In my weight loss journey, weighed myself every day, my weight varies up and down, and I could see a downward trend, like over time, like okay, I'm I'm losing weight. But then I was very, very curious. about what I wasn't looking at. Right? The opportunity to know more without actually knowing the question asked. So I fed I fed Claude all of my weight data. Said, tell me something interesting about all the data that you see, because it it's one of those fancy scales that actually like puts up an electrical pulse and stuff like that. and gives you a whole bunch of other other data data points. Claude said, it's funny you asked that because the first thing I saw Was that you weigh yourself more when you're losing weight. And I was like, Thanks, Claude. So like when I'm gaining weight, I'll miss a few days, but when I'm gaining weight or losing weight, then I'll weigh myself more often. It's like a positive reinforcement type of thing. I'm like, thanks, Claud, for verifying out.
Walter Haydock: Correlation or causation? Hard to tell. Hard to tell. Hard to tell.
Stephen Dufour: But it's it's those opportunities that I'm really looking looking forward to with artificial intelligence, right? the ability to sift through, let's just say, terabytes of historical data related to humans that does, you know, comply with the law and it is respectful of of people's privacy and and things like that for opportunities to better the individual, particular groups and even the world.
Walter Haydock: Well, I think that's an uplifting note on which we can wrap things up. So thank you to our audience for tuning in. This has been the Deploy Security Podcast, and we will see you next time.
