Brian Trzupek, DigiCert | DigiCert Trust Summit

This is Textron tv. Hey, everyone. We're back here live at the DigiCert Trust, uh, summit in, in Las Vegas.

We're at, uh, resort World, and we've had an amazing day. Some really great speakers and guests, and some great conversations about a lot of, uh, a lot of topics revolving around this whole idea of digital trust. My next, uh, guest is a friend of mine, Brian Pec.

cpec. Eck. Eck.

It's okay. I always that Z always gets It gets everyone, man gets everyone. But Anyway, Brian, Brian is ASVP of product over at DigiCert, but he's Brian.

Look, Brian's a he has an interesting history. Brian, why don't give him a little of the Brian story. What, which part?

There's so much of it. Well, You know, what, what you feel comfortable sharing? Oh, man.

I've, uh, I don't know. I've been on a journey, that's for sure. Right.

We've been, uh, in digital security for a long time. Right. I've, uh, started companies, sold companies, uh, been building things in trust site cycle management, uh, space for, what, 14 years now?

Yeah. Uh, doing P-K-P-K-I specifically for about 20, um, working for Digit cer for the last eight of those running product for 'em. Mm-Hmm.

Um, you switched to personal man. I don't know if you know this. I got six kids.

Did you know that? I didn't Know you had Six kids. Kids.

That's right. I'm a collector kids. Yeah.

Yeah. God bless you. I know.

Yeah. Why, what? Coming up on my 25th wedding anniversary speaking.

Yeah. I'm not gonna use AI to generate the card. That's not happening.

You're gonna get someone in trouble here. I Know, I know. Um, six kids though.

What are their age ranges? Uh, top is 22, and so she's, uh, finishing up college now. Yep.

Uh, she'll be a teacher, and then the bottom is just nine years old now. Wow. That's fantastic.

Yeah. That's a nice run. That's about, uh, 13 years, six kids, about every two, every two years.

That's right. God bless you, man. My, my youngest is 22 and he's also finishing up college, and, um, I'm glad I don't, I can't imagine six, though.

Two was more than I could handle. But Anyway, Brian, I, I wanted to talk to you a little bit about, you know, there's this, I I just feel like we're at one of these junctures, not just in technology, but in civilization, right. There, there was sort of that, uh, what do, what do they call the boundary between like, dinosaurs, Cretaceous, and the age of mammals, right?

Yeah. There's that white sort of boundary line. Yeah.

I almost feel like we're at a, a, a boundary line where, you know, the internet changed human civilization. Mm-hmm. Right.

It was more than just techie dudes like us. It changed the way, you know, grandma's on the cell phone and, and grandma's doing e-commerce and grandpa, you know, it changed the fabric of civilization. Then we have other technologies like, um, like the cloud for instance.

The cloud was huge. It didn't really change civilization. You know, grandma says, oh, yeah, I store my stuff in the cloud.

Yeah. It's on my phone. No, it's in the cloud, grandma.

Right. But, and, but it makes no difference. Yeah.

But it didn't really change civilization. She still had her picture. Yeah.

Some of the things we have coming out now, like generative ai, for instance. Yeah. Have the, have the potential to really change civilization and not o and not just in a good way.

Right. The internet, you know, look, I remember early on, and I was early on in the internet as an entrepreneur, where they estimated 40 to 50% of every packet on the internet was porn related. Yeah.

Right. Right. Porn made the internet go, go, go.

Um, ai ai, it boggles the mind when you think about some of the more sinister uses Here applications Yeah. Or applications. Yeah.

But at the same time, there's so much good it could do. Yeah. There's so much good it could do.

There was a session you mentioned earlier where, you know, the whole, like the whole film clip was just generated, was faked. Yeah. Um, as, as someone who's running product that's a digital trust company.

Yeah. It's gotta scare the hell outta, you know? Yeah.

Yeah. I think So. You know, but it's also an opportunity, like everything else.

It it's double edged it. Yeah. There's a tremendous opportunity here because if you can adequately provide trust, you know, some of the things this could unlock is, is phenomenal.

Absolutely. So, you know, does it keep you up at night or, or you know, what do you, how do you, how do you get your arms around this one? Yeah.

I mean, I think it, it's such a, a big space, like you said, and it is so transformative, right? I mean, there, there's, there's no way around that. The, this notion, even before you get into AI and generative content and all those things, just, just rewind a couple years, right?

It's pretty new. We already had challenges with what's real, right? What, what's in the news that you can trust?

What's the source? Who's authoring it? Is it propaganda?

Is it not? Right? All those questions, we already had such a big issue with what is real and what is not.

Let alone being able to create photos and videos and voices that look as if they did happen. There's pretty much no way to tell, and they can exist in the same space and then be amplified by the same mechanisms. Right.

And so societally, that, that's a tremendous challenge. The discernment required by somebody to be able to figure that out. I don't, I don't even know if you can in some cases.

Right? And so that presents just such a, a more on the diabolical side of things, a, a challenge. You bring that into, I think, you know, now you get to that advent of the world where you have generative and you have some of these things, and we've already seen attacks, right?

Where they're using things to clone the CEO's voice, I forget which attack it was, but they, they called into like the C ffo to do a transfer by, you know, cloning the voice, you know, um, deep faking the voice of the CEO to authorize and tell him to do this on a weekend. And the guy's like, oh, okay. Did it, and all his money was lost.

Right? Like, who would've thought you could even do that? Who could have afforded to do that?

I think you told me you could clone me for $10,000 somewhere, right? Voice as well. Yeah.

Voice as well. So the cost of these things are coming down. The, the barrier to entry is coming down the way it's gonna be utilized as a threat and a vector of attack, I think is just gonna only increase.

We're very creative people as humans, we will figure out how to do things with this, right. So I think that's kind of that end of it. And, and, you know, you kind of bring that into what customers are seeing, right?

Like, I just, I just did a session with, uh, the folks from HPE about zero Trust, right? So that's an interesting paradigm too. They're trying to prevent access as everyone else is in zero trust, uh, to systems and, you know, you know, kind of help with that, expanding security perimeter and try and figure out, well, you know, what's the permissions of least pri uh, privilege and defense in depth, and how do you deploy that?

Even in that conversation, it was like one of the greatest threats we have to this is generative content and, and all the phishing attack and all the, the, the supercharge attacks that will come in to try and exploit the holes through these systems, right? So I think we're gonna continue to see inventive techniques in there. Right.

But to the second part of your question, like from product perspective inside dig cer, I think it's fascinating, right? And I haven't even got to the quantum piece of that, right? But I think No, that's a whole nother story.

Yeah. I think, I think it's fascinating because, you know, we we're just looking at so many ways, and I think this is like the good side of AI and generative content and those things is like, you know, we were looking at, we have a product that interconnects with hundreds of types of integrations known and documented, probably thousands unknown and undocumented because they're protocol based and, and all this, you have customers that will come to our team and say, Hey, you know, can we connect with X? Well, depending on the tenure of the person they're talking to at this organization, they may or may not know that we can or can't or that it's possible by using some protocol.

And so they may tell somebody no, right? Yeah. And so we're like, well, dude, they should be able to come in first off, hit some sort of chat system, hit some sort of in-app product help, and hey, do you know, how do I connect with that perfect chat, GPT, those kinds of, you know, generative model languages.

They're able to put that together and give you a way to say, Hey, you know what? It's, it's maybe not on the list of things, but you can get there by doing this and this, and it's pretty easy. So go off and do it.

Mm-Hmm. Well, now you're helping customers get to the value a lot quicker, right? You're, you're making the barrier and time to get there totally smaller.

And then you go even deeper, right? Like in the tech world, we have so many data sheets, so many presentations, so many, so much documentation on our website. You look at our website, we've got hundreds and hundreds of pages of very deeply technical documentation, right?

You feed all those things into a language model and you can get something that comes out that is helping guide training for our staff customers, support making all of those systems and processes faster. I mean, it's knowledge based, right? I mean, look, unbelievable.

com. Yeah. Right?

I think we have 25 or 30,000 thousand articles Yeah. On DevOps put that into an LLM. Yep, exactly.

We have 7,000 webinars. Oh, yeah. You know, great content, right?

It is. You feed these into these engines and, and, uh, but it value out of these things. You hope it does.

I hope it does. That's my good hat on, right? Yeah.

I switched to the good mode, right? Yeah. And, and that, but that's, I mean, that's what kind of keeps me up at night.

Yeah. You know, for a long time I've believed one of the problems with the internet was the evil of humans, you know, prevents us from having the really good things that the internet can bring to us. Right.

And 40% of packets is probably proof. Yeah, Yeah. You know, it, it's, yeah, it's true.

But, um, but, and, but you know, the point is, good or bad progress waits for no person. Yeah. And AI is going to bring the good and the bad, but it's gonna bring it.

It is. Yeah. And, and you know, you mentioned post Quantum before quantum computing is coming.

I was, I forgot I was talking to the VP of engineering from DigiCert. I forget his name now, but he's brilliant. Okay.

We've got a few, so I'm not gonna guess, but he, He is, um, he runs the lab. I, Avesta Avesta. Okay.

Yeah. You know, and he was saying IBMI think is up to a 430 qubit. This would be avesta.

Yes. Yeah. Yeah.

I mean, I thought we were still at 10. Yeah. So, you know, we're at 4 32 now.

It's not enough to be what they want it to be, but it's Right. Significantly higher than it was the last time I checked they Scores algorithm, they're starting to do things and get the attacks and, and, And so now look, it's coming. Yeah.

And so I think part of, especially when you're working at DigiCert is you can't wishy-washy saying, yeah, you know, I, it'll slow or maybe it won't, or it's going to you, you've gotta plan now Yeah. For This. Yes.

Yeah. And so you've gotta be coming up with digital trust products for the age of ai Yeah. Digital trust products for the age of post quantum.

Yeah. And we haven't even been talking about when you combine those things, do you get an exponential Yeah. Kind of, you know, craziness going On.

I mean, I think I'm chomping at the bit on this one, so I'll jump ahead a little bit. Go. But the, you know, it's interesting.

It's such a great opportunity to be here at Trust Summit with all these customers, hundreds of customers here, all the conversations and everybody's excited to, to be going. And p QC is just such a big topic, right? And it just keeps coming out.

And in fact, we had a, um, executive advisory council yesterday, and so we met with a lot of leaders from some of the biggest indus uh, companies in the industry. You'd know, p QC was a huge part of that conversation, right. And what I think was most interesting, and Amit kind of capped it off on stage today when he said, this is kinda like Y two K without a date.

Mm-Hmm. Right. pqc.

Yeah. Because it is, it'll have huge implications. We just don't know when it's coming.

Right. And it could be tomorrow, it could be 15 years. And that's the problem because back to the executive advisory council, right?

What we asked them we're like, well, how, what's your plan? Like, do you guys have a plan to, to get ahead of this? Right?

Because when you, when you look at it, fundamentally, RSA has been a building block of the internet, right? And kind of this Lego that makes all the protocols work, right? Yep.

It makes all these things work together. And that of course is TLS. That's things like SSH, that's things like your secure email.

There's all these things are dependent on RSS a All based on these encryption key algorithms, Everything. Right? You don't just swap the algorithm in, you're gonna have to change the way those protocols work.

Yep. Right? And so Tim Holby, who's, uh, works in industry standards at digital, he'll be the first to tell you all of those internet DR standards have opened back up to drafts now to figure out what do we do with the PQC algorithms?

Well, that's the software side, Alan. Right. Software's easier to change than hardware.

People don't think about that. Yeah. Mm-Hmm.

So you have data centers with like these cavium accelerators for S-S-L-T-L-S that are based off RSA optimizations on silicon. That ain't gonna work. The algorithms that we run right now.

So, you know, we have test systems. We just launched p the Pqc labs that customers could test. Yes.

And do all these things in that, you know, we can easily demonstrate for customers that just generating those keys, right? For, uh, a post quo signature about 10 x slower, about 10 x more processing time, more compute required to process them. Imagine taking a huge cloud infrastructure powered by CAS to accelerate 10 x on them And then drop 'em by 10 x.

Nobody's gonna want, Not today's customers, Right? But what's the challenge? The customers told us, they're like, look, we don't know when this is happening.

They're, they said, look, assert when need it expires, CEO's calling, investors are calling a systems down. There's, we're losing money. You gotta fix this right now.

There's money quoting to customers. There's money in fixing certificate expirations. They're like, there's none in post quantum right now, because they probably haven't Happened.

It's not real yet. And, and that's such a frustrating piece because I get it. I know it, I understand it.

I've been in the position of trying to act for ask for something ahead of the event. Right? That's hard.

And I think dig Cert needs to help customers in articulating that, that space, because it is big. It's gonna be the things maybe they produce, if it's using those algorithms, it's gonna be the things they depend on their infrastructure, CICD, infrastructure, SSH, the search, the keys, the software, the all, everything, the VPNs, all that stuff's gonna need to update just to be there. Hardware is gonna have to update to do that.

And you're gonna have all these processes that go on top of that. It's really mind boggling to think of what needs to happen. And you know, we talked to very few organizations, unfortunately, who I think have that kind of maturity in place that they've got operational control over an environment with automation to be able to bite off this.

Right? Because that's really the key is automation, right? Mm-Hmm.

Like whatever the threat is, you go back in time, heart bleed, that required a lot of change, right? The yes. You know, Deion have a null for a random, uh, generation in certs, big change.

A lot of certs had to drop quantum. Same thing. Just everything's gonna have to change, right?

All of these things require this modernization, this automation, the ability to change infrastructure Real, real quick. The thing with Pqc is it's hardware though Too, right? And, and that, that's the issue.

It's easy to change. It's always been that story, which is why so much moved to software and maybe as a result of this, we'll move even more to software. Yeah.

Right. Which is wouldn't be, I don't think a terrible thing either. No, But have you seen like the FPGA stuff, uh, field program, Gatorades, all the things they're doing, but that with like in load balancers and, and network gear and technology where virtualized all sorts of PCB and chip and silicon based stuff into kind of software.

I know FPGA guys would yelp me for that, but it's closer, right? It's closer than pure silicon. That's right.

But, but here's the thing. As a customer of DigiCert, I don't wanna worry about this till I gotta worry about it, right? I heard this yesterday, But is dig youer when I worry about it, you damn well better have something for me.

Right? That's exactly If you want me to true. Stay a customer.

That's exactly true. And so, and, and inherently that's the issue. Yeah.

I could laugh about it like you does on stage up there, right? Yeah. And, uh, you know, and I could say I'll worry about it when I worry about it, but you've gotta be fashioning the solution.

So when I do worry about it, that's right. You gotta have them ready. Yep.

And that is not easy, my friend. Yeah. Yeah.

I mean, we're, we're working on that same thing within our ecosystem, right? We've got HSM vendors, we've got partners with key management tools, we've got cloud partners. Sure.

We've got all this stuff. And, and so we're working to kind of orchestrate and educate. I think at this point there's a lot of education that, that just the conversation we just had about that complexity.

You'd be surprised the number of customers that don't realize there's gonna be a hardware change. Yeah. And that their software's fundamentally gonna change.

'cause that protocol was so based off RSA as a building block that it's gonna behave differently. Well, what does that mean? That means that your network traffic, your, your stiff sniffers and scanners and things that are investigating packets, well, they're not gonna work either because it's different.

Yeah. The whole thing. So There's so much that's gonna blow up.

And so I think when the customers get their head around that it kind of helps with that urgency and it's like, well, we better get a plan. Right? But then they kinda look at Dig AER and say, help us understand what that, how to, to tackle this.

And you know, I think there's a lot of interesting things. I talked about it earlier today up in the, in the keynote about inventory and knowing what's in place from a protocol, from a software, from a, you know, et cetera. The whole stack of what's there is kind of step one.

You can't have a plan until you know what you have. Right. And so I think that's kinda the first place that we're helping customers understand.

Second place is, like I mentioned earlier, we're helping them with the testing. Just another interesting thing I, how much time we have, but a customer of ours in, uh, England was talking to me and he's like, man, we're gonna roll out all these EV chargers and it's, uh, you know, sometime next year, but it's hundreds of millions of dollars of investment. And they're like, what?

Our question is how do we know if these things will be able to run a Pqc algorithm? Because if we, if we can test and know now way cheaper to fix, then once we rack these things in the field and after we go back and change 'em all, right? Right.

And so they're like, how can we do that? Right. And, and actually conversations like that was the impetus of why Dig search said, you know, we're gonna make a Pqc lab.

You don't need to know how to generate those keys and algorithms. You don't need to have HSMs. We'll make it so it's turnkey you come here.

It's not production. Please don't use these for production. But you can generate them, you can use them, you can have anchors and chains and deploy them that and speed test them and put 'em on your gear and see if it works and see if it blows up.

So 10 times longer. That's exactly why, you know, we spoke about it today with the lab. I love it.

Yeah. I think it's a great thing to be doing out here right Now. I, I think those kinds of things come together to help customers with that roadmap.

And then of course, we have to have our software and services ready and all those kinds of things, which we're working on too. So. Cool.

Yeah. Brian, we are about outta time. There's probably people behind that door, I'm sure.

Waiting to come in here. I, they're knocking. Yeah.

But man, it's great seeing you. Yeah, Good pleasure to see you in person. Yeah, Great, great, great, great Trust summit this year.

I loved it. Aw, thank you. We're gonna Take a break.

I think we still have maybe one or two more, um, interviews today here to wrap up our DigiCert Trust coverage. We'll be back in a couple minutes with the next one. Thanks.