Diana Jovin, DigiCert | DigiCert Trust Summit

This is Textron tv. Hey, everyone back here live in Las Vegas at the DigiCert Trust Summit at Resorts World, and we have our second guest of the day. I want to introduce you to Diana Jovin.

Diana is the VP of Product marketing at DigiCert, and she's joining us here live today. Hey, Diana, how are you? I'm great.

It's really a pleasure to be here. Thank you. It's our pleasure to have you on.

So, Diana, you're, you're gonna talk to us today a little bit about one of my kind of favorite kind of cutting edge. I always like to be out ahead. I missed ai, I'll admit it.

I didn't think it was gonna be this big, this quick, but post quantum computing and, you know, a post quantum post quantum computing world and the challenges it makes, especially for those involved in the certificate in digital security game. Mm-hmm. Um, talk to us if you want to just kind of, kind of frame the issues and, and we can jump from there.

Sure. Um, well, so I think first let's talk about the term post quantum computing. Right?

Okay. So the term itself implies that the things that we need to think about come after quantum computers have arrived. But really the, the way that we need to be thinking about this is how do we invest in quantum safe security postures?

The reason is that, um, the issues that we're going to face as an industry don't come once quantum computers arrive. Bad actors today can employ strategies such as harvest now, decrypt later, where they may take sensitive data and then, um, sit on it until quantum computer's wrong. Scene, You know, we see this, I don't want to point fingers, but we've seen it with a few of the password managers where they were able to just take a, you know, a big chunk of, of hashed, uh, uh, data that, you know, may take 500,000 years to, to crack with today's technology.

But with quantum, you might be able to do it pretty quickly. And there's a second issue too, which is that there's some things that stay out in the field for a long time. Yeah.

Right. Devices, software, those things need to be protected as soon as possible so that, you know, three years, five years, seven years, they're still secure. Um, now the thing is, the tools to do that are now, uh, coming onto the scene.

So, um, NIST announced, uh, you know, that there's been a huge industry collaboration on developing quantum safe algorithms. Right? And NIST announced, uh, draft standards on in August, right?

So after review period and after finalizing the standards, they'll be available next year as final standards for vendors to integrate into their products and services. And for companies to think about implementing and, you know, in their environments. You know, as we were talking off camera, I first became aware of this initiative and the problem trying to, uh, that's trying to solve probably about two years ago when I f that was when I first found out about the nist, uh, working group and stuff.

Um, and I was, I was so happy to see that for once, for once we're out ahead, right? We didn't wait until like this thing, you know, boom, laid an egg on us and we had to go do something. Well, so what I wanna talk to you about though is the survey we commissioned a couple months ago, right?

Right. We're releasing it tomorrow and, um, you know, encourage anyone who's interested in, in understanding more about it to download it and read it. Um, we, we commissioned a survey to see where the industry is in thinking about the delivery of quantum safe solutions.

And the thing that we observed is that it leaders are concerned. So in the survey, 61% think they won't be ready in time and 74% critical are concerned about harvest now decla strategies. And so then the next thing to look at is, okay, what are the obstacles to getting this in place?

And, you know, they talked about, uh, lack of insufficient resources, lack of budget. No, it's not really clear who's responsible for it. The executive leadership doesn't really understand the implications of quantum computing, but really a lot of people just generally don't.

And so I think the thing that as a vendor we're thinking about is how do we provide leadership to the industry and helping people understand where to start, right? Because I think the, the, um, the, the call to action is you have to start to prepare now, right? Don't, don't wait till it's, it's up on you.

Yeah. Um, look, for those who aren't lucky enough to be here at Digits or Trust Summit, where can they access this survey data kind of after today or whatever? Um, so that's a great question.

com. Yeah. Yeah.

So we'll, we'll create a link from the homepage and you can download, download it, and find it. Um, I think in terms of, uh, things that companies can do though, right? Apart from, you know, working directly with Quantum safe algorithms, algorithms is thinking about how they can invest in crypto agility.

So the survey also revealed that 52% of companies right now are, have built an inventory of their cryptographic assets so they know what they have, right? They can start the process of prioritizing what they wanna protect, but that also means that almost half of companies haven't, right? So the call to action is really to get started there, understand what the cryptographic surface area looks like in an organization, and then, um, and then as these standards become available next year, people can start with a high priority items.

Got it. You know, Diane, I, I've been in tech a long time. Yeah.

Not gonna say anything. I'm not gonna fall into that trap. You're not getting me.

But, um, one of the lessons I've learned though, is nice to have doesn't cut it, especially when you're in tougher economic times as much of the tech industry is now. Yeah. Um, nice to have.

Is nice to have. It's not must have. And I think, and it, and it, I I, I suspect it's probably reflected in your survey results and some of which you went over with us is a lot of people do see this as a problem, but it's kind of a problem on the horizon.

Yeah. It is something they want to get out in front of, but in a world where we don't have enough budget dollars for all the initiatives that we want to do, is this the time to invest in it? Yeah.

So that's a great question. And, um, I think the way to think about this is this is a seismic industry event, right? Mm-hmm.

This is going to disrupt and change the underlying encryption for the internet, right? We have to transition everything now. Um, you know, people might say, well, quantum computers aren't here, you know, let's think about it in a couple years.

But the other thing that's happening right alongside it is ai. And so now AI can do a lot of great things for business, but it can also allow bad actors to employ things. Like It could a lot of great things.

Adaptive malware. Yeah. Automated crypto, you know, cyber attacks.

Mm-hmm. So when you think about the increasing threat vector and the risk, right? We're at a point now where people need to invest now because transitioning these algorithms doesn't happen overnight.

It can't just swap out a certificate. Right. You really have to plan for it.

It's gonna take a few years. So the time is now. Absolutely.

You know, this, this reminds me of when we were trying to transition from IP four to IP six, right? Mm-hmm. I mean, so I've been in the internet since it went commercial Yeah.

And back then, So I We're contemporaries, I'll leave it at that. Um, but, you know, you'd get a C class, you get a B class back then, right? I worked at a, we were a large hosting provider roll up.

Mm-hmm. And man, you know, IP four addresses, they were fast and easy. Then it started getting tighter and tighter because, you know, it was sort of a, just in time that we were able to transition to IP six as we were really running low on IP four addresses.

Yeah. I just, you know, my, my gut tells me there's going to be like in every other adoption curve. Yeah.

They'll be the early adopters, the 15%, and then crossing the chasm to mainstream. There'll be a a, a chunk of people who are out ahead or, you know, don't worry. Yeah.

There's going to be a bunch of people though who get caught here. So think about it this way, right? If you've invested in crypto agility, you've secured your most crucial assets, you've, uh, you're prepared to transition things as things become available as certificates wrote out, rotate out, you, you implement the quantum safe certificates, you know, then you are in a position where you're a leader in the industry in terms of, um, security postures that people can trust.

Yeah. Right? We're at the trust summit.

Yeah. Right. And so, um, you know, as we start getting reports of places where people have not invested in their issues, those that have invested are ahead of the curve.

They'll benefit because they will be able to demonstrate that trust to their ecosystem of partners and customers and so On. Absolutely. And, and we should mention these, these, uh, quantum or post quantum al safe algorithms.

Yeah. They're backwards compatible. You could use them.

I mean, if you wanted to use them now, it, it's fine. You know, it works with existing technologies as well. Um, and so there really isn't a reason, so I, I get, look, DigiCert's one of the leaders in the industry, why aren't all your certificates post quantum At this point?

Well, so the standards, the, the draft standards actually Won't Finalized, right? So now the thing that we are, uh, doing right now is, um, standing up roots and issuing test certificates so people can get familiar with the technology. Then when the standards are finalized, then, then that's when, uh, vendors like DigiCert and other companies can implement those algorithms into commercial products.

When do you think we'll see that 2024 is what NIST has? So next Year, yeah, next Year. Next year.

Um, right now it'd be a little bit premature because the standards are still in development. Right, Right. You, you get away for that to be finalized.

Yeah. So that's coming in 2024. You know, there's so much going on with digital certificates.

We're moving the 90 day web certificates. And are we personal? I hope so.

Well, that's what they keep telling me, but I just report, I don't make the news. Uh, but there are things going on. I just say that because, you know, there, there have been continuing drops in validity periods, right?

We went through three years to one year and so forth. And, and that's transformed how people need to think operationally about certificates. But there's, you know, there's cryptographic security around ephemeral certificates all the way to things that last, you know, years in the field.

Mm-hmm. So the, the, the, I think the stance that people have to take is really around having agility in their cryptographic environment. Can I, can I discover what's there?

Can I manage it effectively? Can I automate as much as makes sense in the organization so that I'm reducing the operational burden and improving the, the reducing. I, I think that's really the key right there.

'cause I think a lot of people, they hear about post quantum certificate algorithms. They hear about ephemeral and, and shorter times. Mm-hmm.

And to them, they see one thing. Yeah. Oh my god.

More work. More work. This is, I just want it.

So this is a great time. This is a great, you know, call to action in the industry to actually invest in that area that will make you reduce that burden. So, you know, you think about being concerned about it from a budget perspective, but if you implement that crypto jillion to your organization, you actually make things much more efficient, more secure.

You know, I think it's a, a better posture, uh, both operationally and from a security Perspective. Yeah. No, I mean, you know, this, this is the, the CapEx opex, right?

Right. Yes. Yeah.

Invest a couple of dollars now to save a lot of money mm-hmm. Down the road. And, and not that far down the road.

We're talking in six months down the road maybe. And yeah. Um, I, I, I think smart companies will do that, but I think like every other technology adoption curve I've seen in my life, you know, they'll be the early adopters, the early mainstream, the late mainstream, and the laggards.

Right? It's Just the nature of the beast. So from a consumer perspective, I sure hope the leaders are the ones that are protecting my personal financial information.

Right. And those are the ones you put your, you put your Yeah. You know, no, no pun intended, but you put your trust into Exactly.

And I think that's what people need, need to be thinking about. I want to go back to post Quantum Hook. Okay.

To quantum. Yeah. 'cause this is the question I ask every person I interview on this subject.

Okay. So when do you think we'll see functional quantum computers beyond large intelligence agencies? Well, okay, so, um, you know, perception is an important thing 'cause we can't actually know yet.

But, um, in the survey that most of the respondents said that they believe that they need to be ready inside of five years. Five years. So maybe 20, 28, something like that.

That's not Whole Time. No. Five years goes look, well, especially when you get to a certain age, but let's leave it at that.

It is. Or we're No longer the place that the question is when will quantum computers be here? Right?

Right. The threat is now. So we've gotta, And so I think that's the takeaway, then the threats.

Now the time to get in front of that threat Is now, Is right now. Yeah. com.

Um, Diana, I want to thank you for coming on here and making us a little bit smarter, hopefully out there to everyone. And, uh, for those of you not here at Digit Search Trust is a great survey. It's, it is a very hot topic.

You've gotta be thinking about post Quantum. And you also need, as you mentioned to be thinking about, you know, when you combine AI with this, it, it's like an exponential kind of catalyst. And, and now is the time to be in front of it.

We're gonna take a little break here in Vegas. We're gonna be back in just a minute. It's a pleasure to be here.

Thank you. Thank You, Diana.