Lakshmi Hanspal, Amazon Devices | DigiCert Trust Summit

This is Textron tv. Hey, everyone. We're back here live at the DigiCert Trust Summit at the Resort World in Las Vegas, continuing our livestream coverage.

We hope you're enjoying it. We had a little break. There was a lot of keynotes and sessions going on, and we're really, really lucky to have this woman join us right now.

Her name is Lakshmi Sal. That's right on. Get that Right.

All right, Lakshmi, well, first of all, welcome to Text Drunk tv and thank you for joining us. Lakshmi literally just came off the stage where she presented earlier today, and we're gonna talk about that, but before we do Lakshmi it, a lot of people in our audience aren't gonna know your background. If you don't mind, give them a little bit of your journey.

Sure. Thank you Alan. It's great to be here at the Trust Summit and with Techstrong as well.

Mm-hmm. I've been, um, you know, in cybersecurity for more than 27 years. Um, and I would say it's a combination of technology and cybersecurity, uh, including engineering functions, product as well as customer enablement.

Um, I tend to summarize my journey with two words, hotel California, check out. I checked in and never checked out. You could never Leave.

Yep. Uh, and the never checking out moment is accompanied by never standing, still with the ever changing threat landscape, but also some of the topics that you already touched upon. And the keynotes also touched upon, uh, new innovations that are upon us.

Of course, generative ai, but challenges up in the horizon, challenges, looking around corners that we need to, uh, have that sense of urgency now. Yeah. And prepare for that now.

So I think it's, it's a very, um, engaging field to be in. And, um, you know, it takes a village. It does it more than a village.

I think. It takes a whole world. Um, but Lakshmi, we, we, I would be negligent if I didn't mention that you're the former global CISO chief, uh, security officer for Amazon devices.

So a lot of experience on the hardware side of things, which is something we don't always get in the cyber world, where we tend to focus on software, supply chain security and SBOs and all, all of these things coming on. Um, we're gonna talk about what you spoke about, but I, I agree with you. I'm also in security a little bit longer than you, but not much.

And I really feel that we're at sort of one of those boundary layer event at times where, you know, I look, I remember when the internet went commercial, right? And then the, the kind of the cloud and all of cloud everything was cloud. And, you know, and I, I really think between ai, generative ai as well as ML AI kind of stuff, and, and some of the newer quantum and some of the newer things that are here, we're on the cusp of like one of these boundary layers where there's gonna be some extinctions, but there's also going to be an explosion.

And, and we were talking off camera, one of the nice things is almost every one of these technologies, it's sort of a Mr. Jekyll Dr. Hy thing, right?

Where there's good pharma Double-sided. Yeah. But it's a double-sided, right?

It's a double-sided edge of, of sort. We're gonna jump into those, but first Yeah, I think we'd be negligent. We gotta tell people what did you talk about today?

Yeah. So my journey in my career has been across a number of fields, uh, software, hardware, um, you know, products, engineering, technology transformations, operational aspects. Today my focus was in understanding the sense of urgency with which we need to secure, and I dunno, billions and billions of devices.

Some mission critical, some, uh, infrastructure critical, many of them commerce critical. Mm-hmm. Operational critical as well.

I spoke, I gave examples all the way ranging from, um, infotainment, you know, like Alexa to, um, satellites in the sky to, um, to, you know, the next set of devices that we're thinking about with augmented reality and virtual reality. Um, so the sense of urgency upon us to secure it. Now, this is not a next gen problem, this is a now problem.

Uh, and my, um, keynote focused on three sets of messaging. One that we need effective consortium efforts to do this at larger scale within the industry. This is not a, I can do it alone.

Yep. On my own model or solution. I agree.

And digital trust is about humans and processes interacting in an ecosystem where frictionless security and compliance is intrinsic. That is built in, not bolted on. Right.

So that's the model we're talking about here. So first consortium method. The second is public private partnership sector partnership.

Why is this important? A because reg, you know, public sector, you know, the NIST came up with the first post quantum crypto standard a couple of months ago after this is after several years, seven or more years of debate and discussion, right? So these help to fuel private sector, um, solutions, compliance, innovation, all of that.

So public, uh, private partnership as a tide that lifts all boats. And the third is that we need to have this never standing still moment and a c continu continuum added so that we can address the challenges of tomorrow, today with agility and humility. You packed a lot in there, ma'am.

Let, let's try to take apart a little bit at a time. So, so first of all, I, I, I, I couldn't agree more. The, the, the world we live in today.

You know, one of the problems in society today in general, not just security, is we always look for simple solutions to very complex problems. And we're not children. The world doesn't work like that as much as we'd all love it to sometimes complex problems need complex solutions with big, big ideas, big implementation, big lift.

And so I don't care how big you are, whether you're, you know, Google or Amazon or, or Meta or, or Apple or, you know mm-hmm. Any of those tech giants, even they aren't big enough. We, it, it has to be, it takes everyone and, and to really do it at that scale, I think you must have public private partnerships.

I, I will commend, like, I, I thought what the, the recent work, not just recent, over the last couple years, even proceeding the, the president administration at csa. Yeah. Right.

Uh, C i s A has, has really been the best example in our country here mm-hmm. Of public private cooperation when it comes to, to cyber. I think e the EU in general is probably three years ahead of us.

And they, I think they have a much, a much more defined sense of, Hey, we gotta get this done because it's important. And yes, there are privacy issues and they take privacy very seriously, but, but things like, uh, a universal wallet and digital wallet mm-hmm. Stuff like that.

They're privacy. Yes, they do privacy, but yes, they'll have universal wallets. Another great example of, I I think public private working together.

Um, And we've had some executive orders that have helped really cause in the Last couple years, Right. As, and I think you are, uh, you've spoken to someone about sbo m uh, also, which is paving with the whole software creating paved pots supply chain. Yeah.

Yeah. I mean, it's fantastic. It, it is not enough.

I, I think, so I'm, I'm of, I'm of an age of a generation where, you know, we send people to the moon because the government did it. We can't expect the government to do our moonshot for us, but we need their help to do this moonshot. And I think the other thing you said, and I I really want to emphasize that to our audience is the time to do this is now security is, is not the thing.

You, you don't close the barn door after the cows have run out. You, you gotta have that door locking mechanism in place. And it's, it's important.

So let me put it, throw it back to you now though. You mentioned a whole bunch of things. How do we prioritize?

What do you think are the biggest challenges? Where do we put our money, where our mouth is kind of, where do we make our betts that we're going to get, you know, what's the most priority for us to, to be working on? I think it's, it's important, um, in any journey to what I call back to basics.

Mm-hmm. So, you know, it's important for each of us, and we're in Q four for many comp, many companies Q four and then Q one. So before we head into Q one and the new year to evaluate what that, back to basics non-negotiables look like, and this could be, you know, anything between device hygiene, supply supply chain hygiene, um, uh, uh, software stack hygiene, could be any of that.

But I think it's important to evaluate some of those. What is those non-negotiable back to basics that we wanna get brilliant at. It's called brilliant at basics, right?

Mm-hmm. Important exercise to go through, um, periodically with how we operate. The second aspect here is to look at what challenges are coming our way, whether we believe we are ready or not.

Because sometimes customer ambitious appetites pushes organizations to that readiness. Sometimes it's partnerships that have value addition. And, and, and sometimes it is, oh, we need to deliver this at scale.

And this is not a throwing people and money at the problem equation, right? The scale has to come differently, right? So whichever, and a combination of these factors being, uh, the genesis, I think it's important to look at how we do this and think, so first is brilliant.

A basic second is what's different. Mm-hmm. Right?

Uh, and, uh, and the third one is what's next? So what's different with current, I call this, um, co status cotis. Okay.

How do we, where do we go from here? Right? So co status, what's now, what's different?

Covas, where are we going next? Next? So as I sit here today, what, what's current?

Like what, what's my current Thanks. I think you're right. We, we put a lot on software security, the SS bombs and, and these kinds of things.

Um, I can't help but think though that some of the technologies on the horizon are gonna render a lot of what we're trying to do now. Meaningless. Mm-hmm.

Uh, you know, like paper tigers. Um, I think generative AI is, is probably in terms of what's next. I think that's the thing.

Keeping a lot of people up at night, though. I'm, I'm a glass half full. Like, that to me is a half full glass.

Right? I, I think we could use harness this stuff to, to really help us improve it. But that's me.

As with anything like qu quantum compute. Yeah. Another thing, um, you know, what bums me out though is when I talk to people in the quantum computing realm, they, they, they dampen expectations.

They're like, yeah, no, it's not, It's not a workable model is Yeah. We're not, we're not there yet. Yeah.

Um, and as you know, as someone, again, I think we're spoiled. So I'm at the end of the baby boomer generation, right. To us, technology solves everything.

Right? Sooner or later, our technology will solve it. And it just can't happen fast enough.

And I think with quantum especially, look, we've heard about it now for a while. When's it getting real? Right?

I saw the, uh, was it in an I B M think event a couple of years ago? It looked like a very fancy espresso cappuccino machine. It was all copper with all pipes coming out of it and everything.

And I was like, wow, that's a quantum computer. I can't believe I've seen a quantum computer. I mean, does it make cappuccino?

I don't know. Or espresso. But I don't think it does quant, you know, quite the quantum I was looking for.

Uh, so when, and, and I think that's the biggest problem, especially in private industry. Public governments could afford to be dreamers, private industry, if you're gonna dream, there's a price tag attached to it. Yeah.

And we need to be planners, right? Mm-hmm. I call it the, we can have a, I have a dream speech.

Yeah. Followed by I have a plan also. Um, and I think that's important and that's the balance, uh, to strike.

So two topics that you will continue to hear in, uh, anticipate hearing in the trust summit, r s a next year or anything in between that's coming between now and R S A is going to be post quantum crypto and how to be, um, compliant or ready for post quantum crypto or quantum safe compute. Mm-hmm. There are different ways to call it.

And you talked about generative AI already, right? Both of these can, um, make, um, some of what we think is unsolvable today just within reach for us. And, but both of these technologies can also break many of current solutions that are working that we, that we could take an approach.

Yeah. If it ain't broke, don't fix it. Right.

But we'll wait Until we have to. Exactly. And I think that is where the, um, the sense of urgency, the sense of now, and it is us.

It's not the next gen workforce that's gonna, like I have teenagers, this is not my children's problem to go solve it. Right. Because it will very well manifest too late within our career lifetime.

Uh, now part of the next gen workforce, gen Z, all of that is guiding, is influencing, is shaping what we need to be ready for. Like you mentioned digital wallets, right? Uh, uh, in, I think in a, some, one of our off-camera conversations, that's clearly the direction they're going.

I mean, this is a generation that knows not how to handle cash. Yep. Has no clue on card transactions.

They're always, uh, c N p mm-hmm. Uh, transactions. And, uh, and also just, uh, you knows Seamless.

I think that's, so they're gonna guide where I know today I mentioned that we're going to, we're we're operating in an ever ambitious world where customers are just want the next thing, the next and the next. Right. And, and enterprises want to deliver to that scale, and partners want to provide value addition to all of this.

So how does the digital trust model, again, coming back to built in, not bolted on, because when we think about bolted on, that's when we get caught on our back foot. But that, but that was security for most of both of our careers. Yes.

Yeah. Highly bolted on Yeah. Afterthought.

Uh, so the built in embedded mechanisms, how are we thinking about it both in hardware, both in software, in our supply chain, in our partnerships, in every interaction that we have and in every tech stack choice that we make? You mentioned cloud, uh, but it could be another tech stack choice as well. Edge everything.

So again, packed a lot of stuff in there. Right. But so you're right.

Customers not only do they want the latest, they demand it. If my internet doesn't work on the plane, I'm giving it a one star as a flight. Right.

It was a terrible flight. 'cause I didn't have, even Though the food was, The food was great, service was great, but I couldn't do my email. And I was isolated for three and a half hours.

Unacceptable. Think back to when I remember when people used to smoke on planes and I was hiding not to breathe that stuff. But, um, you know, it, it, it, they want what they want.

Um, But I have to say, Alan, um, I took a cross Pacific flight to Tokyo, San Francisco, Tokyo, and it was Hawaiian Airlines. Mm-hmm. And part of the principle of Hawaiian Airlines, because they operate an island time, I've, I've, I've flown them many times.

Times internet, no Internet. I was quite refreshing, by the way, only If it's an overnight flight. I stayed Far away.

I made sure I was separated by two rows from my teenagers. Oh, really? Yeah.

Because they must you Raised on the flight. I may not know them. Did they do?

Yeah. Uh, They might have been looking for parachutes. Yeah.

I don't know how my, my kids would either. They just, this is what they come Yeah. They've come to expect.

Um, the Bolton versus builtin is, is another important part of it. So look, I'm, I'm not here to be go play in front of your own house, you old men, right? Mm-hmm.

That's not what I'm saying. I, I think we've made a tremendous amount of progress in security over the last 10 years in building it in, I think the whole DevOps DevSecOps movement where we're saying, Hey, developers, we're, you know, you don't have to be a security professional, but security has to be on your mind when you we're developing. Security has to be on our mind when we're testing pre-release.

And, and, you know, C I C D and all that, so forth, supply chain, um, security has to be on our mind when we're designing all of these hardware devices, you know, that are, whether they're in space, under the ocean, on the top of Kilimanjaro or anywhere else they are, security has to be part of that equation. And more so within hardware, because it poses some unique challenges. You know, we talked about hardware devices having longer lifespans, seven to 10 years.

Uh, they could be an inaccessible, uh, places like low Earth orbit. They could be, um, connected devices that could be offline and inline. Um, and of course they have that hardware sort of component.

And not all updates can be over the air. So what your choices, the design choices there. Sometimes, you know, we, we always talk about when we are developing something one-way doors and two-way doors.

Mm-hmm. Right? And you want to have a design that has a lot of two-way doors.

You can go revisit your choice of, you know, selection. But in hardware, sometimes you have to make very critical one-way door decisions. And this is where, um, I think making that thoughtful, deliberate decision with experience really pays off.

And you can see the, uh, differentiators within the industry when they do this Well, and, and the ones that are this what we don't. Yeah. So like everything else in security though, it's not just the technology, it's the people.

You know, I remember, I, I started a security company based in Boulder years ago. One of our big customers was the Department of Interior. Mm-hmm.

US Department of Interior, US Geological Survey. So these people literally have sensors everywhere from the bottom of the oceans to the Mountains, Top of the mountains. We went in there to talk to them about security, unlike earthquake sensors and stuff like this.

Mm-hmm. Their attitude is, look, we're scientists. Everyone has to have access to this data.

We can't lock it down. We can't secure that and cut out people's access to this very, very critical scientific data. Okay.

But when some terrorist wants to take it down and blind you to what's going on, just because they can, or, you know mm-hmm. There's a geopolitical reason for it, then what are you gonna, you're gonna go back down there and replant, you know, reset up all of these devices. So a large part of our, I think we have to have a mindset of a, and I hate to be a cliche, but secure By default.

Security. Yeah. Security first.

Security by Default. By default. Yeah.

And you know, I've, um, over the last five or eight years, uh, I've been talking about this, you know, we've been in an era where we said, we'll teach people how to fish. Right? Right.

Now I'm all about delivering the fish. Just Feed 'em, fish, Just delivering the fish. Get builder, um, builder joy, developer joy by feeding them the fish.

Love it. I love it. And that's okay, right?

Because it's, you know, we have to look at our superpowers, right? We're teaching someone else our superpowers. I think it's important to be aware, savvy, and agile uhhuh.

But when it comes to the experts to deliver it as in be, have that developer mindset, have that build a mindset to enable every part of your organization it's okay to deliver the fish. I love it. I, I agree with you.

Look, if I end this right now, I want you to remember that deliver the fish. But there's one other topic I gotta ask you. So I don't know if you've ever been at any digits or trust summits before, but I wanted to kind of get your impression so far of, of what do you, what are you hearing from people?

What are you seeing? What feedback are you getting? What have you know, have you observed?

So this is my first time to this trust summit. Mm-hmm. And the energy in the room is palpable.

Really. It's amazing. I think it's, it's highly engaging.

Uh, everybody wants to understand, Hey, how are you doing? It's like a, I see that. I said we can't do this alone.

We are neither alone in this is important to understand. Right. Our, sometimes we wanna think our problems at, at scale and complexity are unique.

And then you talk and you say, ah, it's not that unique after all. Right? So come on, sit into therapy with me.

Right. We, We all could use solo therapy. So secondly, so a, I think that the sharing helps us create that, a common understanding that we, we, we tend to have the same problems.

B it's like, okay, group therapy, we can have that. But more importantly, it is understanding what are the tools, technologies, capabilities available. Whether it is, um, lift, shift, pivot, like I can take it and deploy it.

I can take it, customize it, or I can create it. And this is what I, you know, uh, is called the maker shaper taker phenomena. The makers are the ones that are going to create, be innovative and create good solutions from scratch.

Mm-hmm. The shapers will take some of the maker models and customize it to what we want. But there's gonna be a lot of takers that say, that works for me.

I will just lift, shift, pivot, drop it in my environment. So where are we gonna be takers? We have to think about that.

Where are we going to be shapers, where we can customize something that's already available, but to our, you know, we could be a pharmaceutical or some, you know, biotech company that needs a particular customization. And then, uh, it's also important to think where do we have superpowers to be the makers within this industry? So, I agree with you.

I think that's, we're gonna talk more about that in the summit, I think. I hope so. Lakshmi, thank you so much for coming on here today.

I, I know our time goes like that, but, um, look, there, I, I think did, youer was, it was a coup to have you as a, as a, as a speaker, continued success. It do. Come on text, on tv.

I think our audience would love to hear more from you. Thank you for the opportunity. Alright, we're gonna take a break here.

We'll be back in about a minute or two with our next guest. Live at the Digi Search Trust Summit in Las Vegas.