Amit Sinha, DigiCert | DigiCert Trust Summit 2023

This is Textron tv. Hey everyone. Welcome back.

We are still live here with our coverage today from the DigiCert Trust Summit in, uh, resort World in, in Las Vegas. You know, I can't tell you. Well, I, I am going to tell you how, how happy we are to be back in person, especially at this event.

com 10 years, maybe six years ago. Uh, this was one of the first events we did. We weren't even streaming live.

'cause Streaming live was dicey. Yeah. That's how quick technology changes.

And, um, and then of course, COVID happened and we weren't able to do these in person. So it's just great to be here in person because no matter how great the virtual software is, it doesn't replace the buzz. Absolutely.

It doesn't replace the, the human to human element that I think we crave as humans. So, happy to be back here. You know, this is kind of our keynote, uh, interview this, this today.

I want to introduce you to a Amit Sinha and meet is the CEO of DigiCert. He's, I mean, he's been on our tech drug TV show from RSA and, and on our Zoom kind of remote a number of times. But it's great to be here in person with you at, at the DigiCert Trust Summit to meet and welcome.

Thank you, Alan. It's, uh, always a pleasure, uh, being on your show. And I echo your sentiment of doing this live.

I think, you know, you and I were chatting, trust starts with, uh, the human behind. Yeah. And humans are social animals.

And, uh, you know, as, as much as Zoom is convenient, uh, nothing beats a live session. So I very much appreciate it. Absolutely.

And we're, we're happy to be out here doing this. So, I mean, I've been talking all day. I spoke to people from Microsoft and Oracle and Amazon, and every, you know, big companies, small companies, DigiCert employees, and look, this is called the DigiCert Trust Conference.

Trust is at the heart, and we talk about digital trust, and, you know, trying to put my finger on what do we mean by digital trust and why is it important? So I'm gonna throw it at you as the CEO mm-Hmm. What does it mean to you when we talk about digital trust and why it's important?

Yeah. No, it's a great question. And, uh, you know, our, the theme of our conference, Alan, is digital trust for the real world.

Mm-Hmm. And the real world is made up of humans and real things. Right.

Uh, for me, digital trust is foundational. It is, uh, what gives us, uh, the sense of security and trust that all of these things that we are doing online as humans are trustworthy. Mm-Hmm.

I mean, look around you. Everyone probably took a plane and came here, right? Yeah.

How do I trust that the airlines, um, flight avionics hasn't been tampered with, right. Uh, we all use all kinds of gadgets and devices in our home. Some of us use critical medical devices.

Sure. And there's a lot of talk about medical devices. I mean, how do I know that device is authentic and software hasn't been tampered with, right.

Uh, I'm sure you do a lot of digital contracts, right? Uh, do you have the same sense of trustworthiness as you did with a notary like document? Probably not.

Right? I mean, you, you pro you, you got a link in an email, you clicked it and you signed it. You know, where's the, will it really stand up in court Right.

If it had to Mm-Hmm. Uh, so how do I, how do I make sure that these documents, content, software, devices, things that I interact with, and I, in many cases, put my life, uh, uh, on the line for are secure and trustworthy? So to me, digital trust is the fabric that makes this all work, you know?

Yeah. In a secure way. So to me, I, I take it apart.

There's the digital part of it, and then there's the trust part of it. Mm-Hmm. And to me, the digital represents the technology.

Mm-Hmm. Right? I, I grew up as a young person in an analog world.

Yes. Right. Even though, look, I was an Apollo age child.

Right. I remember watching the moon walk. I was, I don't know, I was seven or eight years old.

And, um, and we got to the moon with analog, basically. Right. I wasn't very digital.

We've, but we, we are now a digital world, right? Mm-Hmm. Everything's digital or going digital.

Mm-Hmm. But the real power of digital trust to me is trust. Yeah.

Is human is uniquely human. Yeah. Right.

Um, does a machine trust another machine? You know, it's like 2001 is Space Odyssey. Will I dream?

Yeah. You know, I'll ask will I dream? But trust is about people.

A a person trust another person. I, I was mentioning it in one of our last interviews, you know, I wanted to exchange contact info with one of your speakers. Yeah.

And I, I have this little app on my phone with a QR code, and if you scan the QR code Yeah. You get it. Yep.

You get my contact. I thought twice about giving it to the person. Yeah.

Because I was like, well, she trust it. Right. How does she know?

Yeah. Just because I'm giving it to her. How do I know Yeah.

That I did it unknowingly. Yeah. And that to me is, is, and there's big, I mean, that's a small example of just Yeah, yeah, yeah.

But, you know, we talk about there's so much war and, and death and killing going on in the world. A lot of it is with the help of some of our great digital technology. Yeah.

And, and we, we trust this to do so much. And is it misplaced trust as well? Yeah.

Um, you know, we, I, we spoke off camera. One of the things I, it's a generational thing too. I think younger people they want to trust.

Yeah. Yeah. And they grew up in a world where their digital natives.

Yeah. So they, it's very, technology is, you know, it is, they accept it. It's not a gee Wiz thing for you.

Yeah. I mean, look, uh, it is a fact that the analog world was simple Yeah. Relative relatively.

And, and we all are now digital natives, and especially the younger generation, as you mentioned, they don't know an alternate world. Right? Nope.

Um, there's so much information out there. Um, and, and the issue of, of trust is in every aspect, you know, and I can, I can go into examples after examples where, uh, where, uh, being able to establish the, that trust is, has transformative outcomes for businesses. Mm-Hmm.

Uh, it, you know, uh, reduces attack surface. It gives you, um, more durable customers because your customers trust the, and, and frankly, the end user itself, uh, is very, very, uh, uh, happy to use a device or a service that they can trust. Now, lemme give you a few simple examples.

Um, uh, we talked about medical devices earlier, right? I have a continuous glucose monitor. How do I know that?

You know, it's, I can, I, it's working. How do I know that, uh, the software update came from a legitimate source? Uh, I mean, it's a life and death situation, right?

Um, you know, we were joking about, uh, what would happen with generative ai. Um, you know, will we see, uh, down the road, uh, in a court of law people arguing whether crime scene photos were legitimate, original, or have they been doctored with, right. We're coming up on election season and maybe I need to shut down my phone and TV because how do I know what's real and what's fake anymore?

So with all this digital, uh, uh, content and software and devices, you need source authenticity. You need tamper resistance, right? Um, if I see a video on my phone, I need to know that, well, it, it came from this source, and it's originally, you know, a New York Times version and not something that was deep fake, right?

Mm-Hmm. Uh, when I get a document, I should be able to look at the full chain of trust and feel secure that this contract is legitimate. Right.

Um, when I, when I update software on my Mac, I know that it came from Apple, but how do I do that for 75 billion iot devices, right? So it is, And 75 million different AppSec that aren't all by Apple. Exactly.

And I was talking to, uh, a friend of mine at Google, and, uh, you know, they have, uh, they're looking at, uh, uh, AKYD program, know your developer. I mean, how do I know that this Android app developer is in some, some, uh, you know, someone shady, right? Yeah.

No. Working for a nation state or Something. Right?

So more and more, I think, uh, the use case of the human going back to the human, a validated human, you know, doing things, consuming services becomes more and more important. Right. Um, and, uh, and I think that's, that's foundational identity becomes foundational to digital trust.

Oh, yeah. Absolutely. You know, at the same time though, I really feel like we're trying to hit a moving target.

Mm-Hmm. Because generative ai, post quantum Mm-Hmm. Uh, technology is accelerating, not decelerating.

Mm-Hmm. We do anything from anywhere at any time. Mm-Hmm.

That's what people want, and customers demand it. Mm-Hmm. Right.

I, I want this to work. Yeah. And if it doesn't work, I'm not gonna be your customer anymore.

Yeah. Right? There's no second chances in the digital world.

Yeah. And so, I, I think it, it like puts more straws on the camel's back because it makes it harder, you know, just when we think we kinda get our arms around something, the goalposts are moved a little. I mean, look, with great power comes great responsibility, right?

And, uh, yeah. Generative AI is a double-edged sword. Uh, a lot of the digital revolution that we are seeing gives us, um, productivity and efficiency, but it, you know, comes with side effects.

Um, I think, uh, for me, you know, digital trust starts with industry standards, right? You, you look at a problem, you come up with industry standards. Standards are what makes things interoperable.

For example, all of the internet uses TLS standards for, uh, for encrypted communication. When you, when you, when you talk to your bank and you see a little lock icon. Yeah.

All of that is based on TLS standards and DigiCert's a leading provider of, uh, PKI and digital certificates Yeah. That basically, uh, authenticate you and tell you this is the right website and all subsequent communication gets encrypted. Now, the math, uh, to do all of this securely in the digital world remains the same.

It is about standards and then implementing those use cases in a frictionless way. So let's expand on some of these use cases. Now, if you go from there to say, email now, office 365 and Google Workspace, they all support encrypted email.

They're putting anti phishing standards with verified mark certificates, and you can see a logo of your company next to the email. So you know that there's a real PayPal site and not a, a right phishing website, right? Mm-Hmm.

Um, how do I make, um, the same authentication encryption mechanisms available for seamlessly connecting to my wifi, seamlessly connecting to my zero trust environment, right? So more and more people are using standards in, in, um, in, in the expanding digital ecosystem, uh, to improve security, improve privacy, and overall trust. Right?

Now let's take a look at devices. You know, we talked quite a bit about IOT, you know, the White House is now, uh, pushing for standards similar to what you saw with FDA, putting an organic label, right? Yep.

You know, when I, when I, yeah. When I pick up a, um, something, um, from the grocery store and it says organic, and it has a ingredient list, I feel, I feel like this is a higher quality product. Yeah.

Or trusted. Somebody inspected it. Somebody when They tell you it's 40 calories a Serving.

Exactly. Right. So now, um, in, in the digital world, you know, similar, uh, standards are evolving where you have to go through a security check, you have to put what is called an SBO m software bill of materials, which is kinda like your ingredient list, right?

Mm-Hmm. And then you have to sign it. And if you do that, you get a organic, like, you know, mark on your device, right?

So that, again, raises trust in the ecosystem. Now, having said that, it is a bit of a Tom and Jerry cartoon, right? Like, you know, uh, generative AI is, is very powerful.

But the same tools can be used by attackers the other way against you, right? Uh, post quantum can, uh, you know, quantum comput can solve climate modeling and, and, and, uh, problems that, uh, traditional computers can't even touch. That means they can also touch the cryptographic algorithms.

And what takes a regular computer, uh, a thousand years to break, can be potentially broken in this a couple hours. Yeah. Or minutes.

So, so now, uh, that's a new challenge. And, and the, the, the world is responding to it. So NIST now has announced post quantum algorithms, uh, and the IETF, uh, is working on, in DigiCert's actively involved in all of these standards.

In fact, DigiCert, co-chairs, the IETF standard. And our, our goal again, is to start with industry standards that are secure, that are trustworthy design solutions that enable an ecosystem and help our customers, uh, you know, reduce the friction security and trust, uh, need not be orthogonal to user experience and, and, and business outcomes. They shouldn't be.

They should not be. You can have great security and, and, and amazing trust, and that trust is going to give you business outcomes. Like, um, you know, more customers reduce attack surface, reduce outages.

We're trying to make it frictionless and, and, and not make it a cost center, but may, you know, make it a business enabler. Right. May make it a positive.

Yeah. To, to the thing amid, I I wanna ask you now a question as the CEO of DigiCert Mm-Hmm. Everything we've spoken about.

I think it's true. I think our audience recognizes it as DigiCert. You know, it's one thing if I say, trust me, Mm-Hmm.

Hi, I am Alan Shimel from Techstrong. Trust me. Yeah.

This is a joke. I could tell you offline about that, but, uh, okay. You're gonna trust me the same way you're going to trust, you know, a bunch of people, but when we say, where DigiCert trust me.

Yep. That is a little bit of a different Yep. Promise.

A a different statement, a different trust, a different level of trust. Yeah. It's an awesome responsibility.

It is. But as you said, with responsibility, Right? Yeah.

No. Look, you know, someone, someone once told me that, you know, trust is earned in drops and lost in buckets, right? Yeah.

That's Fair. Uh, and, uh, you know, that's stuck with me. And, uh, you know, look, uh, trust takes time.

Trust, uh, is based on, uh, on a history of, of saying what you do and doing what you say. Uh, DigiCert's uh, been in business for over 20 years. We, this year we celebrated our 20th anniversary.

Um, you know, we are, uh, uh, you know, uh, the roots of trust on the internet as a, as a public certificate authority. Uh, and we're, you know, embedded in all kinds of devices and trust packs around the world. Uh, and over the years, uh, you know, we've, we've earned that trust.

Um, and it comes in, in many operational flavors too. Uh, you know, we, uh, we, we drive standards and then we establish baseline requirements, and we audit and comply, uh, you know, significantly over and above the baseline requirements of the standards. Uh, you know, we have 25 plus audits that we do on ourselves, uh, every, every year starting from, you know, web trust to iso to, you know, you name it, right?

Mm-Hmm. Um, and then, um, you know, as we've built and expanded the platform, we have over 80% of Fortune 500 companies as our customers who, who trust us. All the four leading cybersecurity companies, uh, who have arr, well, north of a billion dollars, they rely on dig.

Right? So, uh, we've, uh, you know, we've gained that trust and reputation over time and, uh, and we work extremely hard, uh, to, to maintain it. Um, and having said that, um, it's not just about, I mean, the least risky thing is to do nothing at all.

And, and, you know, everything is air gapped and touch nothing. Mm-Hmm. Uh, but we, we recognize that the world is going through massive transformation and how do we enable our customers, you know, to, to have successful business outcomes?

And, and, you know, that's where we have expanded our platform, DigiCert one, we've kept the, the roots and things very secure, but we are enabled lots of use cases. We now have 153 patents that we have filed, uh, worldwide. Wow.

We, uh, uh, you know, uh, we're, we now operate, uh, in 180 countries. Uh, it's a, it's, it's a growing ecosystem where we have strong foundations and we continue to grow the business on it. I love it.

Fantastic. One last question for you. I mean, most of the people watching, I'm gonna say all of the people watching this live are not here.

Mm-Hmm. 'cause people who are here are in sessions and doing their thing. Maybe when we replay this on text on tv, some of the people will here, will watch it, but most of them are not here.

Mm-Hmm. But nevertheless, they're interested and they're watching this. Mm-Hmm.

What can you tell our audience why they should make sure they come to next year's cer Dig you trust conference? Well, Alan, I'll say, look, this is, uh, where Digital Trust meets the real world, right? Um, many of the sessions that, uh, that have happened, you can see, you know, virtually, but what you miss is the peer-to-peer interaction with real industry experts who have been through your specific journeys and use cases.

So, um, uh, you know, it, it's a complex ecosystem where security first mindset people have to come together to solve a business problem, right? Security is easier than trust. Security is more about follow the NIST guidelines, make sure you don't get attacked.

But trust takes many, many, uh, you know, parts to come together. And that happens when you meet in person, right? Um, you know, we've had, uh, we've had, uh, Microsoft, Oracle, uh, Amazon devices.

Uh, we've had b Braun, we've had Zscaler, we've had so many of these organizations come together. And yes, you can hear about their keynote, but it's when you talk to them in small groups and in breakout sessions about your particular problem. And, and, you know, what, what recommendations do they have?

Or what learning lessons can they share so you don't make the same mistakes, right? That's where the real, uh, learning happens. And the other thing I'd say is, uh, you know, back to the human angle, uh, we are social animals.

Um, meeting in person goes a long way in establishing business trust. Uh, it, uh, it also opens up career opportunities, you know? Sure.

You never know who you might stumble upon next. And, uh, absolutely. And that, uh, is, uh, the next career break that you're looking for.

So, uh, great opportunity to learn to network in person and, uh, uh, really have your specific digital trust needs, uh, talked about. Fantastic. Amid, thank you so much.

I know you, you pulled in a million directions during these couple days, but I want to thank you for taking the time to sit down and talk with us and our audience continued success at Dig You Cert. We'll see you either at another conference or on Zoom, but we'll continue the conversation. Thank you, Alan.

I know you're everywhere and I look forward to seeing you again soon. I always envo enjoy our conversation. Absolutely.

Thank you. And I, and I enjoy speaking with you. Amit Sinha, CEO DigiCert here live in Las Vegas at the DigiCert Trust Conference.

We're gonna take a break as we mic up our next guest, and we'll be back in a little bit. Thank you.