DigiCert Quantum Readiness Award with Marc Himmelberger and Tobias Christen

This is Textron tv. Hey everyone, welcome back to Textron tv, where we've got another great interview lined up for you. Let me introduce you to Mark Kimmel Berger.

Mark is the enterprise security architect at, uh, MGB or migros. And then we've got Tobias Christian, head of enterprise Security Architecture at Migros. Tobias.

Mark, both of you. Welcome to Textron tv. It's great to have you on.

Let's, let's start with this. I said MGB and I said Migros. What's the help?

Help us with the branding here. Yeah, so Migos is a bit of a phenomenon in Switzerland. It's the largest Swiss retailer.

We've around 35% market share. Um, has a highly integrated industry and distribution logics, so it's a completely vertically integrated, um, retailer. Uh, also runs a bank, has the largest health service in network in Switzerland.

But most of all, Switzerland is, um, is, um, is a brand phenomenon because it got very famous for social engagement where Migo sponsors of every year, 1% of its revenue for projects that promote important aspects of Swiss society. That's really got a, a super reputation in the, in the, in the, um, in the citizenship of Switzerland. And then it stretches outside Switzerland and with, with e-commerce, uh, part of its industries outside.

So it's really a, a large conglomerate of companies, about 200 companies. And there is one central company, which is the, is it's the association of all the, of all the corporatives that, um, is like something like a shared service center. And that's where we work.

So that's where the, the, um, chief Information Security offices is also, um, situated. And I report to him and I run the enterprise security architecture team, which has many initiatives, um, from Zero Trust to Quantum Safety. And, and Mark here is, um, is running our Quantum Safety Initiative.

Fantastic. So what is MGB stand for though? MGB stands for Negro, which means the Association of the corporatives.

So it's, uh, GB is, is the, here in the US we would say Inc. Or Corp or something like that, is Something like that. So it's, it's really a co a set of cooperatives that work together and that's why the Association of the Cooperatives, that's the group.

Yes. It's like the group. Yeah, Like Negros group or something.

It is another way we would say in the us. Excellent. And interestingly, and this is, look, this is big 35% right?

Of the Swiss market, a shared IT infrastructure across the wall. Yes and no. I would say the longer, the more, um, so the, there, the corporatives had a lot of liberty for a long time to run their own IT and stuff, but they also realize that it is a thing that you can do once and it serves everyone instead of everyone reinventing it.

So we have more and more, uh, central initiatives, um, particularly in the security business we're, we are going central all the way. Sure, that makes sense to me. Mark, let us welcome you.

We haven't had a chance to say hello. Uh, as Tobias mentioned, you are on the Quantum secure working on the Quantum Security project at migros, but tell us a little bit more about what you do day to day. Um, yes, of course.

Um, also welcome from my side, um, I am working as an enterprise security architect. Um, that means I, um, help, um, IT projects, um, when they're still in the planning phase, um, to achieve kind of early onset milestones to achieve their security goals. So we try to get in early and we try to, um, teach maybe people that are a bit further away from IT or security, um, how they can build a secure project.

That's mostly the day-to-day. And then I'm also still studying at university at ETH Zurich, um, where I'm just finishing up my master's studies in cryptography and computer science. I love it.

That's, that's fantastic. Uh, you know, I've been in security about 30 years. I wasn't always on this side of the camera.

I started a few different companies, venture backed companies, 20, 30 years ago when I was in security. We didn't call it cyber, we called it InfoSec. And no one went to school for it.

There was no school for it. I, it was kind of, you know, you usually were a network guy or maybe you were a help desk guy and you weren't smart enough to step back when they asked for a volunteer to work on security and you got drafted into it, right. And all of a sudden now you're the security guy.

But, um, security's come a long way since then. And now we have people getting their master's degrees and cryptography and, and, and cyber and all of these things. And I think we're all better off as a result of it.

Um, guys, I I wanted to talk about, you know, Migros was a finalist in the recent, uh, awards, uh, awards program that was sponsored by my friends at DigiCert. And I was honored to be a judge in this particular awards. It was their very first Quantum Readiness awards.

And, and what it was is I, I like to think that DigiCert as part of their mission is trying to shine a spotlight on, hey, we need to get in front. Quantum computing is real, right? It, it may not be mainstream yet, it's still prohibitively expensive and everything else, but every day and every month and every week and every year, we're getting closer to this being commercially feasible.

And this isn't the kind of thing you want to wait until it's out there to figure out what it's gonna break, especially when it comes to security, right? Um, so really for one of the first times in my whole career, we're actually trying to get out in front of something. And, you know, the folks at at NIST and, and, and Mitre and some of the other organizations around the world have, you know, pioneered like quantum proof algorithms for instance, right?

So that we don't break our SSL certificate encryption and, and stuff like this, you know, maybe five, 10 years before quantum computing goes mainstream, we think. But we're out there with it. And, and the DigiCert, uh, who probably one of the leaders, if not the leader in the world when it comes to, you know, certificates, digital certificates, et cetera, and encryption and, and uh, protection, um, they came out with this Quantum Readiness Awards to shine a spotlight on organizations that were out in front on this, that were leading by example and by deed.

And that, you know, I'm sure you were both proud to see that Negros was one of the finalists for this year's awards. If you wouldn't mind, and Mark and Tobias, if you wouldn't mind, tell us a little bit what, what was the Negros project that was nominated and made it all the way to the finals here? Yeah, mark, you you wanna start what you actually achieved and why we made it to the Finals?

Um, yeah, absolutely. So the, I I feel like the main achievements, if you like, um, is we created a prototype, um, for quantum safety. So when we started looking at the problems coming up and the threats building up in the quantum computers getting bigger and faster every year, um, we wanted to understand in detail what it could mean to transition to these new algorithms.

Um, so we created a kind of test setup, if you like, um, of different systems, and we try to look at the commonly used protocols like TLS, maybe IPSec, et cetera. And we try to see really what concretely would we have to do to switch to these new algorithms. And that prototype is, for example, something that we created, um, mid to late 2023.

And that's something that we also open sourced, um, for other companies to look at and to consider, oh, I can exactly see these code changes, for example, helped, um, facilitate the migration. And alongside that kind of initial exploration, um, we also started on the policy side. So we're kind of sitting in the governance unit and we also release internal policies, um, telling people what like the minimum baseline is to achieve so we can call our application secure.

And we also started adapting those and setting a timeline. Um, what, um, kind of changes do we want to make for which kinds of services depending on the data that they handle, so that we're ahead of the issue. Very good.

Tobias, anything to add to that? Yeah, I think we, we learned from this, this prototype what it takes. So we had like two, two major takeaways is that we wanted to have, um, hybrid encryption and we wanted to have crypto agility.

And so we, we figured out what it will take our DevSecOps community to go there. And so Mark, um, was was, was creating trainings for them. He was creating, um, the ways how we, we bring it out not only to the dev ecop, um, community, but also to the managers that need to prioritize and need to understand.

So we make management flyers and stuff like that. So the whole thing to, to make a change like that and early change where some people might not understand why it's so important to go early to save money in the end, um, to make that possible. So it's the technical part and it's the communication part.

It's the whole arianna's issue as well. Absolutely. And, and you, you know, the, especially in technology, the further left you can fix something generally the cheaper it is, right?

And here with, when we're talking about quantum, certainly the further out ahead of it that we get, the less of that last minute scramble. Exactly Right? Yeah.

That, that it is almost inevitable with every IT project, right? It always seems, oh, we forgot the last thing until the last moment. So it's good to see us getting out in front on this.

Um, here's a tough question for you. When do you think we'll see quantum in the marketplace, right? So that we, we, you know, luckily you'll, you guys will already be protected there.

Um, well, I'll leave that question too, mark. 'cause we, we, we talked a lot with that. We Step you like a true antigen to bias.

Let me push that downhill to Mark. Okay. The ones I take the easy ones, right?

Exactly. All right, mark. Hey man, you know, someone's gotta do it.

So he falls on you. What, what do I mean? But also look, as a result of this project, I'm sure you made some best guess educated guess as to when this gets real, right?

When this, we're gonna have to deal with it. So what do you think? Let me put it like this.

Um, I'm not in a position because I'm not the one building the quantum computers, um, to kind of really have an understanding what exactly like the challenges on the horizon are in detail. Um, but the number that we're circulating internally is 2030. I think that's a combination from different expert guesses and also some, um, information security organizations around Europe.

So for example, the German BSI, um, and also I think the US government has similar numbers, and the 2030 is kind of, then it could start, maybe you won't see the quantum computer, then maybe it'll be 2035 or 2040. Um, but then there's also the aspect of when will you publicly know that the quantum computers got that big and when will they actually have gotten that big, for example, in secret programs, um, maybe in nation state that you, that you don't hear about in the press and you also want to be ahead of that, right? So for us, it's kind of, um, 20, 30 years still a couple of years away.

And in my estimation, it's enough to make the transition, maybe not in a hundred percent of cases, but in the cases that are most important. And that's enough time to say, this is when we want to achieve it and not cause um, that last minute scramble because it's such a tight time limit. And then if maybe in 2030 we realized that it's still gonna be five years away, that's all right.

We're already secure. Absolutely. So look, I don't hold myself out to be an expert either, though.

I was the judge of, of the, one of the judges for the readiness awards. But let me, um, from what I understand, the the question is we need to reach the threshold. Was it a thousand qubits, a thousand or a hundred?

I forget now, but we, we had to reach a certain amount of qubits for it to be viable. And at one, I wanna say it was a a thousand, and I know we were, I mean, we've been making steady progress, right? 1632, et cetera, et cetera.

So it's a question of how we could hit that threshold. But in speaking to some people, and, and frankly DigiCert has some of the smartest people on this, you're gonna meet. I mean, they really are, they're working hand in hand with the governments around the world.

They have some brilliant people on this. And it's not just a, you know, just because we build a, a computer that has enough qubits to, to compute or, you know, quantumly, that doesn't mean you would literally have software that right. Is written for it and takes advantage of it.

And it's not just going to exist. You probably won't have things that are ju you know, that a quantum computer does. The quantum computer will work hand in hand with traditional computing and some, some things that are best for quantum will be.

So you're going to need, you know, multithreaded software, so to speak, that threads out the quantum necessary computing from non quantum, but then brings that back together. So it, it's not just, oh, I got a computer getting software. And, and on a practical level, getting it to work may very well be the case where, hey, I may have quantum computers in 2030, but it may be 2033 or 2035 until I have commercially viable applications that'll run on both qu, you know, that'll run in a data center.

Right? And, you know, and, and just because in 2030 we have viable quantum computers don't mean they'll be affordable. I I think you're right.

Nation states or we know maybe some nation states are already running these somewhere cracking iPhones or what have you, right? But, um, it, it's going, you know, it it, and that's the part about this is it's a little hazy when in that crystal ball. 'cause generally in technology, we have a hard enough time saying what's gonna happen in 18 months, let alone five years, right?

Five year, five years ago, no one thought about gen ai and that's yet another thing. What effect is Gen AI gonna have on this whole quantum, right? Quantum eng and ai.

Like that's a very powerful combination. Are the, and I'll throw it to you, mark, because you, you are the architect on this, are the plans you are making now AI proof, right? It's one thing to be quantum proof, but is AI going to change the rules on you there?

I am. I'm less partial I think, than you on the synergy of AI and quantum computers. But, um, because to me, um, quantum computers are something that has been coming very slowly for a long time.

So I think the first like thoughts in the direction were like 1980s or nineties. Yeah. Um, but we were still very, very Theoretical At that point.

Yeah. And then already then the discussion started about, hey, um, how would we do encryption in presence of these maybe future devices, these quantum computers? And now we're kind of getting to the point where the, the quantum computers start to actually exist and they start to scale, but still they have a lot of noise and maybe they have 5, 10, 15, 32 physical qubits, but they're still very noisy.

So there's also that aspect, like you can't just go by absolute number of qubits, but they also have a certain quality to them. And then the calculations may be probabilistic. 001% chance at some point.

Um, and that's all kind of, that all combines to this kind of uncertainty in the crystal ball, like you said. And you just wanna get ahead of that and you want to be early enough. And now that we're standardizing these quantum safe, um, encryption Algorithms, You have them available in the next year, why not use them early?

And then we see how progress goes. Excellent. Gentlemen, we're almost out of time.

We're probably over time. I know DigiCert is maintaining their quantum readiness information on their website. Is there anywhere where Migros has a, you know, public information about how you're dealing with quantum readiness?

Or is that something a little closer to, you know, to the cyber kinda, uh, we, we don't make that information public. I think we made one part of it public. That's Mark's work.

He made an open source study. You correct me, put it on GitHub and, um, oh it is. Yeah.

Yeah. Uh, Well, but you tell Mark, where do we, where do we go on GitHub to get this? com/migros, so M-I-G-R-O-S.

And you should gi there should just be one of three projects on there. So not hard to find. That's excellent.

Hey, mark, congratulations. Well, congratulations to you Tobias, and to the whole Negros team for making it to the finals of this year's digit cert thank Quantum Readiness Awards, but also thank you both. Right?

It's because look, this is a project like you said could be 2030, could be 2035, you may not be working there anymore. I hope I'm not, um, or maybe I should hope I am still working. But in any event, you know, this is, this is almost science for the pure science of it in, in many regards, right?

It's cutting edge. It doesn't have a payoff today, but it's something we need to do. And it it's your work that kind of helps push this needle, you know, forward.

So thank you, Thank you for, for sharing, um, and having us here just the last where we, we believe that acting early, you mean we are above old enough that we remember the, the year 2000 and an old word? Yeah, sure. Is that Y 2K bug?

Huh? That was a big project. And, and so we we're, we are old enough to remember that and we, we plan ahead such that doesn't happen again.

Um, we don't wanna be caught. And the effort is the same whether you do it in, in short term or in long term. But if you have a, a very tight project in the end that disrupts the business.

And so we, we believe that all in all, if you count in all the technology replacement that you do automatically with over the next five years getting quantum ready, it really pays off the good start early. Absolutely. The early bird catches the worm as they say.

Goodbye. Mark, thanks for being on Tech Shrunk tv. Thank you to Migros for, for allowing you to come on here.

And of course, thank you to our friends at DigiCert. This Alan Shimmel. We'll be back in a bit.