Digital Trust – Mike Nelson, DigiCert

This is Textron TV. Hey, everyone challenge civil. Welcome back to techstrong TV.

You know, I'm joined by a friend of mine. I he hasn't been on Tech strong with us. I'm gonna say it's gonna be a year Mike.

No, maybe more little over a year. I mean covid's messed with timelines for everybody. But yeah.

What sense of time in covid here's the good news? I'm we're starting to really get out on the road. We're gonna be a cute car in the end of this month and got to go out to Vegas for qualis event and you'll be in Singapore really things are opening up.

I'm excited. How are things been with you Mike? Yeah, things are great.

Thank you. It's really good to see you again. I hope we can connect in person at some point, but things are great.

Did you search doing great and you know the connected World continues to expand which brings new challenges and problems for us to solve and we love that absolutely maybe our estate. I love it. I'll be there that would be a time for you you usually there yet.

You know what Mike I feel like we we really I just say there is my friend Mike. Why don't you tell people you kind of a little bit of your background and what you do it. Did you sir?

Yeah. Thank you. So, I'm at the desert on the vice president of iot security and I lead our go to market up for what?

Doing the strategy to help secure our ever-expanding connected surface with with devices. We work in all critical infrastructure. You know digicert as a leader in digital trust.

Our role is really to help secure the connected world and that's everything from devices to internet and connectivity and and everything in between. And so so that's my role. I I really look through the lens of connected devices, but it just sort you know, we we do a lot more than just that and yeah, it's great.

Absolutely. Did you sir? Of course as a leader in that whole field?

You know Mike we have coming up next month middle and next month. I I don't know. I think it's our sixth or seventh annual devops experience virtual event and this year, you know every year we try to say what's fresh.

What where's the where's the action happening and this year, you know, we we have a couple of themes one is devops at the edge and Beyond and the other is what we're calling the devops of things. Right because you're right the connected world as you called it. Yeah, I forgot what the timeframe is a 2030 or 2025.

There's gonna be 55 or 56 billion. Yeah devices connected to the internet and you know, they're everything from the ones you expect your computer and phone to maybe the ones we Don't expect everything in the smart home in the smart house and all of these connected devices as well as look you go to a hospital. Everything's connected, right all the medical devices and Scientific and Manufacturing.

I mean the it's an explosion. Yep. And like everything else in today's world.

You can't have nice things without security right you we've got to secure these things and oftentimes security starts with fine a device right and and being and having a trust that this device is what it says. It isn't where it is and what it is and so forth and that's really where you guys come in. Yeah.

Um, why not you I mean, I I laid it off with you. There's your problem run with it. No, I mean, hey, I'm enjoying what you're saying.

You're speaking my love language your Allen. Yeah. I mean, you know, we we talk about a digital we talked about digital trust and I get asked a lot kind of what is that and you know digits are really is the largest Trust Company in the world.

We carry a large responsibility with that that responsibility and I I defined digital trust. I think there's a handful of buckets. The first is around standards.

I think that you can achieve standards can help achieve digital trust if standards are created in the right way and so did assertive and standards development bodies in all different Industries. I think we're gonna talk briefly about some exciting ones that have made headlines recently. Um digital trust is also about compliance and operations.

How do you manage your security? How do you do it in a way that is agile that can be updated that you know, because security is a continually evolving game and and building trust in a way that can be agile can be updated and can be made better as technology evolves. Um digital trust is also about trust management having the tools and the ability to manage your security, whether they're credentials like certificates, whether they're processes like code signing having the ability to manage those processes effectively.

And then finally it's having the technology to actually secure to authenticate your connections to encrypt your data to ensure that you're doing that not just with your core, you know, I mean historically it's been about it. Right? It's the it security challenges but now is operational technology is devices get connected making sure that you're extended in the trust to the edge which sounds like is a topic you guys are going to be diving into it that session as well.

Absolutely which is really important and that really makes up the building blocks of digital trust and and did just hurt we play in all of those buckets and we help really to make sure that as the world and of connectivity grows that there are solutions that can scale and help Tumors engage with confidence that those connections can be trusted. I love it. you know and Situations are created equal right and we start talking about, you know devices internet of things kind of devices.

We start talking about stuff taking place at the edge. Though the security issues are relatively kind of the same. It's an issue of trust Etc.

Form factors as such that it makes it. Harder, right. This isn't the same as locking down or putting your certificate.

On a server or a laptop or something or even a phone right the the form factors the headrooms everything else, you know demand. a little bit more attention to detail. Let's call it a little bit.

You know, you got to think a little bit more to make it. fit do its job without Interfering with the underlying functionality of these devices which you know could be Mission critical kind of stuff. Yeah, I mean you think about like a cardiac device that's embedded within a patient has exactly 15 to 20 year battery life, you know running crypto algorithms on that can deplete that battery.

So how do you do security in a way that enables that device to maintain its functionality for the duration that it's intended to but also protects and make sure that you know that that critical life-saving device can't be compromised and you can do that but you have to walk into it in the right way. You have to take the right measures and be really strategic and smart and how you approach that. I absolutely absolutely hey Mike.

I want to focus in you guys release some news recently. Exciting for those for those of us in the home automation. And who is it who doesn't have any home automation it there though.

Look I have a lot of security friends who being security people refuse to put any home automation in the house because they say, you know, the security issues they won't do it, but Overwhelming majority of us are you know, I've already started that move in our moving towards. You know having connected devices at home and there's been some news there. And did you search right in the center of it?

Yeah share a little bit. Yeah, really exciting news. I mean last week the connectivity standards Alliance which many of your you your viewers may know as the zigbee alliance.

They recently went through a rebranding. They're now known as connectivity standard Alliance last week. 0 and matter is that standard that you're referring to, you know, it was about a little over three years ago where some of the tech powers in the smart home space Amazon Google Apple some other Samsung Panasonic and Comcast.

I mean most of them are now on board, but they realize that there was a developing problem, which was what you experienced many consumers were buying smart devices and they were trying to connect him to their Alexa to Google home and some would work in Wouldn't and that lack of interoperability was creating frustration for consumers. I've had that same problem and I have I have 30 to 40 smart home devices in my home and I have frustrating experiences and really delightful experience based on their level of interoperability matters intended to change that matter is a standard that was developed by a collaborative body of over 300 manufacturers of participated in the smart home space. And it's to create interoperability between devices from different manufacturers, which will improve consumer experience.

But it also creates and raises the bar for security which we're really excited about it. It requires a lot of good security best practices, like code signing authenticating connections with certificates having robust and mutable identities that are established early on in the supply chain and they're carried through the life of the device matter really raises the bar for security and this morning we are announcing that digit is the first approved route of trust for matter. And so as of today manufacturers can begin using our technology in production and start deploying devices that have those approved certificates on them, and we're really excited about it.

That that is exciting stuff. Look I'm with you. I also the last time I looked at my wireless router IP table.

I was over 40 over 40 IPS assigned in the house, which from an old Hoster. I was I started hosting business before it was called hosting 1995 96 the idea of using 40 something I pees in my house. Like I got it.

Oh, you know the guy might as well get a Class C over here. But anyway. And I and you know, we spoke off camera.

I I am one of I don't know if I'm weird or normal, but I have apple Amazon and Google devices and and others in my house. So this kind of thing. Is is critical to me?

but also You know, you mentioned the security aspect of it. Back to the devops experience thing. I was talking about before Edge and Beyond devops of things certainly software.

You know is going where it's never gone before or it's going to places and in ways. It's never gone before devops is enabling some of that in the way we're developing but security is sure to follow right because you can't have software out there without the security aspects of it and without getting maybe two technical or if you want to get a little technical. I know you're a technical guy talk to us a little bit about what goes into the security especially around trust and certificate issues around, you know, some of these iot you mentioned the pacemaker, but even you know home Spanish networking devices or other iot what what really are the you know from the digicer point of view.

What's important? Yeah, I mean what you said about devops, I believe something that needs to happen more is that security needs to be built into the DNA of how we make devices right? We think about functionality.

We think about all the improvements that it brings. We really need to make sure that security is part of the devops process. We're thinking about how does it connect?

How do we update? How do we do all of those things in a secure way? I I list three common vulnerabilities with connected devices.

The first one is around the data and if the data in iot is compromised, I believe it's the fastest way for the iot to fail. If we can't trust the data. The magic of iot is all about the data.

We're aggregating data and we're using it to improve the way we operate whether it's in our home or whether it says a business whether you're a farmer monitoring, you know, soil moisture levels. It's all about collecting data that we used to not have to improve the way we operate and if we can't trust that data, I believe it's the quickest route for the iot to fall. Unfortunately.

I believe I hope that that won't happen. So the first is about handling the data and confidential way that's the first vulnerability and you do that through encryption and certificates can be used to make sure that data at rest data and Transit whether it's being moved from a device to the cloud device to a Way making sure that that data is handled in a confidential way. The second vulnerability is keeping the bad guys out.

And how do you do that? You do that through proper authentication you hear you hear talked about a lot good password practices. Well that's important using things like multi-factor authentication.

You need to be doing those but on the back end. You also need to know that when your device connects to a Gateway that that Gateway is trusted when it connects to the cloud that it's trusted and you do that through certificate based authentication and that's something that of course did just provides and so making sure that you're connections whether that's a user connecting to a device or another device connecting or a Gateway making sure that all those connections are properly authenticated. And that addresses the second vulnerability the third one is all about integrity.

And making sure that whether it's software being sent to a device, you know, we see a lot of man in the middle attacks where data that's being sent is intercepted. It's manipulated malware's put on it and then it's delivered to a device and it's corrupt making sure that you can trust those updates through things like code signing is on an absolute critical practice with connected devices. Most regulations today are requiring devices to be updated if you can't update and secure way and ensure the Integrity of those updates you're gonna fail Absolutely, great stuff Mike.

I want to we're running low on time. But I wanted to the matter standard was is public. You guys are the first rude Authority there?

Backward compatibility for people who have devices at home update required for this. What do you think? Yeah, it's a great question.

Um, I know a lot of the tech Giants Amazon and others are gonna be updating devices that are in the field. So your devices at your home Alan could be getting an update in the near future matter carries with it a brand. So there's a little logo that has like three little it's a circle with like three little lines coming off of It new devices coming off the manufacturing line will actually branded with the matter logo.

So when you're shopping as a consumer, you can see that and be like This device is actually going to work more effectively, which is great devices that are Legacy that are already in your home. You'll get a notification as a user when you open the app. It'll say device has been updated.

It is now compliant with the matters standard and so it will be both new devices coming off but also Legacy ones that are out in the field. Great to hear man. It's good to know.

You know, what for all I know they're being updated at my house right now. It's the magic and devops, right? Yeah.

All right. Mike I want to thank you for coming on it's great. Let's not wait a year to have you back.

Well, hopefully I'll see you in April and our say that would be great. But even then you want to come if you got something good before come back and keep us posted. Okay, man.

Awesome Alan. It's so great to connect with. Yeah.

Hold on my hold on. All right. I'm hold on Mike for people who want to get more information on matter in the whole iot certificate thing.

com is there's specific section of the site. They should be looking at Yeah. We actually just we had an educational webinar recently that you can get access to on digital search website.

com and then we have a page that's dedicated to matter. That's easy to navigate to the connectivity standard Alliance also has a website that has a lot of good information. They have a GitHub repository where if you want to dive into the details of the standard you can get in there you can read through the standard the certificate policy all the things that are there are available for public.

So did the search websites full of good information and then the connectivity standard Alliance is another great resource. Perfect. Love it.

Hey, Mike. Thanks for joining us. We'll see you soon.

We're going to take a break here on Tech strung. We'll be back in a minute.