Digital Trust Survey – Mike Nelson, DigiCert

This is texturung TV. Hey everyone, welcome back here to Tech strong TV. My next guest on texture on TV is my friend.

Mike Nelson. Mike has been doing Tech strong TV interviews with me. I think before we add text drug TV.

Going back to digicert conferences user conferences, and he's always always up for an interview. Hey, Mike, welcome back. How are you Alan?

It's always fun to be with you and always appreciate getting on and having these fun discussions at you. So thanks for having me back. Absolutely, Mike.

We're going to talk about digital trust today. And we I know you guys had recently done a survey and report on it. But before we do that, I you know, not everyone out here.

Maybe is familiar with digits or even though it's So I mean 800 pound gorilla in your space. Why don't we why don't we level set that, you know, give a short bit of the digit story. Hey, you know, I always like talking about digicer and what we're doing so I'm happy to do that.

Yeah. So we're danger shirt. I'm the vice president of iot security at digital and I lead our go to market and efforts that we do in that space digicert and the core of our mission is what we call digital trust and as the world becomes more connected Alan, you know, and your audience knows that everything in our lives becoming connected and as connectivity continues to increase it's important that we engage in that connectivity and secure way and that really is the mission of digicert digital trust.

And so whether you're engaging and online transactions, whether you're signing digital documents whether you're signing code or software firmware that's going to an iot device. Or whether you're enabling a smart home device to monitor your temperature inside your home or to open your garage door, all of that connectivity creates great improvements in our life, but it needs to be secure and dig a certain has a wide Suite of products that we offer our customers to help businesses and consumers engage in that connectivity in a secure way. I love it fantastic and even included your background there.

I'm we're ready to rock and roll. All right, let's go. So Mike we we talk about digital Trust.

Right, let's Baseline that and and then you know, we'll connected you sir to digital trust and and then we'll get into the survey if that's good for you. Yeah. Yeah, absolutely.

I mean it's like, you know, I mean we've talked about the growing numbers of connected device, right the lenses the lens that I typically look at security just because of the role that I play it digital service through the lens of connected devices and you know the threat landscape there is just growing immensely, right? I mean smart devices are popping up your cars are connected Smart Homes. I wear medical devices on me that are connected most family members people know are most people have a family member.

I should say that is using a connected device. And so the connectivity is just growing rapidly. I mean you think about what happened even during covid and how you know Enterprises had to shift from We're securing the Walls Within the walls of our Enterprise now to thinking about remote employees and remote connectivity and how do you establish secure connections with employees that are around the globe working from home.

How do you sign documents in a digital way, you know document signing grew dramatically through covid is businesses had to figure out how to execute contracts and sign things digitally and so that connectivity in the way that we're engaging online is continuing to it expand and you know, it did certain we consider ourselves an innovator and in industry leader in digital trust. And so we're constantly monitoring that connectivity and coming up with Solutions and expanding our product portfolio to help us solve more of those digital trust challenges that are Customers are facing. Absolutely.

Look, we we're seeing it here. Mike Beyond even security. You know, we call it the devops of things and and the edge of course is become a huge.

A new frontier and you know the the yin and the Yang the good in the bed of all of these new. devices and edges and computing Stacks if you will is it gives us more we're more connected we're able to do more see more coordinate more. But every single thing we add ads yet another attack surface yet another Factor.

And and so we're we're constantly. I mean, it's why we can't have nice things right for all these great things. We wind up saying okay.

Well, what are we going to do to secure them because someone's able to use it the wrong way. Yeah. Hey you raise an interesting one out and I question for you.

I mean, how do you think I think the devops space is such it's an area that I can needs a lot of attention right now. I'm curious to think get your thoughts on that. I mean you feel like what you're seeing is enhancements and improvements there.

Do you feel like the devops process still needs? You know, we're talking generally here. But how are you feeling about that space?

com in 2013 started 2014. You know when I first started I got into it because of security. I thought the devops represented a way for us to do better insecurity and it has right those whole rise of so called deaf secops shift left and all of the things involved in it making security tools for non-security people for developers and testers.

It's all it's all good all goodness, and it's It's increased the level of the quality of the software we release. I think Mark andresen's software is eating the world has come to pass software has eaten the world. Devops is helping digest it right.

That's how we do software now. That's how we That's how we do it. But I also think the mission of devops is greatly expanded.

It's no longer just bringing Devon Ops and breaking down that silo. It is the cicd pipeline. It is software as a factory.

But it doesn't end at deployment. right It's those feedback loops and iterations and and you know. Circulate that infinity loop that you often see with devops.

It's real and and as we're moving the to things. Right things today. I mean look think back Mike when you know, I was in security 20 years ago when we talk about connected things we were talking about simple like scada devices that we're open close.

That's not what things are today. I mean there are a lot of things that are still open close, but that's not that's not what they are today today. These things are much smarter much much more capable.

They have much more Headroom on them to do Computing on they run more sophisticated software that's being built with devops, but they have to be built and designed by Design to do secure. Functionality and how do we secure these things? Yeah, we need did you search mission is your front and center there?

Right? Yeah, and that's you know, that's why I ask you that is I'm glad to hear that you I love the things that you're talking about and how the role of devops is evolving and the challenges that they're solving is are growing and becoming more complex and challenging digit is doing a lot of work in the devops space to bring you know, we have a very robust signing manager that integrates into workflows for devops and cicd that you know, the things that you're talking about there so important and it's been focus of just right now and you know good devops is you said really helps. It's the starting point for good security once things are deployed and you have to have that and I think that you know as as we shift now, maybe we can You know this survey that we we did recently we called it.

It's the 2022 state of digital trust survey that was conducted by digital. We learned a lot some devops but just at a high level. I think the way we approached the survey was was pretty neat.

We we didn't just talk to businesses. We we interviewed over 400 businesses and we were targeting individuals who were involved in security who are involved in devops it security OT security but over 400 from organizations over a thousand. So I think a good sample size globally distributed, but then we did the same thing with consumers.

So we went out we talked to Consumers and ask them their feelings of where things are with digital trust and same thing global distribution age distribution gender political affiliation. We had a wide range that we cast our net to and it was really interesting to compare Where Enterprises think they are with digital trust and how much their consumers trust them compared to what the consumers actually said about how much they're trusting the businesses that they're engaging in it. It was quite startling some of the things that we learned there.

And and what we learned is there's a disconnect Alan. There's Enterprises Trend to think that they're doing better with digital trust than their consumers actually believe they're really doing and that's that's quite startling to me, but but it it's it's a data point that I think Enterprise is really need to pay attention to because You know in the world of security it's really easy to think that everything's going well that you're doing the right things until something bad happens. And I think I think too many times consumers are being hit by cyber breaches.

And when that happens their trust is lost and they create it creates skepticism and it creates a lack of trust for them to engage with those those Enterprises. And so, you know that disconnect between Enterprises and what they're thinking and how good they're doing and what consumers are feeling is a really interesting disconnect. absolutely, you know Mike it's funny you you talking about Enterprises and consumers.

It's almost like a dumbbell equation, right? You got these two big things here and and the bar connecting them. But is there a bar connecting them like what I mean?

There are some things that I guess a universal. Right that that applied to both. But is there enough?

I mean, so when you look at it as did you sir. Obviously two different markets are they two different products altogether two different priority lists. How much is overlap?

How much can I reuse? Yeah, right. So they're yeah they're they're certainly is overlap.

I mean, I think one common can one commonality between them is they're both attacked Enterprises get attacked and consumers get attacked our survey found that 57% of consumers have experienced a cyber breach and that could be anything from account hacked password exposure financial data being compromised or stolen but 57% of consumers have experienced us a cyber breach the number I don't think is quite as high on for Enterprises, but many of them have and they when Enterprises get breached those things make the news right and so it's great. I think I think that for us the fact consumer awareness is being heightened on a cyber front the fact that 57% have experienced breaches. Another really compelling stat that we got from the survey said that of those consumers that we interviewed 87% of them said following a breach and Trust they would switch.

Companies they would switch to a different jump in. Okay, so first of all, I think that 57% number. represents consumers who either admit to a breach yeah or know they had a breach I would bet the number of actual consumers who who in fact did have a breach it's probably close to 85% or 90% And they just don't even know it.

Yeah, right because maybe it didn't hit him in the pocketbook or you know didn't rise to that level but they've been breached. I mean it's happened. It's happened.

Even if we Define it as a password still. Yeah, right. They've been breached.

Yeah, actually, I mean how many times has been leaked? Yeah. I mean how many times I use a good password keeper and it's it's common when I log in that says hey there was a data breach at this company.

Your credentials may have been compromised most consumers even if that's where people itself right? Yeah. Yeah, bro good.

Yeah, I mean most whenever million. Yeah, exactly. So I think the numbers much higher.

Yeah number two. And this kind of bums me out, but the as much as we don't want to admit it. The public's memory or Yeah there.

The you know you Equifax got breached today everybody Equifax Equifax Equifax, right? So until Experian got breach then they figure out about Equifax. Our memories collectively as consumers are very short.

So yes, they all say, oh, I would never I'm gonna really think about doing business or the company that was breached until the next time they may season running a sale then they forget Macy's out of breach and I don't mean to me. Yes. No.

Yeah, but but that's how consumers are there fickle. They're really fickle and if we look at stock prices of public companies who've had breaches. Generally speaking a year later.

It's a blip on the radar. Yeah. Yeah.

I I agree consumers have short memory on that kind of stuff and and consumers trust and and I actually I say this a lot but I still consumers have the right to trust. Which puts more of the burden on Enterprises and manufacturers who are making these devices or building these systems to make sure that they're doing secure devops that they're integrating security into the way that they do business to your point that you made earlier quality. Yeah, you have quality has to be associated with security.

It's like, you know, I mean the old seat belts in the car analogy. It's like at what point are we going to start requiring good security to be baked into the DNA of our connected world we have to do it. and afterwards I'm sorry, Mike.

I don't need to cut you off but I think the onus lies on the companies. Let's talk about cars. For example.

Yeah, it's not seat belts anymore. It's the 400 exactly different processors in the series here. Right and the seven million lines of code and all of that.

You know where you can I think it was the TV show Tehran. On Apple TV right where they were able to remotely control the brakes on a car. Yeah, because it's all controlled by chips, right and you can you and all these cars are connected.

Yeah, so You can't expect to Consumer to say geez. I hope my BMW is is not hackable. Yeah, okay on the consumer design.

I hope my pacemakers not hackable. Yeah, exactly. And that's where you know, I think the survey tells us that consumers are starting to pay attention to cyber if your company is involved in a breach consumers are much less likely to do business with you 40 another really cool step 47% of consumers.

Who have experienced a breach with a company moved away from that company almost 50% So if you're experiencing a breach you are losing customers, you're losing their trust and that trust causes consumers to move away from you. And so, you know message to Enterprise today or manufacture Whatever You're Building Products and selling consumers consumers are paying attention to security. They're willing to switch Brands.

They're willing to leave you if you do not honor the trust that they are that they are giving you. I I don't disagree. and Mike the other thing is You know, they're a breaches and they're breaches.

My debit card got breached. They sent me a new one my password on my football league got reached. No big deal.

I changed passwords. But when we start talking about cars medical devices, yeah some of these other connected devices. You know, whether it be critical infrastructure or life and death kind of stuff these these are not.

Oh my God, I'm just gonna switch brands. These are these are the life-altering event. Yes, right.

It's hard to take a cardiac device that's embedded in your chest and go replace it with a new one. Yeah. Oh my yeah, you know, I need it update, you know, but but a lot of those cardiac devices ability in your chest are updateable now.

Yeah, they are. online and and this is I mean, it's scary quite frankly. so I I think we made this point what what other good stuff in the survey do you want to bring up?

Well, I think that I highlighted some of the key points and I you know. Enterprises need to pay attention and be aware of the consumers are paying attention to it and the trust that you the trust that they have in you. First of all, there's they're skeptical and they don't think you're doing as well as you're doing.

but they're also willing to walk away from you if you lose their trust and and that's just something that can be establishing can be maintained if you're doing the right things and so you know, I think that the last thing we have a handful of recommendations for for our audience based on the findings. And the first one is something that we've kind of touched on Alan, but it's really to make digital trust a strategic imperative for your company. And I I talked about it.

I say bacon into the DNA the way you operate your devops process your deployment process your management your ongoing management everything that you're doing. You need to think about security because your business is becoming more and more connected everything that you're doing. And so you need to make sure that you have a strategic comparative that says digital trust is a top priority for our company and then have the right resources who have strict who have autonomy to make decisions and do the right things.

To actually change things when you're doing things in a way that could compromise the trust of your consumers. and I think that I think we're starting to see a shift more product security teams it you're seeing more cisos and leaders and organizations actually emerge and I think that's a good thing. But I think we still have work to do there.

Absolutely. My yeah, go ahead. No, no you go.

Yeah, well, I was just gonna move to next one the next recommendation and and I talked about it here, but it's it's don't pretend like your consumers are not paying attention. If you think your consumers are blind to cyber you're wrong what we have found at to your point Allen. I think even higher but 57% have said we have been breached and following that breach.

We lost Trust of that company and it caused us compelled us to move to another company. Um, if you want to lose customers lose their trust and and if you don't fortify your organization your Enterprise and do the right things and and that really gets down another challenge that I'm sure you're aware of but you know the Enterprises that we interviewed one of the questions we asked was what are the challenges for doing security right way and many of them responded and said lack of town lack of resources who know how to do it. And so when you don't know how to do it and this is a Shameless plug for companies like digital reach out to experts who know how to help you navigate some of those challenges whether it's establishing a secure devops process where whether it's figuring out how to provision certificates to connect to devices in the field or how to set up process for cure for secure code signing and managing credentials.

So you have rights management and access management and all those great things. If you don't know how to do it their organizations who can help you do it in a way that's controlled and and help you grow into that and and finally owned the burden of security don't pretend like it's someone else's responsibility organization organizations need to act with responsibility to say, this is our problem. It's not our consumers problem.

It's not my neighbor's problem. This is our problem. And as soon as you take that accountability in that ownership, then you can start doing those other things like enabling or embedding security into the way you operate as a business and all of those things are going to result in customers that trust you and happy customer base.

And so I think that's the takeaway. I think that is I think number three Mike is number one. Right when you realize it's your responsibility, and then you start taking responsibility.

That trust comes with it and you know what living and we're running out of time but trust is something that predates cyber. When you bought Heinz Ketchup, you bought Heinz Ketchup because it wasn't the store brand that was watery or full of sugar. It was really good ketchup.

That's a form of trust right? You trusted the quality. of that brand of that product Today cyber's part of that trust equation and I think that's what people need to take out.

Like for people want to get more information. Where do they go on this our website? Yeah.

com and you can find we have links in there where you can go and you can dive in a lot of other findings that we had about Enterprise and how they're handling security problems. They're having and consumers. com and you'll be able to find a link to more information on it.

I love it, man. Hey, are you appreciate you improvising here for those who don't know my channel. We had a little internet connection problem and we did this on his phone.

So yes, we could use it on an Apple commercial shot on an iPhone. But like I appreciate it. I hope to see you soon, man and stay well.

Awesome. Alan always fun to connect with you. Thanks for having me on.

All right, Mike Nelson. Did you hear on tight strong TV? Go check out their digital trust survey.

And we'll be back.