Season 2, Episode 11: When Will Quantum Computing Break 256-bit Encryption?

Hi, I'm John Maxwell. When the top companies in the world are looking for trainers, speakers, and coaches, there's one name that stands above the rest, and that's Maxwell Leadership. Our certified team members have gotten proven results for companies all over the globe, and our reputation, I'm proud to say, is second to none. Some of our members have risen to the top of their profession, including the one you're going to meet today. I proudly introduce you to my friend, Bob Fabien Zinga.

Welcome to the Leadership and Success Podcast with your host, Coach BZ. If you need to develop into a better leader, this podcast is for you. If you want to achieve a greater level of success, this podcast is for you. His mentor, Dr. John C. Maxwell, said it best: everything rises and falls on leadership. We hope to inspire you today and provide you with an insight that has the potential to positively impact the trajectory of your life. Welcome to the Leadership and Success Podcast.

Welcome to What's the Problem, the show that explores problems that buyers, practitioners, operators, leaders, and other folks in the world of cybersecurity face today. Today we are fortunate to have Bob Zinga, or BZ as his friends call him, join us. Bob, would you digitally wave hello to all of our listeners?

Hello.

Awesome. All right, BZ, let's get right into it. Why are you qualified to talk about security?

Well, uh, probably because I have more than, what, 20+ years now in IT and security. I guess I started my security career full-time when I was at the University of Alabama back in 2005, so 17 years ago. Since then, I've done security for higher education, the U.S. government, more specifically the U.S. Navy and the U.S. Army, and then since 2014 for Silicon Valley. So I've been a security engineer, a head of security, director of security, a manager for a publicly traded company, Groupon, for almost a year, a director, and then now an executive in cybersecurity in Silicon Valley. So it's been a long time. I've seen a lot, and this industry is changing quite a bit. And yeah, so I think that qualifies me to talk about pretty much anything security related. I believe experience is probably the most important thing, but also education, which I have a certificate from Harvard University, but also IT certification, which at this stage in my career, certification don't really mean much anymore because I think I have more than 28 certs in security and IT. But at the beginning of my career, right, more than 20 years ago, they did mean a lot. I think at this stage in my career, only the CISSP, which is I think the gold standard for security practitioner, because I would never ever ever take the CISSP exam ever again, so I'm gonna keep that one current, but everything else can pretty much not be renewed. I will be just fine with it.

Awesome. Well, Bob, thank you so much for sharing that decades of experience, and also thank you for your years of service.

Thank you.

Talking about a problem, a problem, a problem. Bob, name a problem in the world of cybersecurity that's got your attention right now.

Yeah, the one problem that keeps me awake at night is quantum computing, right? It is already here, it is coming, and what concerns me is the fact that when we talk about security, we talk about confidentiality, integrity, and availability. With confidentiality, what we have right now pretty much is encryption. At rest, most people use AES-256, that's the best standard, or in transit we use HTTPS, or And very soon with quantum computing, right now it would normally take you with a regular computer maybe 2 billion years or so to be able to break that encryption, right? But with quantum computing, it's only gonna take like 20 seconds. So basically confidentiality is going to be completely transparent. It's going to go away. And that's a real problem for my, industry. So we don't really know what the solution is yet, but I know there are people much smarter than I am thinking about it and working on this specific issue. But I feel like it's going to take some type of partnership between the government and the industry for us to really come up with a feasible solution. Because many times you can make the encryption much harder, right? Use a much longer key, but the problem with that too is it's going to be unusable because you need to be able to decrypt what is encrypted long enough for the people to get access to the data, those who have a need to know. But if you have a need to know and you can't even decrypt your own encryption, then it's completely useless too, right? So there's definitely a lot of work to be done in this area, and I know some people, again, much smarter than I am, looking at it right now. So I'm very hopeful we're gonna find a solution.

It's interesting you brought up, you know, the— with this problem, the need for a public-private partnership. Um, you know, do you have any, any examples of public-private partnerships that you've seen work in the world of security or IT in the past, you know, with your 2, 2 or 3 decades of experience?

Yeah, I think with security, the NSA is a great example, right? National Security Agency in the US government. We care a lot about some of our data, right? Top secret, secret, and confidential. So it's really critical for the government, right? Because for the industry, sometimes you may have IP, intellectual property, or secret sauce or whatever. But if anybody knows what your formula is or or whatever, worst thing that happens to you, maybe your reputation and you may lose money, right? But for the US government, people are actually going to die. So it's extremely, extremely important. So I feel like organizations like the NSA, really the people, right? In time they gave us DES and 3DES, but unfortunately all of those have been broken in time. And like I said, very, very soon AES-256 is going to be broken too. And all encryption the way, we know it today. So I am pretty sure the NSA definitely has some people working on it like day and night right now. So, uh, and, uh, I also know the way things are now in, in America with the public, uh, sector and the freedom. For example, in tech we have Facebook, Google, all of, all of the big 5 tech companies out there. I am, I am sure many of them are looking into this, uh, problem too.. And I feel like a partnership between the government and private enterprises will get us there soonest. When you think about it, a lot of the technology we enjoy today really was designed by the military, or at least the US government, right? Including GPS, including the internet. Al Gore didn't invent the internet, unfortunately. So it was already done for the US government, but eventually it was made available to the general public, and we pretty much depend on those type of technologies today. I can't really imagine a day in my life without internet access, right? Especially my kids who are Generation Z, like they were born with the iPhone in their hands. So it's almost impossible to imagine life without this technology. But it does, I guess what I'm trying to say is, it does cost something, right? I think it is so ingrained with our way of life that, uh, we are going to figure out how to keep it going forward, if that makes sense.

Yeah, absolutely. One follow-up question there, you know, you mentioned the National Security Agency or the NSA here in the United States of America. We do have listeners from across the globe. Are there other public agencies from countries besides America that you think are well positioned to be the public side of that public-private partnership to find the next level of protection?

It is possible, of course. I am focused on the US here, but I'm sure there are organizations like the NSA in other countries, and that's definitely going to be a crucial problem for them too, right? Because if encryption becomes obsolete, then there is no more national secret, right? So we just cannot let that happen. So even those people, I guess I won't call them enemies of the US, but competitor, right? Like China, Russia, and all of those countries, it's extremely urgent for them to maintain confidentiality. I think this is really a global problem, and it's one of those issues I feel like even if you are competitor, it's in your best interest to work together to find a solution that works for everybody involved, right? Because otherwise, everybody's secret is going to become public knowledge, which is not something we can allow.

So yeah, yeah, I was thinking about that, you know, the concept of, you know, sure, you're So you clamp down, you know, the NSA clamps down for American citizens here in America and comes up with a solution. But what happens, you know, it is a global economy. I know the world is reopening here, um, here in spring 2022 when we're recording this. You know, what happens when you cross the border and you connect to a Marriott, um, you know, Wi-Fi network in Saint Petersburg, Russia, or you're in Taipei or Shanghai or Beijing or something like that. It's a little bit of a zero-sum thing. It's not like the NSA can just clamp down on American data and secure that and then say, great, everyone else is on their own, because it's not really going to work like that, is it?

Exactly. And I know the government is definitely most concerned about government information, but Then too, right, it just makes sense to share with the industry, right, because it benefits all of us and it's also, I believe, a very critical component of our economy, right. Pretty much everything we do today, like when I used to work for SpareWore San Diego, The Admiral there used to say, because we provide the technology to the Navy Space Warfare Command, and talking about fighting jets, the Admiral there used to say, "A fighting jet is nothing but a supercomputer with wings." And I think he's absolutely right. Even today, when you think about vehicles, even Tesla, all electric, it's really all sensors and computer processing, but with tires, right? So we are so dependent on the technology today that I think it would be just too dangerous. I think last time we talked, I kind of referred to this idea of being too big to fail, kind of what happened to the economy back in 2008. And I think it's going to be one of those things if encryption really becomes obsolete. So I am 99.999% sure there's going to be a solution to it. Actually, one of my mentors— I don't have a PhD, but I was a PhD student, and I am what you would call the ABD, right? All but the dissertation. I've met all of the requirements for the PhD program except for the final dissertation. But anyway, my primary faculty mentor used to tell me that when you are facing a problem, and many times just asking the right question will kind of give you 50% of the solution. But also looking at it, it seems to me like if there is a problem, just by definition, that means there is a solution as well. So it's just up to us to find out what that solution is, right? It's kind of us discovering what doesn't work until we find what does work. But yeah, I really think in the next 5 years or so, we are going to have to really find a solution for that. Now, some of the mastermind groups I am a part of, there is the Forbes Technology Council. I've been a member for 2 years now since 2020. So these are technology leaders really across America and around the world, many of them from Fortune 1000 companies. And from time to time, we have meetings and we kind of talk about what technology is going to be like in the near future. So, but anyway, that's definitely one area where I can get a lot of ideas from my peers. And again, some of them much smarter than I am, but just knowing that this is a problem that a lot of people have eyes on.

Yeah, before we go to our final question, I just wanted to kind of reflect back into the listeners' ears. Asking the right question is 50%, you know, it gets you 50% of the way there. That so reminds me of what's known as the IDS framework, India Delta Sierra. So issue, discuss, solve. And you spend 80% of your time on the discussion as a group or as a team, which makes the issue critical. Because if you pick the wrong issue, you will spend countless cycles discussing it. Then you'll even come up with a solution. And then somebody will raise their hand and go, you know what? I don't think that this was even like, it's real, it's related. Like we're not off track here entirely. But man, I don't think we actually have the right issue at hand here. So then you have to go in the IDS framework, you go back to I. Great. You know, we learned that this isn't the issue. It took us a long time. And that's why it's critical to be critical of the issue. Is this the right problem to solve? Is this the right question that's getting us started on our discussion? So anyways, just wanted to reflect that into the group and have that shared to the listeners. And as we talk about sharing— oh, go ahead.

Actually, I was gonna say, I really like what you talked about, the Ideas Framework. I think on a personal basis too, it is quite relevant, right? When you are a leader, I think many, many times you work on tasks that probably don't even need to be completed at all, right? Some of them you definitely need to do. A lot of the tasks that you have on your plate, definitely need to delegate. And then quite a few of those completely abandoned because they're not going to get you anywhere you want to be. I am a great believer, both at work professionally but personally as well, the 80/20 rule or the Pareto principle, right, it is called. 20% of your activities will get you 80% of the way toward the achievement of your goal. And for most people, unfortunately, they are extremely busy, from sunup to sundown, they do a lot of activities, but 80% of what they do only gets them 20% of where they, what they believe is their highest priority. So I always have to ask myself over and over again, what is the best use of my time right now? And sometimes, yes, you do have to abandon some of the activities you are doing because they are just not in line with what you believe your highest goals. So I thought of that when you mentioned the IDEAS framework. So it's very important to be discussing the right issue. Absolutely.

Yeah, I love the Pareto principle. Warren Buffett actually does that every week. I'm not sure if you've heard of that. Every Sunday evening, he writes down a list of roughly 20 to 25 things that he needs to get done, and then he looks at it up and down a few times, and he circles— I think it's no more than 3 or 4.

Wow.

And everything else is— there are things he's no longer allowed to work on for the next week. And so if it comes up, he says, oh, I have to give this to my deputy Mike, or you need to talk to my head of— head of trading out of Asia or Africa, and, you know, talk to this guy or that lady. Um, but he, he specifically says these are These are no longer things I can work on this week because I have to focus on these other ones. And while we are not Warren Buffett, we can still think in that way sometimes.

Absolutely. And I think it really makes a big, big difference when you focus on the right issues. And because now the, the older I get, the more I realize my most precious resource really is my time, right? Because once my time is gone, I can't get it back. If I lose money, I can always make a lot more money later, but time, it is gone forever. So the way I spend my time is extremely important to me. So I just wanna make sure I'm spending it in the right way. Something that's gonna give me a return on investment.

Yeah, that return on time. I love it. I love it. All right, Bob, let's wrap this thing up. Third question is where we get a little bit vulnerable and a little bit funny. Tell our listeners about a terrible haircut that you have had.

Well, I think the most terrible haircut I've had was forced upon me, right? I joined the U.S. Navy back in 2004. I think it was October 2004. So May of the following year, they sent me to boot camp. I went to RTC— great mistake— I mean Great Lakes, right? So Recruit Training Command Great Lakes, Chicago. Illinois. And the first day I got there, so they picked me up at the Chicago International O'Hare Airport, and we drove maybe about an hour or two. And once we got to RTC, first thing they did was to shave everybody, everyone. They completely— all my precious hair, all gone. So everybody else looked exactly like me. And also they gave us brand new uniforms, so everybody was wearing exactly the same thing. It didn't matter, right, if you were white, black, brown, or whatever, rich, poor. It didn't matter at all. Everybody was exactly equal. So I think that was probably the most terrible haircut I've ever had. And since then, my hair has been pretty short. But yeah, I used to have pretty long hair back in the days. But I guess you kind of get accustomed to it after a while.

A haircut that was forced on you, although you probably didn't know that was coming.

Yeah, yeah, kind of. But I didn't really realize it until it actually happened. It was kind of surreal, but yeah, that's exactly one of the prices you have to pay for raising your hand and volunteering, right?

So yeah, yeah, yeah.

That's why some of my Navy buddies told me, right, Navy stands for Never Again Volunteer Yourself. But I think that's completely wrong because It is important to volunteer and do something not just for yourself but for your community and your country. It's always a great idea to give back when you get the opportunity.

Absolutely, absolutely. Well, before I say our exit phrase, Bizzy, would you say hello and goodbye to our listeners one last time?

Goodbye everyone, and it was a great honor to be with you today. Hopefully this has been pretty instructive or useful to you. Thank you. Really appreciate it.

Absolutely, DZ. And to the listeners, thank you for listening to What's the Problem, the show that explores problems that buyers, practitioners, leaders, operators, and anyone else who's involved in the world of cybersecurity faces today. We'll catch you next time.

Thank you for listening to the Leadership and Success Podcast with your host, Coach Beezy. If you like what you heard, please subscribe to our channels and come back for more wisdom nuggets on how you may develop into a better leader and achieve greater levels of success. Leadership is the most critical skill. The world will always need leaders to lead others, deploy the next disruptive technology, or execute a business strategy, you may as well decide on counting yourself among the 21st century leaders. See you right here next time on the Leadership and Success Podcast with Coach BZ.