Why Trust in Digital Tech is the Key to Future Innovation - Hexcon21 Session by Matthew Rosenquist

Welcome to HexCon 21. I'm Matthew Rosenquist. Today we're going to talk about why trust in digital technology is the key to future innovation and adoption. The infamous and expert cybersecurity investigator Brian Krebs once said, if security breaks down, Technology breaks down. And this is profound. I really like this quote because it talks to the interrelationship, the dependencies that technology, our digital technology, has on security and being trustworthy. And that's what we're going to talk about today. I'm Matthew Rosenquist, CISO and cybersecurity strategist and a passionate evangelist of digital security. Now, I've been in the industry for well over 30 years, and I spent 24 of those actually at Intel as their cybersecurity strategist. I've done the operation side, the planning side, but where my passion is, is looking towards the future in understanding the inner workings of the engine for for cybersecurity and technology and seeing how that is going to change over time. And we are going to experience some very interesting changes as we move forward when it comes to digital trust and cybersecurity. In our lifetimes, we have all benefited from this digital revolution where we have seen transformation from analog into digital, and that's allowed us to create vast amounts data and apply that to create new services, new experiences, more communication and collaboration across the globe. It has been profound in the history of mankind, and everybody everywhere benefits from it, either directly or indirectly. It has been incredible, and people love The fact that they have new services, new toys, new ways of communicating and collaborating, it has enriched mankind. And we have embraced this in, you know, the technology and the tools and the devices that we wear and buy and use and put in our homes. We all have become greater because of it. But as we rapidly innovate and adopt, we also become reliant on that very technology. We forget how to do things. We take advantage of the new services, and that's more efficient than doing it manually. This dependency is important because if it begins to fail if it's taken from us, if it's extorted for us to have access to it, or compromised, then we suffer. And we suffer in relation to how much we've embraced it and how much we depend on it. It comes down to value. And this is where trust plays a crucial role. Because the more we embrace technology in our lives, which is all a great thing, we have to uplevel the trust. The trust that it'll be there when we need it. The trust that the information isn't being manipulated or corrupted. Trust that these services aren't working against us but working for us. Trust rises as we continue to innovate and adopt technology. And if it falters, if it fails, that will have a serious impact on that cycle of innovation and adoption. There is a symbiotic relationship now between the digital world and technology and tools and data and services, and how much we trust it. If it falters, then that begins to slow down our world of innovation and adoption. We're gonna go into more detail on why it's important now, and even more so why it's important in the future. The world has changed as we know it. It has grown and thrived with the benefits of digital technology, of the data and the sensors and the analysis, understanding what is efficient and effective, creating entirely new services and opportunities for people. It has impacted the economics of the world and benefited the livelihoods of people all over the planet. And a lot of that is because we can now communicate and collaborate better, faster, cheaper. And we bring together the brainpower and the creativity and the personalities of people to overcome challenges, to entertain, to educate, to inform, to advance. Now, this tremendous benefit has value. And it has fundamentally improved the lives of people all over the globe, making everything from food, entertainment, transportation, communication, government— all of these things that we experience and we rely on day to day— better, more efficient, faster, cheaper, more accessible. This is what the world runs on today. It would be difficult to find, um, any type of small, medium, or large business around the world that doesn't somehow have a reliance or use digital technology. The global transformations that we've seen has been incredible. Now, when we look at that cycle of new ideas coming to fruition and people getting excited about it? Do you remember the, the first mobile phone, the first cell phone you ever bought? You wanted it, and when the next one came out, you wanted that too. We see in the marketplace where innovators come in and you get those early adopters And we want all those new toys and capabilities. It empowers us, but we have trust in it. And sometimes, especially in the early days, if they failed, no harm, a little inconvenience, but it was okay. The innovation cycle depends on those early adopters to fund and fuel so that production can get large, prices can come down, availability can happen. So from a business sense, it's important that customers, both early and later on when we're talking about the majorities, that they trust and embrace the technologies. Now you've probably experienced this in some way where you saw a new car model or a new computer or a new digital watch or something new that was completely untested, new in the marketplace, first generation, and you probably thought to yourself, I'm gonna wait until they work those bugs out. I'm going to hold back. And if you saw reports in the industry where it was causing harm or impact or failing severely, that then again motivates people to withhold, to not invest. So trust has always played a role, but when we look at digital technology and how interwoven it is and how reliant we're becoming on it for very critical services and functions, this has an amplification effect. So trust begins to play more of a role than it has in the past. And when we look at this cycle, we see the value of technology rising as part of this. We see more users and more devices get created. That creates more rich data that can be transformed into information that can benefit people or systems or processes. And that is all very valuable, very valuable. And what we see anytime there's value is right after that, we see attackers. We see people that want to come in and steal or disrupt or extort that value. And right now we have a severe problem with cybercrime and hacking and nation-states and all sorts of different things that are putting at risk cybersecurity of digital technology, of all those services and devices and our means of communicating. But now it also impacts other things because critical infrastructures that we all rely upon. Think about water or electricity or transportation of food or fuel availability. Those are now part of that value proposition. So as the value of technology rises, it becomes very attractive to attackers and they pursue it. And there's a follow-on cycle. As they pursue it, attacks happen. People get fed up and they demand change. They demand better security. They tend to invest more and security rises to meet that challenge, to fill that gap and benefit from that financial incentives. And the process repeats because the attackers don't give up. They adapt and they overcome, especially as more value comes into the environment and more opportunities. So attacks, they undermine the security, the privacy, and the safety of the digital devices and services and information that we all rely upon. Let's take a moment and explore the growth of our digital world, because sometimes it's tough to get a mental grasp on really how big and how fast it's growing and how valuable it is. So we see that data doubles almost every 2 years. The total amount of data that mankind has created doubles in a little bit over 2 years. That is fantastic. And think about how many uses that data supports. More than we can imagine. It's everything that we see today, but also many innovations that haven't yet arrived. All will, will rely upon that data. We have almost 5 billion users that are online. We're going to have another billion that will be joining just in the next couple of years. And we see critical infrastructures that are tied in. So for example, you know, 94% of hospitals are using digital data. They are reliant upon that, and they also use digital tools in systems in their emergency rooms and admitting patients and for care and ordering medications and tracking all of that. Also in the medical devices themselves, many of the devices that we are seeing again being implanted in people or used in emergency rooms or even in your doctor's office are digital in nature, and they can be compromised for their data, but they can also be manipulated Imagine somebody's implanted pacemaker, right, or defibrillator. Attackers have shown how they can also be hacked to, well, to the grave detriment of the people who are using them. And we're seeing the same thing for devices in emergency rooms and in hospital rooms. So again, every sector is embracing all the wonderful benefits of digital technology and that creates value, but that value can be used against us. Now we've seen a massive rise in the internet, right, over 1,000% just in, you know, in the past decade. And the amount of data that is created per day, if we can wrap our head around this, right, over 7 million high-resolution movies, that amount of data is created every single day. Millions and millions of movies, the amount of data to create that, it is mind-boggling. And the last one here that I kind of like, 127 new devices connected every second. Now that could be servers or desktops or tablets, but it could also be those Internet of Things and Industrial Internet of Things. So it's the smartwatches you have, the smart thermostat, anything smart nowadays is connected to the internet. But also in the factories, it's the sensors and the temperature gauges, it's the pressure control valves, it's even the vehicles. Smart cars, smart trains, smart buses, soon to be smart planes. All of these things are connected, and every day they get more and more controllable by the systems that are within them. And all of these are potentially compromisable by hackers. Our tremendous digital ecosystem— everything that you see here and much, much more— this is the digital world that grows.. It's like this tree, it's a massive oak that's doubling in size every couple of years, and it is a behemoth. And it's all good. It is— well, mostly good. It again connects and enriches all of us. But if we look under the surface and we look to see what's burrowing beneath, that could undermine what our digital ecosystem is, we start to see that it can be fragile. And we've seen attacks recently in the news that have seen— that have shown that. We've seen attacks against healthcare, bringing down hospitals. We've seen attacks against water supply and sanitation. We've seen attacks against food distribution. And fuel distribution. There are many areas where a single attack can create a cascade effect that impacts millions of people, and we're just at the beginning of that. So let's take a look at some of those things undermining, because at the same rate of our growth, and maybe even faster, we're seeing the attackers innovate and pursue and go after that value because they want it. Now, over 500,000 new malware samples, unique ones, are discovered every day. Think about that. Half a million new pieces of malware every single day are being born and discovered. And to date, we have well over a billion pieces of malware that are floating out there, all hungry, all looking for a place to land and cause damage. We're also seeing attacks like ransomware and supply chain attacks proliferate right now, and those are causing incredible amounts of harm. Right now, just ransomware alone is estimated to be at about $20 billion this year, and it's doubling and tripling every single year. And unfortunately, that's actually on the low end because that's about the ransoms they're asking for. That's not talking about the damage it actually causes when those companies or systems or governments go offline. It can impact— a single attack can impact, again, millions of people. And tabulating that cost, you're probably talking in the trillions. And speaking of trillions, cybercrime, which includes things like ransomware but a whole bunch of other things as well, Just this year, it's estimated to hit $6 trillion in overall damages. And in just a few years, by 2025, the estimate is $10 trillion of impact. We've got governments all over the world creating their own offensive and defensive cyber units and spending billions of dollars, uh, identifying vulnerabilities. And this is the new class of warfare. And again, it doesn't just impact governments. Anytime there's a vulnerability discovered and released, everybody gets to see it. And the cybercriminals, for example, will grab it, tear it apart, and use pieces of it. So, you know, as in regards to research and development, we're seeing a huge amount of research and development for potential attacks, vulnerabilities, and exploits. Now we have to worry about all of these things, and all of these and many more eat away at the foundations of that technology tree that we want to grow and thrive. And if it gets too big, it can topple it. It can cause that tree to start to wither and die, and that's what we do not want. Because technology, the trust in technology, if we don't trust it moving forward, we're not going to want to put our lives in the hands of an autonomous vehicle that can get hacked and cause an accident. We wouldn't want to be in an airplane controlled by an AI system. We may not want our electrical grid or our food supply so dependent that a single attack could disrupt electricity to, you know, the western part of the United States, or food delivery to the Northeast, or fuel distribution to the East Coast. And again, these attacks every year, they get bigger and they can scale. When we look at the security and the privacy and the safety, we have to have all of those when it comes to digital technology and as it moves forward to be interwoven into our lives. Now there are a lot of different types of attacks and impacts, and we tend to look at it from 3 different aspects. You've got confidentiality attacks, availability attacks, and integrity attacks. An availability is like a denial of service. If somebody goes in and, and craters a website or maybe your favorite social media site, something like that, takes it offline, you don't have access to it. It can be inconvenient. We've also seen attacks take down entire ATM networks, banks, healthcare facilities. It's a little bit more grievous when You're in the ambulance and they can't take you to the closest emergency room because it's unavailable, because the systems have been shut down by a hacker. So that's availability. When we talk about confidentiality attacks, these are the data breaches that we've seen be so prolific over the last decade. And they can be an inconvenience, force you to change your password, get your data out there. There may be charges on your credit card or someone may have opened up a loan under into your name, those kinds of things, you know what? It causes harm, especially when we consider privacy. When we lose our ability to remain private, it really exposes us to elements that we don't necessarily want. So it could be, yes, somebody lost your login passwords and that's an inconvenience, but if somebody is able to hack into your home cameras, and see what you're doing day in and day out, night and day, that may be more of a concern. But confidentiality is important, as is privacy and what we talk and believe and, and do. The third type of attack is integrity, and we see this a lot in transactions. Think about an ATM transaction or a bank transaction. If a bad person can go in and change an account number or change an amount, they can siphon off a lot of money for their benefit. We can see integrity attacks also go into supply chains, right? Instead of, you know, paying and ordering, you know, one pair of jeans off of the internet, changing that quantity to 100 and still paying the same price, right? Right? Again, it's about transactions. And this is one of the favorites for cybercriminals. That's where they can gain the systems. But all of these, we have to maintain trust for all of these different areas. Because no matter what the technology, the digital technology, whether it's our PC, whether it's the cloud, whether it's some social media or online service or, or retailer. It doesn't matter. We have to protect all three. If any of these get compromised, then we can see a progressively worse impact over time as we become more dependent upon it. One of the biggest targets for cybercriminals and malicious hackers is the critical critical infrastructure networks. Now, there are 16 different critical infrastructures that the United States has defined, but what we can see is attackers like to go after them because the value is very high. It's very timely. So they're a favorite for ransomware, for example, where, uh, if an attacker can compromise it and install ransomware, lock systems, lock data, make it unavailable, they can then extort a great deal of money. And we're seeing attempts, uh, to extort $40, $70 million even just from a single attack. But it makes a lot of sense because we rely on these sectors. Think about, uh, the internet and communications— hugely important. Clean water, sanitation, Our transportation systems, that's becoming more automated, and we're gonna be more reliant on that. Our financial systems, right, how often do we use cash anymore? Very rarely. So again, all these are very, very important, and people want uptime. It's very valuable. These are the locations and the areas that our attackers are going to. And this is where the trust has to be the highest. We want to be able to trust that our food supply and distribution will not be interrupted. We need to make sure that our water supply isn't tainted or poisoned, that our healthcare is available to us, and when we pick up the phone and call for police or fire, that that service is there and that those providers will be available to everyone who needs them. So this is a critical point, and again, all of these are becoming more dependent on digital services than ever before, and it's a good thing. Don't be worried, in fact, that, you know, this is something that can't be managed. It needs to be managed because the benefits far outweigh the risks, but we have to make sure it stays that way. We've covered a lot, and as we continue as a society to embrace the tremendous digital innovation and all the great technology and services that make our lives better, there is one issue that we see in the future that will fundamentally change all of our perceptions about security, about trust in digital technology. And up until now, we've seen attacks. We've seen attacks against all sorts of different things, and it really hasn't slowed us down— our insatiable desire for the next and greatest shiny toy, big service AI solution out there. But there is one that's coming, and all the experts agree, and that's life safety issues. It's one thing if our laptop crashes. We may lose part of a document we're working on, we may have to reboot it, we'll curse at it, but it comes back up and we might have lost some time. But when we talk about digital services that are interacting with the world where life safety issues can be impacted, that's a different story. We're less willing to accept the risks if our car, our intelligent car, gets hacked and causes an accident. And we've seen in the news where there's, you know, autonomous vehicles that are coming, but Even the vehicles today, they are controlled by microprocessors in the vehicle itself. They have access to control the acceleration, the turning, the braking. They've got a good sense of navigation of where the car is. Those types of controls can in theory be hacked, and the cars are getting smarter and more connected. And as we get autonomous driving, which takes in more control, that also puts a risk. And as a hacker, if somebody is able to compromise, let's say, a specific make and model of vehicle out there, all of them everywhere, and remotely control them to accelerate and turn into oncoming traffic at a particular point during the week, you're talking about mass fatalities. And at that point, our trust— anybody that owns that make or model, anybody that owns those types of cars will step back very quickly. People won't be investing in them anytime soon. If we see mass, mass casualty events, then the trust falls apart. It's a house of cards. We're not willing to accept accept that. If we see in the medical field that hospitals are compromised or implantable devices are compromised, messing with somebody's pacemaker or internal defibrillator is life-threatening. So is modifying how much medicine somebody is going to be receiving through a drug distribution panel, right? All these things have an impact. What about if your drinking water coming out of the tap for an entire city or municipality is tainted or poisoned? Again, those tipping points are huge, and they're coming. We need to get ahead of them. But if we hit those tipping points, and hopefully we won't, But if we do, that's when the human psyche takes over and will fundamentally change. Our acceptable risk doesn't go that far. We won't let our personal safety and the safety of our families je— be in jeopardy because of that. And that will drive that investment, our willingness to embrace new digital technology. Given what is at risk, it is absolutely important that we move, and we do so together, to make sure that we can preserve the trust in our digital technology, especially as it evolves, especially as the value increases and it's targeted more by attackers. We want all the benefits. We want to embrace those, but at the same time, we want to minimize the risks of it being used against us, the malicious use of that technology. We must maintain trust in our security, privacy, and safety, and it's possible, but we have to do a few things. First off, we have to communicate. We have to understand as a society that there are risks here. Whenever we get those tremendous benefits, there are equitable risks that come along with those. And this isn't just the problem of the government. This isn't just the problem of a manufacturer or a software company. Everybody has to play into this. We all have a role. Every consumer, every company, every government agency, everybody has to play a role. Now, one of the first and foremost things that we need to do is we need to start being better at designing security into technology. And again, when you think about that race, that innovation race, companies want to be first to market. And designing minimal viable products is really popular. Get— just get something out. We have to pull back from that a little bit. We have to make sure that any of the minimal viable products have security embedded because it's much more difficult to bolt on security afterwards. In fact, we've seen time and time again The strategy of just get something out, we'll secure it later, fails consistently. So we have to change our mindset. But in order to do that, companies have to be aware that that is a requirement from the customers who are going to adopt it. So it's important even for those early adopters who really want it, they also have to be vocal in saying, I want it really bad, but it better have minimum security. At— just at a minimum, it needs to have baseline security. And that would go a huge way in preserving the trust. Now, another thing that we have to do, and this does come back to the experts, it does come back to those big companies and those think tanks and those government agencies. We need to get better at predicting how these attackers, how the cyber criminals or the nation states, how they're going to maneuver, what they're going to target, how they're going to go about it, the methods that they're going to use, so that we can properly prioritize our security, our preventative controls. You can't prevent everything equally. You can't apply security equally. Equally. It just doesn't work. You have to prioritize, and if you want to prioritize well, you have to know where the most likely attacks are going to be coming. So we have to get better at being more efficient at security so that we can minimize loss. At the end of the day, we all want digital technology and innovation to succeed because we all want those great benefits to continue. We want all of that. However, we also don't want to be severely victimized. So we're all facing the same storm, but we all have different perspectives and we all have different roles to play. And it's important that we have to work together. And one of my favorite quotes from Sun Tzu is, "Know yourself and know the enemy." And it applies perfectly here. We have to understand who we are and what our roles are. But we also have to understand what the bad guys are gonna try and do so that we can mitigate that and those risks, because we all want good technology to enhance our lives, but we want it in a way to where the risks are acceptable. So let's get more specific, as each of us have different roles, and we'll break it up into 3 different areas. First off, The security people out there like myself, one, we really need to drive leadership, and it has to be leadership and trust. We have to understand that we need to be protecting that security and the privacy and the safety of new technology, new services, new products, new devices, and the data that they all create. We have to, as security professionals, communicate amongst ourselves There's great ideas and initiatives, and if they're not shared and, you know, adopted widely, they don't become very valuable. And this is something the attackers do fantastically well. When they find vulnerabilities, when they find opportunities, easy victims, fast money, they share it, and that knowledge proliferates. Well, to our disadvantage, but to the advantage of the attackers. We must mirror that in the security world and get just as nimble and work together just as well. And the third thing is the security practitioners again need to work on embedding security into those new services and products and functions versus being brought in afterwards and saying, "Hey, look what I built. Please go secure it." It just doesn't work very well that way. So we have to be— and it comes back to leadership— we have to show that leadership and drive ourselves into the designs and the architecture and the requirements for all of those new digital capabilities, because we have to embed it in as part of the design. Now, from executive's perspective, the leaders of companies, the ones who are accountable for profit and loss, They also have to play a very important role. First off, they have to know and accept that innovation, everything they're doing, comes with risk. And it's not only risk to their company and their data and their innovation and their corporate futures, but it also places at risk their partners, their customers, and maybe in some cases the stability of societies that they're critical to. Executives need to understand that cybersecurity is important to everything they do and everything that they will become. And as part of that, we have to again design security in. We have to make sure that the security professionals are in those architecture and design and coding and review and vetting discussions as products get developed, deployed, and sustained over their lifetime. Executives should be demanding that. Ultimately, cybersecurity is the new cost of doing business. We are all connected in this digital world, and if companies and organizations aren't at least doing the basics, but always progressing, always adapting, because the attackers are. This is what it takes just to be in business nowadays. So executives have to plan for that. The third area is consumers. It's you, me, everybody that's buying these wonderful products or benefiting from them, joining them, communicating with them. We also have to understand we play a role here. First, it's important that we don't become an easy victim. So know the basics about cybersecurity. Again, it's just the way it needs to be nowadays. Everybody has to have decent acumen, understand the basics, and protect themselves. We don't want easy victims out there. Easy victims mean the attackers get even more motivated because they're successful, they have more resources, they can adapt and they can innovate and they can take advantage of technology better and faster. We don't want that. We want to strangle their ability and their resources. The second and probably the most important is to make trust again in that security, privacy, and safety when we're talking about digital products and services and anything that you might buy or spend money on. Make it a purchase criteria. Look to see and go for those companies that are providing trustworthy solutions. It's going to be worth it to you in the long run, but promoting that means that companies will start to compete to get better, to deliver more in those spaces, and we raise all the boats in that case. We make everybody more secure when all the organizations realize we have to do this. It's a competitive advantage, and that only happens when consumers vote with their wallets. And lastly, digital communication has enabled every single one of us to have a voice, and companies listen. Companies want to hear what their customers are interested in and what they want and what they like and what they don't. Communicate your expectations, and as they change, communicate again. Cybersecurity and trust in digital technology, and digital technology itself, is constantly changing and evolving. We have to be part of that discussion. Consumers have to be part of that discussion. In this audience today, we have executives, we have thought leaders, And it is up to you to make change. Without your leadership, people won't follow, and instead we will have victimization. Instead, we will have impacts to innovation, to technology, the value that grows will be taken and abused by the attackers. It is up to the leaders to move forward because we manage security and trust through leadership. So it is up to you, each and every one of you, to make sure that we don't fall into crisis, into desperation. And the attacks are going to get worse out there. As the value goes up, as attackers succeed more, the pressure and the impact to everyone increases. We can turn this around, but the first and most important element of that is leadership to move us forward. The one thing that I want everybody to walk away with when we consider the incredible journey and benefits that digital technology bring to this world is that all of these tremendous benefits, the ones we have now and the ones that are coming, they all have risks. And we have to understand that. And in protecting the trust of digital solutions and technology that preserves the value of what we're getting today and what we're gonna all get tomorrow. We have to act. We have to understand that we have a role to play, and we can absolutely protect trust. Thank you for watching and listening. Please enjoy the rest of the conference. If you'd like to connect, follow me on LinkedIn or the Cybersecurity Insights YouTube channel, where I'm often ranting, dissecting, and discussing some of the most relevant attacks, risks, and opportunities for cybersecurity. Remember, we're all stronger when we communicate and collaborate, regardless of what company, nation, or organization we're from. We're all on the same side facing the opposition that is working to victimize users and undermine trust in our precious electronic ecosystem. So let's purposely help each other and work together to protect the continued innovation and adoption of digital technology for the benefit of everyone.