Sandy Carielli with Forrester Research

SUMMARY KEYWORDS

Quantum computing, cybersecurity, public key cryptography, digital signatures, Forrester Research, post-quantum algorithms, NIST, quantum computer, data encryption, harvest now decrypt later, quantum secure, cryptographic discovery, regulatory compliance, innovation, industrial talk.

00:00

Scott, welcome to the industrial talk podcast with Scott Mackenzie. Scott is a passionate industry professional dedicated to transferring cutting edge industry focused innovations and trends while highlighting the men and women who keep the world moving. So put on your hard hat, grab your work boots and let's go

00:22

08:23

I think it's been at least a few years. Really good to see you again. Scott,

08:27

yeah, back at you, slugger. And you know what's interesting, things have changed in two years. Yeah, a lot. I always reflect upon the conversations that I've had in the past, and I've been, it's been nice being in the seat that I'm in and be able to talk to professionals like you, but that keep the, you know, fingers on the poles of what's taking place in the industry. And it's, it's just, it's just stunning. I mean, it's fast, like it's faster than a roller coaster. You got to buckle in and keep current with this stuff. And I would imagine, I don't know how and and I digress, because you're with Forrester Research. How do you guys, how do you pick and choose what to to research?

09:19

You know, a lot of it is based on questions we get from end user customers, things that they're concerned about. Some of it's based on trends that we're seeing in the market. As we see certain technologies get a lot more exposure, as we see vendors crop up in a particular space, as we start to get questions about what do I need to know about this? As there are major regulatory changes, new policies put in place, all of these different factors that could drive interest in a particular technology or market or something like that, and we just we look at what's interesting, and we look at what's emerging, and figure out where we need to direct our attention. Question.

10:01

Sort of get together in a conference room and say, Hey, these are the, these are the things right here. There's, there's a list, and, you know, everybody's sort of bantering back and forth. Yeah, this is important. That's not I'm going to debate you. I don't

10:17

know how you do it. Well, it's interesting, because there are certain technologies in certain areas where we have long term focus, but every year, we kind of do that virtually, because we get together and fill out surveys and share our thoughts, particularly on the top emerging technologies around what's new. And every analyst within Forrester has the opportunity to add their voice to what are the emerging technologies that they think are relevant. And every year, we publish a top 10 emerging technologies report, and that's based in part, on all of our inputs and what we're all seeing. So we're not in a physical room together, but no virtual room.

10:56

Yeah, that's what I'm getting at you guys. You guys do chirp back and forth and say, Yeah, this is, this seems to be right. Maybe not. I don't know, top 10. It's just, it's just so vital of the service that you provide to be able to, sort of, I hate to say it, but get it right. I mean, yeah, that means, I'll give you a case in point, and eventually we'll get into the conversation about what we want to talk about, but, but, you know, it was like it was overnight that, AI, you know, one week it wasn't anything, and then all of a sudden it was and and then everybody was sort of running with it and doing stuff with it, and then it just became such an overwhelming topic of conversation,

11:47

it did. And I think from Forrester's perspective, there are a couple of ways that we've looked at it. Obviously we've had a lot of analysts jump on AI directly to understand what's the impact to organizations, to people, to all of that, but also all of us who cover other technologies AI has an impact on what we cover and on our market, and understanding what those intersections are and what that's going to mean in terms of changes for users, Changes in automation, changes in potential features that becomes important too. We're never bored. Scott,

12:25

yeah, no. I mean, you guys are living a really interesting life. I mean, it's just that alone. You gotta No. I never mind and, and, and we're going to be talking about quantum security. That's going to be talking about it, which, which, when you reached out to me and they talked about it, I just said, Come on, you're blowing my mind. Are we there? Yet never even thought of that. That's, that's, that's, I guess that's why you guys are in business, and you're able to, sort of have that ability to be able to see so these trends, this one blew my mind. Give us a little background on what you mean by quantum security.

13:05

Okay, so I think we have to start with quantum computers. And I think one of the problems we all have,

13:10

you want eventually, a lot of people would,

13:15

I mean they there's all of this research into creating these incredibly powerful, high performing, powerful computers using quantum principles, and it's all cool and a lot of physics and a lot that goes into it, but one of the impacts of it is that we know, based on Various proofs and research, that if a quantum computer existed that was powerful enough it would be able to break today's public key cryptography. So pretty

13:50

much, yeah, what's that mean? Okay, so I'm a powerful computer. Now I'm I'm quantum guy, and now I have enough robust capability to be able to

14:03

do that. Yeah, so public key cryptography is how keys are exchanged, so that when you're sending a message and you exchange keys and know that you're both encrypting with the same same key, public key cryptography is how that is negotiated. And that means that if public key today's public key cryptography is broken or compromised, you know what the keys are, and therefore you could decrypt the message. Yeah, that's part of it. Public key cryptography is also used to sign emails, sign documents, sign code, sign transactions. It's the means by which we basically underpin trust online, so it is one of the ways in which we communicate securely and

14:47

and because the vision of quantum computing, that capability will be able to because it's so powerful that. That's what they say. It's it's powerful. We'll be able to do that in a very rapid and efficient way

15:06

eventually. Yes, that's the, that's the idea that ultimately there will be a quantum computer powerful enough to break today's public key algorithms.

15:17

Okay, now we get this, we get this quantum computer. It's over here. It's a physical thing. It's right there. It's not something that's in the, you know, the cloud, or it's, it's, it's really a physical not everybody can have that. I mean, you're looking at maybe, how, how does people, how are people going to use it now, what? What's your put that hat on and and say, Here it is. Yep, there it is. Who's using it? I you know, I would say Google and Microsoft and, you know, the same players, but

15:53

the same players, some of them, ultimately, some of those players, will lease or rent space to other users. But more critically here nation states could have one, and we might not know about it. So from the standpoint of wanting to protect our information, protect our trust, protect our data, protect the assurance of our communications and our assets, we we have to consider that risk that a China or a Russia or someone else could ultimately build something like this. That's

16:34

That's it. That's where that makes sense. Okay, now I'm positioned in the right place to be able to have that conversation. Now we're talking and what we want to talk about is, how do we begin the process of ensuring security? Yeah, with the advent of the, you know, quantum computer, we need security. You we need to protect again, those nefarious, powerful, nefarious entities. Okay,

17:04

exactly. And the good news here, Scott is that we started to have this conversation over a decade ago. So

17:11

or are we making progress? Yes, okay, yes,

17:14

18:45

there's, yeah, I'm following you. I am. I'm hanging on every word that you're saying. What if, like, AI, whatever, AI, whatever, in whatever form, yeah. All of a sudden, somebody cracks that code and says, I got a quantum computer, and it's and everybody's sort of saying, Hey, we think quantum computing that that thing will be in out here, yeah, sooner, and you're not ready.

19:14

Well, so there are two pieces to this actually, because one of them requires preparing many years earlier because of something that's happening right now. So let's start with that, and then we'll go to the what if it happens today? Yeah. So there is this attack that a lot of people refer to as harvest now, decrypt later, and basically what's happening is that potential malicious attackers are intercepting communications today and taking those communications, taking that data now it's encrypted, and it's encrypted with, you know, today's algorithms, and we don't yet have a quantum computer that can break them, but they take them and they hold on to them, on the theory that in 10 years or whenever, when a quantum computer exists. Just they can go back and decrypt those and have useful information. So from the standpoint of any organization, you have to look about at the data that's being transmitted back and forth and say, one, what is high value? And two, what of this will still be high value in X number of years? Let me give you an example here. Yeah, let's say I go online today and I purchase something, maybe I purchase, you know, new shoes, and I use a credit card that I know is going to expire in two years. Yeah, if someone intercepts that and they decrypted 10 years later, I don't necessarily care that much that credit card expired eight years ago, so what? But let's say I log into my doctor's office and I share information about my health status that is still going to be relevant 10 years from now. I absolutely care if that was intercepted, because that's still going to be relevant in 10 years. So organizations can't even wait for there to be a quantum computer. They need to think about how they prioritize migrating some of their applications to support these new algorithms so that if my healthcare data is intercepted today, they can't decrypt it later. Make sense? How

21:23

do you, how do you ensure that these algorithms are secure? How did I, I mean, it's one thing to say I got these new algorithms that are fine, Daniel, when we're here, but how do you, how do you have a high level of confidence in knowing that these are, these are the robust ones, they're not going to crack them?

21:45

Well, I mean, you never know for sure 100% and ultimately over time, they're often issues, which is why we migrate between algorithms over time. But the algorithms that we have, the algorithms that went through the NIST competition, had a excuse me, had a pretty good level of analysis and diligence and attempted crypt analysis by cryptographers and by other experts to see, is there a way to break it, and so they are reasonably confident that in the near term, these cannot be broken. That said, Scott, cryptography changes over time. The algorithms we were using 20 years ago aren't the ones we were using 10 years ago. Aren't the ones we're using today. And it may be the algorithm, it may be the protocol, it may be the key size. So we can't assume that when we move to these new post quantum algorithms, we're done forever. It's just the next step that protects us for a while longer, it will evolve.

22:49

Okay, so let's get let's get nuts and bolts. Let's get tactical right now. Yeah, well, what about today? What can I do? What? What are we demanding today? I get it. Look at that future. That future is well future. What are we doing today? To do that?

23:07

What are we doing? You mean, what's the other?

23:09

What are we deploying today? Are we even who? What banks? I would imagine some. Yes, somebody's got to do something.

23:18

So I'll tell you that government agencies and financial institutions, particularly banks, are the ones that are furthest ahead on this. They're the ones that have been looking at piloting post quantum algorithms in their organization, working with partners. They've been trying other types of technology in order to be more quantum secure. They've been doing a lot of piloting and work to to start that process. Other organizations are also conducting something that we call cryptographic discovery, which is basically what algorithms are in my environment, so I know what I have to migrate to and what I have to move. And that's an important part of the process, because you don't always know immediately, so you need to do that inventory, and then that's going to help you prioritize.

24:07

So we have this, we we're doing the work today, hopefully, and and governments doing their thing to ensure that they're they, they see what's taking place. It's happening. You can listen or you can say that it's not going to happen. It's going to happen is somebody's going to crack the code and it's going to have, it's going to happen. So you need to have something in place. That's one thing too. So the government is in recognizing this, that that it's happening. Same with our financial institutes and anybody else. I mean, who's ever listening to this? If I wanted to, if I wanted to connect, it's saying I'm listening to Sandy. I'm not involved. I'm concerned that my you know, what do you recommend that individual to like you? Do this, step one do that.

25:04

So step one is probably to get a lot of stakeholders in your organization together and start asking the questions, what do we have? What regulations are we subject to? And how do we start to work together to address this problem, because this isn't just the security team that needs to be involved. You need dev you need infrastructure, you need emerging technology. You need risk, you need procurement. You need all of these players involved addressing the different aspects of the problem. Procurement, for example, buying new versions of software or products. Do you need something in the RFP? Do you need requirements in SLA is to make sure that the vendors you're working with are upgrading their products to be quantum ready in time.

25:54

Says that you start pulling on that thread. Is like, Yep, and and what I would see and what I I know the human condition not I'm not in some sort of psychologist by but I know the human condition is that, come on, it's quantum computing. Give me a break. I've got my I've got my cyber stuff, pretty stout, right now it how do you get people to recognize that? Yeah, yes, it's going to impact you and begin that process. Because nobody, when you start talking about pulling into all this stakeholders, and, you know, it sounds like that whole jargon again. Hey, get this here and talk about this. And I can't understand that. And here's an acronym for something that I just will zone out on, how do you keep? How do you get? How? I don't know, I don't even know how to ask the question, but it's a how,

26:48

well, it's a great question, Scott, because one of the challenges, and you hit on it earlier, you know, we don't have a definitive date at which a quantum computer is going to exist, and that makes it a little bit murky and easy to set to hand wave and say, Oh, this isn't going to be an issue for a while. I don't know. I can prioritize this other thing first again, human condition, human nature. This is where the regulators really stepped up for us, because I mentioned earlier that a lot of the regulatory bodies in all of these countries and a lot of industries have put in place timeframes by which you have to be migrated. And so now it's not just a theoretical, this could happen. It is a practical. If we don't do this, we are out of compliance, and people will not be able to buy our stuff. Yeah, that helps.

27:41

28:19

I've been saying about 10 years. And when I talk to cryptographers and experts that have been looking at this in depth for a while, they're starting to tell me under 10 years,

28:32

yeah, see, I, I me, ever so humble host here. I think it'll somebody's going to some organization, something's going to crack, and then we'll speed up the speed it up, whatever it is, right? Right? Sudden, it just the dam breaks, boom, goes. Everybody's like, yes, and then you get it, you know, that's

29:00

the risk, right? Scott, that the right advancement, the right chip. We've seen advances in chips this year, yeah, Microsoft launched Majorana one. There. There are, there are advances all the time. Some, you know, some quantum computers are showing up with more qubits than we had before. So there have been technology advances. What if the next advance moves it from 10 years to five years. Yes. What does that mean for us? It's not necessarily going to be okay tomorrow, but it shortens the timeline. And we have all of this work we have to do to migrate our applications, and that takes a lot of time. And I got to tell you, Scott, you ask people, are we going to be ready the prevailing wisdom is we're not going to be 100% ready. We're going to be conducting a prioritization exercise, moving the most important stuff first, not everything's going to be ready on day one.

29:52

Yeah, I support that position. I agree there are going to be that. Oh my gosh. Oh the. White eyes, and it's like, oh my gosh. I didn't know this was happening, you know? But I digress. Here's, this is outside of, you know, the quantum computing, the value proposition with the quantum computer, what? What is driving that we can do more with? Yeah, what I mean we're doing a lot right now. How much more? What I mean, outside of all this other stuff, I

30:27

mean, it definitely expands our ability to do deep types of analysis. The early applications I've heard on quantum computing, besides the security use case, are things like testing and developing new potential drug and pharmaceutical formulations.

30:45

Yeah, that

30:47

could be really valuable. Yeah,

30:49

that is, I don't, I'm not going to. I'll be the first to embrace technology or innovation. I'll, I always think the positive versus the the other side of that coin, but it's, it's, you're bringing up some really interesting questions. I just I didn't know now, when you, when you pinged me, I said, I don't know anything about that. I hear about it, but I don't, I never thought of it that

31:20

way. So can I tell you something else?

31:23

Please share with me, Sandy. So when you

31:27

asked about the risks earlier, we talked about harvest now, decrypt later. But there is another piece of this, yeah, that we need to be aware of. And this is the thing where you know if harvest now, decrypt later, has to be addressed, say, 10 years before a quantum computer exists, then this other thing just has to be addressed before a quantum computer exists, and that's digital signatures. So I mentioned that a quantum computer will be able to break today's public key cryptography, and that today's public key cryptography is used to sign emails, sign contracts and documents, signed transactions, signed code. If a quantum computer is able to break digital signatures before we migrate to the new algorithms, then they're basically able to undo those signatures, change a document or an email or code, and then re sign it, so you no longer have the assurance that this artifact is what you thought it was, that it's what you initially signed. And so we basically have removed the whole notion of non repudiation, and we've removed the underpinning of trust. So we need to for any system where assurance relies on digital signing, we have got to get those pieces moved over.

32:46

There goes my head again. Yeah, you had it in your form right there, but I was geeking out on all the other stuff. Yeah, that's, that's, that's pretty significant.

32:57

It is, and it's one of those things we're so focused harvest now decryptor is really easy for people to understand. I think, yeah, the impact of digital signing is a little bit more complicated, and it's a little longer term, right? It's more this will happen once we have a quantum computer that can break it. But the impact is so profound in terms of not being able to trust all of these things that we had previously signed, yeah, and how that ripples through the ecosystem could be pretty significant.

33:31

Again, pay grade way above my head. That's, that's something that's why you're, you're where you're at at forestry. You have to add your team there at forestry research because, because, I mean, you're just blowing my mind. You're absolutely spot on, absolute that digital signature. I didn't, I didn't think about that either well,

33:54

and there's no reason most people would, but it's one of those things. We're really trying to talk about this and highlight it, because we want to start this migration process, curl

34:03

up in a fetal position and ship it. Yeah, you get all concerned. Well, we gotta wrap this up. That was fantastic. You did again, Sandy, hitting it out of the ballpark. You're always so good you got you're smarter than a lot of people.

34:22

Well, thank you for having me on Scott. It's always a pleasure to talk to you. Really enjoy these

34:26

discussions. It's all cool. How do people get a hold of you? Making me all scared and everything. I need to get a hold of her and get going. Yeah.

34:35

So forrester.com and you can take a look at my blog there, and, you know, reach out through that. And, yeah, happy to engage anyone who wants to know more. But there is a fair amount that I've published on the blog, so definitely check that out. LinkedIn ish, I am LinkedIn ish, good.

34:58

That's always easy to sort of. Yeah, there it is. There's the URL to Sandy carrier, yes. Well, you are wonderful. Thank you very much.

35:07

Thank you, Scott, great chatting with you.

35:10

All right. Listeners, yes, you could tell Sandy needs to be a part of your your network. Yeah, go read them. I'll have the I'll have her blog. Can I have your blog out there on my

35:20

website? Absolutely can. I will send you the link, and you can put it out there. I'll

35:25

do that. Read the blog, all right, we're gonna wrap it up on the other side. We're gonna have all the contact information for Sandy out on industrial talk as long as as well as her blog. So stay tuned. We will be right back.

35:37

You're listening to the industrial talk Podcast Network. You I

35:42

truly hope your mind was blown. I mine was. It was a geek fest. I really enjoyed that. And again, I I always enjoy the fact that you put your future hat on, and you're looking out there, and you're saying, Here, let me sort of assess the landscape out there. And here we are talking quantum computers. When I don't know it's gonna happen, and I guess, and I said it in the interview, it's gonna happen like AI, all of a sudden somebody's gonna crack it. Boom. Hey, we got quantum computing. I just thought, I thought it was just fascinating. Sandy Carielli, link out on industrial talk, Forrester research right there doing incredible job lifting heavy things. That's what they're doing. All right, be bold, be brave, very greatly. Get on industrial talk, and let's change the world. We're going to have another great conversation shortly. So you know, stay tuned.