It seems like you can’t throw a stone on LinkedIn without hitting a vCISO. But for all of the vCISOs out there, are organizations using them right? These roles are supposed to drive strategy and security alignment. So why are so many organizations using them as program managers?

This week’s episode is hosted by me, David Spark (@dspark), producer of CISO Series and Andy Ellis (@csoandy), partner, YL Ventures. Joining us is Mike Wilkes, former CISO and lecturer, Columbia University.

Got feedback? Join the conversation on LinkedIn.

Huge thanks to our sponsor, Tines

Full Transcript

Intro

0:00.000

[Voiceover] Ten-second security tip, go!

[Mike Wilkes] Add the RSS app to Slack. And then create an InfoSec news channel open to everyone in the company, and then subscribe to 20 or so newsfeeds to build a constant stream of news stories to help everyone tap into and build a curiosity around cyber security. Hint, it also helps to surface interesting developments for us InfoSec professionals.

[Voiceover] It’s time to begin the CISO Series Podcast.

[David Spark] Welcome to the CISO Series Podcast. My name is David Spark. I am the producer of the CISO Series. And joining me for this very episode, my cohost, it’s Andy Ellis – the partner over at YL Ventures. Andy, say hello to the audience.

[Andy Ellis] [Foreign language 00:00:55]

[David Spark] This is very relevant to what I’m going to talk to you about later, Mr. Andy Ellis. We’re available at CISOseries.com. If you haven’t checked out our other programming, please go check it out. And our sponsor for today’s episode is Tines, the smart, secure workflow builder. Who doesn’t want smart, secure workflow?

More about that later in the show. So, Andy, you spoke a little Spanish.

[Andy Ellis] Just a little bit.

[David Spark] Just a tiny bit. I was in Mexico over the weekend. I live very close to Mexico.

[Andy Ellis] Are you sure you don’t live in Mexico?

[David Spark] I do not live in Mexico, and I’ve never lived in Mexico.

[Andy Ellis] It’s San Diego. It’s close enough.

[David Spark] I’m in San Diego. Very close. But what I did is…part of my synagogue, we all went down to build a house for a family of four who needed it, and it was part of a group called Baja Bound, which I strongly promote and recommend. They were phenomenal. And it was a great experience because our kids went as well.

They were building the house. It was an amazing experience for them. We also got to see a lot of things that were happening in Mexico for people who are not as fortunate as we are. But really I think the shocking thing was we got there. There was a concrete slab that was the foundation. And in two days, we had made a house.

[Andy Ellis] Excellent.

[David Spark] Which was mind blowing. Have you ever done anything like this before?

[Andy Ellis] I certainly have build a lot of houses. I grew up in the construction trade.

[David Spark] Okay.

[Andy Ellis] It’s an amazing thing to do.

[David Spark] Yeah, especially when it’s like it’s nothing. And in a day… Not in a day. The first few hours, we at least had the frame up.

[Mike Wilkes] The frame, yeah. And you didn’t put a nail through your finger?

[David Spark] I did not. By the way, that’s Mike Wilkes, our guest. I’ll introduce him right now. He is the CISO over at Major League Soccer. Mike, thank you so much for joining us.

[Mike Wilkes] Great to be here.

[David Spark] I did not put a nail through my finger, but I definitely had a little bit of the fear. And I had the fear…not so much the nail through the finger but when my sons were using this concrete gun. Have you seen this thing? Where it shoots the nail right into the concrete?

[Andy Ellis] Yep.

[David Spark] That thing is like a powerhouse.

[Andy Ellis] Yeah. So, I play this game, David, called three unbelievable truths. Instead of two truths and a lie for intros, you say unbelievable things out of context, and people have to ask you the stories of which one they would like. And one of them is I’ve been shot at twice in my life but only hit once.

Guess what once I got hit by?

[David Spark] One of those guns?

[Andy Ellis] A nail gun while building a house, right through my foot.

[David Spark] Hold it. One of those? Because that was the fear, my son was going to do that.

[Andy Ellis] Yep. My dad did it.

[Mike Wilkes] Was it your right foot or your left foot?

[Andy Ellis] My left foot.

[David Spark] Your dad did it to you?

[Andy Ellis] My dad did it to me. Fortunately… The story gets… It’s not as bad as it sounds. It went right between my big toe and my first toe, so it burns and rips the skin off both toes.

[David Spark] Oh my God.

[Andy Ellis] But it breaks no bones, does no major damage. But…

[David Spark] You got lucky.

[Andy Ellis] I was terrified. But my foot is now nailed to the floor because it’s in a shoe. So, I didn’t realize how first how lucky I was because I just feel burning, shooting pain, and my foot is immobilized.

[David Spark] Oh my God. Holy moly.

[Andy Ellis] I mean, I’m glad that it was my dad who hit me and not the Muslim Brotherhood when they were shooting at me. I’m glad they were the ones who didn’t shoot me.

[David Spark] All right. Let’s jump into the show. No one is getting shot anymore.

As a CISO, what do you think about this?

4:16.063

[David Spark] “Enterprises aren’t using true virtual CISOs.” If you’ve been on LinkedIn, you’ve probably seen your fair share of vCISO titles floating about, but Wil Klusovsky argues that most organizations use the role to manage programs like GRC, governance, risk and compliance, or TPRM, third party risk management, rather than using them as an executive role that drives strategy and security alignment as a way to fill security gaps for SMBs.

So, Andy, I’m going to start with you on this. Is this the result of too many security specialists using the vCISO title? When we’re looking at the enterprise, what is the value a vCISO can bring? So, we’re talking about SMBs and enterprise. And have we stretched the term so far that it’s lost meaning?

My guess is you’ve got answers all over the map on this one.

[Andy Ellis] Oh, there’s so many different answers for this one, so I’m going to go for how an enterprise should use a vCISO rather than all the ways they’re badly doing it today.

[David Spark] Okay.

[Andy Ellis] There is two different things that people call vCISO. One is security consultant. I’m going to ignore that. The other is an actual CISO who understands how to be a CISO, and you just want a sliver of their time. And odds are the way that you’re going to use them is you have a security team today, or you want to build one.

It’s really going to be transactional. It’s, “Hey, I want you to come in and either for a very short period look at what I’m doing, give me some input about how I’m doing this, maybe mentor and lead the head of my security team towards being a CISO.” Or it’s going to be, “Go hire me a team and set me up.

Build that initial program out for me.” But that’s more like a fractional CISO sometimes. The vCISO should really be like an in and an out, either sort of part-time advising, like bridge between the board and your security team, or that one-time, “Hey, come in and figure out what’s going on.” Give you the advice from an experienced CISO about what you ought to be doing.

But you really don’t want to think about a vCISO as a strategic long-term resource because you don’t want them to be the one who knows everything about your program. You want that to be one of your employees.

[David Spark] Good advice. All right, I throw this to you, Mike. Instead of telling us everything that’s going wrong, which you can mention one or two, what should the vCISO role be? And why is it a good role to be out there, too, for that matter?

[Mike Wilkes] Let me start with LinkedIn sales navigator. If I were to look up CISO as a title for North America, I could come up with perhaps around 8,000. I think about half of those are aspirational, meaning they haven’t done it yet. And then of those 4,000, I’d say half of those are imposters. So, I think there’s only actually 2,000 CISOs in North America doing the job.

And so, yes, it is being used a bit much and abused. But I did a whole webinar on my first 100 days as a vCISO back in August. I was working on building and supporting a fractional CISO startup called the Security Agency. And there’s definitely a problem with the title and who qualified. I float the idea of a CDLC, a CISO development lifecycle.

[David Spark] I like that term.

[Mike Wilkes] This is actually inspired by Andy, your presentation at that YL Ventures at the Rockefeller Center one morning. Where you have the cycle… I just sort of gave it four phases to begin with. Aspire and become a CISO. Grow and broaden your skills. Achieve and create teams and legacy. And then the final phase, reflect and give back to the community.

And so here, I think about it’s useful… There’s hard skills. There’s soft skills. There’s hands on CISOs. There’s player/coach combos. There’s pure governance and compliance people that live in paperwork and don’t actually maybe even type a password or log into computers to do their job. Right? And so I think there’s also a CISO professional association.

The Cyber Future Foundation is putting it together. Along the lines of a Bar for lawyers. So, that said, I think it’s a very young profession. It’s not barely out of our teens yet. And so there will be fits and spurts of growth and maturation to be expected.

Why has this topic suddenly become the center of attention?

8:23.041

[David Spark] The shipping industry has had to deal with physical security, like piracy, for basically as long as they’ve been afloat. But cyber security is now in sharp focus, too. A recent survey by ASIS International found that, “Seven in ten professionals say that their leaders consider cyber security to be the greatest risk their organization faces.” With at least 42,000 ships globally connected to satellite service, air gaps aren’t enough these gaps.

This issue first came to light with the NotPetya attacks on Danish ship owner, AP Møller-Maersk in 2017. The Financial Times reports that maritime cybersecurity incidents shot up in 2023 to a record 63, up from only 20 in 2022. And ASIS International found that 61% of respondents are increasingly their OT security budgets.

All right, Mike, we’re going to you first on this. In your experience, what are the challenges in maritime cybersecurity, and what does the industry need beyond just bigger budgets?

[Mike Wilkes] Well, let me qualify my experience a little bit in the area. So, I’m a part of the Area Maritime Security Committee for the sector of New York for the US Coast Guard. And so we advise…this committee advises DHS on helping the Coast Guard to level up on cyber, because the Coast Guard knows what to do if a ship is sinking or on fire but necessarily if it’s been commanded to crash into a bridge in Baltimore, like the Dali.

Although that wasn’t a cybernetic event, to the best of my knowledge. But what I would say is that regulatory needs to catch up as the guidance around cyber security in the maritime sector is woefully out of date and very short on details. So, before we can really worry about unfunded mandates in critical infrastructure like maritime, I think we need to get some good rules and some good standards in place.

Even defining what is a transportation security incident is reflexive and self referring. It doesn’t really give you anything to decide what needs to be reported on as a cyber incident or even as a transportation security incident. So, we also need to harmonize the core concepts and rules so that complying with the FAA, and DHS, and FEMA requirements in our ports and on our vessels is not a triple burden.

Because sometimes these requirements are actually at odds with each other.

[David Spark] All right, amazingly good tips right there. Andy, I throw this to you. Maritime cyber security. What makes it so unique, and what should be top of mind for them?

[Andy Ellis] So, I think there’s a lot of things to pay attention to. One is you also look at space as being sort of the next maritime. It’s just a more extreme version of it. Is consider the accessibility of devices. Like it’s one thing… We’re like, “Oh, I need to download a patch. And if I screw it up, I can walk over and reboot the system.” Well, when it’s afloat, you might not…or when it’s in space, you might not have that ability.

[Mike Wilkes] Linux on Mars, yeah.

[David Spark] [Laughs]

[Andy Ellis] Yeah. The other challenge that actually comes into this is maritime rules are already really wonky in the United States, especially with the Jones Act. And who can we really control when it’s not a lot of carriers are US flagged anymore? In fact, there’s not enough to service US needs. So, like how do we actually deal with the fact that you have multiple different governance entities who are sort of playing in this?

So, it’s not just DHS, and FEMA, and FAA requirements. That would be fantastic. It’s also whatever country they’re flagged under. I would love to either get rid of the Jones Act and maybe then put some umbrella over those flagged carriers or figure out a way to get more American flagged carriers. But that would give us different kinds of security than just cyber, because it would also give us things like make sure that gas going to Puerto Rico from the US instead of through Spain.

[Mike Wilkes] Well, to be fair, there is a notice of proposed rule making for Title 33 of the CFR.

[Andy Ellis] I will be so happy if that goes through.

[Mike Wilkes] But it doesn’t harmonize jack.

[Andy Ellis] Right.

[Mike Wilkes] What it does though is it introduces some more modern requirements like pen testing, risk assessments, table top exercises. And for over 12,000 facilities that might qualify if they’re large enough to actually have a CISO. And [Inaudible 00:12:44] a fractional CISO.

Sponsor – Tines

12:44.911

[David Spark] Well, I’m going to tell you about our brand new sponsor now. It’s Tines. You’re going to like this. Listen to this. Security teams are facing a constant uphill battle. I don’t need to be telling you this. This is why you listen, hopefully that it’s not so uphill. But between alert fatigue, repetitive manual tasks, endless false positives, inflexible technology, and the looming risk of burnout, it all adds up, making it tough for teams to stay ahead of threats.

We’re talking about efficiency here. So, every day, valuable hours are spent sifting through noisy alerts and managing rigid workflows instead of tackling the real security issues that matter. It’s draining. And over time, it can start to impact even the most dedicated teams. And this is where Tines comes in.

Built by security practitioners for security practitioners, Tines is an orchestration and automation platform designed to meet the demands of security teams.

Tines empowers analysts and engineers to automate their most repetitive time consuming tasks, regardless of complexity. No coding experience required, just the flexibility to tailor workflows to your team’s exact needs. The result, companies like McKesson, Canva, and Mars are saving hundreds, even thousands of hours on manual tasks, allowing them to focus on impactful work and real-time decision making.

So, if your team is ready to trade burnout for breakthroughs… I like that. And tackle threats without unnecessary noise, go visit tines.com/CISOseries. Please go to that specific address so they know we sent you there. Go check it out. Tines. Because security work should empower, not exhaust.

It’s time to play “What’s Worse?”

14:39.967

[David Spark] It is time to play “What’s Worse?” Mike, I know you know how to play this game, because you’ve played it before. But…

[Mike Wilkes] I’ve won several times. Oh, wait. No, sorry, that’s best worst idea.

[David Spark] I don’t know if there is winning involved in this game. But…

[Andy Ellis] No, there is winning. If you agree with me then David loses.

[David Spark] Well, again, but he is the one who gets the advantage in that I always make Andy answer first. And…

[Mike Wilkes] I thought David was just asking the questions. I didn’t know he got to answer.

[Andy Ellis] He is. He is. But he’s trying to make it… He doesn’t want you to agree with me.

[David Spark] If the two of you agree then Andy wins. If the two of you disagree then I win. That’s what we say. But it’s always in his favor because he gets to answer first. And often, there is one way or the other. Anyways. I have to say a huge thanks to our community because I said, “Hey, I need a, ‘What’s Worse,’ scenario in the next two and a half hours, and I got about eight.

I haven’t even gone through them all. But this was the first one that came in, so this is the one I’m throwing, and I like this one. It comes from Neil Saltman of AHEAD. And Neil has sent in lots of great “What’s Worse” scenarios.

[Andy Ellis] Yeah. And Neil wrote a good book, if I recall correctly. Somewhere back here on my bookshelf.

[David Spark] Yes, for cybersecurity sales. Yes, I have it as well. I’m quoted in the book at the very beginning, in fact. Here are your two scenarios, Andy. What’s worse? The FBI reaching out to you to tell you you have been breached. So, you couldn’t figure it out.

[Andy Ellis] Been there, done that.

[David Spark] So, that’s one. Or the FBI demanding information from you that you don’t have because you reported a breach. What’s worse?

[Andy Ellis] Been there, done that.

[David Spark] [Laughs] Okay.

[Andy Ellis] But I assume by I reported a breach, it’s like I reported my own breach.

[David Spark] You reported your own breach, and now they want more info, and you don’t have it.

[Andy Ellis] Yeah. So, at the end of the day, I’m not beholden to the FBI. It’d be nice to give them information, but I have no downside. Like if they want information that I don’t have, it’s like, “Sorry, you all lose.” So, in both cases, I have a breach. I know, and the FBI knows. But in one, I knew first.

And the other, the FBI knew first. So, I’m going to go with it’s much worse to have the FBI tell me than to have me tell the FBI. Regardless of whether they have more information I don’t have.

[David Spark] All right. That’s it? It’s not like you look bad?

[Andy Ellis] I actually think this one is pretty cut and dry. I think the challenge here is if you’ve never been on this conversation with the bureau, it sounds really intimidating. “Oh, the FBI is calling you and haranguing you.” I had a breach. I’m the victim. The FBI is actually really cordial and polite.

They will ask for information, but they’re not going to put me through a ringer because I’m imperfect at that point.

[Mike Wilkes] Yeah. Or you could even say, “I don’t have the information because we intentionally don’t log it, so there can’t be a silent subpoena, so that we can’t give it up.”

[Andy Ellis] No, you don’t actually say that, even though that’s the reality.

[Laughter]

[Mike Wilkes] But yeah. No information is a defensible position.

[David Spark] All right. Well, do you then agree with Andy here, or do you want to take the opposing side, Mike?

[Mike Wilkes] I have to agree. Because the FBI surprising me and saying, “You’re unaware of a breach event and that you have threat actors…” Of course, it depends how long ago, I guess. If they said, “You’ve been breached for two years,” then I would get pissed at them and say, “How come you’re only calling me now?” This was the case with like NXP in the Netherlands.

They were breached by the Chinese for two years. They only found out about it when another Dutch company, Transavia, got breached by the same threat actor. And the threat intelligence and DFIR team came in and said, “Hey, there’s additional traffic coming to the command and control service from NXP.

Let’s give them a call.”

[Andy Ellis] Right. And here’s a place where we should give a shoutout, I always want to, to Heather Atkins at Google. It used to be before Operation Aurora that the FBI did not tell anybody. Like if you called them on a breach and they found 50 other companies were compromised, they weren’t going to notify them at all.

And when Aurora happened, and Google was basically the center or the locus of that one, and the FBI said, “Oh, we’re not going to notify people,” Heather Atkins was like, “Okay.” Went and found the command and control server, waited for the adversary to deregister it, grabbed that IP address, looked to see all of the adversary’s clients connect in, reverse mapped what companies those were, and called all of us.

And said, “Hey, by the way, you’ve been breached.” And the FBI was so embarrassed they changed their protocol, and now they do notifications. So, among many other things we have to thank Heather for, we should thank her for the fact that the FBI does now notify people.

[David Spark] Is there a government agency for which this scenario, if we swap the FBI out for any other government agency…where scenario two would be worse? Where you’re not giving them the information?

[Andy Ellis] I mean, it might be the SEC at that point.

[David Spark] Yeah, that’s what I’m thinking.

[Mike Wilkes] Yeah, anything to do with financial services records, you’d be hard pressed to…

[Andy Ellis] Yeah, the OCC, the FTC, and the SEC…

[Crosstalk 00:19:32]

[David Spark] So, that would swap it if it was that?

 [Andy Ellis] Maybe. I’d have to think hard about it. But like…

[David Spark] So, SEC sounds like the big one. You’re a public company, and you’re not giving them information.

[Andy Ellis] Yeah, because now that… They have demonstrated their willingness to prosecute you for crazy and silly things. So, I would not want to give them a reason to do so.

[Mike Wilkes] There’s likely a big fine on the other side of that, for a regulated kind of record retention and policy. I think it was one of the…JP Morgan or someone…I forgot, if I’m disparaging them unfairly, but they were actually testing some of their record retention controls, and they accidentally deleted a bunch of data that was on hold.

[Laughs]

[Andy Ellis] Oops.

[David Spark] All right. Let’s hear it for top three federal agencies you don’t want to mess with in terms of not being able to give them information. SEC, is that at the top?

[Andy Ellis] Yeah, SEC is definitely going to be at the top.

[David Spark] Then what are the next two?

[Mike Wilkes] ATF, just because they’re scary.

[Crosstalk 00:20:23]

[Andy Ellis] ATF. ATF, I’m never going to give them information. Look, I’m not an FFL. But if the ATF showed up and asked me for something, my answer is, “I have a lawyer, and you can talk to them.” Yeah, but SEC is right up at the top. I’m probably going to put some of the counter intel folks. So, depending on where that fits within your rubric, like whether that’s going to be the DOD or someone… That’s pretty high up.

When counter intel shows up, you really do need to talk to them.

[David Spark] Okay, so that’s two. Do you got another agency that’s up there, Mike?

[Mike Wilkes] Humorously, I would just say EPA. You know? Because if I was messing with mother nature, I would feel really bad. Like spiritually.

[David Spark] Okay. [Laughs]

Is this really the right strategy?

21:03.554

[David Spark] Unless you’re talking about the HBO show, most people don’t like to about succession. But maybe we aren’t setting the right expectations with executives about this topic. In a piece for Information Week, Glenn de Gruy, with executive search firm Kingsley Gate, recommends that leadership raise the topic of succession planning during the interview process with potential CISOs.

“Bring this topic up within the interview process and you get a better understanding from the candidate,” he says. “How open-minded are they to embrace this form very early in the process?” He further recommends having a succession plan in place with six months of taking on the role. Mike, would you ask this question if you were hiring a CISO, and what would be your answer if you were in the hot seat being asked that question?

I like this one. What do you think?

[Mike Wilkes] Definitely. I would definitely be interested in answering and asking the question. Interestingly, I’m unable to find any references to episodes that have cybersecurity incidents or breaches in “Succession,” which I think is a failure of the writers. But just some stuff around controlling data and covering up a sexual abuse scandal in their cruise division.

But more than once, I have begun authoring my offboarding document in parallel to my onboarding document.

[David Spark] That is interesting.

[Mike Wilkes] Yeah. How to unwind the permissions and responsibilities and make sure that clear ownership for various functions is established. This is out of self protection, but it’s also to protect the team and to help those who have to pick up the pieces afterwards if the exit is too abrupt. So, I’m very transparent, and I think succession planning is very important.

That’s one of the reasons why I teach, actually, is to try to bring more CISOs into the world.

[David Spark] Very good. All right. Andy, I throw this to you. First of all, have you seen this happen in an interview where they talk about succession planning in the interview process?

[Andy Ellis] So, definitely yes. But I’ve usually seen it brought up by candidates.

[David Spark] Really?

[Andy Ellis] Like if you’re a candidate who’s a credible CISO, you’re actually going to walk in talking about succession planning. Because if you are already an experienced CISO, part of your job is to prepare the company for your departure. Whether that’s going to be in three years, five years, ten years, you should be saying, “Here’s how I’m developing the people underneath me.

Here’s how I’m going to establish what the role is, how I’m going to grow the team. And there will always be a succession plan, not just for me but for everyone of my direct reports. And then I’m going to cascade that down in the organization. This is healthy management.

Everybody should be doing this in every role is figuring out who’s going to take your job when you move on because that’s the only way to get promoted. If you are irreplaceable in your current job then you can’t get promoted because they can’t replace you. So, if you want a different job then you’d better actually replace yourself.

And that’s how you get more opportunities. Like you were the CISO. Maybe now you’re the CTO because you understood product and technology, and you had a great person underneath you who can do 90% of the CISO job. Maybe they’re not great at the executive interface, so they work for you for a while, while you’re doing CTO gigs with the CISO title, sort of hanging on until you give it to them.

So, absolutely, this should be right up front. This should not be an issue. That said, I come out of the military in one of my first full-time professional gigs was in the Air Force where the day you show up, you basically are on a three-year timer. Like you are gone from your job in three years. So, you have to plan your offboarding the day you start.

[Mike Wilkes] Well, as CISOs, we’d be lucky if we got guaranteed three years.

[Laughter]

[Andy Ellis] Yeah. Wouldn’t that be nice? I mean, I managed to pull 20 years. I’m the outlier.

[David Spark] I know. You are an anomaly. Hold on. How many other CISOs do you know that have had that title as long as you have? I’m sorry, had the title at one company as long as you have?

[Andy Ellis] Oh, there are a handful who have done it. God, I’m blanking on the name. There’s a guy who just retired here in Boston.

[Mike Wilkes] Ed Amoroso, at AT&T.

[Andy Ellis] Yeah.

[David Spark] Oh, okay.

[Andy Ellis] Ed did. Myrna had it at Comcast for a while.

[David Spark] Okay.

[Andy Ellis] I don’t remember how long. But there’s a handful. But it’s usually the really big, mature companies. I think it’s more we were in the right environment where our company kept growing, which kept us growing in our roles, and the company was successful enough that there wasn’t this, “Oh, we have to cut back the security team because that’s a luxury we can’t afford.”

What’s the future for a CISO?

25:24.214

[David Spark] Gartner released its strategic technology trends that, “span AI imperatives and risks, new frontiers of computing, and human-machine synergy,” according to analyst, Gene Alvarez. This includes agentic AI. These are systems that autonomously plan and take action based on user-defined goals.

Gartner predicts 15% of day-to-day work decisions will be made by these systems in 2028. That’s just three years away. 15% of your work, a bot will take care of supposedly. Andy is waving his finger. Then there’s AI governance platforms, used for creating, managing and enforcing policies for responsible AI use.

Another one of note was post-quantum cryptography. On Cyber Security Headlines we’ve followed the drumbeat of PQC, post quantum cryptography, migrations in the industry. Gartner predicts quantum computing will make conventional cryptography unsafe to use by 2029. Now, we’ve heard this looming fear for a while.

I’m going to start with you, Mike. Will this be a damn burst situation and we’ll all be screwed and none of us are prepared? Because I know they’re trying to prepare us. What’s going to happen? The way it’s being sold to us is a switch is going to turn on, and everything is going to change. What do you think?

[Mike Wilkes] I do believe that there will be a plate tectonic shift when the first cryptographically relevant quantum computer is built. And we won’t know that it was built because there’s no such thing as quantum incident response. You can’t see someone breaking your RSA encryption offline in a bunker deep beneath the earth.

I’ve thought about this question a lot. That’s one of the reasons why I wanted it in this episode. Because I work with the World Economic Forum Quantum Security Working Group. And so we published a quantum readiness toolkit for businesses to gauge their commitments in preparing now for that future day.

And it’s always five to ten years out. Five years ago, it was still five to ten years out. But there have been some leaps lately.

Google has had a lot of error correction because quantum is so unreliable. You need millions of cubits in order to have reliability or two 9s, 99%. And so they’ve fixed some of that. But you still need something like 20 million cubits in order to break RSA 2048 encryption in about eight hours according to Shor’s Algorithm.

So, the question here is how will we know… Like can we create a silent trip wire that would show, like, “Hey, someone obviously cracked the nut and is able to break strong encryption.” I think that trip wire would be somebody silently just starting to spend Satoshi’s first coins. [Laughs] Because no one knows where the private key is to that.

And if you start spending the first bitcoin, that would be a good indicator, a trip wire that this event has happened. But really the other thing to keep in mind is symmetric key encryption is reportedly going to be just fine.

It’s asymmetric that’s used in PKI and ecommerce to bootstrap a secure connection that is the one that is going to fall. And so that’s where all secrets will be known, and stored now, decrypt later kind of attacks, and PGP high jacking. These are all the reasons we have reasons to be worried and why we need to switch to quantum resilient algorithms now.

But of course, one or two get anointed by NIST, and then they get broken a few months later by even a basic classical computer. So, there’s this concept of quantum agility. Really just how quickly can we switch to those new algos once they become available, and then secrecy and private conversations will be available again.

[David Spark] All right, Andy, I throw this to you. Great setup, Mike. Agree, disagree? What’s your feelings on this?

[Andy Ellis] I pretty much agree with Mike. I just want to add some color into this one. So, we sort of skipped over the 15% of day to day work decisions made by AI.

[David Spark] I know, because you waved your finger.

[Andy Ellis] So, just to be clear, that’s decisions, not work. These are two very different metrics.

[David Spark] All right. I didn’t, I’m sorry, give it more qualification.

[Andy Ellis] Yeah. The decisions it’ll make. Because things like… I’ve got Apple Intelligence right now that sorts through my inbox and highlights the five most important messages for me. That’s like 20 decisions that just got made. Great. It saves me a little bit of time, but it’s not spending a lot of time for me.

It’s just making me more efficient. So, let’s not get overhyped on that one. On the quantum side, if I thought that in 2029 conventional crypto would be unsafe to use, I would be out screaming that we need to be off it today because that is four years away. And basically with packet capture going on, enough of the data is being captured today that basically we’re going to be screwed because people will be able to look back and say, “Oh, what was transmitted?”

Because if you can break the asymmetric crypto then you can get the session key. Then you can read what you had already captured. The challenge here is actually going to be the reason things get broken is we have a really painful requirement here, which is we need an asymmetric computation. Which prime number factoring is a simple example of.

Which is if you give me two prime numbers, I can multiply them very quickly to figure out what their product is. But if you give me the product, it’s really expensive for me to find the two prime numbers.

And at the end of the day, that’s the sort of thing we need to make the concepts behind asymmetric cryptography actually scale and work that I can give you one half of a problem, and it’s the half that it’s hard to reverse but easy to generate so that I can prove I know it. And I think we’re fundamentally going to have to be in a different model, because at the end of the day, most of those problems are in the NP hard/NP complete area.

And it’s not clear when we have a quantum computer large enough to break prime numbers that it won’t also be able to solve almost all the other problems that are out there with just a different algorithm than Shor’s.

[Mike Wilkes] There’s one thing I wanted to add real quick, which is the sort of Reese’s peanut butter cup of hype, which is combining AI and quantum and talking about quantum machine learning. So, wait for that one to land.

[David Spark] I like the Reese’s peanut butter cup.

Closing

31:44.937

[David Spark] Well, let’s close it up on that. Thank you so much, Mike and Andy. And, Mike, I’m going to let you have the very last word here on this. But I do want to thank our absolutely spectacular sponsor, and that’s Tines. Remember, they are the ones who are the smart, secure workflow builder. Go check them out.

Go to tines.com/CISOseries. Remember, add the /CISOseries in there. Let them know we sent you there. They want to know that you care about this subject. And, by the way, they’re maybe not going to get rid of 15% of your work, but it’s going to make you a hell of a lot more efficient. What Andy said.

Maybe even more. Who knows? Maybe Andy is completely wrong. That’s what I’m planning on. Andy is completely wrong. What does he know? Mike, I know… You plug this on our Slack all the time. The National Jazz Museum in Harlem. Give us the low down.

[Mike Wilkes] Sure. I’m on the board of trustees at the National Jazz Museum in Harlem. And we have a mission, and I encourage everyone to contribute and donate to our mission to preserve, promote, and present jazz by inspiring knowledge, appreciation, and the celebration of jazz locally, nationally, and internationally.

And of course I’d be completely remiss if I didn’t mention that we’re now in the 30th season of Major League Soccer, and we’re having an amazing opportunity with the world cup coming in 2026. You know, America’s next game is on the rise. And we have a great TV series that just dropped on Feb 21, which is called “Onside” which is from the makers of “Drive to Survive.” So, it should be really good.

Check it out.

[David Spark] Oh, very, very cool. So, you see, that’s what people… They want to know the players who are involved, and that’s why “Drive to Survive” does so well. Exactly. All right. Thank you again, Mike. Thank you very much, Andy. Thank you to our sponsor, Tines, as well. And thank you, audience.

We greatly appreciate your contributions and for listening to the CISO Series Podcast.

[Voiceover] That wraps up another episode. If you haven’t subscribed to the podcast, please do. We have lots more shows on our website, CISOseries.com. Please join us on Fridays for our live shows – Super Cyber Friday, our virtual meetup, and Cyber Security Headlines Week in Review. This show thrives on your input.

Go to the Participate menu on our site for plenty of ways to get involved, including recording a question or a comment for the show. If you’re interested in sponsoring the podcast, contact David Spark directly at David@CISOseries.com. Thank you for listening to the CISO Series Podcast.