The Importance of Verified Mark Certificates with Dean Coclin | DigiCert Trust Summit 2023

This is Textron tv. Hey, everyone. Good morning, or yeah, maybe it's good afternoon, wherever you're on the world, even.

Good evening. Uh, Alan Shimmel here, Textron Group, Textron tv. And we are happy to be out in Las Vegas at Resorts Worlds for DigiCert's Annual Trust Conference.

You know, we've been, we've been, uh, covering the DigiCert Trust conference since before the plague, you know, and, uh, but this is the first time we're back out here in Vegas, in person for it. So that's a lot of fun. Happy to be out here.

Um, we have a great little setup. We're gonna be streaming all day here, and, um, bringing you what, what's new in the world of digital certificates and, and trust. I'm happy to have as my first, uh, guest today, Dean Cochlan.

Yes. And Dean is Senior Director business Development at Digis, and he's going to be talking to us about kind of a, maybe it's not on the main highway, but it's a very, very hot topic right now. And this is this whole area of verified mark certificates.

So, Dean, first of all, welcome and thank you. Thank you. Welcome For, thanks for being here.

Let, let's start with that. What do, when we say verified Mark certificate, what do we, what are we talking about? Sure.

Well, Alan, thanks and welcome to you for coming to our conference this year. It's a pleasure. Um, so verified Mark certificates are the ability to show your trademark next to the, from name in Gmail, apple Mail, and various other email products.

Now, originally this was done for branding purposes to give you the ability to brand and show your brand in every email that you send. Marketers love this because it gets more brand impressions and marketers are all about brand impressions. Sure.

But there's also security benefit to it as well, because in order to enable verified mark certificates, you need to have something called DAC on your domain. DAC is a security protocol to prevent somebody from spoofing, uh, you or someone in your company. Uh, and now Gmail has added a security indicator, not just the logo, but there's a little blue check mark.

And when you hover over that check mark, it says, the sender of E This email owns that mark and the domain that it sent from. So there's a nice security benefit. So people, uh, can avoid being phished by hovering over that mark and seeing that mark, uh, a huge benefit to the public at large.

I, I love it. You know, look, I, I'll tell you, at, at, uh, text trunk, we actually, you know, we're corporate Gmail is the back end. Okay?

Yeah. And man, configuring our DMA system was because we send a lot of mail between our webinars and our newsletters. We're a content right provider.

And so a lot of people try to spoof us because a lot of people led us into their mailbox. Right. And, you know, and we would, you know, we, we, it, it was a learning experience, to say the least, to configure out DMA and, you know, lock it down so that we can't be spoofed while still being able, able to send email right through the various domains and stuff.

Well, think of, think of a verified mark certificate as the reward for doing dmar C Yeah, I know. I can't wait to go home and tell my people to go do this now. 'cause we're gonna put that T logo, the little bug in there.

Oh, Yeah, that's right. Yeah, we're Gonna, we're gonna jump on it. All the work that you've done to enable DMAR can now be rewarded by having that brand and that blue check mark in Gmail.

And other email providers are also supporting this. As I said, apple Mail, Yahoo is one of the other ones that are supporting it, and a lot of local providers are doing it as well. So we're seeing growth in this since it started in 2021.

And since that check mark was added in May of 23, sales have really picked up on verified marks. Oh, I'm sure There's one thing I should mention. So, for a verified mark, you need to have a registered trademark.

So if you don't have a registered trademark, there's going to be a new option coming out in December or January called a Mark certificate. The difference between a verified mark and a Mark certificate is that you don't need a trademark. You just have to show evidence of prior use.

So we go to the way back machine and we'll look, if you don't have a trademark, we'll look at your domain and see that you've been using this logo for at least a year, and then we can give you a Mark certificate. So this is through DigiCert? Yes.

Wow. And the difference in the display is that you will see the logo, but you will not get the blue check mark. Only the verified marks get the blue check mark.

Fair Enough. So do you have a trademark? Um, you know what, we, I'm not a hundred percent sure.

I don't, we have a registered mark register. I don't think it's a trademark. Okay.

So then you'll be eligible for a Mark certificate and you'll get that branding that you like. Yeah. I mean, look, branding's nice.

Yeah, absolutely. But, you know, we, we shouldn't lose sight of the fact that phishing Yes. Is still probably the number one way in when you look at, you know, the anatomy of a breach.

Right. You know, and, and how these breaches occur, you know, is probably still the most, I wanna say popular. I don't know if popular is the right word.

It's more, most prevalent. Absolutely. Yes.

And we're giving a talk here today at four 30 with, uh, Seth Blank from Val Mail on exactly this topic, because phishing is a big problem. Mm-Hmm. A lot of corporations are victims of phishing attacks, and people's credentials are compromised because of these phishing attacks.

And then you're talking about a major, major problem. Let's say the CFO's credentials get compromised. Now all of a sudden, uh, hackers are able to use those credentials to do very, very bad things.

Stealing money. Sure. Stealing customers, things like that.

So we help, we wanna try to help reduce phishing, ransomware. Ransomware. Yeah, exactly.

Excuse me. We wanna help reduce phishing and verified marks are one way to help do that. You know, Dean, I've been in tech a long time, Excuse me, And 20 plus years, I, I felt like the mail industry has been chasing this thing of encrypted and digitally certified.

So, you know, it's really me who sent you Right. This email. Right.

And somehow I, I have a certificate that somehow shows up, but of course, the problems were, I don't know what male client you are using, you don't necessarily have any control over what male client I use and where it's coming from. And it, and so it never really Yeah. Made the connection to, to nail it.

This, this has, if you got Apple in there, you've got Gmail, Google, you, you know, Yahoo, of course, there's still one big one missing, but There is, there's one big one missing there. And we're hoping that they will also implement this in the future. Um, I know that they're looking at it, and we'll see where that goes.

I can, I don't know their, uh, product development timelines, but we'll see what happens there. But you kind of alluded to, uh, another type of email security, which we call SMM or Secure Mail, uh, yep. Implementations.

And that requires digital certificates to verify the sender's authenticity Yep. Uh, to encrypt a message in, in, uh, transit. And also to ensure the integrity of the message.

It hasn't changed when it gets to the recipient. Excuse me. Now, for the first time in 25 years since email security has been introduced, we now have secure standards for how these certificates are issued.

This was just made into effect in September of 2023 by the CA browser forum. And now every certificate issuer has to follow these standards to issue these certificates in a consistent manner so that these email products can then process them in the right way Consistently. And that, that was really the, the issue.

It was a Tower of Babel kind of thing, right. Where everyone did, was doing their own thing. And, but you bring up an appointing that's really important.

This whole verified mark thing. This isn't a DigiCert only. No.

Right. This is, this is an industry-wide sort of movement. Here It is.

It's, it's being promulgated by a group called the Bii Group. Mm-Hmm. BII stands for brand indicators for Message identification.

And it's a group of mailbox providers, email service providers like Constant Contact and MailChimp and other companies that have come together to come and break the, make the standard globally. Now that it's a standard, we have two certificate authorities issuing these certificates for use. And there's been almost, um, I think there's actually about 2000 of these verified marks in use today.

Now, that's a relatively small number, but these were only introduced a couple years ago. And that use is really growing, especially after that blue check mark got implemented. Sure.

So, I think we're gonna see more as more and more people see this and say, Hey, what's this blue check mark? How do I get this? We're gonna get a lot more adoption.

And the nice thing is, big brands are already adopting it. People like Target, Amazon, uh, major League Baseball, all of these companies have adopted it. Uh, and they wanna be able to show their brand and the security aspect as well to their customers.

You know, I, I look the branding is nice from a marketing perspective, but I I love this blue check mark. Yeah, of course. You know, maybe someone who, who does social media would loves blue check marks, maybe they'd want to get A love.

That's a good point of controversy, believe it or not, because after that whole, you know, Elon Musk, blue check mark thing, Mm-Hmm. Some, uh, resistance to actually doing, maybe We should go with a red check mark. Yeah.

Well, red has some interesting conversations. Oh, Green, something green, definitely. But, uh, a absolutely.

So again, BII stands for brand identification indicators, brand indicator for Message identification, For message identification. And, and that's in there too. You know, and this is, I I, it's still rolling.

Right. But this available today. Yes, it is.

Especially if you have a trademark. If you want that blue check mark. Absolutely.

Now, let me give you a little background on how it, what it takes to issue these, because these are very high assurance certificates. Mm-Hmm. So this is not just like issuing a domain validated certificate here.

We have to validate the domain, we validate the business as a real business. We validate the person applying for the certificate is a real person. And we do that through a video call.

So we have, they have to show their ID in the video call, and we verify them. We verify the trademark. So we have to go to the trademark agency and verify that that is actually the trademark that they have.

And we verify the logo that they've submitted matches that trademark. So there's a lot of identification that happens in that process, and it takes a while to do that. So you can't just apply today and get a certificate tomorrow.

Right. We have to do all this validation. And, you know, when you validate a domain, you have to call somebody, they have to respond, or you have to send them an email and they respond.

So there's steps here where people don't respond, and it takes a little bit more time. But I think the benefit here is that for mailbox providers and for users, they get that high assurance that goes with all that validation that we've done. Love it.

I wanna switch gears a little bit. Sure. So we, we were talking off camera about a, a, a new sort of EU wide.

Oh, digital id. Yes. The wallet.

Yeah. So talk To Us. The European Union has, uh, come together with legislation called EIAS, which is the electronic Identification legislation that actually came out in 2014, I believe.

But EI dash two is about to become a law, uh, later this year, early next year. A big part of that update is what's called an EU digital Wallet. The purpose of this wallet is to have cross-border identification of individuals through the 27 member states, and to be seamlessly identified and seamlessly using that ID through all of these member states.

So this wallet application is now, there's a reference framework, and every country can develop their own based on the reference framework. And let's say I am in France and I wanna travel to Belgium, and I can use this instead of my passport or my ID card, I can use the electronic wallet. I could put my driver's license in there.

And a big difference between this and previous versions of wallets is that I can only show people what I need to show them. Uh, if I'm going into a movie theater to prove that I'm over 18, uh, because there's a, a special movie, uh, I can only have to show my birthdate. I don't have to show the whole thing, which has a lot more, you Don't go to many of those special movies though.

Let's just be clear. Maybe buying alcohol or Something. Yeah, something like that.

Uh, or, um, uh, you can also have your diploma on there, and maybe I only need to show my diploma to an employer and not my age and my, um, my blood type and all this other stuff. What about, I was just gonna ask, what about like vaccine records? Yes.

Medical records are also part of this. So showing a blood type or showing the fact that you've had vaccines that can all be put into this wallet. So the wallet can be very powerful, but as you can imagine, when you have so much information in one place, security is paramount.

So making sure that no one else can read that information, it's only available to me, is a primary key in the design consideration of the wallet. And of course, this is, look, we, we've heard talk around this for a long time. The eu, the eus out ahead of, ahead of the US here.

Yeah. I, I think there are so many, uh, private, well, there's a couple things. There's the old state's rights where, you know, not every state wants to do what, you know, a red state may might want to do what a blue state does, and all of that stuff.

Privacy, I, you know, it's gonna take, it's gonna take a big lift to get that done in the us. But What the EU did is they put the legal framework in place. And that's something that we don't have here.

We often had a digital identification or a digital, um, electronic digital identification law since 1999. Uh, so the EU has moved to put that framework together. Once the framework's in place, then people can implement.

Look at Arizona. They now have digital driver's licenses. You can put them in your wallet.

Yeah. Wait. Oh, I didn't know that.

And it's acceptable when a policeman stops you, you can show that digital identification, but that's not acceptable in Pennsylvania. Right. Or New Mexico.

So when you cross that border, it's no good. Right. So if we had a, uh, a US wide framework, at least something that everybody can agree and say, Hey, this is available.

If you want to use it, great. If you don't, you don't have to. I think that would be the first step to get it moving.

But maybe that's a dream. We can't even pick a speaker. Let's face it for the Congress though.

Yeah. Nothing's Gonna happen in This. Yeah, it is.

You know, it, it's, it's a noble ideal. And I, I could see all the good from it. Right.

It's just might be a, a a, a bridge too far as they say. Yeah. Hope here in the us we hope.

But I commend the EU for doing it and looking forward to seeing it implemented. There's a lot of discussions and a very, a lot of excitement around this, this thing now, because right now, people, when they travel within the Shein zone or in the eu, uh, they can show they don't have to show their passport. They can show this ID card.

Absolute. So look, I think you start marrying this to biometrics, which takes the security up three notches. Yes.

Yep. And you're done, you're done carrying around the wallets with Show me, you know, the whole thing. Exactly.

And passports. And, you know, but who am I? And the other thing you can do with this wallet is you can digitally sign things.

So if you have to apply for a mortgage or apply for a loan or something else, you don't have to have, uh, you don't have to be in person. You can use your wallet, which contains your digital credential to actually put a signature on that document. So that's another huge benefit.

So I think the EU has got the right idea going forward into the 22nd century at some point, you know? Yeah. But right now we're, we're, they're ahead of the game.

And, uh, I wish some other countries, I think other countries are looking at this very closely to see, Hey, how do they do this? What's this framework? Can it work in our country?

Asian countries are looking at this. Yeah. I think, I think you'll see countries like Singapore.

Yeah. Japan is looking at Japan. They'll, they'll jump way ahead on this.

Absolutely. So they're, they're really interested in this framework, uh, because it forms the basis that can be used now globally. Excellent, man.

Any, any other news items you want to share with the audience? Well, um, as I said, so going back to the Mark certificate thing, uh, I think the biggest impediment right now for people adopting this is the lack of a trademark. So small medium businesses or nonprofits, think of those.

They don't have trademarks. Right. So now with the Mark certificate coming out, this makes this available to a lot a bigger audience.

Yeah, it does. So we expect this to go into a production in the first quarter, next year, uh, with the cooperation of Gmail and others. And once that goes into production, I think we're gonna see a lot more people wanting these certificates.

Uh, and you're gonna see a lot more logos in your inbox. I, I, I welcome it. 'cause I, I see some now.

Yes. And I, you know, it, it makes it easily, easily identifiable. Right.

And then with the blue check mark to make sure it's secure. That would be great. Exactly.

We'll keep your eyes open. It'll be coming more soon. Absolutely verified.

Mark certificates. Hey, Dean, stop. Thanks for stopping by here in this, you know, it's early in the morning Vegas time, and you're, there's a lot.

Are you presenting? You're presenting here? Yes.

You mentioned with Seth. With Seth from Val Mail. We have a presentation, I think at 4, 4 30 today.

Uh, it should be very interesting. Cool. Well, you know what, afterwards, let's not wait till the next time we're in Vegas to get together.

Dean, Dean Cochlan, senior director, biz dev of DigiCert here at DigiCert Trust. We're gonna take a break. We have another guest coming on in just a few moments.

And, uh, until then, standby.