DigiCert’s 2024 State of Digital Trust with Mike Nelson

Next up on Textron tv today is another good friend of mine, Mike Nelson, who, uh, who is over at DigiCert, and he's gonna talk about DigiCert's 2024 State of Digital Trust Survey. Uh, Mike is, I believe, VP of Digital Trust at DigiCert. And then there's a lot of good information here.

This is Textron tv. Hey, everyone, welcome back here to Textron tv. I'm so happy to welcome back to our screens today, my friend Mike Nelson.

Mike is the global Vice President of Digital Trust over DigiCert and has been for a long time. Mike, how long have you been a DigiCert Man? Coming on nine years.

Can you believe that? Yeah, I, well, I feel, look, I know I was talking to you before Covid, so it's gotta be at least five years that you and I are talking probably more. Yeah.

I mean, Alan, it feels like our friendship goes back. You're just too, you're such a friendly guy. It's easy, you know, it just feels like it goes way back, but I think it was, I think our first interview was right before, uh, COVID, Maybe the year before.

So yeah, it's five years easily. Anyway, Mike, let's start a little bit, you know, Globes global Vice President of Digital Trust. Digital Trust, of course, is something that's near and dear and to the core of DigiCert.

Um, let's talk a little bit about you though, and kinda your history and, you know, background and, and why you're kind of the perfect guy for this role. Well, I love trust. I think trust is very important, and as our world has become more connected, we talk about, I mean, um, you look at, uh, connectivity has exploded within enterprises, um, as employees have moved home.

And, uh, COVID was a forcing function of that. As we're introducing more connected devices into our life, software is, everything is everywhere. Um, I mean, the world is more connected and trust becomes absolutely critical in a connected world, and that's really the mission of DigiCert.

And, you know, I, you and I have talked about my, you know, I'm a type one diabetic. I use connected technology to kind of keep myself alive, and I've got a 9-year-old daughter who does the same. And trust of those systems is really important.

So at a personal level, I really get it as well. And I'm a huge advocate and passionate about it because I really believe that, um, I love technology, but I believe technology needs to be trusted. And so I have a lot of fun talking with people like you and evangelizing and talking about the things that we can do to make sure that as we engage in that connectivity, that we can do so in trusted ways.

Love it. I love it. Mike, I don't want to take up too much time, but I, I think most of our audience, you know, they're a technical audience.

They've heard of DigiCert. I don't know if they realize just how dominant DigiCert is in, in the space that you guys play in. Um, you know, we all, I think the first thing people think of is SSL certificates.

When they hear DigiCert certificates. And yes, that's a big part of your business, but that dig certificates today are a big part of our life. Whether we're talking about our smart home equipment or our, you know, or the containers that our, our, you know, multi-threaded application, uh, applications run on, you know, whether we're talking about verifying identities of humans, machines, software, I mean it all, you know, the, the underlying basis for what makes the internet work is, is the ability to have faith that you are who you say you are, and it is what it says it is, and, you know, yeah.

And that it's pretty much accomplished via, via digital certificates. Yeah. Did I get that right?

Yeah, you're right. And, and, um, yeah, I mean, certificates and, and DigiCert's role with certificates has predominantly in the past been around public SSL certificates. But to your point, the use of certificates has exploded in other ways besides just for web servers.

You know, today they're securing endpoints, laptops, uh, desktops. They're securing connected devices, critical, um, you know, devices performing surgeries and things like, uh, glucose monitors and insulin pumps. And, uh, the vehicles that you're driving, certificates are used on most of the, um, operating systems and the control units within those.

And so, you know, certificates are, um, and, and most consumers don't know that, right? When you're technical and you understand how to authenticate and how encryption is done, then you get a better understanding of where in house certificates can be deployed. But really, they're the fabric of security under most of the digital connectivity that we have.

You look at software, how do you secure software? You do it with a signed digital certificate, right? And so, um, there's, there's so many ways that certificates can be deployed, um, in this ever expanding connected world.

And, um, you know, DigiCert is, to your point, as a global leader, um, we define digital trust really in a handful of different buckets. Like enterprise, it's important that enterprise have it. Software needs digital trust, connected devices need digital trust.

More and more we're seeing digital content. So you think videos, you think documents, all of that stuff needs trust. And so we, we prov we play in all of those different spaces and, and we're, you know, promoting trust and security best practices in all of Those.

You know what we're gonna talk about the, the 2024 State Digital trust report from DigiCert, this year's study. But before we do, on in that vein, you're talking about, Mike, there's two, two areas I want to bring up. One is AI and deep fakes, right?

How do we know, how do we know? This is really Mike talking to us right now. And, uh, I mean, we actually ran a story in Security Bull by a couple weeks ago.

Some poor bank manager had a Zoom with some, was supposed to be the CFO of a company asking him to do a little bit of an unusual transfer of $20 million or something. And the guy, it was him, it, you know, the bank manager had him on the video and he knew the guy, and that was him, and it was his voice, and he was surrounded by other people that he knew. Well, it was a, it was a deep fake, yeah.

It was all AI generated. Yeah. This is something DigiCert wants to help with, right?

Yeah. Yeah, absolutely. I mean, I believe that in the content trust space, Alan, we're on the brink of some big, um, the world needs trust.

Um, you think about the inability to trust content and videos. Uh, we have elections coming up. Can you trust elections?

There is so much trust that is needed, um, in the content space, and it's lacking right now. I think people are searching for truth. And it's, it's hard to find sources of truth because content is just hard to trust.

And we need the ability to know where it came from, know who the authors were, know if that person in the video is right, and to have integrity. Even photos, we're doing a lot in the photo space right now, um, with, with some standards there. How do you know that photos that you're looking at are actually the people that are, are in it and have been fabricated?

And there can be a lot of bad outcomes when if people can't trust those. And so we need, the world needs that, and that's a, it's a critical mission at DigiCert, and we're trying to promote that. Absolutely.

And, and for those who are interested in this kind of thing, you know, we were, tech Strong TV was at the DigiCert user conference. I I was it last October? Yeah, maybe early November.

Yep. Uh, and we had a chance to sit down and talk to a bunch of DigiCert, like some of the really smart, not that you are not smart Mike, but to some of the really smart people at Digi Search Smarter working on who are working on these initiatives, as well as some large organizations that you're working with. And, and, uh, if you go over to the dig, actually it's on Textron TV too.

If you look up under event events, I think the whole collection is there. You can go and watch it. Mike, one other area around trust and around security that I, uh, I wanted to just quickly ask your opinion on, I did an interview a couple weeks ago and someone gave me the number that, uh, I think it was 54% of internet traffic now is API to API.

Right? It's APIs Yeah. Communicating and, you know, shuttling data back and forth.

So we, you know, we, we look to test identify identities of people. We, we verify identities of devices, we identify identities of containers. What are we doing to identify or, or trust API calls?

Is that something you know about or what do you think? Yeah, I mean, APIs are a big part, um, of, of the technology that we, we deploy. And, and there certainly needs to be trust and identity, um, with those.

Um, and yeah, I think you're right. I, we've, we see that the security of API, uh, connections, um, is, is paramount and having authenticity and, um, knowledge that, um, what you're connecting to is can be trusted. And so, um, you know, that, um, we, you know, the APIs that we deploy many of our customers use, use those, and they're good security approaches that, uh, we take to make sure that those can be trusted.

So I, I think those same approaches need to be, uh, employed, uh, with that. And so, um, you know, I, I haven't seen that study, but I, I do agree with your, um, approach that as those things, as we see more and more API to API connections that you still, you need trust between those If you want, if you're interested. I, I, and I hope I get this right, but I think that study came outta CloudFlare.

Okay. I was talking to their cso. Yeah, yeah.

I'll go check that out. That's interest Ous about it. And yeah, they had a whole study on API security, and I remember thinking back then, I wonder if this is something DigiCert could help with.

Right. And I don't even know how you would go about issuing a certificate to an API, but you, you guys would know if anyone knows, you'd know. Yeah.

Um, Mike, let's turn over to DigiCert's 2024, state of Digital Trust. Awesome. Lay it out for us.

Give us a little background and, and what we can expect to see here. See, yeah, I mean, I think it's, it's important to note that, uh, you know, at DigiCert we're, we're constantly monitoring, um, the evolution, uh, and, and state of, of digital trust. And I think that, um, you know, it's, it's been, it's been interesting to see the progression where we're still, where we see the world still lagging, uh, where improvement needs to be made.

Uh, but we recently conduct, we recently concluded, um, our 2024 survey on, on digital trust, and I think we had some compelling findings. I'm excited to talk to you about some of those. Cool.

Let, let's hear. Well, let's dive right into it. Um, yeah, so I mean, I think, uh, the, the first thing, just to note, you know, I think we, um, we surveyed wide and, and far, uh, it was a global survey, um, that spanned all regions, uh, of the globe.

We interviewed, um, over 300 senior decision makers, uh, in the trust space from small to large enterprises. So we, I think we had a good range of, of coverage, various industries, um, mostly targeted at critical infrastructure, uh, just to kind of set the, the groundwork for that. But, um, you know, I think that the findings, um, well, while some of them may not shock, uh, may not be shocking, I think are leading to help us see that we are seeing some maturing in the digital trust space.

Um, but I think, uh, for me, um, we're seeing more, um, we're, we're seeing it's a, a divide between the leaders and the laggards. I think we're seeing the leaders are actually doing really good things and are employing trust practices that are protecting their infrastructure. Um, and you know, I, I think we broke our survey down into, um, you know, the leaders and the laggards and then the, the middle group.

And really most are leaders, or most are laggards. We don't find a ton in the middle. Um, and, and I think that that leads us that organizations are either in or they're not right now.

And, um, and once they get in, I think, you know, we're, we're seeing healthy engagement and the right type of activities, and we can talk about some of that. But, um, but you know, I, I think it, it also emphasizes that, um, that getting on board with digital trust practices can be hard for organizations. But once you get the organizational commitment, the executive, uh, the executive commitment to say, look, this is an important priority for us.

We, we see organizations starting to see the benefits of doing trust right away. And, and I think that, that, I think that becomes compelling, but I think that there's still is a growing divide between the leaders and the laggards. Um, you know, it's interesting some, yeah.

So, um, you know, I think that there's, um, a handful of, um, compelling things. From my standpoint, I think the leaders, one of the characteristics that we see that I think is really interesting is a centralized approach to security. Um, we see the leaders that are actually, they're doing a better job at defining policies for cyber and trust and enforcing those policies.

Instead of saying, Hey, we've got a burning fire over here. Go put it out. They're looking at it more at a strategic level and saying, what are the things that we need to do to protect our organization?

Let's create policies and enforce those policies. Um, and then once they do that, they actually bring security to the business as a centralized approach saying, look, this is not an option anymore. We need to enforce this through policy.

And that was a common characteristic we see amongst the leaders is that centralization of policy and enforcement, but then also of security solutions we see in the crypto space, um, the elimination of kind of siloed certificate management saying, look, we need to do this from a central position so that we can have control, we can have visibility, we can have, um, the ability to mitigate if something goes wrong. And so centralization is something that to me, stood out quite a bit because, um, I think it's a mature practice. It's something that organizations should be doing from setting policies and enforcing those policies.

I love it. Um, it's interesting, you know, so I've always followed, I, I forgot who the author is, but crossing the chasm model where it's the middle, where the meat is, right? But you seem to have almost, I call it a dumbbell, right?

It's heavy on the, on the bo on the front and the back. And people, as you say, people are either all in or they're not. And I, I can't imagine, you know, but usually when you look at a large market like this, we're not all all in, and we're not all laggards.

The middle is usually the fat part, right. People that are in various stages of, of getting there. So it, it, yeah, it's an interesting, Yeah.

And I, and I look at that, Alan, and I think that's right. But I think the challenge with it is security is not as efficient until it's properly managed. And once you get proper management of it, it puts you in the top group.

And so as long as you're dealing with security from a chaotic lack of management standpoint, when you're responding to a survey, I think people think it's still chaotic and they're not doing well. So they qual they identify more with the, the lower tier, right? Mm-Hmm.

Um, it's hard to say you're doing security. Well, when you're 50% secure, if you're 50% secure or 50% in your practices, you're like, I'm not doing very well. Right?

Yeah. You don't get that confidence until you have higher levels of trust and you're doing things that are actually giving you more of a enterprise wide confidence that you have the right things in place. Yep.

Does that make sense? I Think Yeah. No, it absolutely does.

And I, but I think you also hit on, you know, I've been security 25 years. You also hit on one of the soft white underbellies of security, which is most organizations don't have the wherewithal to get there, right? Yeah.

They don't have the budget, they don't have the manpower, the skillset to get there. Yeah. So you can't be a little bit pregnant here.

Either you're doing it or you're not. Yeah. And that was one of, one of the findings is as we look at, um, as we look at the challenges, I think, um, you know, the increased complexity of connectivity, um, is one, you know, I think organizations are saying complexity is, we talked about at the beginning today, is like the complexity of connectivity is just skyrocketing, uh, with remote workers.

Networks are becoming more complex. The applications that are connecting are, are more challenging devices, remote workers, all that stuff. Um, but a skillset is still listed as a top reason for why people are struggling is not being able to find the right resources.

So I think that still is, is a significant challenge for organizations. And an interesting thing, the number one thing, you know, when I came outta school, we didn't have cybersecurity in school. We, you know, you didn't have a cybersecurity degree, you had computer science, but really nothing on security.

Now you've got kids coming outta kids, you have people coming outta school with cybersecurity concentrations and degrees, and they can't get jobs. Right? The number one thing we hear from those people is, how do I break into this industry?

Yeah. And I can't get a job. Every job wants three to five years.

I'm just coming outta school. Yeah. Um, so, you know, we, we've created this conundrum of we can't get people to fill these skilled jobs 'cause they don't have skills, but we won't give people a chance to get those skills, even though they may have education behind it and everything.

It, it, you know, it's a, it's a catch 20 class, a catch 22, and, um, is what it is. Let's return back to our, our, uh, report, though. What else is, is, you know, in the top highlights here.

You know, I, I think just, uh, a compelling outcome for the leaders is the benefits that they achieve from having those in place. So you look at, um, significantly less, uh, exposure to data breaches, significantly less disruption to their business because of outages. Um, those, you know, outages and data breaches can be catastrophic for organizations.

And, um, there was dramatic variation in the leaders and the laggards with the impact of the business on those. And so as you're looking at compelling reasons to engage in that, I would say that that is certainly compelling elimination of data breaches. Um, and, and also compliant.

So a lot of organizations, uh, operate in critical infrastructure where they have regulations that they have to be compliant with. Um, the leaders, um, report a much high, it's, uh, it, uh, much higher compliance with regular regulation, um, and less impact based on, um, non-compliance to regulation. And I think that that, um, is another, you look at healthcare or automotive safety critical systems, uh, you know, you need to have compliance and you need to have solutions that allow you to do that.

And a lot of those regulations now are starting to talk about protection of data, the protection of the critical systems, and the security of those. And so having the ability to confidently say we've got the right stuff in place, um, uh, to be compliant with those, uh, is, is, is really important. And so I think that there's, the takeaway from what I'm saying here is that there is business impact, uh, reputation, you know, I mean, preservation of, of income and earnings by not having to spend money on recovering from data breach or outages.

There's tremendous, uh, benefit to the organizations that are engaging in digital trust. Um, and, and I think that's, that's a compelling driver, uh, to say to those that are in the laggards, you gotta get on board. Absolutely.

You know, um, it kind of reminds me of when you look at the DORA metrics and the DORA surveys and DevOps on high performing IT teams and how having a high performing IT teams smooth so many bumps and, and allows you to accelerate so much faster than not having a high performing team. Yeah. It's the same thing here with security.

Mike, I, I'd love to jump more into this to you, but we're, we're at the end of our time. We got people in the waiting room. I think we might have to do a part two on this one.

It happens every time you and I talk we wanna done. Yeah. We'd love to chat.

Yeah. Um, before we go though, for people who maybe don't wanna wait till the next segment, we record to find out more, where can they go get this report study? com.

They can go and there will be a link where they, they can find it. And if, if you'd allow me, I mean, I, I think the, I I would love to end on this, if I could just say, sure. You know, Digi, we have some recommendations that we're making for organizations based on the findings of the study.

And I think your listeners will find this study compelling. So I do encourage you to go, we've touched on some of it, but there's a lot more. But, um, we have four recommendations.

One is organizations need to take inventory. Um, they need to really have an inventory and understanding of the crypto assets, the security approaches that they're deploying, really understand where you are and take inventory around crypto assets. Inventory is so critical.

Um, but then the second one, and we've talked about this, is define policies. Get your corporate policies in place that govern how security is to be deployed so that you can ensure trust is there. And then enforce that policy.

Centralization of security approaches, especially around certificates, is absolutely critical as the use of them grows. One of the biggest challenges they reported was centralized management of security. And so get centralized approaches, figure out how to do that, and then prioritize your approaches based on your business and the risks of your business.

Prioritize what you're doing and your roadmap based on the risks to your business. And, you know, I think, uh, there's a lot of compelling data in this survey. Really appreciate being able to dive in with you, Alan, on this.

And I hope you, I hope you and your, your readers can go and find some more insights from the survey. Absolutely. Well, I'm serious.

Let's have you back on, and to jump in, we'll peel the layer back a couple onion, a couple of layers of the onion. Mike, it's great seeing you again. Great work as usual on the State of Digital Trust report.

And, um, keep doing what you're doing, man. We'll be in touch, Alan, always fun to chat with you. Thanks for having me on.

All right. Mike Nelson, global Vice President of Digital Trust here on DigiCert. We're gonna, uh, here on text Drunk tv.

He's from DigiCert. Uh, we're gonna take a break right now. We'll be back in just a minute.