So thanks everybody for coming. My name is Keith Neustadt and we're going to be talking about Keystone security Before I get started how many people are somehow involved in the security field. It's pretty good And how many people are pretty familiar with Keystone while I'm at it All right. Great. Sorry about that. So before I get started, I want to start by saying that There's a lot of really good information out there in the community on this topic And I would recommend that everybody start by reading the open stack security guide. There's really good information in there And as a matter of fact the community has already recently has also recently done a threat model of Keystone and That's out there as well. So it's pretty interesting reading. I Would also like to point out that Everybody's deployment everybody's use of Keystone is going to be a little bit different Everybody's environment is a little bit different so it can be a hard to come up with a boilerplate recipe or checklist set of rules of what you need to do to make sure that you are secure Security is really a mindset and a process and So we thought it would be interesting to share with you guys our process and the things that we've been thinking of as we at semantic Go through the process of deploying Keystone into production. So before I get started I just want to give you a some context of you know, what it is that that semantic is doing We are building A very large cloud for semantic We're building the next generation semantic cloud that all of our products and services are going to be deployed on And it's a really exciting project It's a Greenfield project all the way up from brand new data centers up to the infrastructure and platform services And we're heavily committed to OpenStack. So again multiple data centers thousands of nodes and our approach is that we're going to use OpenStack in every way that we can and In areas where we have needs that We don't find yet in OpenStack. We're going to Build in features. We might build entirely new services. We're going to contribute all that back to community So I'll give you a quick example In partnership with Mirantis, we have started a new OpenStack Service called MagnetoDB Which is a no sequel database as a service and as a matter of fact, we've got a design session tomorrow on that So if anybody's interested in that, I invite you to come and you can also talk to me after the presentation So again, I'm Keith Neustadt. I've been in security for Coming up on 15 years I Was recently the architect for the various Norton web services that includes the Norton identity provider Which is in a lot of ways very similar to Keystone These are you know fairly large-scale services. We handle billions of requests today North of a hundred million users and also north of a hundred million endpoints And being semantic we are a really attractive target people like to go after us and so we are basically constantly under attack and sometimes it's a low level of attack and Sometimes those attacks kind of ramp up, but they're always happening and we definitely understand Security from a practical production sense So I've now moved on to again to to cloud platform engineering building the next-generation semantic cloud But this presentation just isn't just about me. There's a larger team at semantic that worked on this I can see some of those folks in this room So if you see people wearing a semantic shirt like this one in the hallway Feel free to pull them aside and say hi asking any questions you've got Now I know that most of you guys have a pretty good sense of what Keystone is But to kick us off. I really wanted to you know, just start with a really brief Overview of what it is and how it works Keystone is open stacks identity provider This is the thing that allows you to log in that identifies your users and here's how it works The user goes to Keystone and authenticates using some form of credentials like a username and a password Keystone then responds with some sort of an identity token that says that I keystone vouch for this person They are who they say they are And now that user can go and take that identity token to any other service in open stack and Use it to authorize themselves without that service service might Validate the token itself Using something like PKI or it might pass that token through some back channel to Keystone to get validated For example with you ID tokens But either way this is this is really good stuff This is a it's a very simple pattern, but it's a pretty powerful pattern It gives you a lot of things for example It gives you one point for authentication for all of your services. So your users Always know where to go. They always have the same rest interface They always know how to authenticate and when they authenticate once they're authenticated to all of the services inside of open stack There's a common API layer that you to put on top of all of your authentication protocols It doesn't matter if you're using LDAP or MySQL or something else And here's I think the most important thing is that it reduces the exposure of your credentials Right because rather than passing your you know users passing your their credentials to every single service They only pass them to Keystone Keystone is the only service that get to see the credentials We all know that the credentials are very important gives us a place to focus our efforts in securing those credentials And of course Keystone is a lot more than that, but for the purpose of this presentation I'm gonna I'm gonna focus on this flow. So here we are all gathered together to talk about Open stack and security Why are we focusing on Keystone? Why is Keystone so so critical? and the answer comes from Basically looking at the assets and if we look at open stack and we look at the assets we see things like passwords keys certificates tokens and Keystone is basically the gatekeeper for open stack and If you can get through that gate you have a lot of access inside of open stack and these things we're talking about They're keys to the gate. They're basically keys to the kingdom. So if these things are stolen, that's a big problem And also if somebody wanted to DOS your open stack Infrastructure this would be a good place to start right because if you can shut the gate Then you've shut down access to a lot of open stack So for semantic as we determine that Keystone is particularly important We start to look at how we're gonna secure it and we have a tendency to look at things in layers All right So for example, we'll start by looking at our process for securing Keystone And then we'll start to look at our environment where we're gonna deploy and run it And then finally we look at the application itself and figure out how are we going to secure that application? How are we gonna secure Keystone? So I'm gonna use this as kind of a framework to go through the presentation and We'll start with process now security to a large extent is about learning to ask the right questions and so I thought it would be fun to share some of the questions that we're asking ourselves as we're Going through this process of securing Keystone and the first question you tend to ask yourself when securing anything is What is it that I'm trying to protect? What are my assets? Where am I deploying? And where am I likely to be attacked? And we use the security development cycle life cycle as our security process There's others out there. That's the one that we've chosen for us and that's a pretty broad topic I'm not gonna talk about all that but I do want to talk a little bit about one aspect of it, which is threat modeling So who here has done threat modeling has had experience with threat modeling Okay a few So threat modeling is cool. It's really cool. It's a lot of fun actually it Takes us away from that typical perspective of how do I secure what I have and it flips it around and allows us to take the perspective of How would I attack what I have if I wanted to do that? And this is a really important exercise because the fact is that if you don't do it your attackers are going to anyway, right? so you might as well know what they're thinking and We're right now going through the process of threat modeling keystone and open stack as we're going to deploy it for ourselves and as I mentioned the community is already working on some of those activities and we're actually getting involved in those Threat modeling activities of the community too But I just wanted to pick just one just to give you a sense of how this works one little snippet of a potential Keystone threat model So up here in the top you've got a user who's logging in they're passing their credentials into a trust zone For a keystone and eventually those credentials find their way to the LDAP driver And the LDAP driver passes those credentials to the LDAP server LDAP server authenticates them sends back the user's ID maybe some roles other information It's a pretty straightforward interaction and now that we've got that interaction understood mapped out We can apply stride to it And stride is an acronym for different categories of attacks that somebody might launch against you So let's take an example and see how this works What would happen if somebody tried to spoof the LDAP server? Maybe they got into the network some DNS attack and they were able to replace our DNR LDAP server with a fake one of their own and what could they do? Well, they can see all the user credentials every user that logs in they can see that that username and password All right, and those are the keys to the gate. It's the keys to the kingdom, right? They could also elevate privileges they could look for certain users and they could pass back additional roles if they saw them All right, so this would be a very powerful attack that we find from this very simple Interaction so we ask ourselves now that we understand the attack and we understand what's at stake How do we mitigate it and the answer when it comes to spoofing usually comes down to some kind of authentication? How does the LDAP client? authenticate the LDAP server and you know, that's likely maybe through TLS and server sites to certificates for example Am I running what I think I'm running? Did I get the right distros and even if I got the right distros? Is it the same thing that I actually deployed into into into production or did somebody inject something malicious into it? And am I running the right patches? So this is pretty standard standard stuff I don't want to spend a whole lot of time talking about this, but I do want to call out that Since this process of getting the distros building the distros deploying the distros since it's not production Sometimes we have a tendency to overlook it And I'll give you an example is a story that a friend of mine told me recently about a previous job previous place where he worked and at this place They had their CICD server as a machine sitting underneath somebody's desk and They realized that they had a physical security issue with the server because Every once in a while somebody would sit down at that desk and they would cross their legs and they would kick that big Power button on the front of the machine and they would basically DOS themselves unintentionally So in realizing that they had a physical security issue They went to mitigate it. They took a Snapple cap and they taped it on top of the power button and Now no more DOS attack So again, I have I think we have a tendency to think since it's not production I don't really have to worry about it But if that machine can basically be shut down if you've lost physical security of that machine What else is going on that machine? What else could somebody do on that machine? You know, maybe what I'm deploying a production isn't really what I think it is. Let's go on to environment Is my system hardened against attacks? Once I've deployed could somebody change it What could somebody steal from it? And after it's happened, do I know what happened? Can I figure out what happened after the fact? So this is really about compliance and we're talking about, you know, two sides of the same coin with hardening and auditing All right, and you're looking at how do you harden the important config files log files the ports executables your environment itself So that they can't be changed Or at least that they can't be changed or read by anyone who shouldn't be And then since all these things are going to be changed eventually, you know when it's appropriate How do you audit those events? How do you know who changed it when they changed it what they changed? So In terms of Keystone I'll go back to it every keystone deployment is a little bit different And so the process of hardening and auditing it, you know exactly what it is that you need to harden It's gonna be different for everybody, but what I'd recommend is that everybody start with the keystone.com file open it up and read it from top to bottom and I think the first thing that you'll find is that there's really good stuff in the keystone.com file If you wanted to steal something that would be the first place that you would go because there's admin passwords There's keys. There's ports There's locations to other files like your cert files your CA files your key files are all sorts of really good stuff in there So you certainly want to make sure that that is hardened and audited But you can also use it as a trail You can just follow the trail from the keystone.com because it tells you where all the other assets Related to Keystone are on your system and while you're at it You might want to think about changing those default locations because you don't want to make it too easy for someone who manages to Get on the keystone system to find all that stuff change the default ports change the default file locations in Terms of compliance There's a lot of tools out there. It's meant to happen to make one And so that's what we're using is a data center security It kind of automatically goes out there and makes sure that you've hardened Linux and they're also working on Open stack policy. So also goes out there and make sure that you've hardened Open stack, but you don't have to use our tools. There's other tools out there A lot of people use SE Linux these tripwire things like that So just you know pick a tool and go with it is my data secure while it's in motion What high-value assets am I sending out in the wire and what would happen will be the repercussions if somebody managed to intercept those and I think you know, this is an important one. How much of my environment do I really trust? I think we have a tendency to think of our environments as everything that's inside is Trusted and good and everything that's outside is untrusted and we don't know The reality is the way these attacks happen is they get a tiny little foothold into your environment And then from there they slowly drill their way in so you have to ask yourself How much do you want to or do you even need to trust some of these internal parts of your environment? So now when we talk about data security motion, I think we probably all agree You know we're talking about SSL right and we I think we hopefully we all agree that cells important We should be using it, but I want to point out that it's not just about SSL But how you use it? So let's go through an example Up here at the top. We've got a client that's logging in they're passing credentials down to Keystone and As you can see those credentials are completely unprotected through the internet So we're going to add SSL and now that path is good and they're protected on that path But again, we're not talking about just attack vectors on the public internet There are also attack vectors internally what happens if somebody manages to Compromise a process that's running on one of your open stack servers Or what if you happen to have deployed something that's not open stack? Maybe it's a monitoring application Or maybe there's some sort of web service that you deployed either intentionally or maybe unintentionally on the same subnet But you can see that After that SSL termination those credentials are in the clear and anybody who's on that subnet can see those credentials And those credentials are the keys to the kingdom, right? So the way we're dealing with this it's semantic as we're going to push those as cell Endpoints down to the open stack servers, and then we know that credentials are always alright Very small round of applause. So So now we know that all the credentials are always in every case. They're encrypted. They're never on the wire without being encrypted But there's cost to this right and you have to kind of assess your own risk and your own cost and figure out What you what you need to do? Now you've got issues and you know things like deployment of certs You know deployment of these endpoints Maybe it affects your ability to use hardware low balancing and SSL termination So you have to think about what works for you But at the very least think about the any clear text network that your keystone server is on and think about Segregating it now onto keystone Well, I know when I'm under attack and you got to assume that it's gonna happen Who's attacking me? How are they attacking me? What are they after? And do I know how to stop them? Do I know that I can stop them? So there's two sides of this point also there's prevention and there's forensic How do I how resilient is my environment in production against these kinds of attacks? And then after the attack happens do I have the information I need to figure out what happened and maybe what was lost? So I know what I need to do to remediate Now again working on the Norton identity provider We were always under attack and we saw the kinds of attacks that that tend to come to us And for the most part with an identity provider, you're gonna see a lot of brute force attacks They're looking for those passwords and they're gonna try to use your service to try to guess those passwords running through dictionaries things like that So when looking at how you foil a Bruce for a brute force attack you need to slow it down So you need to look at things like rate limit because if you can prevent these attacks from Making thousands of requests per second against your identity service You're basically going to disable the attack. It's the only way they work The other thing you might want to ask is Is this a human user? This is a real person that's that's making these requests or is it an automated process because again These brute force attacks don't work if they can't use automation So there's certain challenges you could send back like CAPTCHA You need the ability to be able to black the blacklist bad IPs, you know, maybe You've determined that traffic you're seeing from a particular IP is bad You know blacklist or maybe you get a feed from somewhere, but you need to be able to block certain IPs and Then you know the other thing that that we started to do is sort of look for anomalous patterns All right anomalous patterns and logging in but also maybe a non anomalous patterns and how users use your Your applications so maybe you're seeing a lot of users from the same geographic area Log in and follow a particular and unusual pattern through the other services Maybe that's an indication that again you've got somebody coming from a particular area. That's that means you harm And then after the attack you need to make sure that you've got the data that you need to figure out what happened And that's a lot of data It's things like users that logged in users that failed to log in Maybe hashes of the tokens you gave out and so you can track them through other systems. You want the source IP addresses?  So you've created this new very highly Highly valuable asset that somebody might want to steal and so it's something new that you need to figure out how you're gonna protect So keystone includes a lot of you know, really good logging. We're looking into that But if there's other information that you need to collect and certainly to be able to to support Things like rate limiting and challenges There's a couple of options. You can build a filter for keystone You can add a proxy. There's some, you know, load balancers hardware load balancers that offer layer seven Rate limiting so you can look at other options like that So is my user validation effective? Is it working? Am I really determining that my users are who they say they are or passwords enough and If they're not enough, what other kinds of authentication should I support and how should I implement it? So we're really we're talking about two fact two factor off here Everybody knows how to factor off works, right? I log in I have to provide a one-time password That gets texted to my phone or I've got some sort of a fob or something like that So if you don't have my phone, but you have my password, you still can't log in So two factor off for semantic is really important. We're gonna have two factor off in production so we start to go out and we look at options for how we support that with keystone an open stack and We see a couple of common deployment scenarios for authentication For the most part people either use the LDAP driver to hook up to an LDAP server Or use a sequel driver to hook up to a mysql database to do the authentication and From what we've seen we don't see a solution that works for us for two factor And so when we look at this diagram we think about how would we want it to work? Really what we ideally like is a radius driver Radius is a low-level authentication protocol that's supported by a lot of different authentication servers that are out there And so once you have this radius driver, you've got choices For what you're gonna use for your back-end authentication and use RSA Semantic has a solution. There's all sorts of open source authentication servers that support radius Now once you've got that choice you can go out there and you can pick something that supports two factor And we happen to have something but again, there's other options that are out there So this is this is what ideally we would like and actually in talking informally to some other people in the community We kind of get the sense that this driver might have been implemented by others before but just not shared not open source So what we're gonna do is we're gonna look for an implementation that seems to work Or if it's not out there we'll partner or we'll build it ourselves But whatever we'll do whatever we do we'll share So how do my services and scripts? authenticate themselves I think that a Lot of the time when we think about authentication We think about the case where the user is sitting down at the computer and they're typing in their password All right, and we know how the credentials are secured, right? They've got them up here in their head and hopefully they're not writing them down on the sticky note Or they're telling their friends or whatever it is So it's pretty straightforward, but there are there are times when Machines need to be able to authenticate themselves when there isn't a person around to help them do it For example open-stack services authenticate themselves with Keystone and There are clients out there that might need to authenticate themselves with Keystone All right, maybe it's a cron job that does a health check or maybe it's a deployment All right that needs to authenticate itself so it can run some sort of script And so in looking at these kinds of user scenarios We think about a couple of things So first of all since we're assuming since there's no you know human That's got the credentials in their head that there's some sort of credential that's being cashed on those machines So how do you secure those particularly given the fact that some of these machines? They're not owned by us. They're owned by our customers, you know on their phones or on their laptops and How do you? How do you how do you limit the damage that can be done if they're stolen? like how do you limit the scope of access that these things have or the amount of time they might live and and Finally at the management of these I like if you're talking about things like keys Where do you store all those keys at a central place so that they're protected and how do you distribute them in a secure way? So in a sense what we're really talking about is we're talking about delegation I mean I'm I've got a certain amount of access and I want to delegate some small portion of that access for some Limited amount of time to some machine so it can act on my behalf in a limited way So we looked at some of the different potential solutions that's available with Keystone We started with cash passwords, which I think is where most people start and I think we know why that's a problem We looked at the EC2 key, which is a little bit better than cash passwords But just a little bit because if you steal the EC2 key, you've got all the same access right You almost might as well have the password We looked at trusts which is a lot closer It does a lot of the things that we're looking for you can log into Keystone you can ask for delegation To give to a certain user with a certain scope a certain amount of time and now that other user can act on your behalf But where we get stuck is that I can only delegate to another user Which means there has to be a user that's logged into these other machines Which means that these machines need to have cash credentials and those cash credentials also have a scope Then there's other solutions like keys and certificates and now you get into Manageability issues, right? So we're this is something that we're still looking at about how we want to go about this And we'd be interested in hearing if there's other people out there They're asking these same questions of themselves and what you guys are thinking and then finally I want to just make a comment about standards So and the Norton identity provider we started in a similar place where you know Keystone did which is it's a REST API Something that's proprietary that you can use to log in for single sign-on get tokens and We eventually took a step back and we decided that it was important for us to support industry standard protocols And so we did that we made that migration and I'll tell you it was hard. It was not easy Because we had lots of clients hundreds of you know hundreds of millions of clients out there that used our old protocol And we were moving them to something new and something web-based. So it's not easy But we decided that it was important because it had specific benefits So let's say that Keystone supported identity pro identity standards. You could log in single sign-on to Not just open stack, but to maybe Google apps maybe sales force so you get broader single sign-on Yet some improved integration both when you're bringing new services into your open stack environment But also if you wanted to integrate external identity providers like Like Google or Microsoft There's actually a little bit more control over the credentials in these protocols and You also get a unified not just API but a used unified user experience for logging in so your users know what the login page looks like they're familiar with the Graphics and Whoever's running that identity provider has a lot of ability to add new features to it in a multi-factor retina scan Security questions identity proofing things like that. So there's a lot of benefits We're not the only ones that brought this up there's a lot of discussion going on in the community There's blueprints out there So I know it's being talked about we just wanted to throw that out there It's something we've got experience with and we'll look to participate when the time comes So a few parting thoughts Credentials are the keys to the kingdom right there Among the most important things that you've got so you got to make sure that you protect them threat model your deployment Watch the credentials whether their keys or passwords or whatever it is watch them work their way through the system Look at every interaction think about how they could be attacked and how you can mitigate it Securing your use of keystone is going to be an ongoing process All right, everybody's deployment is a little bit different everybody's got different considerations different production different tools different services So you want to do that threat model and then every once in a while when you change your deployment you add some services You maybe upgrade keystone dust off that old Threat model update it look at the new interactions And then finally share security is a team effort and This is the team right it's the community so ask yourselves your own questions Share with us the questions you're asking the things that you're thinking about the solutions that you're deciding on Maybe the solutions that you implement And again, feel free to reach out to me or others in the semantic team That's it Any questions? Hi, I'm Adam young with red hat keystone core And I just want to say this fantastic presentation really really got a lot out of it and I took notes One thing I'd like to I Think you might have oversimplified on the statement where you said, you know change the standard locations and stuff like that I'd like to put a caveat on that which is Use SE Linux and if you use SE Linux don't change the standard locations because what's gonna end up happening is you're gonna have to manage your own policy so I think what you said is in a vacuum a really good piece of advice, but understanding that When you deploy keystone Especially under htbd, which is the the approach that I highly recommend htbd already has an sd Linux policy for Securing port 443 you don't want to put that on a non-standard port and then have to deal with telling htbd How to deal you don't want to do sd Linux almost your radius commit some some time to it But I think the the the the concept behind the advice is really good You With when you start talking about radius and the the ability to externalize the authentication One of the things I was wondering if you looked into it, you know again with htbd and the ability to use the external Off-plugins if perhaps that that might come closer to what you're looking for that you let htbd Say who you are and then keystone's job becomes more what you can do. Have did you investigate like along those lines? Yeah, we so our off team You know separate are you the basically the the verisign off team did take a look at that? I'd like to talk to you about it a little bit more than let's let's let's talk about it And I actually let me just point out that Adam has a killer blog out there So I was talking about About resources that are out there Adam's blog is one of them It's it's not just good information is actually a really good read So maybe we'll talk and that'll become a post and to do address your last point about share It would be great if we could see Symantec You know on the code reviews on the design reviews up front for the stuff that we're talking through if you guys Come on over the dev lounge participate there I'm assuming you you're planning on it But I'm gonna get the shout out for doing it now and that would be great. Sounds great I have a question about what network is used data marriage data network or Management network is there a use case where you can use keystone on the data network. I had another question about Multi-region support in keystone. How does this? How does that work? What was the second question multi-region support? So How do you how how does keystone support multi-region deployment? See I'm not sure about that Maybe Adam can respond to that Well, the question was about multi-region support in keystone. It sounds like it sounds like they're still working on it. Okay? All right, let me try to just to summarize that it sounds like there's been some work done at the API layer But there's still underlying functionality that's still being worked on for that Okay, try now. So when you say multi-region support, I'm assuming you're talking about the Ability to annotate on an endpoint which region it's in is that what you mean? So if your services are distributed across multiple regions, right then does the key store? Are the are the authentication tokens sort of replicated does that? It was across multiple keystones, right? No, they're not and our goal in one of our design summit sessions here is to get rid of Having to persist the tokens altogether. We want to move to ephemeral tokens with pki There really is no need to go back to keystone to to validate them So if we can get it such that A two different keystone servers Can issue tokens independently and without sharing keys because obviously that's a bad practice stuff like that Then what should be able to happen is it doesn't matter which one you get it issued from Everybody should be able to authenticate You know validate the key the the tokens. Okay. Is that what you're looking for? It's on my roadmap. Okay So another so sort of my first question I wanted to sort of talk about the use cases for using key store or the data network is that I Mean typically when you do this service level token request or authentication You're using the management network. Is that is that right and is other use cases where? You're building services on a stack and you want to make use of key store. Is that does that does that work? We're talking about you have Other services outside of open stack that you want to provide authentication to using keystone. That's right. Yeah, right? Yeah, I mean keystone is a basic. It's a it's a it's got its own identity provider pattern that you can plug Various things into it. As a matter of fact, we've done it ourselves. We've added services to open stack And used keystone is the way to log into them and you know this, you know particularly this new one Magneto DB that we're working on It's not yet open stack core, but you plugs in just like any other open stack service does Would you agree with that? No And the reason I say no is not that you can't do that, but I kind of feel like you should One of the patterns that we're seeing time and time again is that Keystone's Roll has has shifted over time originally. It was a central point for Passwords so you didn't have to replicate them across all the different open stack Services and what we've seen is people already have their own identity providers People already have LDAP or people already have this way of ending if you're any non-trivial organization and We're trying to get out of the business of managing passwords and trying to make it so that if you have some other service out there Use a standard like the list that you had up there like Sam L and in curb Roseburg, you know the enterprise X509 client service, whatever it is a cryptographically secure way of authenticating it and think of keystones Reason for being as an additional layer of authorization on top of a secure authentication layer Okay, so you should not have to go in And make your application keystone aware Unless what you want to do is tie in with the role-based access control view of the world the keystone does in and say that the Roles that I'm going to use are going to be consistent between this application and say Nova I understand what you're saying. I think it seems like maybe the division is Are you providing authentication to something new that you're providing to your customers as a service? If it's a service similar to you know the way you might provide Nova You might provide Swift or something like that then certainly that makes sense But if this is you know something for your own back-end authentication where you could just as easily use something else That would make more sense Use this use the standards and the cryptographically secure off authentication Mechanisms where possible. Okay. Thank you. Great. Thanks a lot


Security operatives have sealed off the venue of the rally called in support of the proposed Euroban nation in Oshinbo, Oshin State. Police officers and men of Nigeria Security and Civil Defence Corps gathered at the Nelson-Mandela Freedom Pack early in the morning to stop the rally. Also at the venue were men of Amotecon Corps, who were positioned as strategic sports. None of the organisers of the rally had arrived by 9am and participants later were grouped on the November 27th bridge along the Oshinbo Road.


Last, but not the least, we're going to end our day with a keynote session on our digital future by Andy Hood, BP Emerging Technologies, WPP. Andy founded the creative research and development team at AKQA, which operates where creative UX technology and strategy meet. And he continued to lead them and lead the team until moving up to WPP this year. You know, for 20 years at AKQA, he worked with a huge range of clients, including Nike, Xbox, Ferrari, H&M, Barplays, and many others on many award-winning projects. Mr. Hood, hi, I hope you're well. Hi there. Thanks very much. I am indeed. And thanks very much for inviting me to host this session. Right. Hopefully, we can all see this. So hey, everybody. And again, thanks for inviting me to host this session. It looks like it's been a brilliant event for everybody. I'm sure it has. So I am Vice President of Emerging Technologies at WPP. And in that role, to be honest, the technology itself, the workings and engineering of it is much less interesting to me than the possibilities and the impact that it has, the problems it solves, and the behavior that it changes and creates. Now, change can be unnerving. And some emerging technologies can make people quite anxious. I'm actually very positive about the possibilities that emerging technologies present. And I couldn't do this role if I wasn't. And I'm very fortunate to be working in a big company who prioritized that and who prioritized the collaboration between big companies who have enormous amounts of really deep knowledge in wildly different areas. And that's never more true of how it is actually in India, where collaboration even recently between such entities as Ogilvy and WaveMaker and GroupM serve to make the whole of WPP much greater than the sum of its parts. Now with all that in mind, what I want to talk about briefly today are two major themes which are quite nascent right now, but will play an ever-increasing role in our digital future. And they are, one is digital humans, and the other is the metaverse. And I'm pretty sure that you will have read and heard and seen an enormous amount about both of these things, their huge, huge subjects right now. So this is a digital human, and a digital human for our purposes is an animated avatar that you actually have a conversation with. And she can talk to you in a relatable, authentic human voice. She can see you through the camera and therefore with facial gestures respond emotionally to you. She can understand and speak any language. She could be anybody, for example, this guy. And he can be always on, everywhere, 24 hours a day, 365 days of the year, which is a really powerful new thing. Now this may seem to be very high tech, almost sci-fi, you see these things in films. But actually everything I'm talking about today is entirely device agnostic. There's no tech barrier and certainly no behavioral barrier preventing people from interacting with these things. This report by Group M and E4M that talked about the fact that 99% of people are using their phone to access the internet, that's actually resulted in an increase in voice search of 270% in the region and a rise in Hindi voice search of 400%. So clearly this behavior of using your voice to speak to your devices and interact with their services is something which is exploding and only going to get bigger and bigger. So that's the how. But the first thing many people think of when they're imagining having conversations with digital humans is won't that be strange, won't that be awkward, why would you do it? But actually the interesting thing is that it's been shown that there are conversations that people will have where they will be far more honest and open with a digital human than they will be with a real one, particularly in more sensitive subjects of health, finance, etc. And the awkwardness wears off very, very quickly. If you remember the first time you used voice with your phone and how strange that felt, but how quickly you move past those barriers. And there are some examples of digital humans playing a role already in interesting areas. This is Ella and Ella is part of the New Zealand police force assisting the concierge team as part of an upheaval of their service delivery. Now Ella obviously can deal with a lot of inquiries at one time with stressed people and with her empathetic responses this helps can calm things down and deal with a large volume. This is Maya and Emma they're from Maryville University in Missouri. They have a huge influx of new students each year and Maya and Emma help guide those students in filling out documentation, in career planning, in financial advice, all of these kinds of things that people want help with and they want help when they need it like now. This one this is Mia and as you can see this being delivered entirely through mobile and Mia works for a company called Madeira Residential which is a real estate company and this is customer service which is an area we've become used to seeing chatbots in. And Maya deals with those kind of repetitive low level questions that can otherwise take up a lot of people's time and that people get frustrated with. Maya can deal with all these, this huge volume, leaving the real people at Madeira Residential to deal with the things that they actually have expertise and knowledge in. It's got a more nuanced conversations. Really my favorite one of these is Florence, Florence is part of the World Health Organization and helps people get rid of their smoking addiction. And the key here is that a conversation with Florence is a judgment-free conversation which is a really important thing when we're talking about things like addictions, a lot of these things carry like a certain maybe a sense of sensitivity, maybe shame with them. It's true to be open and honest can be really, really helpful and Florence has been successful enough that at the start of the pandemic when there were so many myths and theories about COVID-19 and let's face it there still are that Florence was deemed as a great way to debunk those myths basically to clarify the situation because there couldn't be a question that you would be too embarrassed to ask Florence because of that judgment-free conversation. So there's real power here to reach a lot of people in an interesting way. Actually at WPP we use the artificial intelligence behind digital humans to elevate and to upskill the tens of thousands of people. It's a big organization about 130,000 people at WPP and we're dedicated to upskilling those people. So here you can choose any topic to do with AI and whatever language you want to have that conversation is and a video is generated of someone talking you through. It looks a bit like this. Next up, strategy and creativity. Across WPP, our teams use AI to enable and involve creative work that wins hearts, minds and awards. Wonderman Thompson's the next Rembrandt was a masterpiece in the creative application of AI. To help ING celebrate its sponsorship of Dutch art and culture, Wonderman Thompson used artificial intelligence to create an entirely new Rembrandt painting or remaining faithful to the artist's vision and craft. Now, obviously this video goes on and there are many, many videos like this with different digital humans. And the beauty of this is that the digital humans can be swapped in and out. New languages can be added. This digital human could say that and repeat the same video and narrate it in Spanish or Cantonese or Mandarin or English or Hindi. So, you know, there's a lot of scale and a lot of reuse that comes out of this. We can even personalize these videos. So digital humans, there's an enormous empowerment to having this 24 seven access to open information. This is democratization of expert information. Being able to have those conversations with empathetic responses and a judgment free environment is also very powerful. We've already seen that voice behavior is already well established and only going to grow. Intriguingly, there are actually digital people everywhere and you've become so used to it that you're kind of almost immune to it. So the digital de-aging of people in Marvel films through to actors actually being recreated entirely from the past in certain movies. Music artists like concerts featuring holograms of artists who passed away like Tupac or Ronnie James Dio and then the digital influencers who exist everywhere on social platforms. And then the conversational technology behind these is rapidly increasing in sophistication. This is happening all the time. We're really at the beginning of this movement. Let's take a quick look at that. So we used to chatbots and voice assistants that sound the same and say the same things to everybody. It's one conversation at scale, but that's not how we are as people, is it? As humans, we change what we say and how we say it depending on how we're talking to. Now, AI can actually start to build a picture of your character and personality as it's talking to you, which enables it to start to adopt a tone of voice for you as an individual. Using the camera, basically being able to analyse your emotional state and respond accordingly. Now, it can sound uncomfortable, but actually this is only enabling a digital human to behave in exactly the same way that you all and I do all day, every day. How about how they sound and the voices? We're used again to hearing that artificial voice that we've become accustomed to, that Siri kind of voice, but that's changing too. This is a famous coach from the NFL, Vince Lombardi.  It was powerful. It was absolutely his voice. There was no actor involved. But Vince Lombardi died in 1970. So how has this done? Again, this is artificial intelligence and artificial intelligence doing voice cloning, which is where an AI is trained to be able to say new things in an old voice. Just to show how accurate this can be, this is done using Microsoft's custom neural voice. This is a human voice. Four walls is so good, laughing out loud. And this is the synthesised voice. Is version three, the JPEG version, that would be fantastic. As you can see, there's not a lot to choose between those two. And it, again, it's not just English. Here is one example of voice. And here is its twin. Now, I actually can't remember which order those two are in. That's pretty powerful stuff. So the conversation technology behind digital humans enabling us to distinguish between people, to therefore personalise tone of voice and approach, to actually have a, you know, an empathetic response in a genuine human voice. So rather than being one conversation going on everywhere, this is true to one-to-one conversation at scale. And that's very powerful. So that's digital humans. What about the metaverse? Because that's kind of exploded, hasn't it? Well, let's start with, with a few stats here. So in 2020, 27 million people attended five concerts by Travis Scott in Fortnite. These were viewed 45 million times in May of this year. And for a one hour only, Gucci sold a digital version of one of its Dionysus bags in Roblox, a virtual world, for 475 Robux each. Now, Robux is the currency within this Roblox virtual world. So about $6. Now, the resale value of these digital bags reached a point where one of them was resale for over $4,000, which is $800 more than the asking price for the real world. Until October last year, the most money being made by digital artists of Beephole off the sale of one of his works was about $100. And then he got into the NFT game. And this year, an NFT of one of his works was auctioned at Christie's in New York, and fetched about $69 million. And then this year, again, Commerce Company Boson protocol spent a fairly significant amount of money on the real world. Commerce Company Boson protocol spent a fairly significant six-figure sum of money purchasing real estate in Decentral land with a plan to build experiences there that bridge the physical and digital commerce divide. Now, these are all metaverse stories, but they're all wildly different. They're all really big with really big numbers attached to them. And they're not outliers. They're like, there are lots of other stories I could have used in the place of this. So what actually is the metaverse? Well, simply put, the metaverse is any virtual space where people go to play games, to interact with each other, meet people, buy things, dance moves, outfits, go to gigs and just hang out. Now, again, like digital humans, this all sounds very, very high-tech and expensive and rather science fiction. But again, the answer is no, it's not. For example, this is Haikland, which is built off the back of the Haik messaging app in India and it's a space where people can watch videos and hang out. It's a pure mobile virtual world and it's described as a magical place to hang out online. There are a lot of big virtual worlds out there with millions and millions of players, Fortnite, Roblox, League of Legends, Decentral land, Minecraft, Animal Crossing. But as you can see, there's no technology barrier here. A mobile-first or even a mobile-only community can be still be just as much a part of the metaverse as a person with an Xbox or a PlayStation. And actually, this report from the Mobile Marketing Association in collaboration with Group M showed that of all those many people that we've heard about today, using their mobile as the way to access the internet, 84% of those are using it for entertainment. So there's no shortage of an audience for the metaverse in this region. Sort of about NFTs, because we've heard about those, but they're not virtual worlds and that's indeed true, but they are crucial to any future metaverse economy. Now, an NFT or a non-fungible token is essentially a code which is attached to a singular instance of a digital image or item and tracked on the blockchain. Now, we're used to a digital asset being just one of a potentially infinite number of identical copies. So each one individually doesn't really mean much. As you attach an NFT to one of them, the first one, that becomes a unique one-of-a-kind item. That gives it value. That gives meaning to ownership, which gives rise to trade, this scarcity that's created by NFTs is a powerful thing. So the NFT boom that we're experiencing is inextricably a metaverse phenomenon. Now, Indian blockchain firm Polygon have actually created a solution, which is the first dedicated NFT platform specifically for Cricket. And today is actually quite an auspicious day because I'm pretty sure that today is the day of the auction for Dinesh Kartik's Six for the Win NFT. Now, Cricket fans out there and I'm gonna assume that there's a fair number and I am myself, would remember India needing six runs to win off the final ball against Bangladesh in a famous cricket match. And Dinesh Kartik smashes it out of the ground. So what's been created here is little animated film of this event with Dinesh Kartik himself narrating it, giving his kind of thoughts and feeling as it happens. And NFT has been attached to this and it's being auctioned today. So keep your eyes peeled basically for the success of this auction and to see what happens. But this is just one of many, many things happening in the region with NFTs. Now, interesting things happen when the metaverse in the real world coincide and cross over. We can imagine that happening through augmented reality in the spatial way. And an interesting example of that happened in London fairly recently through Snapchat. So again, a completely mobile first experience with city painter. And this enables you to go to a real physical space and apply virtual graffiti through augmented reality. But the key is that graffiti is retained in the virtual world.  So there is a digital copy of the world invisibly inhabiting the same space as the real one, which is really interesting. But what it means is that we can't afford to think of this metaverse as these virtual worlds as being separate as other and kind of closed off. The metaverse is becoming an increasingly large part of the everyday world we live in. And it will play an increasingly large role in our everyday lives just as it already is for so many millions of people. Now, earlier this year, Mark Zuckerberg stated that the future of Facebook is as a metaverse company and there's word that they might even change their name basically to accommodate this or what does that mean? Well, it really means that alongside everything else we've talked about today can see that the metaverse is not like a passing fat. It's a fundamental cultural and economic shift that we need to be involved in and understand. Right now, the whole movement is nascent, which presents a huge opportunity to get involved and help to shape a metaverse that we can all believe in. A metaverse which is consistent with the values that we hold to build an environment that is a positive one for ourselves and for our children. But things are moving very, very fast. And that window of opportunity to be truly influential will not remain open indefinitely. So really to close this, my rallying cry for everybody is to get involved because the more people with a passion and with a good aspiration who can partner with people who have the same aspiration and the knowledge and experience, this is the thing that will allow us to actually make real positive change in the world using these technologies. So thank you very much. Hi. There we go. I thought I'd got away with it there for a minute. No, you didn't. In fact, the audience has many questions that I'm just going to restrict myself and ask you three. So here goes the first question. How would you suggest that we all get started in learning about NFT and the metaverse? It's an interesting one, this one, because I think way back when we were talking about websites in the 2000s, we all used websites. That was quite easy. And then we started to talk about iPhone apps when they emerged and we all used our mobile phones. So that was quite straightforward. We are now finding a lot of people talking about the metaverse and NFTs where it's quite possible that not that many people over say 35 have actually been there. So the thing to do is actually to dive in and you could start with the metaverse. For example, you don't have to create big profiles and do complicated things in Roblox and Fortnite. You could just start by having meetings, business meetings, internal meetings in things like alt space or Mozilla hubs or horizons, which are really, really easy. And what you get out of that is just understanding the feeling of being in there, of what it's like to meet people and talk to them and to behave in virtual worlds. And then we create a common ground to have a conversation which we can move forward. And getting a wallet for NFT transactions, again, just buy some cheap ones. It's not about spending lots of money. Just use the mechanisms of the metaverse and have a presence in it so that you can understand it. It's really, really easy. Okay. Well, that takes me to the next question, which is what steps should a brand take if they are planning to get into the metaverse? Like what are the initial go-to strategies that a brand should employ for the same? Yeah, and there'll be a lot of brands thinking about this because the stories are coming thick and fast. So, but the key is to understand the relevance and kind of role of the brand and the consumers. It's just like if the metaverse was a real physical new country, a brand wouldn't just, you know, fly in, set up shop and start selling things. They do some thinking and research to go, okay, well, you know, where does our brand fit in this new country? And how do we speak to the people there? And what are their customs and behaviors and how do we align with those? It's the same. So you need to kind of have an idea about where your brand will fit in the metaverse and the kind of message it could have or the kind of experiences you could provide, how they relate back to that brand in the real world is important. Because as we say, these things are not, shouldn't be considered as two completely separate things. If you've got a big audience in one, you want that to translate. So it's just having some ideas and some thoughts that you can test in quite small ways to prove some of these ideas out before starting to do some bigger things. Right. I'm gonna end this with a slightly open-ended question. You know, because of the pandemic, we've seen this sudden shift worldwide to a more virtual and hybrid model for businesses. And that also brings about this as things normalize, it brings about this thought that things will get back to normalcy what we do pre-COVID. So my question to you would be all of this, right? We're talking about metaverse here, we're talking about the importance of the virtual world. Why would you say that this is all not just a fad, not just a passing tandem trend? And you know, what is it, what is going to ensure that this model stays? Yeah, to me it's because the, so technology change, although obviously it requires experts and gifted people or whatever, it's easier than behavior or change. Behavior or change is really, really hard. It's the hardest thing you can do is to try and shift people's behavior. So technologies that do really well have a tendency to actually allow you to use your normal human behavior to interact. It's why voice is actually so easy and has, which seemed odd when it first happened. It was an awkward thing. You would like say something to your phone and then it would kind of respond and you laugh and tell jokes and things. But very quickly it becomes normal because actually it's just you interacting with your devices and services in the same way that we interact with each other. And in the metaverse, what you see is that people have an environment and an identity in the metaverse and they care for it and curate it as exactly as they do in the real world. So there isn't a big behavior or shift you're using your lifetime of learned experience to behave in the metaverse as you do in the real world. But the fact that it is, it's not the real world, allows you to carry out things and do things which in the real world you can't. Going to a concert in a metaverse concert like Roblox or Fortnite, these are concerts which are not bound by the laws of physics and those are amazing experiences. So it's that combination of the enhanced experiences you can have but just being able to have those things with the kind of life experience that you bring to it. It's not that you have to learn some complex set of controls and culture. You really can just dive in and get going straight away. Just to understand a little bit more, I'm actually not supposed to but this is an interesting topic and you have a lot to say. So I'm going to ask. When you say metaverse, right? I mean, essentially what we're saying is that you talked about behavioral patterns of consumers. Behavioral patterns often, not often actually always are dependent on the environment they're in, right? So during the pandemic, the environment was such where the behavioral pattern turned to a metaverse. So in your humble opinion, I mean, do you see even if the environment changes, quote unquote, becomes normal, do you see metaverse holding in terms of behavioral patterns of consumers? Yeah, because these metaverse worlds that have become enormous things, they come from the world of gaming. They're game worlds. And gaming isn't going to go away. Basically, this aspect of play isn't going to disappear. There are more and more gamers, like all over the world, there's a huge number of gamers in India, for example, it's become a professional sport now. And you see esports, which is people watching people play games, which to me when I was young would seem crazy, but it's a huge industry. So the metaverse basically has kind of been created off the back of the gaming explosion, which means that rather than anyone who might remember second life from way, way back in the day, which was metaverse to a degree, but it was really, it was a bit bare bones. Like it hadn't been fleshed out, it was new. But by the time people now are getting into the metaverse, these gaming worlds are very well-established and very sophisticated in kind of complete exploratory environments. So, and I think that passion for gaming and connecting in these places will just keep powering it forwards. Lovely. Well, that was a really interesting session. I know that you're overseas and you've logged in at a different time. Thank you so much. It's pleasant. It was an honor having you here and we hope to see you soon in India at an on-ground event. Absolutely. It would be lovely to do this in person at some point, wouldn't it? 100%. And we look forward to that up until then. Take care. Stay safe. Thank you. Cheers everybody.


Our ummah has gone through a lot of different times in which we've seen women's voices in different ways. Knowing that we've had those differences is helpful for a 19-year-old girl who's been told since she was 13 that she cannot memorize the Qur'an because the imam will not teach women and he's the only imam of the masjid. For that 19-year-old girl, for the 40-year-old woman who have told me that when they stopped reciting the Qur'an was when they hit puberty and the only person in their masjid who could teach was the imam and he said I'm not comfortable teaching women. And they were so impacted by that that they started feeling more and more distant from Islam and they've told me that now that they've been hearing women recite the Qur'an again in their 40s for the first time they're opening the Qur'an again. That's a generational reality. Because having children, that's going to 60 and 70 and 80 and maybe having grandchildren and not opening the Qur'an or never reciting it out loud in your private space because you don't know that as a woman the Qur'an is for you. And in the Qur'an, Allah swt talks about how women were present and he recorded women making specific statements for a reason. Like for example, when Allah swt talks about the daughters of the sheikhun kabeer who are the answer to the dua of Musa alayhi salam as he's asking for Allah to send him something. They come and they meet him and then one of them goes back to her father and she says what? Allah didn't have to say that line. That line is not necessary to understand the story. Why did Allah swt say it? So that women know that they were included in financial matters. When the queen of Sheba is asked about what to do, when she's asking for advice from her advisors what to do about Suleyman alayhi salam's letter, she talks about what Mooduk do when they come into the new land and they ruin the land. And then there's an ayah right after she speaks and it says if she's saying and that's what they do. The scholars of Tafseer say that is Allah swt affirming her intelligence by saying yes that is what they do. That it's exactly and this woman is depicted as a righteous ruler that it's exactly what they do. Allah swt has recorded the voices of women in the Quran for a reason. Whenever you as a woman may feel like you're not sure of your status with Allah swt or you're confused or you disagree and that's okay. It's okay to disagree but when you're questioning that part of yourself as a woman, I've been asked by Muslim women sincerely asking what tears in their eyes did Allah create women to be like somewhere between an animal and a man? Is that our level with Allah? And if that's what Allah wants, that's fine, that's I accept that because that's what Allah swt wants but is that it? When we have an eight year old asking that question and then she becomes a 28 year old who has internalized that and then she potentially raises children with that internalization where does our entire ummah go? We often talk about the next generation and Islam for the next generation. If women are feeling disenfranchised in this generation, who are the great grandchildren? Who are they tracing it back to? To save the future of our ummah we need to support women right now because whether or not she or you are ever going to be mothers because Allah has willed each and every one of us to have a different role for a reason. He says, subhanahu wa ta'ala, this verse I end every time with because I want you to remember, he has chosen you and Imam al-Tabari mentions he's chosen you for a quality that he sees inside of you even if you don't see it yourself. He created you to be a woman of this ummah in a time where women are struggling with being women in a time where we're being attacked by every ideology at a time where everyone else is welcoming you onto their understanding. He's invited you to fight now and right now and honestly forever maybe absolutely no one will know our names. But Allah doesn't forget and the angels who roam the earth looking for the people who come together in his name coming together and surrounding you with tranquility and taking your names up to Allah don't forget and one day we are going to be those women in history. So the question isn't whether or not your voice matters and the question certainly isn't whether or not we are equal to men. The question is what are we going to do to make the future generations of Islam of Muslims look and say the women of the past change the course of history because of their strength in their belief in Allah subhanahu wa ta'ala and you all are deserving of being one of those people.


A 16-year-old male teenager was arrested on Saturday in Boston and is accused of using a knife to rob a group of four people at Boston High School. The Polk County Sheriff's Department says it was called to the scene on 5 p.m. on Saturday and arrested the suspect then. No one was injured in the incident and the investigation into the case is ongoing. If you've enjoyed this segment of Lakeland News, please consider making a tax-deductible contribution to Lakeland Public Television.


Hello, Columbia. Welcome to our edition of Telling Our Story Exploring the Parks. I am your host, Wanda Austin Herndon. Join us as we explore our parks. Hello, Columbia. And welcome to Telling Our Story Exploring the Parks. I'm your host, Wanda Austin Herndon. And today we're at beautiful Emily Douglas Park. So come take a walk with us. Under the shades of the large oak trees nestled in the historic Shandon neighborhood of downtown Columbia, you will find this quaint and cozy park named Emily Douglas Park. Located at 2500 Wheat Street, the park has separate place spaces, large green space, dog park, and community center. The neighborhood center is open Monday through Friday from 2 p.m. to 6 p.m. and offers an after-school care program for children ages 11 to 13 years of age. I came in for this community to help out with the kids, do programs. I grew up in the park so I wanted to make sure that it continued on. We have an after-school program and it's catered towards the teens simply because we're right across the street from Han. We do different things. We have food for them. They get a snack. They get a dinner. They get homework help. We play games. We do arts and crafts. We have a STEM program that we use and we also have a gaming program that we have come out once a month also. The City of Columbia Parks and Recreation Department will be offering a winter teen retreat for December the 27th through December the 30th. For more information in reference to the retreat, please contact Kim Mitchell at<PHONE_NUMBER>. Situated in the back corner of the park, there is a dog park. It is quite popular for the residents of the neighborhood. Dogs are allowed throughout the entire park. However, when they're outside the doggy park, they must remain on a leash. The green space in New Douglas is big and offers a lot of space for several activities. The options are endless. The uniqueness of it being in this neighborhood, it being close to five points, you can look down in and it's always looked like a little hidden treasure over here and I like to be in places where there's not a lot of people and this this is not spot. It's a quiet awesome park. Emily Douglas Park also offers two separate play spaces. One of these is better suited for the older kids, which includes monkey bars and a large climbing structure and ballast swing. The second play area is designed for kids between the 80s of two and five years old. In this space you will find a perfectly sized play space with two slides, a bridge and various climbing structures. The spray pool of Emily Douglas is open during the summer weekdays from 10 a.m. to 12 p.m. and then again from 4 p.m. to 6 p.m. and closed on Saturday and Sundays. You're in the city so there are some noises, but for the most part you get a calm energy here. There's a sense of community, togetherness, nature, freedom that I think is really nice space, you know. One of my favorite things about Emily Douglas Park are the trees. I love the trees here. Thank you for joining us and stay tuned for our next episode of Telling Our Story Exploring the Parks. As with all our parks, our mission here at the City of Columbia Parks and Recreation is to change lives through a culture of transformational leadership, innovation and phenomenal customer service. Thank you for joining us today and please join us in the future for more episodes of Telling Our Story Exploring the Parks and remember we are Columbia.


Hey everyone, welcome to this special Cube Conversation. I'm your host, Lisa Martin. I've got a great conversation coming up next about making digital trust a strategic focus for your organization. My guest is Dr. Amit Sinha, the CEO of Digister. So great to have you, Amit. Thank you for joining me. Thank you for having me Lisa and it's wonderful to be back on the Cube. Isn't it nice? It's nice to be back in person. We can actually have a conversation. Love a 3D conversation. 3D, yes. So I want you to have the opportunity to introduce Digister to the audience. Not many folks know. Talk to us a little bit about the company and how you're providing digital trust to your customer base. Yeah, Lisa. So Digister is a leading provider of digital trust. We are proud to serve over 80% of Fortune 500 organizations as our customers. And our customers use our Digister 1 platform to manage trust across the users, their devices, their software, their content. We've been in business for over 20 years and we have north of 3 billion devices now secured. 3 billion devices and of course that's only gonna grow exponentially. There's so many buzzwords in security. We have topic conversations about security with every guest pretty much these days. But describe to us what digital trust is and how it relates to security. Yeah, yeah, that's a great question, Lisa. Digital trust is sort of foundational infrastructure that allows users, businesses to have the trust and confidence that their online transactions and interactions are secure.  We live in a very connected world, right? When you connect to your bank, how do you know you're connecting to a legitimate banking side? When you are transacting with the bank, how do you make sure that those transactions are secure and encrypted? Nobody's snooping on it, right? How do you know your iPhone is getting the right update from Apple and not some tampered software, right? You get a digital document that was signed. How do you know the right person actually signed it, right? Hospitals, how do they guarantee that the MRI machine has not been compromised? How does an airline make sure that their mission critical flight avionics systems haven't been tampered with, right? All of this is foundational and built on digital trust. Absolutely critical. You know, we talk about trust a lot as well, trust as currency these days, but on the consumer side, we just have this sort of blind expectation that document that I got for e-signature, the right person signed it, or the update that I'm getting from Apple is legitimate and unless I hear something on the news. So that trust factor is, like you say foundational, but it's really table stakes for every business, every consumer. We talk a lot about zero trust. I understand that conceptually, but can you talk about how zero trust contrast compare it with digital trust for us? Yeah, that's an excellent question. There's a lot of discussion in the security industry around zero trust. Maybe I can share a simple example, right? Let's say you go to the airport and you need to fly somewhere. How do you go through airport security?  So zero, that's zero trust in action. It's a security architecture where you validate identity, you validate intent, and based on that you either allow someone or you block someone, right? Let's take a step back and see what was the infrastructure that went around that particular action to make it successful? Well, it starts with a passport, right? Who issued you the passport? You know, the U.S. passport office. You showed up at the passport office, maybe showed your birth certificate, documents, and once your identity was validated, you were issued this stamp approved document, and now you can use that document to assert your identity and go through an airport and do other things. That is digital trust. So think of digital trust as the infrastructure that allows physical identities to get validated, and then you have digital identities that you can then use in subsequent workflows, right? One of those workflows could be going through the airport in the physical world. Yeah, so zero trust, digital trust seemed to be very symbiotic, working hand in hand, kind of really from a hierarchical perspective, really facilitators, symbiotic enablers. How, what are some of the challenges that businesses have? That airport analogy was great. I had a nightmare a couple of years ago with the passport trying to get to Italy, didn't happen. But what are some of the challenges that businesses, airlines, hospitals, banks, encounter where digital trust is concerned and how is DigiSERD the one that comes in and says, we got you covered, we got those challenges, we're gonna take them off the table? Yeah, I'm glad you latched onto the passport analogy, sounds like it made sense. Well, just like passports expire every couple of years, digital identities in the form of digital certificates also expire.  Now, back in the day, businesses had a few web servers and they installed these digital certificates that were longer lived and once they expired, they went and kind of renewed it and tracked it on a spreadsheet and managed all of that. Today, when you go to a large organization, they might have hundreds of thousands of these digital certificates across users, devices, servers, cloud workloads, right? And it's a nightmare to manage, right? Imagine you having to deal with one passport, imagine an organization having to deal with hundreds of thousands of this, right? And these digital certificates are getting shorter and shorter in duration. And when certificates expire, they cause outages. I mean, any business you go to, they'll say, hey, some critical service or system was down because of cert expire, right? As a matter of fact, Elon Musk recently tweeted saying that the entire Starlink system, the SpaceX broadband satellite internet system was down because a digital certificate on a ground station had expired. So these outages happen, but it's not just outages. Security breaches have happened because digital certificates have expired. One that comes to mind is Equifax, whereas I think about 150 million user accounts and information were compromised. And the root cause was a digital certificate that expired on a critical network security device, right? And these outages can cost tens of millions of dollars to large organizations. So what more and more people are realizing, particularly businesses, they need automation. They need a centralized way to manage all of these cryptographic identities across their organization. And what Digisert provides is Digisert One Platform and it comes with things like Trust Lifecycle Manager where all your identities, all your digital certificates across devices, servers, content, users can be discovered, managed and automated without a human in the loop, right? So it really cuts down outages, reduces your attack surface and the risk of security breaches. That's so critical because we've seen in the last couple of years alone the massive rise in security breaches, whether it's, and so much of it's human area, you talk about the challenge of manually managing hundreds of thousands of security search that probably have a huge variety of expiration dates. It's managing that at scale and dialing down the risk has to have automation. It seems like that's not a, you know, I'd be nice to have, that's, we have to have this. And you know, we did a quick survey at Digisert and found that 47% of users said they will switch their vendors when their trust is broken. So it's not just a security issue, it's also a revenue impacting issue because your customers stop trusting you. Oh, Churn is one of the easiest things. She said nearly 50% of people would say I would leave brand reputation. It can be absolutely catastrophic if that trust is broken. Let's talk about the consumer side for a minute. We all have, I don't, I've lost count of how many smart devices I have in my home. I'm doing a remodel right now, so there's gonna be more. But when we think about consumers, we're cooking in the kitchen and we're asking the one with the girl's name, you know, to play certain music or how many ounces and a cup or whatever happens to be. And we're not thinking about the security aspect of that. But the White House and the Federal Communications Commission recently announced the Cyber Security Labeling Program for smart devices to protect consumers like you and me. This is the U.S. Cyber Trust Mark Program. Talk more about the threat here on the consumer side and how digital trust and Digisert are helping consumers ensure that the transactions they're doing are secure. Yeah, that's a wonderful question and very relatable to end users, right? You know, there's estimates that by 2025, the number of IoT, these types of internet of thing devices would be somewhere in the 75 billion, like 10 times more devices than humans, right?  Now the challenge with these devices, generally these are low cost with poor quality software, not often patched, right? And the question is, how do we raise the security of these devices? Because they are now posing a massive attack surface, right? So the question, if you look at IoT devices, I'd say, take a look at your iPhone. It's generally much more secure and why is that? Because your phone has a digital tamper-proof identity in the form of certificates, you know, from Apple. When you get software updates, it's signed by Apple. So you know, it's sanctioned software, it's not been tampered with. So you have a trusted device getting trusted software and that's how you get a trusted ecosystem. How do you bring that to your consumer IoT device that are cheap and maybe price is a factor as well? So step one is sort of digital identities, right? And fortunately, standards like matter are evolving and led by Amazon, led by Google, they want to increase interoperability in the house, but also raise the bar on security. And fundamentally talking about a few things. One, tamper-proof digital identity. So every device should have an identity, right, that prevents counterfeiting. Number two, software that goes on to these devices needs to be scanned, right, signed, and then you have this ecosystem like your iPhone where a trusted device is getting a trusted update. The standards are also pushing for what is known as a software bill of materials. You think of it as like your nutrition label on your favorite snack. You pick up your favorite snack, you see the nutrition label, you can take it a step further, maybe the FDA certifies it as organic and then it gives you that visual indicator that this is higher quality food, right? So how do you bring that concept to your consumer devices, right? And that's what the White House and the U.S. Cyber Trust Mark is all about. You know, trusted device, trusted software, with a software bill of materials, telling you what's inside this. And with a visual mark, the U.S. Cyber Trust Mark, kind of like organic, saying, hey, consumers can make an informed choice that this is a more secure device. Right, and that's something that I think, probably a high percentage, just thinking off the top of my head here, of people never once think about with their phones, with a thermostat, a doorbell, and we see so many crimes being caught on doorbell cameras and being released publicly, but it's something that consumers need to have because, like you were saying earlier, from a trust perspective, from a brand reputation, from a revenue impact perspective, for any organization, whether they're dealing with a consumer or not, it is absolutely foundational these days. You mentioned that, I love the airport analogy, airlines making sure that aircraft systems haven't been tampered with. Healthcare, you know, we go in for an X-ray or an MRI, and we don't think, we're curious about whatever is wrong, but we don't think about, this is an organization's IoT device. How is digital trust and digital, how are you helping organizations really enable IoT security, especially as the numbers of IoT devices just keep rising? Yeah, that's a good question. And going back to those two things, I talked about digital identities and secure software. So our customers are using Digisert One, which includes a module called IoT Trust Manager. And what that does is it allows you to stamp these digital identities into your IoT devices, right? And it integrates well with your manufacturing environments, your factories, your OEMs. I mean, you might have a factory that's not even connected to the internet, right? So you need sort of flexible ways to add identities when these devices are being produced. So that's step one. In step two, Digisert One also includes software Trust Manager, where you can scan the software that's getting deployed, make sure it doesn't have any vulnerabilities, generate a software bill of materials, kind of like the nutrition label I talked about, right? Sign it so that it cannot be altered, tampered, and you get that secure ecosystem where you have a trusted device getting a trusted update. This is particularly important for the medical devices. And we have now customers who manufacture continuous glucose monitors, smart infusion pumps. I mean, it's literally life and death. You don't want these devices to be tampered with, right? That are using these mechanisms to essentially reduce counterfeiting, make sure that genuine software is installed on these devices, and also secure the communication between the device and your app or the rest of the ecosystem using the same digital trust mechanisms that exist between your app and the bank, right?  We talked about consumer electronics, medical electronics. What other, are some other types of OT, IOT devices where digital trust is relevant? I imagine the answer is D, all of the above. Yeah, I mean, quite literally it's all of the above, right? As I said, this is a massive attack surface and it's an easy way in into an organization. So a couple of very interesting new use cases. You probably use an electric car, for example, right? And people often wonder, how can I just drive my car to a charging network and plug it in and magically my account is getting billed? How is all that happening? Well, it turns out that the plug and charge standards use digital certificates. These digital certificates are essentially authenticating, authorizing and securing the communication between your electric vehicle and the rest of the charging station network, right? And it's tamper-proof, no human in the loop and everything just magically works. You know, we have now appliance manufacturers, people making refrigerators and air conditioning units basically stamping out these identities, just like the IOT devices that we talked about. So I think, more and more, you're going to see these standards emerge and a recent FBI study had shown that almost half of the devices out there, right, are just very insecure and they hardly ever get patched. So you're seeing matter and all of these standards emerge and Digisert is actively participating in these standards and driving products that address this for OEM manufacturers as well. Seems like relevance isn't the right word. It's really business criticality for digital trust, what Digisert is providing. But for organizations, and so many are living in a hybrid, multi-cloud world, what's the rule of the hyperscaler where digital trust is concerned? What are they doing in this space and are you guys working with them to deliver digital trust really to organizations and to end? Absolutely, hyperscalers and cloud computing is a massive market. The role of hyperscalers, the AWS, Azures and the like is primarily to provide cloud computing infrastructure, storage, compute, lately a lot of AI services, right? They're not really focused on validating the physical identities of domains, of organizations, of users, and then issuing them digital certificates that they then use on that cloud infrastructure. So today if you go to AWS or Azure and spin up a server and get a digital certificate, more likely than not, it has come from Digisert in the background. So these hyperscalers use central or certificate authorities like Digisert in the background to generate those digital identities. We recently signed a deal with Oracle. Customers who use OCI, Oracle Cloud Infrastructure can now get native Digisert services within their environment as well. And Oracle has some pretty interesting features like sovereign national clouds, right? There might be big governments or entities that don't want their trust boundary to go outside. They want it to be in country. So it really helps in that type of scenario. And then across the world, I mean with folks like Microsoft, we have very deep partnerships. Lots of enterprise customers use Office 365 and the SMIME certificates that are used to authenticate and encrypt email communication often come from Digisert. Similarly, a lot of Microsoft customers may use Intune to manage digital certificates across their device fleet. So we have deep partnerships with hyperscalers and you can think of Digisert's role kind of like that passport authority, right? We are validating your physical identities, right? Checking to make sure you are who you say you are and then giving you tamper-proof digital identities then you then leverage on your hyperscalers whether it's cloud workloads or other services. I love that really kind of opening the hood and there's Digisert in there really enabling digital trust across the hyperscaler environment. You talked about AI. We can't these days have a conversation that doesn't talk about gen AI. Talk a little bit about what Digisert is doing in that area. How are you using gen AI? Like it's under the hood, the passport authority that you talked about. Give me the sense of the role of gen AI in that context. Yeah, like many progressive organizations we use gen AI to improve efficiency within the organization whether it is AI powered support chatbots or AI based contract review systems. We also have developers using AI co-pilots to increase their coding efficiency. But if I take a step back probably the biggest challenge gen AI poses to our information based society is content trust. And how do you know what's real and what's fake anymore, right? How do I know that this video I saw of Putin on my phone is legit? How do I know that maybe I'm a juror and I'm sitting and wondering are those crime scene photos original or have they been doctored, right? Did the CEO really say that on the earnings call? We get trolled on social media all the time. We're wondering is that a bot? Is that a real person, right? So, you know, gen AI has experts worried, right? It can be used to spread misinformation, to tamper elections, to propagate scams, generate counterfeit identities, you know, ruin reputations of celebrities with things like celebrity porn, right? Fortunately, content authenticity initiatives are being worked on, right? And we're working with companies like Microsoft and Sony and Intel and Adobe on content provenance. And the core idea is as a consumer, I should be able to have a tamper-proof way to validate the source of any media. Where did it originate? What were the subsequent changes done to it, right? And then make an informed choice. So, think of it this way. Let's say Lisa, you take a picture with your phone. Your phone then, you know, records information like location, type of camera, timestamp. And then most importantly, uses the digital signing mechanisms that we've been talking about to sign a manifest. And that can be edited or tampered with, right?  Your photo editing or video editing software does the same thing. It says, hey, you applied these filters, you made these changes. Another manifest is generated and signed. Maybe a news channel takes it and shows it, right? They might add some captions to it. And other things, yet another manifest. All of these manifests are cryptographically bound to the original media package. So when I consume it, I can see, you know, here's how it originated, here are all the changes, right? And I think this would play a huge part in generative AI and Digisert along with in the PKI industry will have a central role in content provenance. Content provenance, that's something that we're absolutely gonna be following because it affects all of us. But a couple times you talked about digital signing and I was thinking about, oh, the last time I signed something electronically. Are we talking about something that's similar and that's driven by automation?  You know, when you sign a piece of paper, what's happening? I mean, you have a unique handwriting that is hard for someone to clone, right? And if I see a document with your signature and if I have the original, I can kinda match the two and then get a sense that, well, this is Lisa who actually signed it. Well, the same mechanism happens in the digital world. In the digital world, every entity gets a pair of keys. It's called a public key and a private key, right? It's your job to keep your private key secure, but you use the private key to create the signature, right? Think of it as your unique handwriting, right? And everyone else in the world has access to your public key and they can use the public key to then check and make sure that the person who signed it is indeed the right person. And this is based on math that, you know, has been established and it's very hard to break. So what does Digisert do? Well, Digisert essentially validates that you are Lisa and gives you a pair of keys, right? And then you can generate these digital signatures. So when you get a DocuSign link or Adobe EchoSign link, right now you get a link, you click on it and you sign, you can think of DocuSign, Adobe and others as document management systems that are doing the act of signing, but kind of the keys and the infrastructure is coming from Digisert, right? But I can take it a step further, right?  Now that will stand up in a court of law. Why? Because the notary validated, hey, this is Lisa. You made a note in their logbook, right? Manually, yes. And so that wet ink signature happened in front of them and so it's much more, it's a higher assurance, you know, physical signature. How do you get that in the digital world now, right? And that's where new standards in Europe are evolving. It's called electronic ID standards, EIDES, where they're looking for qualified signatures, right? Where I really validated that you're Lisa. I gave you your unique set of signing keys, right? And you're using that to do a notary-like signature that will hold up in a court of law. Wow, that's fascinating. So you did such a great job talking about Digisert, what is the platform is providing to organizations across industries, the TAM must be huge because the relevance, as we said, it's not relevance, it's business criticality. What keeps you as the CEO of Digisert? What keeps you up at night? What are some of the things that our audience really should be aware of from your perspective? Yeah, I mean, one thing that keeps me up at night is quantum computing. You know, last weekend I watched the movie Oppenheimer, right, and it's about Oppenheimer bringing quantum mechanics to the US and then becoming the father of the bomb. It's taken several decades, but now we have quantum computers and you have Microsoft and IBM and Google, they're all in a race to announce faster and more stable quantum computers. And they can really revolutionize things like drug discovery and climate modeling and also take AI to the next level. But it is a double-edged sword. Those same very powerful quantum computers can break all of cryptography, all the digital trust that I talked about. It could be like, I'd say, an extinction-level event, right? Needs almost a Manhattan project-style effort, right? And some people call it Y2Q, years-to-quantum, just like Y2K. But what is the fundamental problem? Well, the fundamental problem is that the authentication and encryption mechanisms that are used by current cryptography are based on math problems, like factoring very large numbers that are incredibly hard on even the best computers that are available today, right? So it might take a very powerful computer, say a thousand years to break a current cipher. The same cipher can be broken in a couple of hours on a reasonably large, stable quantum computer. And that's because these computers have these spooky properties of superposition and entanglement that you and I would have a very hard time understanding in real life, but it gives them massive, parallel processing capabilities, right? So imagine what happens if suddenly your phone backups are broken, enterprises, their cloud backups are broken, right? Or unauthorized people have access to it. You might have a digital contract that someone has now changed. Your communication on the internet is no longer secure, anyone can eavesdrop, right? So it is an extinction level event for digital trust. Fortunately, now people are working on it, right? So in fact, the White House and President Biden recently issued a national security memorandum instructing government agencies to move their cryptographic standards to what they call PQC, post-quantum computing, right? And Digisert's working with the National Institute of Standards and Technology, NIST, the IETF, the Internet Engineering Task Force, to bring these PQC standards to fruition. And the goal is to have digital trust based on cryptography that is quantum resistant. So they cannot be broken, they cannot, should quantum computers be available, you know, you have new math and new algorithms that even they can't crack. But what does that mean to organizations today, right? I talked about Y2Q. Progressive organizations are looking at this as an opportunity for crypto agility. What do I mean by that? Now I have, I talked about, you have tens of thousands of these certificates and cryptographic assets across your organization. Step one, you need an inventory, right? Tell me, you know, what machines, what devices have what type of algorithms? And step two is all the management and automation. So should I have to swap all of these certificates with post-quantum, right? I have the infrastructure in place, so I don't have to do it manually. Otherwise it would just kill the organization. Oh, it could be catastrophic. Catastrophic, so, I mean Digisert is working on a lot of these post-quantum computing standards, and we also have our Trust Lifecycle Manager platform, which is part of Digisert one, that is enabling organizations to discover, to manage and to automate all of these cryptographic assets across their organization. Discover, manage, automate, absolutely critical.  What's that mic drop statement from your perspective? I think, yeah, mic drop, well, I'd say, first, thank you for having me, right? Digital trust is so fundamental and critical, and Digisert is kind of an anchor, the root of trust on the internet for making all of this happen. You know, beyond that, what I would say is, you know, we've built this amazing business around core company values like customer obsession, awesome innovation, relentless execution, and exceptional collaboration, and we're really grateful to our customers and partners for giving us the opportunity to be of service to them. If you're interested in digital trust, you know, look us up, there are plenty of opportunities for builders and sellers in the organization, and more importantly, you know, I know every organization has digital trust requirements, if you do, please do give us an opportunity to be of service to you too. This was outstanding, I know we're out of time, we could keep talking about this, this is such a critical, I mean, to your earlier point, one of them, life and death situations. Thank you so much for sharing with the audience about Digisert, the platform, what digital trust is, why it's critical for every organization. We really appreciate your time and your insights. Thank you, Lisa, it was my pleasure to be on your show here. My pleasure as well. We wanna thank you so much for watching. I'm sure you're riveted by the conversation with digital trust, we thank you so much for your time. For Dr. Amit Sinha, I'm Lisa Martin. You're watching theCUBE, the leader in tech event coverage.