Welcome to the Azure Security Podcast, where
we discuss topics relating to security, privacy,
reliability, and compliance on the Microsoft
Cloud Platform. I'm the Chief Technology Officer
of Azure. I'm also a Technical Fellow at Microsoft.
And as of about a year and a half ago, I've got
some additional titles, Deputy CISO for Azure,
Deputy CISO for Engineering Systems, and for
our core operating systems, Linux and Windows.
So actually, before we get on, what is a Technical
Fellow? I'm sure a lot of our listeners would
like to know. Well, that's a great question.
In fact, Scott Hanselman and I just recorded
on our Scott and Mark Learn To podcast an episode
on career trajectories for developers at Microsoft
where we do discuss in some depth about what
the distinguished titles of distinguished engineer
and technical fellow mean. But in a nutshell,
it means that the engineer at Microsoft has had
massive impact on the company and likely the
industry in whatever domain that they happen
to be working in. Yeah, a good friend of mine
over in as your data just became distinguished
engineer. So it's great to see. It's an impressive
accomplishment to get that because it's also
typically means that you've been executing at
that level for a long time to be able to have
that kind of impact. Yeah. All right, let's get
stuck into the topic of this, which is all about
quantum cryptography, basically a podcast based
on a blog post that you wrote. We just want to
turn it into sort of an audio format for people
who want to sort of learn more about this while
they're driving to the gym or something. So let's
get stuck into something. I've got the intros
out the way. My first question is, you know,
if you could kind of give your take on quantum,
right? And, you know, because there's quantum
computing, there's quantum physics, there's quantum
cartography. So if you kind of, you know, give
us a quick sense of that, and then very interested
in this term quantum safe, like, what does that
mean, you know, to us to Microsoft to you? And,
you know, why is that, you know, becoming a big
deal for people? Sure. So in this context, we're
talking about quantum computing, which is computing.
that takes advantages of quantum physics. If
you take a look at classical computing, it's
very much binary, and it starts with transistors
that have on and off states. When you talk about
quantum computing, you're talking about the quantum
effects at microscopic level, different materials
that actually live in a superposition state,
which means that they actually reflect a probability
of a state. That doesn't reflect an actual state
until you measure it. And this is kind of the
bizarre thing about quantum physics. When I started
to look more closely at quantum physics, which
I'd never had any education on in high school
or college, about 10 years ago, as I got more
familiar with the quantum program that we had,
my mind was blown by some of the effects. quantum
physics like the double slit experiment with
light for example where you shine the light through
the double slits and if you're measuring the
number of photons going through you actually
end up with a pattern on the wall or the reader
on the other side of the slits that shows that
the photons went through one slit or another
but if you don't measure them then you end up
with a scatter that shows that they actually
kind of went through both slits and That's just
like we're not just not used to thinking about
things like that. What this allows you to do
is computations that work on maintaining massive
amounts of state in a very compact way. Because
if you wanted to simulate a physical environment
like that light going through the slits with
a classical computer, basically you have to represent
for each bit has two to that power of bits of
state represented in it that in a quantum bit.
can store all of that state in just that one
bit. Simulating a quantum computer is exponential
in a classical system. And if you want to simulate
100 atoms, now you're talking about 2 to the
100th states. And you start to explode in terms
of memory, for one thing. Whereas in a quantum
computer, you're just talking about 100 qubits.
And what you can do with qubits is actually simulate
physical environments. Like Feynman said, quantum
computing, which he's one of the pioneers of
quantum computing, is the best way to simulate
a physical system is with the physical system
itself, something that represents it. And the
physical world is quantum and probabilistic.
And so if you can simulate it with probabilistic
computing, you can actually simulate exact outcomes.
And where this becomes interesting is when you
want to solve problems like, how do these molecules
bond? How do I develop a new chemical that has
these properties? How do I simulate traffic,
which has actually this kind of exponential state
thing and best and optimal traffic flows? And
you can look at problems around different domains
and see where using this kind of power would
help you solve problems that are intractable
on classical computers. So back in the early
2000s, around 2008, Microsoft embarked on a quantum
computing program to build a quantum computer.
The key part of a quantum computer is the quantum,
the qubit that you pick, the physical qubit you
pick. Which material are you going to use that
has that quantum physical property to build your
quantum computer on top of? And there's lots
of different microscopic materials that exhibit
these quantum physical properties. Like you can
take an atom itself. You can take an electron.
You can take a photon. You can take ions. And
you can use them as your physical qubit. Now,
the pros and cons of using different physical
qubits is they each have different sizes and
speeds and stability. And so kind of those three
dimensions. And back in 2008, Microsoft quantum
researchers concluded that all of the kind of
materials that I just mentioned or physical qubits
I just mentioned were not going to get us onto
a path. to a scalable quantum computer. And I'll
describe what that is in a second. But they'd
read about this or knew about this theoretical
particle called a Majorana fermion, which was
actually predicted by Enrico Majorana, an Italian
physicist, back in the, I think it was the 1930s.
But nobody had ever actually seen one. And they
said, well, this particle, which is its own antiparticle,
if it exists, is fast, small, and stable. And
if we could build a quantum computer with this,
we could... get to scale of a million qubits
on a wafer of material that you could actually
produce. And the benefit of that over looking
at some of these other physical qubits like transmons
or ions or photons or electrons is that with
all those other technologies, you have to create
a system that has a million logical qubits or
a few hundred thousand logical qubits. You're
talking about a system that is the size of a
conference room or larger. And with that comes
this big problem of how do I synchronize the
thing across that kind of scale and how do I
measure things reliably and how do I keep everything
coherent? And this is what it's called. You don't
want the superimposed state to collapse. You
want it to stay in that state. Once you measure
it, of course, it collapses and you can inadvertently
get measurements which cause it to collapse.
So the bigger your system, the more likely you're
going to have. And then that means the more error
correction you need, which means the system gets
even bigger. But with my own fermions, we could
avoid all that. And so that's been the focus
of the program since the start is how do we actually
prove these things exist? Then how do we make
them reliably? And then how do we build a qubit
on top of it? And then how do we build a quantum
gate on top of that? And we've been hitting each
one of those one after the other steps on the
path to. Majorana fermion based system. These
are called topological qubits. The ones we build
with Majorana fermions in, I think it was like
six or seven years ago, we proved that they exist.
And there was a paper in Nature. Microsoft proves
that Majorana fermions do exist. And then the
next paper was Microsoft proves that they can
make them. And now we actually showed what we
can create qubits on top of them. And then at
build, we announced Majorana one, which is an
eight bit topological qubit based system. That's
our first one to actually start playing with
and investigating the properties of it. And then
the path is, of course, to scale that into hundreds
of thousands onto a single wafer. And we've been
building all the supporting infrastructure around
having a real scalable quantum computer when
it's ready, like SDKs for how you program the
quantum computer, getting the algorithms ready
so when it's ready, it's ready. Getting cryogenic
CMOS controllers that we can put next to the
quantum computer so that we can actually measure
and control it. at scale at scale without worrying
about the decoherence like this essentially allows
you to do calculations that were extremely difficult
before which is essentially what our cryptography
was built on very quickly right exactly so quantum
computing is great on one hand and then it's
terrible for security on the other you're right
so we're creating this situation where with a
scalable quantum computer of a few hundred thousand
qubits you can start to break elliptical curve
cryptography and rsa cryptography at at the key
lengths that we're using today you know 256 bit
uh keys would be breakable by a system of that
size and that poses obviously this is an existential
threat to computer security because if somebody
can break that the tls isn't secure on disk encryption
isn't secure because the keys themselves are
encrypted that way and then ultimately there's
symmetric almost every technical control relies
on in some form or fashion without that. Yeah,
hashing gets broken. Like all the fundamentals
of our computer security are broken once that
happens. Yeah, isn't there a thing right now
where people are actually collecting ciphertext?
They can't break it yet. Yeah, this is break
now, read later, decrypt later. Harvest now,
decrypt later. It's like that, yeah. They're
grabbing it now and they're going to do it later.
It's harvest now, decrypt later. Decrypt later.
Yeah, HNDL, like handle, yeah. You can just record
the TLS communication, the handshake, and then
break it with a quantum computer at some point.
And then all that communication is in the clear.
Yeah, very cool. Well, not very cool at all,
but anyway. Very scary, actually. So what are
the biggest challenges, biggest technical challenges
with migrating to post -quantum cryptography
that you see? People need to really, really think
about it. What is it as you need to think about,
for example? Well, so the first thing is what
kind of timeline that we've got for this. Because
I think that's, you know, you need to do a work
back, which is what we've done, which is saying,
when do we think we'll get to that kind of scale?
Or somebody will, and we think Microsoft has
a good chance of getting there first. And we
think that in the early 2030s might be the kind
of timeframe we're talking about for a scalable
quantum computer to be in the hands of people
that want to break cryptography. And so when
we work back from that, we say, what's the timeline
we need to be ready? to safely ready, conservatively
ready for that. And so we set ourselves a timeline
of 2029. And that means, and being called post
quantum safe means, we've actually switched over
to using cryptographic algorithms that quantum
computers can't break, instead of using these
ones that I mentioned. And that means starting
with the core dependencies of like your cryptographic
library support it, and then your ships in the
operating system, and then your Network traffic,
TLS is starting to use it, and your on -disk
key protection and wrapping and your token signing
are all using those kinds of algorithms. And
so we've mapped out all the steps we need to
take, starting with the fundamental one of, hey,
let's get those algorithms coded up and included
in our crypto libraries, and then going from
there. And so quantum safe means you've actually
re -encrypted your keys. You've actually switched
over to that for all your network communications
as well. And you're signing all your code with
those algorithms as well. So the tool that we
have started working on, one of those fundamental
components is SimCrypt, right? Yep. Which is
available all, it's up on GitHub for Windows
and Linux and I assume Mac as well, is that?
Yeah, it is there for Mac, too. So where does
SimCrypt fit in the hierarchy? So Windows today,
we have historically a crypto API and then CNG,
crypto next generation. So where does SimCrypt
map in that hierarchy? And when are protocols
like TLS1 .x or 2 .x, whatever happens in the
future, you're going to switch over to using
these post -quantum algorithms? So it's like
the most fundamental piece. It's at the heart.
The bottom of the dependency stack is SimCrypt.
And so that's where we started first. And we've
got two algorithms, post -quantum algorithm shipping
as part of SimCrypt, ML -DSA and ML -Chem. So
DSA is digital signatures and Chem is key exchange.
And those are NIST certified official standards
for post -quantum cryptographic algorithms. One
of the challenges, by the way, we faced is that
these algorithms are showing up. They go through,
we're waiting for NIST approval. And the risk
here, even... even as the algorithms get approved,
and that means cryptographers have beaten on
this in the public for a few years and nobody's
found any flaws with them, is that actually even
the ones that got through the initial gate, NIST
gates, some of them have fallen by the wayside
as researchers find problems with them. And we
don't know for sure that there's not going to
be problems found with these. This is such a
complex mathematical space. Like I'm not an expert
in it. I don't know if you are, Michael, but
we run this. this risk. And so we've got to be
quantum crypto agile. And crypto agility now
means, hey, if something happens to MLDSA, we
need to be able to swap it out for another one.
So crypto agility is one of my favorite topics,
favorite, favorite topics. The biggest mistake
I find people make, you know, both inside Microsoft,
to be honest, and outside of Microsoft, is to
hard code slash embed. Crypto algorithm information.
So for example, I've actually seen code from
a customer, believe it or not, that was using
56 -bit DES, ECB, electronic code book, right?
So you can imagine how weak that is. And they
had terabytes of data encrypted with it and they
couldn't do anything about it easily because
their code just was hard -coded to use DES electronic
code book. So I don't know. I mean, I can certainly
talk at length about practical ways that we've
done crypto agility inside of Microsoft. Is there
anything you want to talk about? Because I do
want to spend probably 60 seconds just to give
people some flavor about what crypto agility
actually means from a practical perspective.
I mean, I think you should run with it. Okay.
Again, it's one of my pet topics. I'm just a
huge fan. In fact, in the Microsoft security
development lifecycle, it's also a requirement.
Thou shalt be crypto agile. So what does that
actually mean? Well, it basically means that
you can change algorithms and aspects of algorithms
on the fly. So you could change from AES to...
post -quantum algorithm. You could change from,
let's say you're still using AES, but you want
to go from cipher blockchaining to Galois counter
mode. You can easily do that. And the way you
do it is essentially, there's two major ways
of doing it. One of them is the way SQL Server
does it with always encrypted. When they encrypt
the data, they use AES -256 with a SHA -256 HMAC.
And that is version one. And if they decided
to move to some other algorithm, say post -quantum
or perhaps Galois counter mode or whatever, that
could be version two. And so the first byte of
the ciphertext is the version number. And then
their code, they just look at what it is and
they encrypt and decrypt using that. The nice
thing about that is new stuff can be encrypted
with version two and they can read the old stuff,
which is version one, which is really, really
nice. The other way that it's commonly used is
in Microsoft Office in their XML data format.
they have an XML block at the very beginning
which describes all the Cypher information that's
used in that document. So it could be AES in
Cypher block chaining mode, 256. Here's the initialization
vector, password -based key derivation function
for deriving the key based on a password. Whatever,
I don't know, right? All that sort of stuff is
in there. The nice thing about that is, again,
you can read it. in whatever format it is, and
you can write it out with whatever is the current
version. I don't think Office exposes the individual
knobs that you can tweak on the cryptography,
but internally it certainly could. And those
are two magnificent ways of supporting crypto
agility because it allows you to read the old
data, encrypt it in the old credi format, and
write out using the latest and greatest to your
point mark. Let's say one of these new algorithms
has an issue and so version 2 is released, then
you can upgrade to version 2 and still read the
old data and then write out using the newer formats
if you propose that you should do that. Now,
speaking of formats, I think one of the things
that, as part of this transition, is that we
can't just flip over to post -quantum cartography.
We've got to be compatible with existing systems.
And so we have now hybrid TLS connections, for
example, which... we'll use both. So if we find
that when we're ready to flip, we can flip over,
it also means we can fall back to the classical
ones if there's a problem with the quantum safe
ones or the supposedly quantum safe ones. Yeah,
so does TLS 1 .3 today have reserved cipher suites
for post -quantum or is that something that's
still evolving? Yeah, because that's where we're
doing it with TLS 1 .3. Very cool. That's really,
really cool. Yeah, and actually, so TLS, has
historically also supported crypto agility. Because
during the negotiation, you negotiate, like,
here's the cipher suites that I support as the
server, and here's the cipher suites that I support
as the client. Then the server selects the strongest
out of the intersection of the two. And if there
is no intersection, then there's no communication,
right? Because we can't agree on the algorithm.
So TLS has always done a very good job on crypto
agility as well. In this case, it's encrypted
with both. Right. So if one breaks, the other
is still protected by the other one if the other
one's secure. When you say it's encrypted, you
mean the keys are encrypted? Yeah, the key, right?
The symmetric keys that are exchanged. Just stepping
back for a moment, just I want to make sure that
this is clear to the audience. We're talking
about crypto agility in the context of Microsoft
and the protocols and whatnot. But the reality
is it's not just, hey, we've got Azure and then
we get new algorithms from Microsoft through
Windows Update and the other mechanisms. There's
a certain amount that's kind of done for you.
But there's a lot of stuff that uses cryptography,
different physical devices, whether IoT, OT,
older software, might be hard -coded stuff, maybe
custom -built, maybe a vendor's out of business,
etc. And so organizations really need to start
thinking through how do we do inventory of all
of the different... crypto algorithms we have,
you know, via software, via hardware, or, you
know, essentially software embedded hardware.
And it really starts thinking about that, because
that's the key challenge of quantum is, you know,
there may be some devices that you simply can't
update the crypto algorithms for. So definitely
start that conversation that thinking early,
because you do not want to be caught flat footed
trying to buy new devices when, you know, it's
sort of like, I live in Florida. So it's like
toilet paper in a hurricane. You don't want to
be trying to buy the same thing everybody else
is all at the same time because there's only
going to be so many replacement devices and whatnot.
You bring up a good point around hardware because
that's what everybody's recognized we need to
be on top of right away. And in fact, at Microsoft,
we pioneered and launched with a group of partners,
AMD and NVIDIA, Google and others, an open source
root of trust. for our data center hardware.
And Root of Trust is the core component that
launches the whole platform and does the measurement
and the attestation for the security posture
of the platform. If that thing is broken, then
you have no security in hardware. And even your
software systems on top rely on that. And so
this core Root of Trust called Calyptra now has
in Calyptra 2 .0 This Adams bridge accelerators
component of it, which is a post quantum safe
cryptographic accelerator to support the post
quantum algorithms on part of that we're to trust
in this. And so that is part of OCP, the open
compute project, anybody can take and use it
where all of our hardware that we're building
in ourselves in Azure uses Calypter. And like
I mentioned, some of those partners and, and
a broader hardware ecosystem are now using Calypter
as well, because it takes from the time you Put
it in your design three years effectively until
it shows up in production hardware. Cool. Now,
you'd mentioned a little bit of work with NIST.
Can you talk a little bit more about, in general,
how we work with standards bodies like NIST,
ISO, and the like on this topic and how we're
sort of contributing in those ways in addition
to the open source stuff you mentioned? Sure.
Well, I mean, the standards are extremely important,
right? The standards bodies are defining for
governments what crypto algorithms they consider.
secure. And ideally, you know, we settled just
like we have with classical crypto on some standards
for the whole world for the whole industry. In
the case of the post quantum algorithms, NIST
took a lead on this and they had in 2017, they
had a call for submissions for post quantum safe
algorithms for these various operations like
digital signatures and key exchange. And Microsoft
actually submitted four submissions. So these
are four algorithms that we are security or cryptographic
researchers came up with into that call. And
I think there's one in the current one. So we've
been hard at work at coming up with crypto algorithms
that we that look like they'll be post quantum
safe and submitting them to NIST. And so And
then we're working with other standardization
bodies, ISO and ITF, again, on defining the standards
for what does hybrid key exchange look like for
TLS 1 .3, as well as whatever those standards
bodies are defining as requirements around cryptography
that we make sure that post -quantum is reflected
there. So at a practical perspective, I mean,
what impact is this going to have on Azure, Windows,
Office, and so on? I mean, will people actually
see any real changes? Or do we expect to see
sort of Perhaps UI change or configuration changes?
Or do we expect this to be pretty much hidden
from most end users? That's an awesome question.
And I think our goal is to make it hidden from
everybody. Anybody that doesn't need to know
about it shouldn't have to worry about it. It
should just be there, baked in. I think most
people aren't even aware of the classical cryptography
algorithms that we're using. The vast majority
of people, right? It's just typically a few people
that are worried about crypto that are looking
and saying, oh, time to upgrade our, you know,
retire TLS 1 .2 and time to retire this algorithm.
Time to move from MD5 to secure hashing, right?
And most people don't even know what MD5 is,
so. Yeah, so you're telling me people don't need
to learn quantum superposition? Yeah. That's
good. That's a good thing. That's a really good
thing. So put your philosophical hat on, your
technical. I know you're actually very good at
this. I actually enjoy listening to you when
you talk about things like this. But where do
you see the intersection? We live in really amazing
times, right? All of a sudden, everyone's had
to learn about AI. Whether you wanted to or not,
if you're a nerd, you've got to learn about AI,
right? You just have to. And I see that on the
horizon as well with quantum. All of a sudden,
people are learning about superposition and all
sorts of things like that. Where do you see that
intersection in the future, say 20 years from
now? where it's in sections of AI and security
and quantum and massive compute in the cloud
and massive storage. Where do we see that going
in the future? Yeah. Well, so first, I think
the reason a lot of people are talking about
quantum and post -quantum cryptography today
is because they're worried about it, not because
they need to know about it. Like if we could
do this transparently, like we talked about,
the problem solved, they're not going to talk
about it. When it talks about quantum computers,
The only people that are going to be looking
at quantum computers are the people writing quantum
algorithms. If you think about a quantum computer,
it's not a replacement for a classical computer.
You should think of it as an accelerator. And
just like very few people write CUDA kernels
for GPUs, very few people are going to be writing
quantum algorithms for quantum computers. And
most cases, and there's very few applications,
the kind of specialized ones I talked about,
like chemical simulation. new molecule discovery,
those kinds of applications are going to be the
only ones that care about quantum accelerators.
So the vast majority of people will continue
about their AI related business without even
thinking about quantum computing or quantum cryptography.
But where it is applied, it can have a huge impact.
Like we can come up with artificial fertilizer
and carbon capture molecules that They allow
us to reverse greenhouse gas effects in our atmosphere
and come up with new chemicals that have really
cool properties very efficiently. Wasn't there
something just recently we did with Pacific Northwest
Labs with like a lithium battery? Yeah, a new
type of battery. So one of the things that we
ask all of our guests is, you know, what is a...
day in the life look like for Mark Krasinovich?
That's, that's always sort of, you know, we ask
of all of our guests, but you know, in particular,
you know, everybody knows your, your sister internal
history and, you know, the deputy CISO role and
all the cool stuff that you do and share with
Scott. But like, what's, what's, what's a day
in the life look like for you? It depends on
the day. It's very like every day is a new adventure.
But I'd say if you'd said the average of all
my days, the average of all my days is. 80 %
meetings. And those meetings are divided into
meetings with my team to do checkpoints and reviews
on the work we're doing. Meetings that are broader,
architectural, typically meetings across Azure.
One -on -ones with key technical leaders across
Azure and other parts of the company. Outside
of the meetings, then, it's reading. Reading
papers, internal papers. It's reading external
papers. It's looking at what's going on with
technology. And it's also playing with AI and
spending a lot of time just in between meetings
and in evenings and weekends researching, doing
AI research and researching AI. So I want to
just pull on that thread just a little bit. I'm
a big fan of just constant learning. Constant
learning. You can't. You've got to do it, right?
You can't just ignore things. So what's your
little strategies for learning things? My father
actually gave me some advice when I was growing
up. He's like, when you want to learn a new subject,
go find the thinnest book you can on it. And
I was like, that's really sunk in over time of
I know what he's saying. It's basically like,
go read the most high level description of the
subject, because that'll give you an overview.
And then you can dive in from there. I'm a huge
fan of that. I actually have that concept, not
the thin book. That's a new one on me. Yeah.
But just the whole, get an idea of what the thing
is. Because obviously, sometimes you just don't
know what you don't know. Yeah. And so getting
an idea of what the thing is, now you've got
an idea of the things you probably should understand.
and then go a bit deeper from that point forward.
And in fact, if you follow your dad's wisdom,
if you think about it, I've heard many, many
years ago, someone say, if you are a technical
person, you can't explain something simply. Richard
Feynman. Was it Feynman? That's right, it was
Feynman who said that. A person said that. Okay,
Feynman said that. If you can't explain it simply,
then you probably don't really understand the
topic that well. Yeah, kind of coincidentally,
since we've been talking about quantum computing,
and he's the father of quantum computing. Yeah,
it is kind of, yes. That's why I asked the question,
Mark. You knew that. I mean, I love that, you
know, read the thinnest book thing because like
I used to like worry because I have a lot of
books, right? And people see the bookshelf behind
me oftentimes, the videos. And I sometimes only
make it to chapter like two or three. And I used
to feel guilty about that. Like, oh, I had to
learn everything technically. But if I can get
the gist of it and the idea of it in the first
couple of chapters, I don't necessarily need
to know. the 10 X level of detail. Yeah. Yeah.
And that you can decide if you want to, because
you need to, or because you're interested. So
for the other thing that I do is get hands on.
Like if you're, if you really want to understand
something, you need to actually in, in the world
of code, of course, it's like go code it or go
use the product. You want to go level deeper,
go right about it. So actually the windows internals
books that I worked on, that was one of my favorite
activities is one that has multiple benefits.
And writing about something both makes you, forces
you to learn and understand it to the point you
can explain it like we just talked about. Also
gets your name out there and helps other people
understand it. I remember when I was working
on designing and developing secure Azure solutions,
it was when the hardware security modules like
the original managed HSMs were coming on stream
in Azure. The team was kind enough to give me
access to one while I was writing the book. And
it was interesting because I found issues in
the SDK because I was, tinkering in certain areas
that you might not normally tinker in don't get
me wrong there weren't massive serious issues
but there are many documentation problems But
even so, you find issues while you're learning.
And also, the managed HSM support symmetric encryption,
not just asymmetric encryption. And that leads
to all sorts of different things you need to
think about. So yeah, I agree. Writing about
something really forces you to think about what
you're working on. And you learn a lot when you
start writing about it. That's why I urge people,
write blog posts. If you've got a topic of something,
write a blog post on it. People will read it.
You'll be surprised. Well, here's something I'm
wondering. The problem we're going to run into
now is it's so easy to have AI write your blog
post for you. If you rely on AI to do the writing,
you're not going to get that kind of, I need
to conceptualize this thing, understand it in
a way that I can express it. You short circuit
that. which I think is a risk to people really
learning. I'm always very careful because I have
the same effect when I build a PowerPoint slide.
I know people make fun of me for saying PowerPoint
slides are a serious thing, but when you're actually
trying to model the thing out and make something
make sense, you find gaps visually too. But I'm
always very careful about how I use AI because
I want to tap the power of it and the knowledge.
We're doing roles and responsibility for security,
so tell me what a CFO does for a living, and
then I'll tell you what they have to do for security
to integrate it into their business. job or a
COO or lawyers or whatever. And so it's great
for tapping into things I don't know, but I always
want to make sure that I'm doing some original
thinking of my own on it, that I don't want to
just take it as a final product and do a couple
tweaks and minor copy edit things. I want to
make sure I'm actually processing it. All right,
let's start to bring this episode to an end.
So another question we ask our guests, Mark,
is if you had just one final thought to leave
our listeners with, what would it be? Breathe.
Breathe? That would be the shortest final thought
ever. I can explain what I mean there. Like,
it's stressful times. Stressful times in technology,
stressful times in the world. And actually, one
of the things that I found, I kind of discovered,
was mindfulness, which is effectively learning
how to breathe and focus on breathing as a way
to relieve stress and kind of ground yourself.
I know it's not technical, but it helps in everything
you do, whether it's technical or not. So that's
what I'd leave people with. If you said one thing,
you didn't scope it, so that's the thing. No,
and it's not scoped on purpose, right? We just
want people to be really honest, and I'll be
frank, we've never had anything even close to
that. Everyone's given purely technical advice,
so I think it's good to have something that's
a bit more grounded. I think it's fantastic.
All right. So let's bring this episode to an
end. Again, Mark, thank you. I know you're a
really, really busy guy, so I really appreciate
you taking the time. And Mark does too. Thanks.
Fun conversation. Fun to talk to people like
yourself, you and Mark, that know that you're
living what I'm talking. And so we can have a
great conversation. You bet. Absolutely. That's
100 % true. 100 % true. All right. So again,
thank you so much for joining us. And to all
our listeners out there, we hope you found this
episode interesting. Stay safe and we'll see
you next time.