Welcome to the Azure Security Podcast, where
we discuss topics relating to security, privacy,
reliability, and compliance on the Microsoft
Cloud Platform. Hey, everybody. Welcome to episode
129. This week, it's myself, Michael, with Sarah.
And our guest this week, probably has no introduction,
but it's John Saville, here to talk about what's
kind of top of mind for John. But before we get
to our guest, let's take a little lap around
the news. Sarah, why don't you kick things off?
Well, I... I'm going to do the really obvious
news, well, for the time we're recording for
me, which is last week it was Microsoft Build.
You may have seen this person's face in the keynote.
If you didn't, obviously you should go and watch
that. But in all seriousness, I was showing MDash,
which we're hoping to have an episode on soon,
actually, if I can grab one of them. They're
just very busy at the moment. MDash is our code
scanning. harness it's very cool it's currently
in a private preview when we're recording this
but you can sign up and request access keep an
eye out it will go public preview in GA hopefully
in the not too distant future. There were also
some other sessions at Build around managing
your agent estate with Agent 365, which obviously
has a security aspect. So all the sessions are
now up on YouTube. So if you were not there,
if you weren't lucky enough to go to Build, you
should go check those out because they're all
online now. That's it for me this time, Michael.
And make sure everyone spots the little Easter
eggs about your dogs, right? Ah, yes. Yes. Okay.
So if you watch my demo, the M -Dash demo, see
if you can see the Easter eggs for my dogs and
my shadow demoer's daughter. There are some Easter
eggs for her too, because that's what we do.
Well, some benign Easter eggs in the corner.
I always add Easter eggs to things like that,
always. Just little subtle things. Oh, you have
to. Yeah, you have to. You have to. As long as
it doesn't, it's only in the corner. And there
were a few people who found them unprompted.
They were like, Team Grayson. And I was like,
yeah, of course. Like, Team Grayson. And they
were like, Sarah, you put your dogs in your demo.
I was like, of course I did. Like, what kind
of a question? Of course I did. If I can, I will.
All right. So as to my news, first of all, I
have a new book coming out. It will be available
about the first or second week of July this year.
It is called Threat Driven Software Development.
I've talked a little bit about this in the past
on the podcast, or at least hinted at it. It's
quite different to other books that I've written.
It still focuses on software engineering and
software security and so on, but it pulls in
information at Microsoft around the Secure Future
Initiative, as well as... Microsoft Security
Development Lifecycle, or the SDL. However, every
chapter looks at whatever the topic is through
the lens of threat intel. So one of the co -authors
we've had on this podcast before is Sherrod DeGrippo.
And she wrote some flavor text at the start of
every chapter called the Threat Intel Perspective.
Then after that, the three of us, myself and
Sean Hernan and Lee Holmes, would then go and
write the actual technical content. Sherrod also
has a chapter on Threat Intel, like modern Threat
Intel, right at the very beginning, again, to
really set the tone of the book. The other two
news items that I have, both of them are to do
with post -quantum cryptography. The first one
is that Azure SQL Database now supports transparent
data encryption, AES wrapping keys using managed
HSM, as you're probably well aware. In a post
-quantum world, RSA and elliptic curve become
essentially destroyed. And we now have to look
for alternate methods. And the symmetric way
of doing that is to use AES key wrapping. So
that's available. There's also an asymmetric
way of doing it, MLChem, but that's not available
just yet. So yeah, AES key wrapping is available
in managed HSM. The other one, which is really
cool, this came out at Build, is that we've now
got a version of S -channel in Windows, Windows
11. that supports MLChem on TLS 1 .3. So MLChem,
if you listen to our last podcast that I did
with Jack Richens, was on MLChem. Well, all sorts
of post -quantum stuff, but MLChem was the big
one, which is the key encapsulation mechanism
that is now available in Windows 11. You have
to enable it, though. So you have to call set
TLS ECC curve and then the actual hybrid. group,
and that will then turn it back on. So I'm going
to write a blog post on this in the next few
weeks. But yeah, it's great to see that it's
available now in Windows 11, and eventually will
be in Windows Server as well. So a couple of
post -quantum announcements there. There's a
lot of headway being made by Microsoft, and it's
good to see these things coming out. All right,
let's turn our attention to our guest. As I mentioned
at the top, our guest this week needs absolutely
zero introduction, but it is John Saville. John,
welcome to the podcast. We'd like to take a moment
and introduce yourself to our listeners. Thank
you. Firstly, thrilled to be on the show. And
it's nice to talk to you both. A bit intimidating
talking to both of you. But I've been a Microsoft
fan, I guess, since I was 18. Like I've been
doing this stuff for over 30 years now. It was
a hobby and I was lucky enough that my hobby
turned into a job. But my current role is I'm
the CTO for America's Markets and Industries.
But I think if anyone does know me, they know
me because of the YouTube channel. I've been
sort of focused on that for maybe like seven
or eight years now. And just, it's my way of
learning and my way of trying to help other people
like give back. And so it's just a lot of fun
creating content to help people understand something.
Because I think if you understand something,
you're not scared of it anymore. And if you're
not scared of it, you'll go and use it and take
advantage of it. So that's just something I enjoy
doing. I think it's more than that, though. I
mean, the number of... people who have asked
a question and my response is always, well, just
go and watch one of John's videos. It's 15 minutes,
20 minutes, and I'll answer the questions. I
love the format of your videos in front of the
electronic whiteboard, diagramming things out.
And there's something that really irks me, not
about you, there's something that really irks
me about people who do technical presentations,
and that is they assume the people watching you
know a whole bunch of stuff. And you go at it
as an angle of assuming that people don't know
what you're about to talk about. And look, don't
get me wrong. People who know this stuff, can
John just like, just get, just get to the concept
of the point, you know, but the other 97 % are
like, thank you for explaining that stuff to
me. Right. Because you've got to build upon baseline
knowledge. Right. So I love your videos. I think
they're awesome. And the benefit I have is I'm
not that smart. And so it works out really well
for me. So I have to try and how did I understand
it? And then I try and like replay the steps
and the layers of knowledge I had to do to get
there. So it's very natural for me to do it that
way. So, John, I've had an actual conversation
where someone said to do this, you would need
John Saville level knowledge. So you've actually
become like a rating of knowledge. Now, what
they were saying, though, it was a very low level
of knowledge. You're interpreting it the wrong
way. It was just a John Saville level of knowledge
to get this one. So I want to ask you an honest
question of you. Honest question. How much do
you learn? preparing for the videos because whenever
i write write anything whether it's a blog post
whether it's a book i learn a lot researching
to be able to put it into into some form that
can be understood by more people so do you learn
a lot while you're doing the videos oh i do no
i mean so i mean what i said is very true like
part of the content is yes i create stuff because
i want to help people like to me it's my way
of giving back a little bit it's why i don't
monetize the channel but I learned a phenomenal
amount because if you want to explain something
to someone and if you want to be able to explain
it in a way they can digest, you have to really
understand it. You have to go to a level of understanding
way beyond what you're actually teaching so you
can try and frame it the right way so someone
can take the concept and do something useful
with it. So no, I do not know most of what I
cover at the start. I have to go and learn it
and play with it and break the thing. And then,
yeah, I learned a massive amount doing the videos.
Do you find bugs along the way? I always find
bugs. I have found bugs along the way. It's funny,
especially funny enough with some of the Entra
stuff. A lot of, I do stuff early on with the
Entra things. And then other times I've found
sites like, this is not working right. It's like,
oh yeah, don't mention that. And then they'll
go and we'll work on that. It'll be fixed by
the time you release. Okay. All right. So let's
get stuck into the actual content. Now we're
talking about your YouTube channel, which by
the way, we will put a link in the show notes.
If no one's ever heard of it. Yeah, right. So
the topic of this episode is John Saville's top
of mind. So let's just start with, I want to
tell everyone, by the way, we really don't have
an agenda. We're just going to talk about stuff.
So let's see how this goes. So let's just go,
let's start off with, you know, what's top of
mind? Like what are customers talking to you
about? What sort of, you know, is really... sort
of bugging you right now? What's, you know, what,
what things are changing that are of real interest
to you? You know, so what's really, what really
is number one top of mind right now? Yeah. I
mean, what's interesting about when, so my role
changed beginning of the year and I have a lot
more customer conversations now with like the
leadership and what's concerning to them. And
obviously as you would expect, AI is kind of
on every conversation we ever do. But what is
really interesting, it's not just AI, it's about
trusting. what AI is doing. And so we've moved
into this new shift in thinking that in the past
with software, hey, we had test harnesses, we
had test scripts, input A, do we get output B?
We're good. Like it doesn't work with AI because
suddenly it's this creative thing. And this non
-deterministic nature is massively concerning
to every customer because there's the element
of security and AI introduces a whole new set
of security concerns. Like, yes, all the other
stuff we always think about still applies, but
now you have the prompt injections and the jailbreaking
and the hallucinations and the reasoning faults
and all these other things. But they're super
concerned about trusting what the thing is actually
outputting. And that is something that we're
constantly trying to help the customers understand
in terms of how do you trust what this creative
intelligence is generating, but also making sure
it's staying within what you need it to stay
within in terms of security policies and other
guardrails. So that is the number one thing that's
keeping customers up right now is how do we control
this AI thing? And that is great for me to be
on this show is like, I know what I think about.
And I know we talk about evaluations and we talk
about governance and we talk about permissions.
But like, what do you see? I mean, that's kind
of interesting to me is like, how do you answer
that question with customers? Like, hey, how
do you trust the agents? I don't. And that's
why you have to have things like least privilege.
And that's why you have to have a whole bunch
of other guardrails in place, assuming that the
AI is going to go all wonky. I don't. I mean,
I think if you look at some of the very earliest
incarnations of OpenCore, you know, people were
just running it without regard for any security
boundaries, any guardrails whatsoever. And, you
know, it got a bad name for itself, right? Because
it could do anything. Well, if it's running as
you with no other guardrails in place, then sure,
then it matured, you know, and then we saw changes
and so on and so forth. I don't trust it. I don't
trust it at all. I don't mean that in a really
cynical way. Perhaps I'm just too old to trust
input of any kind. It's just an input problem,
again. It's actually harder than that, right?
Because in the old days, with SQL injection,
for example, we know how to mitigate that with
parameterized queries. But with prompt injection,
it's not as easy as that. There is no single
solution to validate the input. Don't get me
wrong, we have a whole bunch of guardrails that
can take the input and check. you know, if it
thinks it's good or bad, but even then you don't
really know using AI to, to, to check AI. And
so that's why I just run absolutely everything,
you know, least privilege and a whole bunch of
other guardrails read only where possible as
opposed to read, right. Which is just least privilege.
You know, that's where things like low, you know,
identities come into play as well. Well, I think
that's, I mean, that's the super interesting
thing. I think initially with the AI people just
like, Oh, great, it's intelligent, you do all
these things, you give it all this access. And
I think they forgot about a lot of kind of the
zero trust and the defense in depth. And I think
a lot of companies are coming back to that now,
which is why suddenly companies care, to your
word, the identity. It isn't just, hey, it should
always just run with my permissions. And if we
think about autonomous agents and AI teammates
as we go in the future, the identity is also
saying that, everyone is talking about and what
is the right way of doing it and how you secure
it. And that's one of the things I enjoy talking
about. So identity has always been a passion
of mine. Like I loved the, I was an AD guy and
then what was the Azure ID and the Entra ID.
But I like the agent ID and the agent user ID
stuff because to me, it's supernatural. Like
if you think of humans, And we're used to the
idea of we're given the mentor identities and
we have conditional access and we have the risk
detections. And we've built up a pretty strong
set of capabilities and we understand it. Like
companies understand it. So I don't understand
why you'd want to do something different for
agents, which fundamentally are going to be doing
a very similar thing to humans. And so why recreate
a wheel? To me, it makes a lot more sense that
you've got something you trust in already. You've
got skills around. You just have to tweak it
a little bit. Like Sarah, if Sarah works 24 -7,
I'll be suspicious. If Sarah downloads 500 documents
in a minute, I'll be suspicious. But hey, we
just tweak the behavior of what we expect a little
bit. And I think we can take the same solution.
Obviously, I'm a Microsoft person. I've always
been a Microsoft fan, but I genuinely like the
approach of just extending what we're doing with
Entra to agents, extending what we do with Purview
to agents. To me, it makes a lot of sense for
the organization. I think one of the things that
is very obvious to me having conversations with
folks, though, is that obviously with Purview
and Entra, we've had all this stuff. a lot of
these controls in the non -agentic, non -AI field
for a while, but people haven't always done them
super well because they're difficult and they
take a while. And so now what I find is one of
the biggest things, which I think is a good thing,
is that a lot of folks are... particularly with
data security, because I feel like data security
was always something people were just like, ah,
we'll get back to that. We'll get back to that.
Like, you know, we're going to label it later.
It's too big a job. Now people are realizing
that they can't really, well, they can do AI
without doing it, but it increases the risk because
AI is really good at finding data that you shouldn't
have access to and haven't protected way more
than human manually. And suddenly people are
like putting more focus on stuff that's been
kicked. The can's been kicked down the road for
years, which I think is a good thing. I know
it adds more stuff on people's plates to do,
but I think long -term will be a good thing.
I don't know. What do you think, John? You've
talked to way more customers than me. So it sounds
like you're saying security through obscurity
is not a good corporate strategy. I don't know.
It sounds like that's not the answer. No, it
might not be. No, I mean, you're right. It comes
up every time because with AI, we've kind of
accepted now, I think, the fact that... the quality
of the data drives the quality of the outcome.
Like we used to have garbage in, garbage out.
With AI, it's the garbage in, colorful different
shapes of garbage, but it's garbage all the same.
And so suddenly every company, to your point,
is putting a semantic index over their corporate
sort of data structures. So suddenly I can find
everything. And so those over permission sites,
those, all those things suddenly get found out.
But also, if they want a really good AI application,
it has to be able to talk to all of the data.
And so suddenly they're putting these data virtualization
layers in their company that they either shortcut
or mirror, but everything is suddenly available,
which is great for the AI to work. But it's actually
an opportunity for the company to suddenly get
a handle on the data because for once, there's
now an endpoint. that the data governance can
talk to. So suddenly I can find the stuff, I
can classify the stuff and I can protect it.
Whereas in the past, it was just all siloed.
So I think to your point, AI has introduced a
new problem and surfaced. It's not a new problem.
It's surfaced a problem that's been there for
a really long time. But fortunately, the technologies
we have to put in place to make AI work like
that data virtualization layer is also the way
we can kind of solve it. because suddenly the
data governance can see all the data and actually
start to protect it. So yes, it's a whole new
set of problems, but it's a problem that had
to be solved anyway. So I don't know. I think
it's a good thing in the end that it'll actually
get fixed and then it fixes it for the humans
as well. I have a take on the obscurity thing.
I don't mind security through obscurity as long
as it's not your only defense. That's, you know,
slowing an attacker down is fine. But yes, it
can't just be your only defense. That's my take
on it. Well, I guess we found it was the only
solution for some companies because it was just
as soon as it found it, it's like, hey, I can
read everything. Absolutely, absolutely. Not
the best day. So John, what is next on your hit
list of things that are top of mind for customers?
I don't know if it's always top of mind for customers,
but it's something that always comes up as something
they should be doing. And it's that fundamental,
like we talked about least privilege. And one
of the huge challenges I think people still struggle
with is just that authentication and strong authentication.
And I think Passkeys, like I'm a big fan of the
Passkeys. I just did a video on now we have Passkey
registration campaigns that we've kind of got
in Entry ID. And I would love to see like a greater
adoption of Passkeys because I think for the
average user, It adds so much protection for
them. Like, to me, the two biggest things is,
yes, they're technically easy to use. And yes,
it's a strong auth. But the proximity element
of it to stop people getting tricked to go and
authenticate some bad actors. Like, hey, I'm
the help desk. Just going to check this. Give
me your code. And then the fact that it will
only work against the legitimate domain that
it was given for. So I can't be tricked to do
something slightly similar. To me, I really think
there needs to be a great push on getting these
passkeys adopted. And I know we've sort of recently
added support for the synced passkeys now within
the ecosystem. So, hey, I can put it in my iCloud
keychain or the Google password manager. And
I know that terrifies some sort of corporate
identity, sort of people that the key is now
not in a place. That key is now... floating.
And one of the things we talk about is, well,
with conditional access instead of applying,
I could still lock down the use to be a sort
of a healthy device, the managed device. I don't
know what you see. So like from a passkey perspective,
again, I'm trying to learn from you guys on this
call. Like, how do you position the confidence
in a synced passkey where device bound is lovely?
I know it only lives in this one place if it's
synced. how do you have that conversation around
well yes it exists in multiple places but hey
we can still trust it because of x well i'll
say that i think the conversations i've had with
past keys which are probably not as extensive
as you two is that i feel like it's a bit deja
vu because do you remember when we first started
doing mfa and you would get pushback from People
being like, it's too hard. I don't want to do
it. And it's holding up our workflow. And for
particular, and then that sort of went away over
time. But you'd still have certain groups of
kind of users who would still kind of hold out
about wanting to use MFA. And I feel like we've
almost got past that now. But I'm seeing it kind
of start again with passkeys almost. Because
passkeys are a little bit, sometimes they're
fiddly to set up. I find. And for someone like
me, I'm going to like, because I'm stubborn and
I'm like, no, I will make this work because that's
me. But for a lot of user bases, they're just
like, no, this is too hard. And so I think we've
got like that adoption challenge again that we
saw with MFA, at least for certain types of user
groups. And I'm sure we'll get through it with
time. I'm not sure I have like a magical answer.
I feel like it's just same as we did with MFA.
It's going to take a bit of time and education.
And of course, listening to what the gotchas
are. I mean, I can tell you that on my phone
for ages, I made a passkey on my Gmail. And it
wouldn't work. And it kept saying I would try
and log in and it would be like, no, no, no.
And I was like, I know how to make a passkey.
How dare you? And it turns out that there was
something after I did some research. And when
I say research, I asked AI, obviously. The iPhone
defaults to using different stores. And because
the passkey was somewhere else. But it doesn't
explicitly say that anywhere. It just says, oh,
your passkey isn't working. And I remember being
really grouchy because I was like. I think I
can do a passkey or I hope I can make a passkey
that works. And it took me a little while, but
I'm the kind of person who will go and dig into
it and understand. And there's a lot of user
bases. And if we think we want everybody to use
passkeys, which we do, I'm like a tiny proportion
of a user base that would go and try and troubleshoot
it myself because I'm a stubborn so -and -so.
And so I guess. Yeah, that would be my thing,
I think, about capacity is there's going to be
a bit of like adoption friction again. So it's
going to take a little while. But I don't know,
Michael, what do you think? Yeah, I think the
number one question I get is how is it different
from MFA? And I just keep it really simple with
people and just say it's essentially. And John,
you correct me here if I'm wrong, but I'd sort
of simplify things a little bit. It's like essentially
fishing resistant MFA. It's still MFA. It's just
something that's. stronger than mfa to your point
it can be tied to a domain and uh and it's phishing
resistant is that a fair comment or am i yeah
no i i think we can call it that when we talk
about like authentication strengths in entra
we have phishing resistant mfa and we have pass
keys in there because to your point it it's supposed
to be able to protect the user from being tricked
they can't authenticate some remote person and
they can't click on a fake domain because it
won't let it so i i I think it's a great thing
that anything that adds protection to the user,
because in the movies we see the hacking and
the hacking is always, hey, they're dropping
a payload into something or other and it's exploiting.
Really, most of the hacking is they're phoning
up Bob and it's like, hey, I'm from the IT. I'm
just checking. You've been hacked. Do this. And
if we can stop the users being able to be tricked,
that closes probably a massive portion of the
attack surface that's real. I don't think there's
that many people really dropping these worm payloads
to go and hack into X, Y, and Z. It's Bob is
really the problem. Bob in IT. Yeah, it's funny
you should bring that up. Like my two recommendations
to sort of normal human beings outside of IT
are one, use passkeys for your normal, like at
least for anything that you care, like really,
really care about. like, you know, your bank
or anything like that. Just set up passkeys for
everything. And the second one is use your cell
phone and Apple Pay or, you know, Google Pay
or whatever when you're buying gas as opposed
to using a credit card, as opposed to swiping
a credit card, you know, from a skimming perspective.
You know what's really funny on that? So my parents
came to stay recently, and they are fairly technically
illiterate for people in their age bracket. But
they will not, I discovered, particularly my
dad, I discovered when they came to stay with
me, my dad will not use Apple Pay. And I was
like, why? He's like, oh, I don't think it's
secure. And I was like, Dad, it's fine. In fact,
it's probably better. And he was like, oh, no,
no, no, no. And I was like, oh. So I was trying
to educate him. I was like, honestly, dad. Also,
then you don't have to carry cards around and
they can't be skimmed and blah, blah, blah. And
I was explaining it to him. He wasn't having
it. And I would say that luckily my parents do
not listen to this podcast. I would not call
my parents Luddites as far as tech goes in general.
And I was really surprised. So Apple Pay all
the way or whatever. Electronic wallet. Everything
is scary. If you don't understand it, it's scary
and it can be compromised. It's just, hey, if
you can get people to understand. Twice I've
had my credit card stolen from gas stations,
like doing that skimming thing when I was younger.
I've had my card details used, but it hasn't
been at petrol stations, by the way. Gas stations.
In my adopted country, it's a gas station now.
That's right. But I've definitely had my card
details stolen. Someone bought flights in Japan,
budget flights in Japan on my card once. I have
no idea how they got my number, but there's so
many ways, right? I will not buy gas from a gas
station that doesn't allow me to use my phone.
I just, it's just not worth the risk. I mean,
the fact that you've got something that can read
a credit card outside, unprotected, accessible
to the bad guys so easily. I just don't. If I
have to, if I absolutely can't, like, again,
I'm on E for enough. I will choose the gas pump
that is closest to the shop or whatever is associated
with the gas station in the hope that they haven't
put a skimming device. I always check. I don't
know about you guys. I always wiggle and see
if anything moves. Wow, Michael. And you know
what? I just remembered as well. Obviously, for
people who might remember, I did live in the
US for a year. I forgot. So for those of you
who have not been to my side of the world, and
actually quite a lot of places in Europe, there
is a difference about buying petrol, gas, whatever
you want to call it, is that we don't... always
have card machines outside at the pump you go
in to pay and you pay after you have put the
petrol in which I know shocks many Americans
because in theory you could drive off except
we don't because we're good people well most
people are so we don't have that same problem
in Australia because you have to go in to pay
like there are no card machines at the pump the
things you cover in this podcast And I've learned
E for enough. That's a new one on me as well.
That's the, that's the eternally optimistic side
of me. All right. I think we've done pass keys
to death. Everyone use pass keys. Yeah. But we
didn't ask, no, you know, John, we didn't answer
the question about what, you know, what, what
feedback have we heard about potentially having
roaming pass keys between devices? Personally,
I've not heard anybody complain about them. A
lot of people, certainly outside of IT, the normal
question I get is, what the heck is a passkey?
So I haven't got past that door yet. But from
a corporate perspective, I mean, if people don't
want it, then my guess is it's policy. You can
turn it on or turn it off. It's just a policy.
Yeah, there you go. It's easy to turn it off.
I think some people have got scared of it, but
not a valid. Some people, you do want to know
exactly where the PASC is at all times, but for
a lot of people, you don't need that level. And
again, conditioner access still applies. It's
still done at the actual authorization to use
it for a thing. So yeah, I don't think it's as
big a problem as people make out. Yeah. All right.
So what's number three top of mind for John Saville?
From a nerdy perspective, and I think it's becoming
a very real perspective, I think the quantum
thing, and obviously because this is security.
Oh, here we go. I'm ducking out here because
this is Michael's baby. I did not pay John to
say that. Do you know, I spent a whole, but I
did a video on what is quantum computing. And
you talk about learning stuff. Like, I had no
clue. It was a good video, man. And that video
must have been some of the... hardest research
because i'm not that smart i'm not that good
at math and everything you look at quantum math
comes into it at a certain point but i think
it it's fascinating and you look at the behaviors
it's like well that's impossible how can if you
measure it it collapses like how does it know
i looked at the thing like how can it transmit
state over infinite distance it like but i think
from a entanglement perspective and what we just
announced the build so you talked about the build
stuff so the myrana 2 and qubits kind of the
quantum version of the thing we were getting
milliseconds of durability for the things suddenly
we're at 20 seconds now a thousand fold increase
to me and that that's massive and we're now saying
hey 2029 scalable quantum computer. So if we
think about quantum is fantastic from a, hey,
there are things you cannot model with a classical
computer because of the way the combinations
and the dependencies between them. Suddenly I
can model like real world and solve medical things
and find new materials. But it also suddenly,
the thing you mentioned at the start about, okay,
the new capabilities we're adding, our old sort
of asymmetric encryption, that relies on some
math things are really hard to solve, like longer
than, I think it's like history of the universe
thing. Suddenly there are these algorithms in
quantum that nudge you to the right answer, I
think in minutes. And so if in three years, potentially,
we now have this way to break what most of our
communication kind of relies on, I think the
post -quantum cryptography stuff, and even today,
stopping people just, storing the data they can't
decrypt, but then harvest it later, it becomes
a really real thing. And I can't remember the
name of the technology. I know it's based on
lightsabers and warp cores. Like there's two
things that we kind of do that I forgot the exact
terms for it. Well, I remember I did the video
and I was holding a lightsaber because I know
it's sort of the crystal that would get the lightsabers
to work, the code name. But I think... Oh, crystals
Kyber? Yes, Kyber. Yeah, that's it. And then
the warp core stuff. But like, I think... it's
not being taken seriously by enough companies
today that this really is around the corner.
I think people said, no, is this 50 years away
or it's a hundred years away. And it's really
not like there were things that I think everyone
should be thinking about today. It's like, does
that traffic have to be on a public network today?
Or can I keep this within a private network?
So someone can't harvest the thing. And what
work am I doing for my services to start looking
at the post -quantum cryptography stuff? Like
I, I think it's a really real, that people are
going to leave till the last minute and then
be like, oops. And I know that's Michael. So
I was excited. So I was like, oh, okay. I know
Michael's into this stuff. And it's like. And
I know we're doing a lot of work on it as Microsoft.
I'm curious, what are your thoughts on that?
So you talk about the Majorana 2 chip. What's
fascinating about that is not just the fact that
it exists, but like I was going to say, the quantum
increase, but I figured that would be a dad's
joke, dad joke. But the huge increase, like you're
saying, durability of the qubits is, and that's
in a short amount of time. So give it another
four or five years, right? I mean, we're going
to make even more leaps and bounds. I'm going
to throw something at you two right now, and
I hope you're sitting down because this, which
I know you are, but this is going to, when i
say this you're going to be blown away and obvious
at the same time quantum computers actually model
the real world our current computers do not like
at the end of the day when you go all the way
down to the minutiae of the quantum world we're
just modeling the quantum world that's all we're
doing and because we're doing it natively it's
incredibly efficient um but also the fact that
you have to your point you know we have these
qubit things where they can all hold all the
values at the same time with a probability and
then the and then you observe them and then it
collapses and then you have a higher probability
of one of the qubits being a specific set of
or some some of the qubits having a specific
set of values and you run that multiple times
and it's all it's basically just an averaging
out of the probabilities of the results that
you get. But it's just modeling the real world.
That's all it really is. But to your point, you
know, yes, RSA, elliptic curve, Diffie -Hellman,
all these, the asymmetric algorithms essentially
get, you know, become incredibly weak. because
quantum computers are very good at sort of algorithms.
So, for example, factoring large numbers, which
is the root of RSA, or the mathematical problem
that's hard in RSA is very easy with quantum
computers. And they've got discrete logarithms
with elliptic curve and so on. Those functions,
those sort of algorithms are very easy to model
in quantum computing and they're very efficient.
With AES, which is symmetric, there is a speedup
called Grover's algorithm. But it's still basically
brute force. It's not an algorithm. It's just
brute force of checking keys. But there is a
speed up from Grover's algorithm that came out
in the mid -90s. So yeah, it's a fascinating
area. And to your point, John, you're seeing
a lot of customers sort of... what seems to be
like waiting to the last minute. Think Y2K. How
many people waited to the last minute for Y2K?
Virtually nobody. And do we have any real problems
once 2000 rolled over? No, because people had
done the work. You can't wait until the last
minute. And I really want to point something
else out. And that is from my perspective, from
the customer calls that I get, the customers
that really care. really care like they really
want to know what our plans are what we're doing
what the industry's doing and we're sort of looking
at their plans as well for rolling things out
they know that no one can do all of this overnight
it does take time because it's very very layered
you got to get all the the substrate done and
then you got to build on top of that substrate
and you know for example you got to get the low
-level crypto in place. That's all in place in
Windows and Linux now. In Windows, there's a
thing called SimCrypt. Then on top of that, you've
got things like TLS, TLS 1 .3 with MLChem for
doing the key encapsulation. Then on top of that,
you've got the applications that are now going
to take advantage of all of these things. And
to your point, John, if you can do something
where you don't have to go over a public network,
even better, right? Because that way it's not
being exposed for Harvest Now, Decrypt Later.
I could keep going, but I won't. No, I mean,
and it's interesting to hear your thought on
it because to your point, like I've maybe had
two customers actually ask seriously about it
this year and it should be a lot higher because
I think there really is a, I don't know, a denial
going on about that it is coming and it's real.
I feel like it's because I haven't had a ton
of chats about it with people. I feel like it's
one of those, oh yeah, but it's a bit like. You
know, back in the day, I feel like, again, we've
mostly moved past this when people would say,
oh, but why would someone hack me? You know,
why would someone hack me? I'm so small. I'm
just this. And the answer is because they can
and you're on the Internet. So you expose yourself.
And we also know now that threat actors will
actually purposely go for like smaller businesses
because they know their protections tend to be
less and it's less effort. But I feel like it's
a bit of that mindset that, oh, yeah. We'll be
fine. It still ages off. And even if it does
become a thing, who would hack us? It's like
almost like conscious naivety, like sort of.
I don't know how else to call it, like sort of
being like mindfully kind of like, it's not us,
we'll be fine. And I think it comes back to that
thing. I think a lot of people don't really understand
it. And it seems like there's movies out, the
quantum, like it seems like pure science fiction.
It's like, this is not real. Like this is not
going to happen. And so it's just like, I'm not
going to think about it. It won't impact me if
I don't think about it. But it's just not the
case. Like we really think we're a few years
away from this knocking on the door. And I think.
It's critical people really start to look at
their services, their apps, their capabilities
and plan. To your point, Michael, we have it
now in our library. You can start to use and
look at these things now and start planning for
it. Go and discover where you're doing encryption
and start thinking about how you're going to
address it. Yeah, that's the first thing is you've
got to know where you're doing crypto. Right.
I mean, you've got to know where it is everywhere.
And that's the first thing. I've actually been
working on a few things. So the problem is some
of it you can do statically and some of it you
need to do dynamically. So there's no one single
way of determining where you're using crypto.
One of the things that's really hard inside of
Azure is we're very dynamic. It's an incredibly
dynamic backend. And so we've done our crypto
inventory work at the backend, but it's incredible.
It changes every day. But yeah, to your point,
you've got to know where you're doing crypto.
And if you're doing any kind of key wrapping
or key exchange with asymmetric algorithms, that's
the big issue right now. And that's why TLS 1
.3 has to be used everywhere because once everybody
has the post -quantum algorithms, they can essentially
just turn them on. And as I mentioned at the
top of the podcast, We now have a version of
Windows 11 that has S Channel, which does the
TLS support, and it has the post -quantum. It's
in preview, but you can start kicking the tires
on it right now. Very important. Yeah. Don't
wait. Let's sort of wrap up this episode, bring
it to a close. Otherwise, we will be here forever.
We'll have to get you back on for John's Thought
version 2 in like six months or a year to see
what's changed with customers. John, we always
ask our guests a couple of questions, which is,
what does a day in the life of John Salvo look
like? It is highly consistent and highly boring.
So every day I get up at 3 .30, I work out from
4 to 7, then 7 till sort of 4 or 5 work, then
family time, go out in the woods and try and
get a bit of nature in, and then... Go to bed.
And the workday is customer meetings. Sometimes
I'm traveling for customer things, meeting with
product groups. I am lucky. My job is for the
most part my hobby as well. So I'm always learning.
Like to me, staying curious, like I'm still as
curious as I've ever been. I'm still trying to
learn stuff and find out what this thing is and
what this thing can do. And I still love to be
challenged and find new things. For most days,
it's a good, happy, positive day. That's pretty
cool. And I can confirm, by the way, because
I have been on work trips with John, that he
does indeed work out for three hours. And I've
also talked to you at times in my afternoon where
most people would be asleep. So I can confirm
that John really does get up that early to work
out. It is true. And then the last question is,
so the last thing that we ask our guest, John,
is, For our listeners, if you wanted to leave
them with a final thought, what would it be?
Honestly, I think in this day and age more than
ever, it's just keep an open mind and be curious.
I think today it's the most important thing.
Don't be afraid of something and so then close
your mind and say, I'm not going to look at that
thing, know what I'm doing today is the right
thing. You're quickly going to... become irrelevant
so i think if you keep an open mind and look
at everything that's out there some of it's not
going to be anything useful but if you take a
look try the thing out i think that's how you
stay ahead and that's how you stay relevant and
informed so just be curious and keep an open
mind i think that's that's the key to success
in this day and age yeah i really couldn't have
said it better i mean just stay curious i think
it's just So important, really important to just
little silly things that just interest you. And
I think it makes you a more well -rounded person.
John, thank you so much for joining us this week.
I always learn something from my guests and this
was absolutely no exception. So it was an absolute
pleasure having you on the podcast. Thank you
for having me. It was a lot of fun. And as Sarah
said, hopefully we can have you back in six or
12 months. Version 2. And to all our listeners,
we hope you found this episode of use and of
interest. Stay safe, and we'll see you next time.
Thanks for listening to the Azure Security Podcast.
You can find show notes and other resources at
our website, azsecuritypodcast .net. If you have
any questions, please find us on Twitter at AzureSecPod.
Background music is from ccmixter .com and licensed
under the Creative Commons license.