The future of security in a world of zero trust

This topic is a hot one – the future of security – and we cover a lot of ground with our guests including the growing risks, particularly now with more hybrid working, the core issue of trust or rather zero trust, the role of boards, and the need for greater collaboration between business and government. Guests: Bob Mansfield, Bruce McCabe and Pip Marlow.

See omnystudio.com/listener for privacy information.

Episode Transcript

Speaker 1 (00:03):
Welcome to Vocus Inspire, the podcast full of brilliant ideas
for business.
Hi, I'm Luke Coleman, head of government and corporate affairs
at Vocus, Australia's leading specialist fibre and network solutions provider.
Before we get things underway, we want to acknowledge and
pay our respects to the traditional custodians of the land

(00:24):
from wherever you're listening. In this podcast, we dive headfirst
into what's on the minds of Australian business and government
leaders to help inspire you and your organisation to go forward,
go further and go faster. So let's go.
Welcome to episode 2 of the Vocus Inspire podcast, where

(00:47):
we continue the conversation with global futurist, Doctor Bruce McCabe,
CEO of Salesforce, ANZ and ASEAN, Pip Marlow, and former
chairman of Vocus, Bob Mansfield. Today's topic's a hot one,
the future of security. And we cover a lot of
ground with our guests, including the growing risks, particularly now

(01:07):
with more hybrid working, the core issue of trust, or
rather zero trust.
The role of boards and the need for greater collaboration
between business and government. Let's start the conversation with Doctor
Bruce McCain. Doctor Bruce has a PhD in organisational and
technological innovation, and for 30 years has travelled and explored
how people innovate and adopt new technologies.

(01:30):
Doctor Bruce McCabe, it's great to have you with us again. Alright,
I'm going to ask you to take off the, uh,
the organisational psychologist hat for a moment and put on the,
the futurist hat. 10 years from now, 2030 or thereabouts,
and how much more connected are organisations going to be
in 2030? Give me the vision of the future.

(01:52):
Really, and it'll vary, of course. So let's talk about leaders.
Leaders will have, I guess that, how do we imagine this?
How much more connected. Every employee at every level has
rich interpersonal video, cloud-based communications to everything anywhere in the world.
I think the important thing is individuality, so we're all

(02:15):
choosing our own devices, we're all choosing our own.
Work mode, the way we like to work, and, uh,
the glue that holds that together are those cloud-based applications
like we're using now for this podcast.
Gosh, how do I think of a metaphor for this?
I'm probably running out of puff on it.

(02:35):
It's, it's, it's hard to reconceptualize sort of entirely new
technologies on the back of the ones we've already discussed.
I think the leaders are just going to be supercharging
all of those, and giving out all the tools and,
and imposing that social layer on top that says, hey,
here's what we don't have to do, so you don't
completely immerse your lives in the technology. But certainly on land,

(02:56):
sea and air, uh, and in the train, you should
be able to do everything that you can do in
the office.
Now, when the world rapidly shifted to working online, schooling online,
communicating online at the outbreak of COVID when everybody was
uh suddenly in lockdown and and and doing everything from home.

(03:17):
Uh, we saw an explosion in stories about, uh, the
security concerns that that come from that, whether it's something
as simple as people being scammed because they're connected more, um, or,
or calls being interrupted by um, by people who might
have malicious intent or might have just been doing it
to fool around and and cause trouble, so.
Um, Security is surely going to be key to the

(03:41):
progress of connectivity, and the more we become reliant on connectivity,
so I want to know how's the world changed when
it comes to the security of our connections, um, as
all of the information that we hold and exchange is
increasingly or almost entirely conducted online.

(04:01):
So the, the risk has grown exponentially, especially in, if
we look at quantitative terms, how many people are now in,
in a riskier environment.
Healthcare and other things are particularly volatile and, and, and
interesting here and important, and also the infrastructure. So as
we connect more devices that manage all the little things
going on in our cities, and our hospitals and so forth,

(04:22):
all of those are new layers of exposure. And there's
a technical,
pathway here that's really important and one of the most
fundamental challenges in computer science, but there are people working
on it. And that's this idea of zero trust computing
where we're really gonna have to rebuild, I believe, and
I think we will do this, every mobile device, architecture
from the bottom up, where we have basically trusted chips

(04:46):
that are authenticated and re-authenticated from the, the lowest level
upwards till you get to the operating system software, uh,
and then it's the applications.
So that we can be sure that each layer is trustworthy,
hasn't been tinkered with or changed in the same way
that we use checkbits to make sure communication hasn't been
tinkered with or so forth. But we have to do

(05:07):
it for the whole architecture of every phone we carry
and every device we deploy. So, I mean, we don't
have to do it, but I think we will do
it because the risks are, uh, uh, uh, are growing
and we'll, we'll be pressured to do it, and you'll
see that sort of shift in the world. So think
of every
Hub, router, everything's going to have to be authenticatable, uh,

(05:30):
from the, from the bottom up. Because, you know, let's
take a slightly more extreme example, which we can imagine.
When we look at the aerial taxis, this idea of, uh,
drone taxis, man-capable or person-capable drones flying point to point
routes in our cities from the airport to downtown, that
sort of thing. Um, they're a real technology, they work,
we've done the trials. All we're looking for is a

(05:52):
bit more airtime with the batteries.
There will be a class of traveller, and that will
happen within 10 years, which will get into autonomous vehicles
for shuttle runs between two points in our cities without
a pilot.
Now, it doesn't take much imagination to think of the
security risks and what you could do with that, with the,
you know, hacking a communication protocol into that device and

(06:15):
having a drone fly somewhere you don't want to fly
to and, and, and so forth. So, you know, you
look at that, that needs a layered approach now to
every part of the system. If there's no pilot, it
can't be truly autonomous, you know, you'll have some connectivity,
some checks and balances with
Uh, a controller somewhere. There's always a human in the
system with those systems. So like think of a, uh, someone, uh,

(06:39):
in a control room in the middle of Melbourne, watching
all of the taxis, making sure they're doing the right thing. Um,
the hardware itself is going to be self-authenticating. Um, the
passenger can't take over, we need layers and layers and
layers of, uh, uh, of bottom-up architecture that makes sure
that if something tampers with it.
It immediately goes into a self, uh preservation mode and

(07:00):
does the right thing and lands somewhere.
The idea of getting into an automated taxi is certainly scary,
but it can't be any scarier than getting into an
average taxi in Sydney today, I think. It's so I
don't know what's possibly worse there and what's, uh, riskier
for my own personal security. But, uh, so you, you've
spoken a bit now about the risks and the issues
that come, uh, from.

(07:20):
From security and our increasing use of communications, but surely
there's going to be opportunities that come from this as well.
So from your experience, what are the opportunities that are
being explored to help the world meet and address these
growing threats to data and network security?
Opportunities for the technology industry you're asking about, like, uh,

(07:45):
I think so, yeah, how, how is, how is technology
going to solve these problems that in a sense technology
itself is caused by, by bringing so much of our
data and information into the online environment. The biggest opportunities,
because they're completely green fields are going to be in
uh quantum, quantum computing particularly, and if we look at
security in post quantum encryption.

(08:05):
This, this is, this is massive. It's bigger than people
realise because ultimately, as we move into, uh, quantum computers
with enough qubits, and, uh, we get into this generation
of computers which, uh, can do, uh, uh, factoring, prime
number factoring and so forth, we can start to break
everyone's encryption today. Um, that means all of the communications
that all of us are doing and all of our organisations,

(08:27):
while they're not readable today, will become readable in the future.
No matter what technology we're using, so there's this grand
shift required in all communications technology to a layer of
of quantum encryption and, and,
That hasn't been sorted out yet. They, we know it'll work.
I mean, if you can do the decryption, you do
the encryption. We're quite sure we can build that world. Um,

(08:49):
all the people I talked to are quite confident. Oh,
don't worry about it. We'll, we'll have that layer. And, um, yes,
you know, the quantum decryption won't beat the quantum encryption,
and we, we'll, we'll have a new world where everything's
safe again.
But we have to make that transition, choose the protocols, um,
standardise the technologies, embed that stuff in hardware, um, and

(09:09):
there are huge opportunities in every layer of that, um,
to come. Um, interestingly, you know, all this work on
blockchain around the world, and we're looking at, um, cryptocurrencies
and all that, they're also potentially completely under threat from
that transition. So all of that has to be secured
as well.
I suppose in a way, the, the best security is

(09:31):
often what we don't see if it, it just works
beneath the surface and so a lot of people might
not really understand what's at the cutting edge of cybersecurity.
I'd love to know uh what's the most impressive idea
or concept that you've seen when it comes to future
possibilities in uh in security space.
Oh, Probably what I talked about a little earlier with

(09:52):
the architecting from the ground up, this idea of zero
trust chips. So you don't, you trust nothing. You absolutely
trust nothing and you have to re-architect from the, the
little boards and chips we have on our phones upwards.
It's impressive. It's also a large idea. It's gonna take
a lot to make that happen. But we've been talking
about that in computing.

(10:13):
For 20 years, you know, or maybe much longer. That's,
that's as long as I've been aware of it. This
sort of, uh, need to build that. That would be
the most impressive. At a single layer, wow, when we
look at what we're doing with face recognition and biometric recognition,
so this is sort of at the point, um, the, the,
the coalface if you like, type technologies. I, my mind's

(10:35):
blown by what we can do with, uh, multi-modal biometric security.
So this is the idea that if you turn up
to an airport.
Or you land somewhere like I've just done, and you, um,
get off the plane, you have a customs officer or
you have someone talking to you, but now you have
cameras and they're all through Europe, which are not just

(10:56):
watching you and recognising your face, but they're also tracking
thermally through IR or the flushes as you talk, the
dilation of your iris, um, your pulse rate, um, all
of which takes no more compute power than is on
the average Xbox, by the way. It's not difficult to
do from a computational point of view, from a software
point of view, we've gotten.
Uh, to, to mind-blowing levels, and also listening to the

(11:18):
stress patterns in your voice. So, when you combine them,
you get a very, very good over the shoulder helper
for the, the officer interviewing you of whether you are
lying or not about how long you intend to stay,
and whether you intend to work in the country, and
whether you intend to go home again, or whether you
have COVID. And so, essentially, it's like, uh, they don't
call it this, but it's lie detection technology.

(11:40):
Long time ago, that used to be, you know, uh,
a couple of things you strap around yourself and, uh,
and something looks at the, uh, electrical, or thermal conductivity
of the skin, and, and you'd sit in the police
station and it was completely unreliable anyway. Now it's getting
really reliable and it's thought provoking and it's also, it's, it's, uh, uh,

(12:01):
provocative in that sense, but it's also quite amazing what's possible.
Some years ago, the military piloted some early stage technologies in, uh,
Uh, in Iraq, and I spotted that. Uh, and that
made me really think hard about this technology. This is
the idea of interviewing people about what they knew about
a roadside bomb, for example, that had gone off, but
they were doing more than just, they were actually listening

(12:23):
to voice patterns as well as, um, using the software to,
to track the pulse rate and other things. But now
we can do so much without touching the person, just
having it on the airport counter watching, um, very provocative
security technology.
Now Bruce, we've covered a lot of territory today, so
I'm going to ask you a really broad question that

(12:44):
if you had one wish, uh for all businesses and
government leaders,
If they could put one thing in place, what would
it be and why?
That's really big. Let me, uh, well, the government one
is dead set easy. Um, and business might follow actually.

(13:07):
The the government one is dead set easy. Let me
try and articulate this. If, if I could get them
to change one thing, it would be to see.
Just how vast?
The opportunity is for them in sustainability.
And particularly in climate change, because that's, that's the thing

(13:27):
of the moment. So we, we, we always look at
this as a threat and all of our political class, uh, and, and,
and the layers beneath them, the politicised public service if
you like, look at climate change, there's enormous threat that
has to be dealt with.
But if they could just see that it's, it's, it's
actually the biggest, not only environmental, but the biggest social

(13:50):
opportunity probably ever presented to us as a species. And
the biggest economic opportunity in a positive sense, ever presented
to us as a species. Like, that's how big it is,
this transition. I can't think of a bigger technological and
economic transition and how much more money or where you
could make more money than as part of this transition.

(14:11):
And on the back of that,
Of course, it means the biggest political opportunity.
The absolutely biggest political win, it just has to be
framed correctly. It's more jobs. It's all opportunities, there's so
much money to be made in the transition, um, to
a more sustainable energy system on this planet. If I

(14:31):
could do anything, it would be to flick that switch
and just.
Take away that incredible naivety that we're seeing in that space, uh,
where they, uh, uh, are essentially fighting a rear guard
action to, to, uh, to, to, on what they think
is saving the near-term economy and it's not, but in
doing so, they're, they're, they're making sacrifices against the entire

(14:54):
future economy. Um, and, and they just don't see how
much political their opportunity is in framing it the right way.
We could spend hours listening to Bruce talk about the
future of security, but for a different perspective, we spoke
with Pip Marlow, the chief executive officer of Salesforce, ANZ
and ASEAN, about the importance of trust in a digital age.

(15:14):
Welcome Pip, and thank you for joining us again. You
mentioned a few times about the the role of digitization
and the acceleration of digitization that's been brought on, particularly
by COVID. Um, with this shift to a greater use
of connectivity and greater digitization, how has security grown in
importance when it comes to an organization's risk profile?

Speaker 2 (15:37):
Yeah, I think, I think it's incredibly important. I touched,
you touched on I mentioned our number one value at
Salesforce is trust. And I think in a digital age,
trust is more important than ever because people are trusting
the infrastructure, you that that the data goes in trusting
the data centres that things reside in, trusting you how to,

(15:58):
you know what you will or won't do with their data.
Trust the behaviours of the people in your organisation. Trust that,
you know, it's not, you know, somebody's not listening to
you and they shouldn't be. All of these things are
not just built into technology, they're behavioural, they're cultural, uh,
their values, and their technology, um, controls to ensure that
that that trust is there. And so I believe it

(16:20):
is elevated. I think the other thing that's happened over
the last few years is
The educational awareness, both at a consumer level and at
a business level around trust, around security has grown dramatically.
I always remember reading ages and ages ago, a funny
article about there was a cafe in the Bay Area.

(16:41):
And you know, when you, you go and use free
Wi Fi and you accept those terms and conditions, you know,
clause 13D was
You know, if you use this Wi Fi, you promised
to give us your first born. And they're like a 99.9% acceptance.
And I'm like, look, not my first, but maybe my second.
I have. But, um, but my point is, people were not,

(17:01):
you know, aware, you know, there's this sense of ownership, accountability,
the point of somebody making those terms and conditions, um, consumable, and,
you know, that people can understand.
In a simple way. So I think trust, transparency, it,
it's only going to increase, and the organisations that earn
that trust, because, you know, what's that saying? Trust comes

(17:23):
into town on a tortoise and leaves on a galloping horse.
So it's a long time to build trust, very quickly
to lose it. So organisations have to be really committed. It's,
it's a long game around, uh, you know, trust and
security for me.

Speaker 1 (17:38):
Great insights from Pip there. Trust is everything.
To finish off this conversation on the future of security,
we caught up with Bob Mansfield. He's one of the
most distinguished directors in Australia. His career spans over 40
years and includes CEO positions with McDonald's Australia, Optus and
John Fairfax. Let's see what Bob's thinking. Bob, one of

(17:58):
the other big trends that's come out of this increased connectivity,
particularly through COVID, is a hugely heightened focus on cybersecurity.
Uh, now you were one of the advisors on a,
a government cybersecurity, uh, report, uh, providing content into that report.

(18:18):
So I'd love to hear your view on it, how
has security grown in importance when it comes to an
organization's risk profile.
But it's grown significantly. And, uh, like I said, in
new developments, you've got a positive side on one page
and a negative on the other, and the cybersecurity risk
on the, on the, uh, problems it's creating has happened
because of the increased connectivity, the greater reliability on digitization.

(18:42):
So all the benefits that I've just spoken about, you're
saying the baddies can use them as well for the
wrong reasons. But cybersecurity is a big issue for every
board of every company. It's an issue that I think
will continue to be very, very important.
I also, uh, try to explain that, you know, from
a board perspective, this is my humble opinion, that it
doesn't mean it's right, wrong or indifferent, but I don't

(19:04):
think it means you've suddenly got to have 6 directors
on the board that are cybersecurity experts. You've got to
have a cybersecurity resource in the management that the board's
aware of and the board gets updated on a routine
basis and you make sure that you're staying on top
of policing the, uh, cybersecurity factor within an organisation. So
it's not a quick fix. It's there for, um,

(19:26):
Forever, really. And the one thing that struck me on
that committee that has now been taken over in the
sense there's an implementation group now put together chaired by
Andy Penn, who also chaired the, uh, the government committee
I served on. The one thing about that is that
It struck me as I was going through all the
input coming in for the task that we had to

(19:47):
advise the government, and I, I used to yell it
as loud as I could. You can't just say the
government can solve it.
Hm. It involves society, it involves businesses, and everybody has
to play their part. At times, we've all got to
come together to do it. All the aspects we've spoken
about in previous questions with regard to digitization and connectivity

(20:09):
and how good it's been, the same applies on the
other side of the page, and that is, if it's
used for the wrong reasons, it creates problems. And that's
what every business has to confront going forward.
Unfortunately, some of the baddies in inverted commas are, um,
some of the best experts out there as well when
you look at what's happening in, uh, some of the
overseas countries. So it's a, a permanent part of every

(20:30):
board from here on in. And it's one they've got
to make sure that their own company is well resourced
to be able to manage. It doesn't mean you've got
to have the boardroom suddenly full of, um,
People that are experts in cybersecurity, but you've got to
make sure that the reporting up to the board about
cybersecurity issues and the breadth of coverage on it is
acceptable to the board. That's an interesting point, Bob, because

(20:52):
there might have been a point in time where you
would have had the relevant security people with organisation that
were trusted to look after this stuff, but you're saying
that the board has a role to play here. So
what should boards, what role should boards have in managing
an organization's security profile?
Well, the starting point is to get some reporting statistics that, uh,

(21:14):
are benchmarks that they can reveal whether or not you've
got a problem. And, you know, it can be, um,
the pretty basic ones of, of, uh, people doing fishing
and all the rest of it that, uh, uh, a
pretty basic, uh, statistics that can open up the bigger
problems if they're not addressed. So I think it's, it's
having a framework of reporting from the resources you have

(21:36):
in the company through the management ranks.
That gets to the board really is a topic of discussion,
at least once a quarter in my view. And if
you do have a problem, it could be once a day,
it could be once a week.
And some of the cybersecurity attacks that have occurred, so
it's not one action that will plug the gap. It's,
it's an attitude and a a whole approach to it

(21:57):
which has visibility, accountability, and that extends to the board
as well. Now Bob, you were involved as part of
the federal government's 2020 cybersecurity strategy. You were involved in
the cybersecurity industry advisory panel. Can you tell us a
bit about your experience as a part of that panel
and the report that it produced?

(22:17):
Yeah, for sure. And it was an enjoyable, uh, period
of a few months, uh, working with, uh, experts from
different segments of the, the industry, not only telcos, but
defence industry and, uh, and, uh, other aspects. And, uh,
it was really to advise the government what direction they
should take. And that's now extended to, uh, an implementation
committee that Andy Penn is chairing for, uh, putting that

(22:38):
into action. And one of the stark realities that, that
hit me.
More clearly, I guess, as a result of the committee
was so much of the input or so much of
the discussion was government should do this, government should do that.
And no doubt the government has to have a big
role in this stuff. But at the same time, it
extends to businesses and extends to society overall as well.

(23:00):
You just can't, uh, sit back and say, I don't
need to do anything because the government's going to do everything. Well,
they're not. And, you know, uh, you, you think of the, the,
the Nigerian emails that say, send me your bank account
and someone loses $100,000 because I fell in love with somebody, um,
on a, on a website. That sort of stuff's got
to be, uh,
Part of the training system of society. It's when you

(23:22):
get into a car, you drive on the left-hand side
of the road. Even if you want to drive on
the right, you can't do it. And we've got to
get that seriousness to, um, these things that are tragic
in their own right, because they're so devastating to people. There's,
there's a lot that needs to be taken on the
res the shoulders of responsibility for society, for business, and
for government.
And, um, at times it makes sense for business and

(23:43):
government to work together to handle situations that they're so
sophisticated these days. Uh, that capability, I saw very clearly
from the, the deliberations of the committee, and I hope
as we move forward, that that will become a lot
more natural, uh, part of the overall, um, attention to
detail in this area.
Do you think that corporate Australia is doing enough when
it comes to securing their future and treating cybersecurity as

(24:06):
a serious issue?
Uh, I'd say they're doing a lot more than they've
ever done, but I wouldn't say they're doing enough in
the sense of sitting back and saying, yep, we're OK.
Because the moment you do that, you've got problems. So
it's a, a permanent responsibility to stay aware on these things.
We're doing a hell of a lot better than what
we used to do, but I think we've still got
a long way to go. And, um, as I say,

(24:27):
I don't think that'll lessen, um, in the years ahead.
Now Bob, I'm going to shift gears a bit away
from cybersecurity and uh going to ask you a question
that if, if you had the opportunity to put one
wish out to uh the leaders in business and in government, um,
to either avoid, uh, making a big mistake or so

(24:51):
that they could grasp on to an incredible opportunity, what
would your one wish be for business and government leaders
and why?
It's a good question. And, uh, as you get older
in life, you look back and reflect on it more seriously,
I think. If I had to summarise my biggest regret
in the 70 odd years I've been on this earth,

(25:13):
it's the fact that we find it so difficult.
To work together.
At times of war, it's amazing. You don't have labour
and Liberal. Times of war, you don't have people marching
in the streets until the end of the war when
they've had enough of it. But it's a time of
working together to handle the challenge that we face. And
I think that's politically, I think that's between business and
government instead of all the expectation being the government will

(25:35):
take care of it. So it's the ability to work
together and everyone's shouldered some responsibility for the roles they
need to play to, uh, handle the challenges that, that,
that they're faced with.
Uh, it's a very difficult thing to look back and
I cannot understand why political parties are so far apart.
Whereas if you locked them in a room and said,
we can't get out of here until we agree on
6 things that are going to impact the overall country

(25:58):
to the betterment of everybody, that might be the best
way to do it because there are 6 things that
would do it, but nobody can get agreement on it.
It's ridiculous.
And yet it's part of the mankind's way of, um,
of doing things. So I, I, I find that extremely frustrating.
I find it, it impacts that attitude impacts the family.
It impacts the society, and it impacts, uh, a country.

(26:20):
And leaders can do something about it, in my view,
instead of saying, you know, it's always part of the system,
we can't do anything about it. You can. I mean,
leadership is about doing what people need to have done,
not what necessarily people, uh, would do themselves.
Mhm.
Now Bob, I'm going to wrap up by slinging 6
rapid fire questions at you. Um, so just a, a

(26:43):
quick response to each one. First thing that comes to mind,
don't mull on it and don't feel like you've, you've
got to talk for a long period of time, but
we'll pepper the, uh, the podcast with the responses to
these questions. So, number one, what's your favourite piece of technology?
Probably the mobile phone these days.

(27:04):
How do you disconnect?
Uh, a range of blackout.
What's the most important thing you do for your wellbeing?
I try and keep in, in the right priority the
balance between work, family, and health.

(27:27):
What's one thing that would surprise people about you?
My kids would say how daggy I am, I guess, but, um,
probably how conservative I am really, um.
What's one personal trait most important to success?

(27:51):
recognising that none of us is as good as all
of us.
What's one thing there needs to be more of in
business today?
Uh, fun and enjoyment. I think a lot has gone
out of it, um, in today's, uh, um, uh, environment. Um,

(28:11):
but at the same time, recognising that the opportunities are there, um,
you've got to have the vision, the courage, and the motivation,
the drive to, uh, seek them out.
Well, if it makes you feel any better, Bob, I'm
having a hell of a lot of fun and I'm
enjoying myself, so I think we can call that a wrap,
thanks so much, Bob.
That was Bob Mansfield with some great insights on cybersecurity,

(28:35):
the increasing role of boards, and the need for greater
collaboration between business, government, and society as a whole with
respect to keeping us all secure. And that brings us
to a close on our conversation about the future of security.
Our special thanks to Doctor Bruce McCabe, Pip Marlowe and
Bob Mansfield for joining us again.
And thanks to you for listening. I hope you've enjoyed

(28:56):
the 2nd episode of Vocus Inspire, and we look forward
to bringing you more inspiration in coming episodes.
And don't forget, if you want more information, more episodes,
and more inspiration, head to Vocus.com.au/podcast. You can follow us
on LinkedIn and Twitter to stay up to date with
all things Vocus. We'll see you at the next episode.