Speaker 1: This is Dana Perkins, and you're listening to Switched on
Speaker 1: the BNF podcast.
Speaker 2: Now.
Speaker 1: I don't know about you, but it seems like all
Speaker 1: of my friends are talking about AI lately. And among
Speaker 1: the myriad of things to consider is cybersecurity. It's such
Speaker 1: a hot topic, in fact, that it was even featured
Speaker 1: in the most recent Mission Impossible film. But cybersecurity is
Speaker 1: not a new topic, as will come to find, as
Speaker 1: much of the world has an increasingly complex grid that
Speaker 1: has evolved to become even smarter and more digital and
Speaker 1: capable of optimizing energy use, which will prove helpful in
Speaker 1: the race to net zero. These very additions themselves have
Speaker 1: created new vulnerabilities which cyber attackers can exploit. So what
Speaker 1: sort of damage can be caused by a cyber attack
Speaker 1: on electric utility and can we protect them? And what
Speaker 1: exactly is an air gapps. It's a computer or network
Speaker 1: which is isolated from other networks for security reasons. Today,
Speaker 1: instead of me telling you any more about it, I'm
Speaker 1: joined by our Grids and Utilities team member Amanda al
Speaker 1: She's going to discuss some of the findings from her
Speaker 1: recent report called Guarding the Grid Utilities Fortify cyber defenses. Together,
Speaker 1: we discuss the different forms a cyber attack can take,
Speaker 1: the motivations behind these attacks, and the scale of damage
Speaker 1: that can be caused, as well as the costs involved
Speaker 1: in fixing them, and to ward off attacks. Can anything
Speaker 1: be done at the government level to beef up cybersecurity.
Speaker 1: We assess some of the policies countries have put in
Speaker 1: place to strengthen cybersecurity in both the public and private sectors,
Speaker 1: and the marketplace for companies offering grid security. And finally,
Speaker 1: what does the future of grid security look like? As
Speaker 1: we enter an era of AI and quantum computing with
Speaker 1: even greater computing capabilities, also comes some potential threats and
Speaker 1: are there measures that can be put in place to
Speaker 1: combat these even more complex attacks. To access Amanda's report,
Speaker 1: BADF subscribers can find it at BNF dot com, on
Speaker 1: benf Go, on the Bloomberg terminal, or on the BNF
Speaker 1: mobile app. If you like this podcast, make sure to
Speaker 1: subscribe and you'll receive an update when a future episode
Speaker 1: is published. And if you give us a review or
Speaker 1: a rating on Apple Podcasts or Spotify, it'll make us
Speaker 1: more discoverable by others. But right now, let's jump into
Speaker 1: our conversation with Amanda. Amanda, thank you very much for
Speaker 1: joining switched on today.
Speaker 2: Thanks for having me.
Speaker 1: So today we're going to talk about grid security. What's
Speaker 1: at stake here? What is the worst case scenario?
Speaker 2: So, I mean utilities are really integrating more and more
Speaker 2: digital technologies, meaning that they're investing in more technologies like
Speaker 2: sensors and creating digital models of the grid and investing
Speaker 2: in communication technologies. And as they do that, it means
Speaker 2: that first of all, the grid is getting the eyes,
Speaker 2: the brain, and the sense that it needs to act efficiently.
Speaker 2: By at the same time, integrating all these new technologies
Speaker 2: which have in at access means that it's increasing the
Speaker 2: potential cyber attack service of the power system. And with
Speaker 2: this new link with the Internet, it basically means that
Speaker 2: cyber thread actors could potentially access physical grid infrastructure, leading
Speaker 2: to damages, leading even to power outages.
Speaker 1: So we're most concerned about blackouts maybe citywide, statewide, Like
Speaker 1: what scale would the worst case scenario be? And I
Speaker 1: guess the follow on to that is really how connected
Speaker 1: is it? Is it all of the grids across the US,
Speaker 1: barring or cut that are all connected. You know how
Speaker 1: big could a problem be if there was a cyber
Speaker 1: attack they got in If we're specifically focused for this
Speaker 1: question on power outages.
Speaker 2: I mean, that's really hard to say, because what we
Speaker 2: know right now is that there is malware out there
Speaker 2: that could specifically target technologies on the grid, like substations
Speaker 2: or other kind of operational technologies. So I mean, hypothetically
Speaker 2: a cyber attack could maybe take out and an ore
Speaker 2: utilities network. Hypothetically, I'm just saying, but I mean, of course,
Speaker 2: utilities are investing in new cybersecurity technologies to make sure
Speaker 2: that doesn't happen. But potentially the more and moral malware
Speaker 2: coming out that can target power systems means that this
Speaker 2: could lead to outages across utilities.
Speaker 1: So outages and then you also reference the damage to equipment.
Speaker 1: So is that one way of targeting or using malware
Speaker 1: is to actually cause maybe a piece of equipment to
Speaker 1: malfunction and to actually cause very expensive damage to critical infrastructure.
Speaker 2: Yeah, exactly. So there's one example. There's a kind of
Speaker 2: malware called crash override, also known as in destroyer. I
Speaker 2: love these names that're kind of funny, but what they
Speaker 2: do is really not funny. For example, crash override was
Speaker 2: used actually used in an attack on Ukraine's grid in
Speaker 2: twenty sixteen. And this malware basically took and codified, meaning
Speaker 2: put into code knowledge of how control systems work, so
Speaker 2: the control system for substations, how they work, and then
Speaker 2: use this to shut down the substation in Kiev. And
Speaker 2: this was one substation. But the scary thing is that
Speaker 2: cybersecurity professionals here thing that this could have been a
Speaker 2: proof of concept since not all of this malwar's functions
Speaker 2: were used. So if this is not on a larger scale,
Speaker 2: it can really damage the grid and of course impact
Speaker 2: people that depend on electricity.
Speaker 1: So let's talk a little bit about the olden days
Speaker 1: when the grid was not connected and things were much simpler.
Speaker 1: Technology hasn't just spreaded immediately. Over time, systems have gotten
Speaker 1: more sophisticated, and there used to be security measures built
Speaker 1: into the way that it was designed. Can you talk
Speaker 1: a little bit about how the grid used to be
Speaker 1: designed and really what precipitated such a dramatic change to
Speaker 1: make everything interconnected.
Speaker 2: I mean, originally the text structure of the grid or
Speaker 2: the digital tech structure of the grid was based on
Speaker 2: two main elements so it's informational technology and operational technology
Speaker 2: or IT and OT, so for IT think things like
Speaker 2: file management, emails, internet, and for OT. These are the
Speaker 2: technologies that monitor and physically control power equipment on the grid,
Speaker 2: like substations. And originally these were kept separate because you know,
Speaker 2: if OT, like a substation or circuit breakers on the
Speaker 2: grid were compromised, then it could result in power outages.
Speaker 2: So keeping IT and OT separate was the OG, like
Speaker 2: the original kind of cybersecurity mechanism for the power system
Speaker 2: to ensure a hack in it would not impact the
Speaker 2: physical grid. But I mean now we're seeing utilities are
Speaker 2: digitalizing at a rapid pace. And what I mean by
Speaker 2: digitalizing is that, as mentioned earlier, the grid is integrated
Speaker 2: news technologies like sensors and analytics software to access and
Speaker 2: analyze data from the power system to help run this
Speaker 2: physical infrastructure more efficiently. So this is great, you know
Speaker 2: if you think about efficiency, But this also means we're
Speaker 2: integrating IT and OT. So with this new link between
Speaker 2: information technology and operational technology, if a cyber thread actor
Speaker 2: hacks into an IT system, you know a simple thing
Speaker 2: like a phishing email, it might be able to move
Speaker 2: laterally and access ot networks and really cause damage to
Speaker 2: the grid like we've been seeing.
Speaker 1: So we talked a little bit about the olden days
Speaker 1: of the grid when things weren't as interconnected, and there
Speaker 1: is some brilliance in that simplicity in that.
Speaker 2: Is there a.
Speaker 1: Move to in some way make these grids a little
Speaker 1: bit isolated from one another to actually minimize the risk.
Speaker 1: I know that there's a lot to gain in terms
Speaker 1: of efficiency and reducing waste when we have a much
Speaker 1: more connected grid. And we're all familiar with these terms
Speaker 1: connected grids, smart grid, and actually even the rise of
Speaker 1: new business models like virtual power plants. But is there
Speaker 1: a space for grids to not be connected with one
Speaker 1: another and to have a series of non connected units
Speaker 1: that you know, the connectivity essentially ends somewhere, And is
Speaker 1: there thought being given to how connected is to connected?
Speaker 2: That's a good question. I think that it would be
Speaker 2: very difficult not to have connected grids because we need
Speaker 2: both ram above and distribution grids and transmission grids and
Speaker 2: interconnection among these grids to support a broader sustainable energy transition.
Speaker 2: So I think what we need to do is understand
Speaker 2: that the power grid is getting more and more access
Speaker 2: to distributed energy resources such as evs such as roofs
Speaker 2: of solar and batteries that are connected to the distribution grid,
Speaker 2: which are connected to the transmission grid, which are communicating
Speaker 2: more and more with one another to help balance the
Speaker 2: overall power system. And as more of these decentralized energy
Speaker 2: resources come online, the cybersecurity of power systems also needs
Speaker 2: to reflect or mirror increasingly decentralized nature of the power
Speaker 2: system as well. Because it's happening, We're seeing a lot
Speaker 2: more virtual power plan projects. We're seeing a lot of
Speaker 2: more distribe engry resources come online. So of course some
Speaker 2: grids might like for example, microgrids, they can be islanded
Speaker 2: when need be. But what we're seeing is that a
Speaker 2: broader focus on coordinating the broader power system.
Speaker 1: Now, cyber attacks are something that are probably not new
Speaker 1: to any of us. We all think about phishing emails
Speaker 1: when we think about our own inbox. And what I
Speaker 1: want to know is how much of the focus I
Speaker 1: guess on these cyber criminals is on the energy system.
Speaker 1: And is this a big thing for us to be
Speaker 1: worried about.
Speaker 2: I mean, short answer, yes, Unfortunately, that's exactly what we're
Speaker 2: seeing is that cyber attacks on utilities are on the rise,
Speaker 2: and the frequency of cyber attacks on utilities are reaching
Speaker 2: even new very high levels. And this is because as
Speaker 2: we digitalize the power system and connecting more and more
Speaker 2: connected resources. Connecting mean that they're connected to the internet,
Speaker 2: it means that the cyber attacks surface of the power
Speaker 2: system is growing and because of that, we're seeing more
Speaker 2: cyber attacks. So the frequency of cyber attacks on utilities
Speaker 2: we saw reach very high levels during the pandemic and
Speaker 2: part driven by more remote work and cyber attacks have
Speaker 2: also been increasing since the war in Ukraine, potentially because
Speaker 2: this is allowing threat actors to showcase their cyber war
Speaker 2: for techniques. So it's clear that this geopolitical and social
Speaker 2: issues and upheaval usually leads to an increase in cyber attacks,
Speaker 2: and this seems to indicate that the energy sector really
Speaker 2: is becoming more and more of a target. For example,
Speaker 2: according to the data from IBM, the energy sector for
Speaker 2: about eleven percent of the total global number of cyber
Speaker 2: attacks IBM tracked in twenty twenty two, which is higher
Speaker 2: than the sector's pre pandemic levels of about six percent,
Speaker 2: and North America in particular has been the most targeted
Speaker 2: region for attacks, according to this data on energy firms
Speaker 2: over the past two years.
Speaker 1: What happens after a cyber attack? Do the consequences include
Speaker 1: needing to as you referenced, know if something gets broken,
Speaker 1: repairing kit or is this a conversation around actually being
Speaker 1: held round because that happens sometimes as well, where they
Speaker 1: won't release your system until you've paid a certain amount
Speaker 1: to the cyber criminal. What happens and how do these
Speaker 1: companies respond to these attacks when something does go wrong?
Speaker 2: Yeah, I mean a cyber attack can make many things
Speaker 2: go wrong, from money being lost due to just downtime
Speaker 2: of the power system, to having to pay off ransomware,
Speaker 2: to potentially having to pay fines because the cyber attack
Speaker 2: was caused by some kind of non compliance with regulation,
Speaker 2: or you know, fixing or repairing damage equipment. We've seen
Speaker 2: that Also, IBM estimates the global average cost of a
Speaker 2: data breach, which means just accessing illegitimate access of confidential data.
Speaker 2: They're saying the global average cost of a data reach,
Speaker 2: specifically for the energy sector, has reached nearly five million dollars,
Speaker 2: and this is because actually identifying and dealing with those
Speaker 2: reaches is getting costlier and taking longer because honestly, these
Speaker 2: cyber thread actors are getting more and more sophisticated in
Speaker 2: their techniques. At the same time, there's more technologies and
Speaker 2: services coming out specifically to respond to these attacks, so
Speaker 2: incident response technologies that includes both services like some companies
Speaker 2: like Drego's offer services like playbooks, which are basically lists
Speaker 2: of action items for specific cyber attacks that a company
Speaker 2: can do, and Dregos is specifically focused again on operational
Speaker 2: technologies such as in the grid. So other than services,
Speaker 2: there's also startups and companies coming out with new technology
Speaker 2: to support and even automate incident response. So, for example,
Speaker 2: there's a technology or group of technologies called SORE like
Speaker 2: Fly in all caps, which means Security Orchestration, Automation and Response,
Speaker 2: which uses basically AI algorithms to help both detect and
Speaker 2: automate some of the response to actual cyber incidents.
Speaker 1: So there are new companies that are seeing this vulnerability
Speaker 1: and fire a way to really help utilities figure this out.
Speaker 1: But surely it's not all coming from startups looking to
Speaker 1: strategically fix these problems. I would assume that the utilities
Speaker 1: themselves are invading in various ways to protect themselves. What
Speaker 1: is happening with the utilities and what other I guess
Speaker 1: domestically grown technologies or responses are they then turning to
Speaker 1: in order to secure their grid.
Speaker 2: What we've been seeing really is that utilities are spending
Speaker 2: more on cybersecurity and developing their own cybersecurity strategies, especially
Speaker 2: the larger utilities. So basically that involves one developing business practices.
Speaker 2: So that's things like growing security teams, having cybersecurity expertise
Speaker 2: on board levels, and also running annual incident response practices,
Speaker 2: kind of running hypothetical cyber attacks that might happen on
Speaker 2: the utility and have the security teams actually practice what
Speaker 2: they would do in that situation. That's the business evolutions side.
Speaker 2: There's also a lot of new investments coming out of
Speaker 2: utilities on cybersecurity. You know, what we're seeing is that
Speaker 2: spending is on the rise on cyber For example, in
Speaker 2: the US, we've seen that utility is a spending more
Speaker 2: in terms of capital expenditure on cybersecurity, specifically operational technology security.
Speaker 2: So for example, Southern California Edison or see their capex
Speaker 2: on cybersecurity, Rose about two thirds from sixty million USD
Speaker 2: in twenty twenty to nearly one hundred and ten million
Speaker 2: in twenty twenty one. And that was kind of driven
Speaker 2: by their grid modernization program to make sure that their
Speaker 2: grid technologies really are cybersecurity. And you know, we're BNS,
Speaker 2: so we had to quench the numbers. And we found
Speaker 2: that in the US, be calculated that the annual cybersecurity
Speaker 2: capex for utilities is likely already one billion US dollars,
Speaker 2: with the average share of capex allocation usually around one percent.
Speaker 2: And I mean, of course this might be higher or
Speaker 2: lower by utility, but this real isn't a small number,
Speaker 2: and it is likely to grow, we think as well.
Speaker 2: One regulations get more strict and two when, if, and
Speaker 2: when cyber attacks grow so.
Speaker 1: Much like you can't drive a car without insurance in
Speaker 1: many parts of the world, is there an obligation illegal
Speaker 1: obligation in some countries for cybersecurity to be in place
Speaker 1: because nobody wants blackouts, least of which the company is
Speaker 1: operating the grid and also the power providers. But are
Speaker 1: governments getting involved?
Speaker 2: The US really is leading the way in terms of
Speaker 2: regulation and standards for cybersecurity specifically in the power sector.
Speaker 2: And I think that's potentially because cybersecurity has been seen
Speaker 2: as a matter of national security for a while now.
Speaker 2: And for example, in two thousand and eight, the North
Speaker 2: American Electric Reliability Corporation NERK came out with mandatory standards
Speaker 2: for critical infrastructure protection called NIRKSIP. Sorry a lot of
Speaker 2: acronyms there, for both physical security and cybersecurity of the
Speaker 2: bulk electric system. And bulk electric system here refers basically
Speaker 2: to the transmission grid, so violations of these standards can
Speaker 2: result in fines of up to one million dollars per
Speaker 2: day per violation. But while the US has been kind
Speaker 2: of leading the charge in cybersecurity regulation and policy, I
Speaker 2: think also Europe is catching up. Originally, the European Union
Speaker 2: couldn't really impose strong regulations for power system cybersecurity because
Speaker 2: issues like cybersecurity are really related to national security, and
Speaker 2: I think countries don't really appreciate when you meddle into
Speaker 2: matters of national security, so it was difficult to do that. However,
Speaker 2: as cybersecurity is becoming more of an issue, and also
Speaker 2: I mean, we have a bunch of grid interconnections among
Speaker 2: European countries, which means a cyber attack in one country
Speaker 2: might affect another country. The EU is stepping up their
Speaker 2: cybersecurity directives as well, and the biggest thing there right
Speaker 2: now we're seeing is the Network and Information Security Directive
Speaker 2: or NIS number two, which is an update of that directive,
Speaker 2: which basically calls for essential entities which includes grids, to
Speaker 2: ramp up their cybersecurity measures. And there's a lot of
Speaker 2: fines there too, and it has to requires member states
Speaker 2: to basically set a maximum fine of at least ten
Speaker 2: million euros, which is about ten point six million dollars
Speaker 2: or two percent of their global annual revenue, whichever is
Speaker 2: higher if they fail to comply. So I think the
Speaker 2: European Union is also ramping up regulation here.
Speaker 1: Now you're only as strong as your weakest link. Is
Speaker 1: there a specific part of the network that is most vulnerable?
Speaker 1: And how do most of these problems actually get in?
Speaker 1: Is it malware connected to an email or is it
Speaker 1: something else? Is it our smart refrigerators or the electric
Speaker 1: vehicles connected to the grid directly, where are the biggest vulnerabilities?
Speaker 2: I mean, based on what I've seen, most cyber attacks
Speaker 2: on utilities are still the regular ones, So phishing or
Speaker 2: through public facing applications or through websites and stuff like that.
Speaker 2: But as we get more and more distributed enjury resources
Speaker 2: connect to the grid, like electric vehicles, smart meters, even
Speaker 2: air conditioning units are becoming smart nowadays and can give
Speaker 2: and take electricity from the paragrid, it means that we're
Speaker 2: getting more and more end points connecting to the paragrid
Speaker 2: which are also connected to the Internet. And this means
Speaker 2: that honestly, utilities networks are becoming far more complex than
Speaker 2: they used to be and have far more endpoints than
Speaker 2: they used to be, which means that having regular firewalls.
Speaker 2: I think when we think about cybersecurity, right we think
Speaker 2: about traditional firewalls, which are basically like putting a giant
Speaker 2: fence around your corporate network. That's really not enough anymore
Speaker 2: as we have more and more of these endpoints flooding
Speaker 2: utilities network, So that's really calling for new sets of
Speaker 2: cybersecurity technologies down to the actual endpoints, specific security measures
Speaker 2: for these distributed energy resources and within the network.
Speaker 1: So if I had to break this down in its
Speaker 1: simplest sense, it is a system that is connected to
Speaker 1: the electrical grid and in some way is trying to
Speaker 1: decide whether or not it pulls electricity or it stops
Speaker 1: pulling electricity based on what it's getting in terms of
Speaker 1: data from that grid, regarding perhaps peak demand at that time,
Speaker 1: in power prices or whatever that input is. What I'm
Speaker 1: wondering is with these firewalls that exist, those that are
Speaker 1: trying to break into the network, is it that the
Speaker 1: network inherently has vulnerabilities and they find those? And this
Speaker 1: raises the question of AI and an increasingly smart computer
Speaker 1: system that can go through a number of permutations very
Speaker 1: quickly and find those vulnerabilities versus when human being and
Speaker 1: mistakes do happen, responds to as you mentioned, phishing and
Speaker 1: essentially allows that vulnerability to happen because they made a mistake.
Speaker 1: I would expect that both of these exist, and you
Speaker 1: said the vast majority are coming from fishing right now.
Speaker 1: My question there lies, do we think that first scenario
Speaker 1: that I went through the w and where AI and
Speaker 1: locating those vulnerabilities without being aided by someone like myself
Speaker 1: clicking on the wrong thing, is that something that we
Speaker 1: additionally need to think about in the future.
Speaker 2: Phishing is one that we know of for now, but
Speaker 2: I think as we have more resources connecting to the grid,
Speaker 2: we have more entry points for cyber attackers. So, for example,
Speaker 2: if we think about electric vehicles, even though a utility
Speaker 2: has its own set of cybersecurity measures, it needs to
Speaker 2: interface with an increasing amount of additional second and third
Speaker 2: party players. Right, so, every think about EV's they connect
Speaker 2: to the grid, and for example, a startup called si
Speaker 2: Flow is focused specifically on EV cybersecurity, and based on
Speaker 2: data that they're sharing, they show that the communications protocol
Speaker 2: used for EV charging management systems can be compromised by
Speaker 2: cyber thread actors, and by doing that, the thread actor
Speaker 2: could for example, turn EV chargers on and off, or
Speaker 2: even steal and as more evs come online as v
Speaker 2: an EFC's will happen in our new energy outlook and
Speaker 2: electric vehicle outlooks, if we do depend more and more
Speaker 2: on electric vehicles and systems like vehicle to grid where
Speaker 2: the power system calls on EV's to help support the grid,
Speaker 2: this could really cause damage as well. So basically what
Speaker 2: I'm trying to say is as more endpoints come online
Speaker 2: and the grid depends more and more on distribute energy
Speaker 2: resources which are also connected, that's a huge issue on
Speaker 2: the endpoint security level, which is kind of lacking right now.
Speaker 1: So when I think about hacking, I think about non
Speaker 1: state actors, but we also know that some of these
Speaker 1: are either first of all state sponsored or secondly, is
Speaker 1: there a fear that essentially this could be weaponized.
Speaker 2: Yeah, I mean what's a bit scary is that cyber
Speaker 2: thread actors are getting better and better at specifically developing
Speaker 2: malware and attack techniques targeting operational technologies like substations on
Speaker 2: the power grid, Meaning they're figuring out how to launch
Speaker 2: cyber attacks that are tailor made for the power grid,
Speaker 2: and this can definitely be used in cyberwarfare. So a
Speaker 2: very famous example of an attack on an industrial control
Speaker 2: system was stucksnet, which basically targeted a nuclear power plant
Speaker 2: in Iran by taking advantage of a software vulnerability to
Speaker 2: access controllers in that plant, and basically the attackers use
Speaker 2: this vulnerability to compromise the control system and make the
Speaker 2: centrifuges spin too fast, causing damage to the plant. So
Speaker 2: this and some other examples we've seen around the world
Speaker 2: are kind of showing us that cyber warfare is an
Speaker 2: increasingly normal thing, specifically targeting the power system.
Speaker 1: Another data point that came up also from IBM is
Speaker 1: that the cost per data breach is averaging around four
Speaker 1: point seven eight million US dollars each time. So this
Speaker 1: is expensive. It's expensive for the breech and invariably now
Speaker 1: it's costing more money to try and prevent them and
Speaker 1: cut it off at the past. So this is a
Speaker 1: burgeoning industry of companies that are looking to service this.
Speaker 1: But what is the next thing for you now that
Speaker 1: you've spent time researching this, What is the next thing
Speaker 1: that you're going to look at and look into that
Speaker 1: hasn't been covered in this research note in the vein
Speaker 1: of trying to better understand cybersecurity.
Speaker 2: That's a good question. I think what I've been seeing
Speaker 2: in general in cybersecurity tech innovation is that the security
Speaker 2: focus is coming closer and closer to the end resource
Speaker 2: or the endpoint. So it's going from being this massive
Speaker 2: firewall around the network to end point security, which basically
Speaker 2: gives endpoints like ev smart meter substations their own set
Speaker 2: of security measures. And this endpoint or resource focused security
Speaker 2: also brings us the access control, So we've been seeing
Speaker 2: a lot of innovation and access control, which traditionally is
Speaker 2: things like encryption or firewalls or multi factor authentication. And
Speaker 2: what interesting innovations here are zero trust models and quantum
Speaker 2: resistant encryption. So in a zero trust model, access is
Speaker 2: basically provided to resources like a substation, for example, or
Speaker 2: a smart meter on a per asset and per request basis,
Speaker 2: as opposed to kind of you know, allowing access to
Speaker 2: all assets in a network once an actor is within
Speaker 2: a firewall. So for example, ge and other tech vendors
Speaker 2: are beginning to integrate zero trust architecture as a layer
Speaker 2: in their grid software portfolios. And then on top of that,
Speaker 2: another interesting innovation is think about a future when quantum
Speaker 2: computing becomes a reality. Encryption like today's encryption can be
Speaker 2: easily decrypted with an actual functioning quantum computer. So encryption
Speaker 2: today needs to get up to speed, so new kinds
Speaker 2: of cryptography or post quantum cryptography can help. For example, IBM,
Speaker 2: Google and university partners co developed a kind of lattice
Speaker 2: day digital signature in which encryption security relies on the
Speaker 2: difficulty of finding short vectors and lattices. So basically what
Speaker 2: that means is it's a very very difficult mathematical problem
Speaker 2: about finding specific vectors in a three dimensional space. So
Speaker 2: definitely we've been seeing some cool innovations in access control
Speaker 2: and any kind of tech that's bringing the security closerts.
Speaker 1: At the end, resource, I love that the form of
Speaker 1: protection you brought up is called zero trust architecture.
Speaker 2: It makes exactly it really, don't trust anyone.
Speaker 1: Don't trust anyone I might click on that phishing email. Amanda.
Speaker 1: Thank you so much for walking us through not only
Speaker 1: what's happening with cybersecurity, but also this different set of vocabulary,
Speaker 1: so these different systems that are being used in different acronyms,
Speaker 1: and also my personal favorite from the show, zero trust architecture.
Speaker 2: Thanks for having me.
Speaker 1: Bloomberg NEF is a service provided by Bloomberg Finance LP
Speaker 1: in its affiliates. This recording does not constitute, nor should
Speaker 1: it be construed as investment advice, investment recommendations, or a
Speaker 1: recommendation as to an investment or other strategy. Bloomberg NEF
Speaker 1: should not be considered as information sufficient upon which to
Speaker 1: base an investment decision. Neither Bloomberg Finance LP nor any
Speaker 1: of its affiliates makes any representation or warranty as to
Speaker 1: the accuracy or completeness of the information contained in this recording,
Speaker 1: and any liability as a result of this recording is
Speaker 1: expressly disclaimed.