Assurance Unknown with Kai-Fan Chang and Pascal van Gimst

Kai-Fan: Hello, long time no see. Well maybe it's not so long for you because I just bring out a show every month. So it's the end of the month, but I haven't been doing anything related to the show since I think the beginning of this month. So after the previous show I attended the IEEC in Rome. triple C is the International Common Criteria Conference and of course it's such a big event with a lot of people that we know and love hopefully respect at least together to talk about common criteria and its applications and of course there are a lot of things about AI and also C R A how CC is is going to fit in there, the relationship between C C R A and U C C all those kind of things. It becomes quite complex situation but I I think with the group of people I see there I saw there it will it will go well. Only maybe the speed is not that fast to adapt to the the AI speeds. But but we are progressing. And there of course like promised I also recorded a show with Jose from JTSec. JTSec is a lab under A plus and they bring out a report about the CC certifications every year. So in our conversation we also talk about the CC certification, the trends and noteworthy certifications that we see from this year Of course I'll edit the show and publish the next month. So from the beginning of October till now, it's already almost a month and because I haven't done much for the show, I feel like I haven't seen you guys for a long time. But now we're back and I'm still scheduling new conversations, new interviews. If you have any idea on the new shows, just let me know. this episode my guest is Pascal van Gimst. So you already heard his name during the conversation between me and Alan and of course I asked him about the question if he did say that he will leave the industry if Key Site Riskier will become a C C lab. you'll hear his reaction. in the show and my history with Pascal started when I joined PriceSight in two thousand six and he was my first manager in in Bryceight. Of course he left PriceSight to rescue her after a year or so but I think we were both developing and grew in this industry quite well. You'll hear a lot about his stories and his career, his career move and choices he made, both personally and professionally on on the different markets. So I think it's a very interesting talk because there are not so many people who started doing commercial stuff and developing new markets from that long ago. So I'm one of them and especially on the Asia part, but he was also responsible for rescue going into the digital rights management industry and later for many other things. So hope you like this conversation and maybe you'll notice this time I I didn't use any text in front of my eyes, so you will not see my eyes just skinning through the text. I thought it was really unnatural and and also i I if I say something wrong or hesitate I'll just repeat and edit the wrong parts out. So I thought I don't have to use the text. to make sure that I go through it once and and everything works directly. So hope you like this format and I want to have more personal connections with all the people. by the way I I was in the IEEC and I saw that there's also an podcast called ICT compliance podcast which talks about more recent topics about I C T compliance and and my podcast is more about the history and people I know and and the people who shape this industry. So I think they are all complimentary and I'll also be listening to that podcast to learn some new things. Hope you enjoy it again. The music is done by Shuchi and the logo is done by Narashima. I thank you all and hope you enjoy the show. If you like it, please like and subscribe and leave your comments down below. Thank you.

speaker-0: Hello everyone, welcome to this episode of Assurance Unknown Podcast. And today we have a guest, Pascal van Grimst. I'll let him introduce himself a bit. But when I joined Bright Side, Pascal was the manager of mine. and then he just gets sick and tired of me and left Bright Side. Ask him about that. And so welcome, Pascal. Do

speaker-1: Thank you.

speaker-0: you want to introduce yourself a bit?

speaker-1: Yeah, a bit. As you say, I'm Pascal van Gimst. I joined the industry in 1993. So that's 33 years ago, time flies. I have a background in electrical engineering and I came in by coincidence. I can talk about that later. And I've been in that industry ever since. till recently. else to say.

speaker-0: We can we can share about what you're doing or going to do, at the end. Maybe people in the industry they want to find someone to have a conversation with. I think they can come to you and have a talk. So let's start is T and O your first job after graduation or there was some

speaker-1: I think I had a two-month summer job after graduation. But during my bachelor's at electrical engineering, I did an internship at a startup which was called Katina. I think it was Katina Microelectronics. It was a startup of five people and one intern. That was me. and they didn't have enough space so I was sitting in the kitchen, literally. After my internship I kept working there for a day a week during my education and then at the end of, yeah, when I graduated we had a chat about me working there but it was not really the good fit for me but the founder and managing director of Catena, Anne Snortholt He advised me to call TNO. I didn't know much about TNO. So I just dialed the office. I got the reception and I said, can I talk to HR? They said, do you have an appointment? I said, no. Can you put me through? So with a little resistance, he put me through to HR and I explained who I was. what I was looking for and then he said yeah there is a department here who may have a vacancy I said okay can you put me through to the manager of that department

speaker-0: Just for the young people to know, at that time internet did not exist.

speaker-1: They did. This is pre-interview. This is you had a phone and that's it. So he said, well, it's very unusual. I said, well, you can put me through to the manager, right? It's not a problem. So he did. So at that time I had a quick chat with the manager of that team and he invited me for an interview and I had an interview with two people. One of them was already in the podcast, Ernst Boverlander and the other one was Gerard van Batten. And I think after 15 minutes we were talking about the music industry. And I don't know what did them decide to hire me, whether it was the music or the technology, but that's how I got into T &O.

speaker-0: As an evaluator or

speaker-1: The word evaluator didn't exist, I think. I don't even know what the title was, but it was a technical role. And together with Gerard, who was my mentor and my roommate, I started doing technical assignments, which at that time were power analysis. So for some people this was before DPA. So we were doing SPA. We didn't call it. We called it current analysis. And we were doing this on banking cards to retrieve PIN codes. But I was also doing more hardware stuff, probing. We had a very old electron microscope, which was usually out of order. So I spent a lot of time trying to get it back in order. And we did some stuff there. We had a chemical lab. So I learned from... some people to delay your chips and all that. So that's the first three years of my career.

speaker-0: And then what happens?

speaker-1: Well, what happened was that we got a few new colleagues who are still in the industry. And I realized they were incredibly good, technically. And I felt like, I'm lost. There's no competition. To give an example, I was very bad at programming. So when I was doing simple power analysis, I was collecting traces. And I was printing them on a piece of paper. And at a second trace, which I printed on a transparent sheet, and I was moving them on top of each other to see if there was anything valuable there. So if I probed a data bus, it took me days to get a key, and those guys did it in minutes. So I realized either I have to up the game or I have to look for something else. So I decided I like working with people, with customers, colleagues. So I wanted to become a project manager, which I told at the time my manager. And then it took, I don't know, six months or so. I even applied for a few other jobs

speaker-0: Yeah.

speaker-1: because I was impatient and I didn't get the project management role fast enough. But I concluded those other jobs were not a good fit. So eventually I became a project manager and then I did that for a few years as well.

speaker-0: And then you left T N O for a little bit and came back again.

speaker-1: Yeah, I left TNO after seven and a half years and I went to this company which was at the time, this was 2000, was a very unique company in the Netherlands. It had 500 people, they never had any vacancy put out, was all word of mouth, it was a completely flat structure. For offices they had... meeting places who look more like a bar. This is all 25

speaker-0: Okay.

speaker-1: years. Well, they did mostly consulting. And I joined that company because Ernst was also there. then after one and a half years, I figured out consulting is not really my thing. So I went back to TNO and then I came back in a commercial role. account manager, business developer, that kind of stuff. And then I started to focus mostly on growing.

speaker-0: And that is two thousand three or

speaker-1: That was 2002, maybe even mid 2001. And then I stayed till 2008.

speaker-0: 'Cause many people did not know but the name Bryceight was actually through you, right? So you were at that time the so called marketing guy. And you you were working with a marketing agency for that.

speaker-1: Yeah, so T &O was the team was becoming independent and we needed a new name. So I found this company that was good at inventing company names. That was their business. And very famous names in the Netherlands and Europe were made by them. So we started working with them and then we had... think five names or something and then we chose Brightside.

speaker-0: And at that time also the mascot near the dog.

speaker-1: Yeah, the dog. Yeah, yeah, yeah. That was interesting because I selected this company that was doing branding for us. And I don't know exactly, but it came up with this dog. And I personally thought it was fun. Later on, I realized that maybe in some cultures it was pretty weird to have a dog as a mascot. But,

speaker-0: 'Cause at that time it was called Bryceight Partner of Security Approval.

speaker-1: Your partner in security.

speaker-0: Approval. Yeah. So I I think it was because of the partner you want to have a loyal, smart

speaker-1: Yeah, yeah, so so it all seemed to fit together but it's now and then Was made clear to me that it was a bit odd, but I think All is good, you have something to talk about and you can explain why and and and if you're just Predictable boring

speaker-0: I think it I think it was cool. But it I think eventually when we were at events people came to ask about security, not rele relevant stuff. are you selling dogs or dog food or things like that. But I think I was just making fun. I don't think they were serious. But I think young Peters was not so happy. Yeah,

speaker-1: It haunted him.

speaker-0: so so we changed it. Yeah. it's but it it was fun. so Two thousand six I joined the company and then actually our path are a bit the same in the way that now I hear what you said. I was also bad at programming. And I believe there was this project where I needed to program on a mobile phone. At that time NFC was very new. Yeah. So the project was for me to program it to use the NFC interface and I didn't know how to code because somehow me and software language we don't work the same way. So I only I only was good in scripted language like Python, but C's and you have to link all the different things was not n intuitive for me. So I remember at that time it was maybe my im imagination or something, but I think the company was really thinking, do we still want this guy or not? And then I think in two thousand eight the Chinese market started to to grow. Tier Khan went to IEEC and met ZTE and then Ta Tang came to us and started this whole thing and my language skill and my knowledge about evaluation just fit and then I I started to do PCI evaluation and things. So I stayed. I think like that at least that's that's how I remembered it. I don't know how you remembered it. maybe I was almost fired, I think.

speaker-1: I cannot remember those details. remember you joining, I remember managing the hardware team, and then I remember at some point leaving.

speaker-0: But how how was it? How why why did you leave? Just the cling and the

speaker-1: The truth.

speaker-0: the truth and nothing but the truth. Can you handle truth? I can handle the truth.

speaker-1: I that was a famous quote from Jack Nicholson. No, mean, I think I was looking for something new and I found something new, which was the pay TV market. And I wanted to get in and I had found a way in. But there were some differences of opinion. I needed one of our colleagues to be dedicated to that market. And that same person was also involved in Coma Criteria, which at the time was seen as more promising, I don't know, important. So basically I had this opportunity. And I couldn't get it in. So I was disappointed. And I thought, okay, if I'm a business developer and I bring business, but we cannot get it in, then maybe I don't know what I'm doing here. So yeah, that eventually led to a decision to leave. And then, yeah, I started looking around. And of course I knew Mark. because he was a colleague before at TNO. a fun fact, in 2001, when I was about to go back to TNO, I had several conversations with Mark to start a company together. But I just had a mortgage and two very young children and I thought, no, this is too scary for me. So I chickened out and Mark went out.

speaker-0: Ha ha.

speaker-1: it's the truth. And then when I decided to leave, I called Mark and said, it's time to have another beer. And I said, look, I'm going to leave. I'm going to look for something else. And he said, perfect timing, because we can really use someone like you. So that's when I joined.

speaker-0: And how many people were there in Risk?

speaker-1: 15.

speaker-0: Fifteen.

speaker-1: Yeah, I was number 16.

speaker-0: So just to piss them off, how big was the Pay T V evaluation market at its prime?

speaker-1: At its prime? Well, its prime, the total market, I don't know. But for us, when we went in 2008, when I joined, the pay TV market was still smart card based. So you had a pay TV decoder and a smart card. Smart cards were not done by us because they had common criteria or whatever. So we were mostly looking at the pay TV decoders. But then the market required to get rid of those smart cards because they were very expensive and they moved the entire security to the SOC. And that was for us the gold mine. Because at the time we were basically there were two other labs, but somehow they were not very active. So we quickly conquered that SOC business. And I think at its peak we were probably doing 15 SOC vendors. We were doing a lot of set up boxes and we were talking to everyone in the industry from the Hollywood studios to the chip vendors. So I think percentage wise it was, I think it was at least 30 % of the revenue. So it was good business. And it was also... Yeah, in a way it was nice because I proved that what I didn't get in the end I got. But yeah, it was also good because there were very little competitors and it was a lot of fun because the way of working...

speaker-0: Party with the Hollywood stars and

speaker-1: Yeah, what happens in Vegas stays in Vegas. I can't say much about that. No.

speaker-0: No, Risk Curie really had the monopoly of pay T V and by the time that Bryce I wanted to take a look, it was basically impossible. Also it's not big enough for many labs to join, but it's also exclusive because you got all the different pay T V vendors already and you cannot just get one and do one, you have to do them all to to have this value. Also for the young people why it requires a smart card in the beginning is to identify yourself, right? To authorize. You have to buy the membership and then use that smart card you get access to the content.

speaker-1: Indeed. And yeah, when we started, we only worked for one conditional access vendor. Was the first one working with us moving from Smartcard to SOC, which was a DETO. And then I was thinking, okay, if one CAS vendor needs this, they probably all need it. But it took a while, I think it took five years before we had all of them. But we had a very, yeah, we were gradually building a reputation and our name was mentioned everywhere, from the studios to the... So, yeah, our yearly conference trade show was IBC in Amsterdam. I think at the height we were doing 40 customer meetings in five days. So it was just, it was a lot of fun.

speaker-0: I I think Risk Cure is probably a better platform for that at that time. but we talked in the show and also it it haunts me in my career for people who do not have a mandatory requirement to do security and sell them security evaluation. I think that's very very difficult. So what do you think is the motivation for these vendors? how did you trigger them to do it?

speaker-1: I didn't trigger them. no, So in those days, the Hollywood studios were really in charge. They had the valuable content and they would only give the content to operators if they had the proper security in place. Because if the content would leak, it would cost the studios a lot of revenue. So The responsibility in that pay TV industry was heavily on the cost vendors. They were delivering the systems, the technology to secure it. And I have never seen a contract between a Hollywood studio or an operator and a cost vendor. But I'm sure there were some wording there that made the cost vendors take that security. very, very serious.

speaker-0: But is there a bar? Who who said the bar?

speaker-1: So the bar was set by the different cast vendors and the studios, they were seeing our reports or parts of our reports, but they were not at least telling us what to do or not to do. I think in general, the cast vendors were very advanced technological companies. Hi-tech, I mentioned Erdetto, was Nagra, was MDS, Conox, Vyexcess, they were living in a world of piracy. So for them, setting a high security bar was not a luxury, it was just the world they were living in. So we were really asked to break it and to, to share how difficult it was and potentially how piracy could be done. of course we were trying to, because we were the only lab and we were talking with all of them, we were also trying to make sure that we could, because my sales pitch was okay. as a sock fender you need approval of five cast fenders. If you work with us, we can deliver all to you. But they all had different tweaks. So that means 80 % was the same and then one wanted this and another one wanted that and some had their own IP that was put inside the SOC. So in the end it was the cast fender who would

speaker-0: Cause it's like

speaker-1: conditional access system. yeah, CAS vendors, they were eventually deciding whether a ASUC was secure enough or not.

speaker-0: And I think it's also a different security issue than smart card. I can imagine for a pay T V probably it's also you have to decode things in a very high speed and a big bandwidth and

speaker-1: Yeah, yeah. So to give you an example of the complexity when we were already doing risk-care side channel analysis, fold injection on smart cards. Now, if you have a smart card setup with a smart card reader, you can do DPA in five minutes. You put in the card and I think the first couple of SOCs we were doing DPA, it took us six full weeks to even build a working setup. So the knowledge we developed in that pay TV market was also very beneficial later when we started doing other SOCs like for mobile phones for instance.

speaker-0: Yeah, I can imagine because at that time even for smart cards sometimes we don't have enough memory in the oscilloscope to to record and to to do analysis and if you record a lot of data you have to align for a long time and doing a lot of things. So I can imagine it takes much longer time and also to have this setup ready to

speaker-1: So building a working setup was in the beginning very challenging. I would say memory problem because at the same time Riskure was developing side-channel and fold injection tools. we were not only interested in making better tools for our own service but also for our customers who had our tools. So at some point we implemented ways to deal with these complexities.

speaker-0: So you started with the pay T V market and then you also do some other things. Were you involved in tool sales and other things?

speaker-1: When I joined Risky in 2008, I was the only salesperson. So I was doing services and products. And then I think one, two years later Bartek joined. And after a while we concluded that he would continue products and I would continue services. So for the first, I would say three years, I was doing both. And then I focused on services.

speaker-0: So he reports directly to you or to the

speaker-1: At that time he reported to me and of course now everything is different.

speaker-0: Okay, so after a while I also asked this to Mark, but maybe hearing from your side, what is the pivot moment to go to the evaluation part?

speaker-1: So.

speaker-0: four more evaluation and not yes.

speaker-1: Yeah, yeah, formal evaluation. I think it was... customer demand. So we had customers that we were doing what you would call now pre-certification or free format testing, hacking, whatever. And those same customers were also looking for more formal evaluation or certification. And they were just knocking on the door and they were basically... persistent that we need another lab. And in that time, there was a particular interest for another lab in the Netherlands, especially when it comes to common criteria. So, yeah, we just, you didn't have to be very smart to see the opportunity. Business-wise, the opportunity was there. Now, of course, developing that is something else because... Free format hacking, black box hacking is a different skill than formal evaluation.

speaker-0: I think it it's not only a different skill but also requires a different mentality in people and

speaker-1: Definitely, yeah, yeah, definitely. It's... Yeah, think evaluation, certification, you need to provide assurance that it meets a certain level. Nothing more, nothing less. When you work in a market where they really want to know, can somebody break this? You have to break it to demonstrate that you can break it. that is a very different focus that means that you can go on one attack very deep because if you give it a few more weeks you're gonna break it. While in evaluation you have to cover a whole set of things that do not maybe allow you to forget about half of it and go very deep on two.

speaker-0: 'Cause what we do in EMV call common criteria for smart cards take as example. There there's also o always a p attack potential that is agree on and if you see or you invent attack that you see it's already up there or above that attack potential you can choose to do it or not to do it. so in a way it's set. But it just comes to me this question you can choose to ask to answer or not. So how do you quote that kind of thing that you can because I cannot imagine customer give you unlimited budget to break it. No. So how do you agree on a certain boundary with them and then say we we try this first and then we do more?

speaker-1: I think it works very similar to formal evaluation. Because also in formal evaluation, like you said, you can decide to do a test or not. Sometimes you can argue why you should not be doing it. But also in formal evaluation, you have to make choices. in more hacking or free format type testing, you can just offer a certain effort and you can define a certain scope. Are we going to attack the hardware or are we going to attack the software or are we going to attack just one application or only one attack, whatever. You can agree on that and then you can also agree on a certain effort. You can explain to customers, look, you can do a week of side channel analysis, you can do two weeks, you can do a month, two months. I think everybody understands that the more work you put in, the higher the likelihood that you will find something. And then it's up to the customer to decide how much time and effort can or do I want to spend.

speaker-0: But for example EMV co would say you have to have a million traces for DPA. if you're not doing it for a formal evaluation you can tell the customer we can try five hundred thousand, we can try one million, two million and you can choose and this is the difference.

speaker-1: Yeah, this is all a collaboration with the customer and you can for instance also say look the industry standard in payment is one million traces. But the nice thing is with the free formatting it can go any direction. Some customers can really challenge you and say look give it all you got and whatever you want to use. So yeah.

speaker-0: Yeah, I was at the customer once and then they were showing me their lab. And then they say to make sure we can pass the evaluation, I know you are taking one million traces, so we took take hundred million traces just to see just to make sure we don't fail. I think that's

speaker-1: Yeah, yeah, yeah

speaker-0: that's but that's also why people want to buy tools. Yeah. from from Risk Hure. What do you think are the motivation for the tools?

speaker-1: Yeah, it's funny because when I was still at TNO and I was watching Mark developing riskure, at some point I saw on their website they were offering a side channel analysis tool. And I remember thinking that is really a very stupid idea. Who wants to buy this? This is something you make yourself. Because in those days all the labs made their own side channel and fold injection tools. Also because they were not for sale. So I was completely wrong about that. So what are the motivations for buying tools? To develop them yourself, it's an incredible investment. So if you need that kind of testing equipment, the best thing I think is buy it. Because if you develop it yourself, it's usually developed by one or two people. They don't have time for documentation, don't have time for updates. If they leave, then what happens to your tool? So that was a, I would say, not very difficult pitch. So then, of course, you have customers who are thinking, should I buy those tools or not? They're not thinking, should I develop myself or should I buy? But they do not know, should we buy? in general. And I think arguments for those companies are, yeah, if you have tools in house, you can go better prepared to, for instance, certification. also have a faster turnaround because if you have to outsource it to an external lab, you have to wait, are they available or not? At some point, it's also a cost. issue is the cost of hiring a lab maybe more expensive than the tool. So yeah, those are arguments why companies are interested in tools.

speaker-0: I think really companies who are more dedicated to security they should buy the tool and test themselves. Yeah. Because although the same tool in the hand of a senior evaluator it's very different than in the hand of a junior person at the developer.

speaker-1: Yeah.

speaker-0: Because you see different things, you can focus on different things, you're not wasting time searching for things. So If you're not dedicated to it, then don't buy it because you're not going to use it the right way anyway.

speaker-1: Yeah, I often in conversations compared those tools with a musical instrument. Because we also got the question, why are you selling tools to your competitors? And we always had the idea, look, the tool we sell is like selling a piano. I don't know, do you play piano?

speaker-0: Yeah.

speaker-1: So let's say I'm a professional piano player and I sell a piano to you. Will you become my competitor? No. So that's the same with the tools. To be very good at it, you need to practice, you need to have a lot of, working with it. It's not just buying the tools and plug and play. It's very different from functional test tools where you have scripts, you run them. and then you get the output, you see the points where it does not meet.

speaker-0: Because I always see tools as a very good business actually if you look at from evaluation side because we started out not as a tool company, as a service company. But these services I think the the real barrier to enter this market is your accreditations. And that's not easy to get because you cannot just become a lab for the Netherlands for the country.

speaker-1: Yeah.

speaker-0: So in a way, the tools will help you sell your evaluation and also have bigger integration with your customer. If they use your tool they're also like come to your lab more more easily because they want to make sure that what they have done in the pretesting is also the same as during the evaluation. So so in that part I never see that people can just become your competitor because they have your tool. But even better is that they'll work closer with you if they have your tool.

speaker-1: That's, think, when we speak about customers like chip vendors or technology vendors, but we were also selling to other labs. They bought our tools, but they were not necessarily our customer for services, although that sometimes also happened. But yeah, it also with vendors that works the other way around, if a lab finds an issue, then the vendor who takes security serious, they want to replicate it. They want to understand it. If they have the same tools, that's also easy.

speaker-0: But from the left side I think I've two consideration. First if you sell to the other lab, it will also work the same. The the customer of that lab will also buy your tool because their lab is using yours. But I think in Bright Side many years ago we had the discussion why don't we just use Risk your tool? why do we still develop? I was really against it. Because I think at a certain point when you are not a newbie lab but you are already having your own stature as a lab. It's also very dangerous to depend on your competitor. If someday the scheme start to require you have to do this new test because this new paper is coming out and then you you cannot do it because the the tool does not have that functionality. You have to ask your competitor and your competitor is yeah yeah we'll do it. But They roll out themselves maybe two months earlier than you can get it. And then you will have a problem with that. So so I always thought indeed for competitors the negative side is at the competitor. I I think for riskier it doesn't matter to to whom you sell.

speaker-1: No, for us it was fine.

speaker-0: Business. No but and then we came to this this question I was interviewing your ex colleague Alan in Taiwan. So his episode will be a bit later, but I think before this one. And he mentioned that a very s very famous quote from you, if Riskio ever does common criteria, I will quit.

speaker-1: Yeah, it is a famous quote. was actually, I think I said it to Matthias Wagner from NXP and then it haunted me for, well, to this date. You're asking about it. I said it, I think because I was at that time very interested in that pay TV market, which I couldn't develop. And the reason was common criteria. And I just really liked the more independent cowboy style yeah, sometimes you say things, know, they're a bit provocative and you don't expect them to follow you the rest of your life. It was always fun, I remember once at a J House meeting, Mathias said to the whole team, oh, by the way, if you're interested in Pascal, he's available. but yeah, now eventually I have kept my promise. Yeah, after I think we started in 2015,

speaker-0: No, ten years later.

speaker-1: 11 years later.

speaker-0: No, but I think for me the industry did not change that much since maybe five to ten years ago. Especially after COVID. it's not very at least technology wise it's not it's not much difference and the landscape is changed more in the structure of the ecosystem. We see a lot of laps being acquired by the big TIC and also Riscure is acquired by equipment vendor key site. So I I think Risk Cure also chose a different way. I I talked that with with Mark so watch that episode. so how do you see from now and look back the development of certification and do you see that it is becoming a different thing than before and what do you think will be would be the future? Because in the beginning we are only doing higher assurance and only higher assurance has the money or the motivation to do security but after IoT F connected world and now AI I think security has to go down to equipment level. or normal equipment level and that also requires evaluation and certification to change. So what is your view on that?

speaker-1: Yeah, I agree that the security requirement is spreading to much more markets. But I would say the level that is... affordable is not the same in every market. So if you make a smart card and you can sell that in multiple markets and you can sell that for an amount of years, then an investment of a common criteria evaluation, U5 +, U6 +, is maybe makes sense. But for, let's say, a toy for children that includes a camera, you cannot do a Neo 5 Plus evaluation. So maybe that's also why the TIC players have come into play. Because I think they are much more used to doing automated, operationally very efficient testing, which is very different from a lot of manual, I would say, evaluation work. yeah, I see it growing, but I think it's not likely to have that same rigor and depth as you can see in some other markets. in payment, it's clear what's at stake. And even in pay TV, the landscape completely changed.

speaker-0: That's the emergence of Netflix and this kind of

speaker-1: Yeah, definitely. 10 years ago, 15 years ago, there were basically only five studios that were having all the valuable content. And with valuable content, mean the content that would make you decide to have a pay TV subscription. Nowadays, yeah.

speaker-0: You just need the internet.

speaker-1: You need internet and yeah, maybe you take Netflix for a month and they take HBO or Disney or whatever. It's very different. So also the technology changed, it moved to DRM. So I think in response to your question, think that maybe security has, the need for security has grown. For instance, take automotive.

speaker-0: Yeah.

speaker-1: Everybody would say automotive needs a lot of security. But my experience is that there is no.

speaker-0: Not so sensitive to the

speaker-1: No. So. Yeah, I don't know if that answers your question, but...

speaker-0: An answers in in a way. I I think that's also a question that there's no answer, real answer to how it will be changed or what is the right format but we see from common criteria there's development of CESIP, there's development of fixed timed evaluation, which is a bit similar to what you just said about P T V and Also there's the RED or Resilience Act with industry, automotive, medical, they have each in each diff vertical they have their own security requirements. It's more fragmented. I think the high assurance industry is trying to bring order into that by having the methodology, but it is very expensive

speaker-1: Yeah.

speaker-0: to do even even CESAP. So Yeah, it's it's it's a new era.

speaker-1: I think the drive for security testing, evaluation, certification is not coming. It's usually not coming from vendors. They implement security features and very often they conclude we made a good product. The drive is coming, of course, from external parties who are... maybe when security is compromised and they suffer losses financially or otherwise. if you look at automotive, this has to come from... European government, American government, whatever. But I think if you look at how complex a car is, if you would like to test and evaluate and certify a car at the level of what is done at a smart car, a car would become twice as expensive. So in the end, there is no real business case. So, yeah, I... I think sometimes people think if you install a new certification scheme then the industry will follow. I don't believe that. I have many proof that certification schemes by itself don't solve anything. It has to be a real driver and a real need.

speaker-0: And which is the money?

speaker-1: Well, yeah, in the end, money is very important. you're a vendor, why would you spend an awful lot of money on certification and testing if it's not required or if it's not bringing you anything?

speaker-0: true but that also brings a bit to the the AI topic.

speaker-1: huh.

speaker-0: What we see is that things are happening super fast. I think it's faster than anything I remember. Of course we experienced the PC and internet and all the things but AI is in such a b such a bubble. For me it's the real first bubble because the last one I was still studying so I was not so sensitive. And we can see all this company moving at a very fast pace and we don't really know what they do with security. And they don't want any certific so certification will not catch up because if you rely on on CRA or or European Union or country to set a rule you have to do this, it will be a few years. But in a few years AI probably is at a at a place we never imagined. So how do you see that? do you see a balance still from the developer that they also do security even no one is asking or it's left o left I

speaker-1: I know for a fact and I've worked closely with several vendors that have security in their DNA. So they just want to make secure products, they invest a lot, they have people, resources and they use it as a selling argument. But I also have seen a lot of vendors which didn't have security teams, they were doing maybe a few security things, sometimes with lot of flaws. So I think that is not going to change with AI or not. I think there will always be companies who for whatever reason see security as something they want to do. And there will be a lot of companies who don't or they do it poorly. Because it is very difficult to make a secure product. So yeah, in that sense, don't think much will change.

speaker-0: So the final question is how do you see AI being applied in this industry? Yeah. W will it be like AI evaluators everywhere or

speaker-1: of course this is looking into the future. I think AI will be used by vendors, by labs and by...

speaker-0: Certification body.

speaker-1: and by attackers. So the cat and mouse game is not ending here. think labs who implement AI in a way to speed up or make their work more efficient, they are going to be more competitive than labs who don't. Vendors who use AI to make more secure products will be... probably more successful than the ones who don't. And so yeah, it's adding a new layer. I don't think that maybe this is, a guy from a different age. I don't think AI is completely gonna replace people, but it's definitely gonna have a huge impact. And for me, it's more... The difference is, do you use it or not? And how good are you at using it and applying it to whatever you make or provide?

speaker-0: So I was having conversation with Walter Slachers and we were joking about it that in the future all the simple things like evaluating reviewer security target will be done by human because p human are better in watching out, setting the scope and all the very high end attack will be done by AI. Because first it's very expensive for AI to do this kind of thing, so you need something more difficult for them to do otherwise it does not worth the money. and the second thing is they are just smarter in in doing DPA analysis. Probably they they are able to analyze this without the traditional DPA methods to get the correlation or something like that. So that's very interesting.

speaker-1: Yeah, it's gonna be... and like you say, it's going so fast.

speaker-0: human will be the the blue collar in the future. Yeah. And the smart jobs will be done by AI, yeah.

speaker-1: We'll see. I don't know. It's going so fast. almost feels like what you... If you catch up today, then you're out of sync again next month. So it's unbelievable.

speaker-0: So okay, so so we talked about it in the beginning. So what do you do now? You you just left Rescure and I think you what I know is you start also a coaching studio.

speaker-1: Yeah, the riskier was acquired by Keysight and then we had the whole integration, know, 200 people company integrating and 16,000 people. So that's a big effort to do that, changing systems, adapting roles, everything. And then After that was finished I started to think, okay, what is it that I need, that I like? And I came to the conclusion that over time I shifted more from sales. I still like sales and business development, but my interest in people grew significantly. So as a manager at Keysight, I was mentoring, coaching, managing people. At some point I thought, okay, it would be nice to maybe get some more education in that. So I did some coaching, education three, four years ago. Currently I'm doing that again to become more advanced. So I really like... helping people to grow, to overcome something that is constraining them. So I decided I'm going to do that for a couple of days a week. And for the other half of the week, I am currently planning to join another company. But that is not all yet. set in stone. when you have this podcast out, it probably is and maybe people have seen my announcement on LinkedIn. But for now that's, it's still insecurity but something very different.

speaker-0: But I I know it's not limited to to security evaluators and things. you're coaching things but I think if you are security evaluator and you want some coaching, at least you are knowledgeable about the whole industry. Yeah. And and the dynamics and things.

speaker-1: Correct, but to be more specific, my coaching is not related to anyone's profession. It's more related to you want to grow into a certain area and for some reason you're not getting there. Or you are stuck in a situation which you want to get out of and you somehow don't know how to. So it's more like life coaching. But at the same time, if there are people interested in coaching when it comes to sales, business development, the security industry, yeah, by all means send me a message and... Yeah,

speaker-0: Can they reach you on LinkedIn or

speaker-1: I'll link to it. Okay.

speaker-0: Well, Pascal, thank you very much. I think it's it's quite easy and smooth, right? So

speaker-1: It was an easy ride. Thanks.