Category: Management

Q-Day Is Sooner Than You Think

Information security people are worried about Q-Day, and maybe not worried enough. That’s the date when quantum computing will render today’s encryption methods obsolete. Information security depends on cryptography – secret code keys that are uncrackable because of large numbers and hard math problems.

The good news from quantum computing is that we’ll have a new generation of more-powerful computers, with the usual benefits – discovering new medicines, powering AI, and generating cat videos. The bad news is that we will have to come up with more-robust cryptography, in time for Q-Day.

Breaking Crypto

Quantum computers are not literally faster than today’s binary ones, but they support a new class of algorithms made possible by the weirdness of quantum theory. Oddly, the algorithms getting all the attention are not the ones for medicine or astrophysics, but those that defeat public-key cryptography.

Suppose someone wanted to find your four-digit PIN. They would have to try 10,000 different combinations (or half that, on average). This algorithm is “order n,” meaning that it varies linearly with the number of digits. See Know Your Time Series for more on “order n.” Grover’s algorithm for quantum search is order √n, which means only 100 tries.

Shor’s algorithm for prime factorization is, in fairness, kind of the first thing you would do with a new computer anyway, cryptography or no. It was my first homework assignment in Fortran (Euclid’s, not Shor’s). Cracking a four-digit code is no big deal. The backbone of information security today, RSA, uses a 2,048-bit key, which is more than 600 decimal digits.

How Many Qubits

Early microprocessors, like the Intel 4004, had about 2,250 transistors. Each transistor is like a switch that can be on or off, representing a binary digit, or “bit.” Google is proud of their latest quantum computer, Willow, with 105 quantum bits, or qubits. Shown here is its refrigeration unit. IBM advertises 1,000 qubits, but counting them is tricky.

Computers today sacrifice about 12% of their capacity, to error correction. Every eight bits in memory require a spare bit for error checking. Error checking overhead varies depending on the application. For quantum computing, this overhead is massive. It can take thousands of physical qubits to make one good “logical” one.

That’s why Google bangs on about error correction. Their 105 qubits may be stronger than IBM’s 1,000, depending on error correction. The latest paper on breaking encryption makes specific assumptions about how reliable the qubits are. It’s called How to factor 2048-bit RSA integers with less than a million noisy qubits, or 1,400 logical qubits.

When is Q-Day

Progress toward breaking RSA 2048 is happening on several fronts: better hardware, better error correction, and better algorithms (that tolerate errors). Gidney’s previous work, just four years ago, required 20 million physical qubits.

IBM plans to deliver a real, commercial-grade computer, “the first fault-tolerant quantum computer,” with 200 logical qubits, in 2029, with 2,000 in prospect around 2032. Startup IonQ is targeting 1,600 in 2028. They’re growing by acquisition, and targeting this audacious goal by stacking a bunch of new technologies.

Google is also in the hunt, but their roadmap is more complicated. As you know from the link above, Google doesn’t use the popular logical/physical shorthand. They talk about computing benchmarks that explicitly include error correction – kind of like Gidney’s “one million noisy.”

Depending on how you assess the roadmaps, Q-Day probably happens around 2030. But then, there’s “harvest now, decrypt later.” Hackers can start collecting your encrypted information today, and saving it to use later, when RSA 2048 falls.

So, the real question is: do you have confidential data that will still be important five years from now? In that case, Q-Day is today.

The Cybernetic Teammate

Here is a recent HBS study on the role of GenAI as a collaborator in a team work environment. What I liked most about the study is that it is field work – real-world tasks in a real company, Procter & Gamble (read more about field work in my review of Gary Klein’s book). It must have been a fun field trip for the Harvard kids. By the way, you may recognize Karim Lakhani as the author of Competing in the Age of AI.

GenAI’s ability to engage in natural language dialogue enables it to participate in the kind of open-ended, contextual interactions that characterize effective teamwork

The introduction recaps the literature on team work, and points to some testable hypotheses about using GenAI as a “cybernetic teammate.” They then proceed to a product development exercise using the company’s standard methods, with a large sample (n=776) of employees in randomly-assigned groups.

The image shows a chart for one of the outcomes, proposal “quality.” For quality, AI-augmented teams were more likely to produce proposals ranking in the top decile. This chart is a little scary, if you think about it, because the bump from adding AI is bigger (and cheaper) than the bump from adding more people.

In a nutshell, teams do better than individuals, but individuals using AI do better than teams. I see this on my LinkedIn feed all the time, and I can vouch for it myself. Shrewd founders see AI as a force multiplier, allowing them to go farther alone before needing to bring in partners.

The study also found that using AI produced proposals better balanced between marketing and technical orientation. Apparently, this is a big skills divide at P&G. Marketers will produce groovy ideas that aren’t feasible, and vice-versa for the tech people. Note the bimodal curve in Figure 11. So, the basic team needs at least one of each skill – unless you’re using AI. AI had the effect of bringing solutions more toward the middle ground.

Finally, test subjects self-evaluated for emotional bien-être, and discovered that working with AI was almost as satisfying as working with other people. So, if you can’t afford a marketing colleague for your lonely, overworked engineer, you can at least get him a cybernetic teammate.

Reality-Based Management

On May 29, 1919, a team of astronomers led by Sir Arthur Eddington photographed the star field behind a solar eclipse. Comparing the position of these stars at night, versus their position during the eclipse, they proved Einstein’s theory that starlight was deflected by the Sun’s gravity.

This experiment made a profound impression on Karl Popper, a young philosopher studying the scientific method. In order to be “scientific,” Popper wrote, a theory must make predictions that can be tested by experiment.

If Eddington’s team had not found the predicted result, Einstein’s theory would have been dead. As Popper wrote, “confirmations should count only if they are the result of risky predictions.” In his famous essay on falsifiability, he contrasts this with the work of Marx and Freud, also popular at the time.

In those theories, Popper found only confirmation bias: “you saw confirmed instances everywhere: the world was full of [post hoc] verifications of the theory.” A theory that is “irrefutable” is not scientific, he wrote. A scientific theory, like Einstein’s, must make definite predictions that could be disproved.

One hundred years later, Scott Adams would warn his readers against confirmation bias, directing them instead to test their ideas based on predictive power: “The best way to judge the accuracy of an idea is not by logic but by its predictive power. If an idea predicts the future accurately, it is a useful idea.”

Business leaders I have worked with pride themselves on “reality based” management. You can’t plan a strategy or launch a new investment based on an incorrect understanding of your market. Maintaining an accurate model of reality takes concerted effort. Read Popper’s full essay here

Top 8 Car Dealer Security Tools

Today’s post on Information Security is coauthored by ISC2 2024 Board Chair Dan Houser

This time last year, CDK Global was hacked and ransomed. Fifteen thousand dealers were locked out of their systems, causing an estimated $1 billion in losses. CDK suffered a follow-up attack, which disrupted their efforts to recover. Car dealers also faced a secondary wave of scam artists looking to profit from the confusion.

We did quarterly audits with a checklist, counting violations like passwords on sticky notes, unlocked cabinets, and contracts left out.

Car dealers are a hacker’s dream target. Here you have a lucrative business with many employees, high turnover, and disparate computer systems. While big dealer groups have security teams and contingency plans, smaller groups are poorly equipped to handle security. Sophos describes ransomware as an “existential threat” for a small business.

I have written before about the special challenges facing smaller dealers, and this is another example. In today’s post, we’ll cover the “software stack” of tools you need to protect your dealership.

Dealership Security Stack

These eight tools are the minimum you need to keep your dealership safe. The working title for this post was “top ten,” but we were able to narrow it down.

  1. Managed Detection and Response – CrowdStrike, SentinelOne
  2. Vulnerability Scanning – Rapid7, Tenable
  3. Multifactor Authentication – Microsoft, Duo
  4. Next-Gen Firewall – Cisco, Fortinet
  5. Security Awareness Training – Ninjio, KnowBe4
  6. Secure Backups – Veeam, Acronis
  7. Email Scanner – Mimecast, Abnormal, Proofpoint
  8. Antivirus – Sophos, McAfee, Bitdefender

Managed Detection and Response

This would have been a “top ten” list, including endpoint detection, response, and incident management. Nowadays, these all roll up into bundled services like Arctic Wolf, which may include “eyes on glass” in a Security Operations Center (SOC). An outsourced SOC is key for early detection, unless you feel like hiring your own staff to watch the monitors 24/7.

Vulnerability Scanning

According to Sophos, exploited vulnerabilities are the leading cause of ransomware attacks, particularly when coupled with phishing. Hackers regularly devise new ways to compromise popular systems. Whenever a new “exploit” is discovered, vendors rush to deliver a patch for it. Scanners like Rapid 7 warn you of unpatched vulnerabilities.

Multifactor Authentication

This is where, in addition to the password, a system confirms your identity a second way, like sending a text message to your phone. All systems should have this, including your dealership’s network.

Next-Gen Firewall

It may seem like your network is self-contained, but it has internet traffic with your OEM portal, your DMS vendor, and F&I platforms – to name just a few. These should all be certified and encrypted, but a wily hacker might still compromise the connection. An advanced firewall can inspect network traffic, looking for suspicious data packets.

Security Awareness Training

Trained employees are your first line of defense against the top two attack vectors – account takeover and email compromise. Dan motivates his training with “InfoSec at Home,” like protecting your personal Wi-Fi and keeping your kids safe online.

Awareness training software includes hitting your employees with simulated phishing attacks, and follow-up training for the “easy clickers.”  I like Ninjio because the lessons are short, topical, and entertaining – perfect for the kind of personnel and turnover you have in a dealership.

Secure Backups

Backing up your data is super important. During the CDK attack, many dealers discovered their data was on CDK and nowhere else. In 57% of ransom attacks, victims could not restore their data because the hackers had also compromised their backups.

Use the 3-2-1 rule: Have three copies of your data, including the primary system, with two in different places, like a NAS device with cloud storage, and one of these offsite. The offsite copy should be isolated from any network access.

Email Scanner

A common attack vector is malicious software sent via email, or “man in the middle” impersonation attacks. I know of one dealer who wired $250,000 to a hacker’s account, because the wire instructions appeared to come from an OEM’s email. You’ll need a scanner like Mimecast, with some kind of pattern matching (AI) and a deep blacklist, to keep evildoers out of your inbox.

Antivirus

You should have antivirus software running on all your computers, and managed at the network level. Most car dealers will be running Windows LAN with Active Directory, and you can use that to push Defender or Symantec to all computers in the domain.

Once your security stack is in place, you’ll need to test it. There are various ways to do this. You can hire consultants to check your work, run scans, and maybe even try to break in – a “penetration test.” You can also run a “tabletop exercise,” in which you simulate how you would deal with a major security incident.

As a CTO, I find that an increasing share of my attention must now be devoted to Information Security. Having come up as a developer, this is not my favorite thing. So, the first thing on my list is to consult a certified security professional – like Dan.

Hire a CISO. This means Chief Information Security Officer. The list of interview questions is long, but my personal favorite is: tell me about a notable incident and how you handled it. If you can’t afford someone full time, you can retain a part-time “virtual” CISO.