Future of Cybersecurity is ‘Friction-less Zero Trust Data’

Mar 1

Smart Cities Council Managing Director Philip Bane hosted Brian Wane, XQ 's CEO and founder, on the Smart Cities Chronicles podcast. The podcast's topic centered on frictionless zero-trust cybersecurity and its importance for the future of SMART Cities.

The three key points for this short - 10-minute podcast are:

With protection at the data level, XQ Msg can protect through the complete life-cycle
Network agnostic data protection allows for an infinite number of applications
Interoperability reduces the cost of deployment

Listen here or download on Apple, RSS, Spotify

The following is an excerpt of the podcast:

Philip Bane: Hi, everyone. Welcome to another episode of the Smart Cities Chronicles, your podcast for smart cities, action, investment, and outcomes. My name is Philip Bane. I'm the managing director of the Smart Cities Council. Our topic today is frictionless data. We frame the topic from our unique three things perspective. What are the three distinct aspects of this topic? Our guest today is Brian Wane, the CEO of XQ Message. Hi, Brian, how are you? And thanks for being here today.

Brian Wane: Philip, thanks for having me. It's great to be here.

Philip Bane: So, tell us a little bit about XQ Message and what you mean by frictionless data.

Brian Wane: Sure, happy too. So let's focus on the conversation around smart cities. So smart cities are the future of the planet. They harness the power of IT and faster networks such as 5G, to provide better and quicker services for urban mobility, development, and living. So, XQ explicitly solves the problem of digital trust by providing frictionless zero-trust data. Most security systems lock down data and limit its potential; we superpower it. So two standard practices around cyber security focus on the network and the device protection, but we do it at the data level itself. And we start by trying to remove that friction that we talked about. Firstly, there is the chain of custody.

We encrypt the data at its birth and keep track of it throughout its life cycle. Right? We make the data self-protecting when it's encrypted at the edge, letting the data travel wherever it wants. And we know who looked at it, when they looked at it, and where. Right? That provides transparency that no one else offers, and that provides confidence. We also allow the data to be network agnostic. So we provide private channels on public networks like wifi, that sort of thing. We also encourage and support data and network interoperability, which is a best practice. So we allow all the systems to talk to one another securely while tracking that data and giving you a holistic, transparent view into all of your data.

Philip Bane: Cool. So what I hear you saying, Brian, is that you're protecting the data at the data level as opposed to the file or the network level, that you're keeping a complete chain of custody from the data. I really like that, from the beginning through the life cycle of the data. We want to get into a little bit about how you're doing that. And then you also can work on any kind of network. The last one was interoperability as a best practice. So talking a little bit, maybe we could use video capture, the use of video as a use case. Maybe talk us through a little bit the life cycle of if, I mean, the famous city today is San Diego and their use of surveillance, but if I was sitting in San Diego and I was the police department, and I had a camera in the Gaslight quarter, and I was capturing videos, what would happen to that video after its capture? If San Diego was using XQ message?

Brian Wane: Yeah. This is a great example. So communities and cities capture a lot of information. A lot of data. Smart cities are powered by data. Right? Unprotected smart cities data breaches can be catastrophic for smart cities in the following ways, public safety, certainly privacy concerns with your personally identifiable information being out there, hacking into that data at the edge, and just the data integrity for things like your analytics, your data lakes, the support of critical infrastructure. So what we end up doing is the first time that an XQ agent encounters that data, and at this point, it can be on the camera itself. We slice and dice that data up and say that a hundred frames, a thousand frames, whatever else, we're streaming quantum random numbers to the edge, and then we're encrypting that packet of data at the edge uniquely and then vectorizing it. Right? We give it context. It's at the corner of Smith and Maine. It's this time. This identity can look at it. It's going to live for this long. It's encrypted there. And then we do that repeatedly, right, for every hundred frames and send it across whatever network it usually would go across anyway. Then on the other side, we have that bit of data, and we ask, and we say, "Hey, we're an authenticated endpoint," at this point, we're allowed to read it, "Can I please have the key for it? Great, let's decrypt it and put the whole stream back together." So it's a little bit like protecting the gold bars in the safe, rather than protecting the safe or the pipe. Right? Or I also give the example of when you go to the airport, and they take your luggage, and they wrap it in cellophane, and then it goes through, it's stamped, he's got his own little passport for your luggage.

What we are doing is opening up that luggage and wrapping all the shirts and trousers and pants and your hairbrush in cellophane separately, sending it through whatever airline that it normally would go through, whatever route it would go, and then unwrapping it at the other side and putting your luggage back together. That's essentially what happens to the video. So what's great about this is that it also allows a complete chain of custody. We have a passport that gets stamped wherever that data goes, wherever that luggage goes, and that lives throughout the life cycle of that data.

So if I want to go back and say, "Who looked at that data from Smith and Maine on February 4th?" I have a complete key chain of custody of who looked at it then and whoever looked at it since and before that. And I can also say, "Okay, well, that data isn't needed for the public safety or whatever else, I'm going to delete that key." And no matter what other copy of that key exists in the world, that video, that data essentially turns into digital dust, it's not accessible anymore. So, it provides complete transparency on both sides of what happens to the data and then where it is.

Philip Bane: So let me ask you this. You and I have talked about this, but Ruth [inaudible 00:06:47] at IDC, have just finished a big study of a lot of cities in the United States. And one of the big issues was what they called digital trust, which was the idea of the privacy of data, but also how you govern the data. So going back to the use case on the video. So let's say I have this camera at Smith and Maine, but in your XQ API, which is in the cloud from what you've told me, can you put governance rules in there also? So for instance, when the video is created, captured, and it's sitting there at the edge on the camera, can you then also have a governance rule that says, "Okay, that video can only be seen by this kind of person. Like a police officer or not a police officer?" Is that something? Can you put governance rules in there?

Brian Wane: Oh, a hundred percent. And we can make them also time-bound because there's no reason that that police officer might need to have access to that forever. They just need it in the course of that investigation. You can think of it also for any type of public data that's stored. Say for instance, the department of transportation. It's got everybody's records, which is super terrifying, and that maybe I have a vendor, a city vendor, that needs access to that, so for a certain period of time. We can say, "Okay, rows X through Z, we're going to allow good software vendor over here access to this for a month." They can download that and use it. And I'm going to have a record of how they use it, every time that they use it, and then afterward I'm going to deprovision them, so even if they have a copy of that data on their hard drive, I'm going to take back that access. Right?

And then I'll say, "Okay, X to Y, they no longer have that access to it." I have a complete record of everyone that's accessed that over there, but now they're on another project, we're going to reprovision A through C, the rows in this data lake for these guys. So this ability to dynamically assign and assess and limit the ability for other applications, vendors, personnel, based on a role and other privileges to access that data, but still keep a complete chain of custody of it.

Philip Bane: So not only is the data protected at the data level, the governance is integrated at the data level. And as you say, it can be time-bound, so if I'm the city of San Diego, and let's say I am the custodian of that video, I could set the rules going in to the future about how that video would be used, correct?

Brian Wane: Oh, a hundred percent. We deal with this with real estate quite a bit. So for REIT's or any sort of contract, you have to keep a copy of that for seven years, that file, that contract. Then afterward, you have to make sure that you get rid of it. Well, how do you know who's looked at it or if they have a copy of it, or if there are duplicates of it somewhere else? Well, A, you'll have a list of everyone that's had access to it if it's encrypted with XQ. And B, you can say, you can delete that key remotely, and then wherever the other copies of that are, it basically turns to digital dust. So this is great for also sharing between municipalities. So I say that I want to share flood data between three close-knit communities, but I want to make sure that I know where it was, where it went, who looked at it, and they should only have it for this period of one fiscal year. I can do that on a data level. On a file level, on a transmission level, you have an incredible amount of capabilities and the ability to reprovision that data remotely.

Philip Bane: That's cool. Now you told me the other day, some good news, you had been issued a patent for this technology, correct?

Brian Wane: Pretty exciting stuff. Yes, have a quantum resistant, zero trust data architecture that we've been given a patent for. And when we say quantum-resistant, we're really saying state-sponsored, attack-proof. So we're protecting, again, data exfiltration, ransomware, providing compliance and logging of all the data, as we said before. And this is a unique data-centric approach to information protection that we have uniquely been offered a patent for, which we're really excited about.

Philip Bane: That's great. And then the quantum-resistant is really future-proofing the solution so that any of your customers that invest in it know that for a conceivably good period of time, that it can resist penetration and misuse. So with that, Brian, thank you very much for your time. I think these three distinctive points are really clear, frictionless, complete chain of custody, network-agnostic. I'll add two more, quantum-resistant and a patent, which is really cool. So-

Brian Wane: Oh, interoperability.

Philip Bane: And interoperability. We don't want to forget that. But thank you very much for your time. This is really interesting. And look forward to talking to you again.

Brian Wane: Thanks. It's been a real pleasure. Anyone that's interested in following up please navigate to Xqmsg.com. You can visit our website for more information. Thank you so much, Philip. I really appreciate it.

Philip Bane: Thanks, Brian. Take care.

To learn more on how XQ is helping SMART cities: https://xqmsg.co/smart-cities

Guest User