#75: Bringing Cybersecurity into Focus: Senior Director of Information Security @ Canon EMEA, Quentyn Taylor

29:48So how is Canon sort of adopting modern technology innovation, specifically AI? Well, with obviously not wanting to spill any secrets, it is a big topic. I mean, I think it's a big topic in every single company. But Canon's already got AI in many, many products. Take, for example, your... In your cameras, for example. Yeah, your camera in the autofocus, if you've got a relatively modern mirrorless camera, it understands what it's looking at and then can make a decision that if it's a bird a bird tends to have an eye there so therefore that eye is there so i want to track that bird because i probably want to get the eye nice and sharp or if that's a human being do i want both eyes in focus one eye in focus do you want the left eye the right eye you can specify this and say hey left eye focus on that person there please lock on to them and then you can then have a face in a crowd and have beautiful bokeh and beautiful blurring around the edge.

30:41And that's just there already right here, right now. And I think people forget that AI is being used in many, many different tools for analytics and to understand, and not just in Canon products, but I think everyone sort of sees AI as things like the large language models, obviously chat GPT being a classic example, but they're forgetting the fact that there's been this kind of technology in place for many, many years. And I think it's only just because people have now said, oh, wow, I could use that to write this or do that or whatever else. But yeah, I think like many big corporates, it's a huge topic because there are both, there's massive advantages, but of course there are some risks and we just need to be very careful of the risks.

31:22And of course I focus many on the risks, but the advantages are focused on by other people and there's large amounts of these products coming down the line. What excites you most about AI innovation, Quentin? It doesn't have to be in relation to Canon. I just mean in general, like productivity-wise or, I don't know, its ability to write content and things like that. What are you personally most excited about? I think when we get true AI, I think it'll be amazing. At the moment, we don't. At the moment, we've got, is it AI? Is it just big language models? I mean, at the end of the day, it's not thinking for itself.

31:58None of the AIs, I don't believe at the moment, are thinking for themselves and that will be a watershed moment when the ai starts to think for itself and you know what it might start to think about things we don't want it to think about that's the debate isn't it yeah the ai models are all governed by the human beings who who put the input in and we've seen that where we've seen ais that are prejudiced because they've taken the prejudicial views of the programmers or the unconscious biases of the programmers and have just put them in i I mean, we all see this with the way that certain children are grown up and they take the attitudes of the parent or they take an opposite view to the parents, whichever one is appropriate.

32:40And I think that's the same we're getting. I think when we get an AI who can kind of think independently clearly and start to say, well, you told me this, but I now don't believe that. I have made my own decision. I think when the AI starts to refer to itself as I or we, not because it's been told to, but because it thinks it should, that'll be a watershed moment. When you start to get independent thought, when you can ask it a question about something that no one's given it any input in, and it can start to say, well, based on what I know, these are the questions, this is how I would start to think.

33:12And that'll be a scary moment, actually. Yeah, for sure. Imagine when that, and I know you're a gadgets guy, so I want to talk about that a little bit, Quentin. But can you imagine when this all-encompassing sort of, you know, AGI technology is at that level that you've just described? Couple that with robotics. Are we in a position maybe in a couple of years, and I'm saying a couple of years because the pace of change is unbelievable at the moment, isn't it? You know, we could have robots walking around performing tasks for us, delivering parcels, you know, jumping on drones and fly into the next, to deliver the next parcel.

33:46Who knows? But I mean, I think that's not that unrealistic anymore, is it? I mean, Skynet is playing out perfectly, I think. I think the Terminator series of movies and the books have probably meant that military planning with respect to... In fact, I would love to see what military planning was before the movies came out and post the movies came out. I bet you there's like a Skynet clause in there where they've gone, look there is already a movie the support end of things this must never happen there must always be a human being at a senior level who makes these judgment calls yeah so i think that'll be yeah i think i think that's but i also think there's those practicalities that come in the way i mean like we talk about like drone deliveries i fly drones and i and i i don't think the drone deliveries are going to be here anytime soon really oh that's interesting yeah i thought they were quite close.

34:42But can you elaborate on that? Well, I just don't think that there is the market for it because the drone itself is relatively complicated, relatively expensive. The airspace is relatively cluttered. And I just think that regulation is going to really, really make it very challenging. Imagine that drone would have to be able to fly autonomously. What value of goods, if they're high value goods and the things flying below 500 feet, then it's a risk of getting stolen. and the drone itself is at risk of getting stolen and taken. I just think it's one of those things where it's an idea that's looking for a market.

35:17I think things like using a drone to deliver an AED on a beach or in a crowded park, a drone to deliver medicines out to a crash site, I think that's absolutely, that's technology that's probably going to be in the next one. I think the AED is actually already here. I don't know if someone flies or it goes automatically. and being able to fly a drone out to a swimmer and drop a boy to them or a life jacket, that's kind of already here. And now if that could happen automatically, that would be even better. I think we're probably more likely to see autonomous driving drones. So for example, fire service, having a dark fire station.

35:53And if you need an extra ladder unit, an extra pumping unit, just being able to call it. And then that autonomous vehicle can just drive from wherever it happens to be to you. We already saw dark kitchens in the age of the food delivery services. We may end up with like dark fire services, an ambulance delivery service that can literally just pick up and drop or can bring extra equipment on demand and not have to have human beings maintaining that service. If you get the human beings out of the equation, then you don't need to have toilets. You don't have lighting. You don't need to have access passageways.

36:27You can very much more maximize your usage of the building and you don't need to have well, your security can be perfect security because it can just be autonomous vehicles coming in and out. Yeah. I mean, autonomous driving is a big one, isn't it? In the context of cybersecurity, can you imagine if we have, I say, can you imagine it would be a reality soon, I'm sure, when we have autonomous vehicles driving around, if they were to get hacked by some belligerent who wanted to cause chaos, and all of a sudden everyone's driving into walls and things so i don't think we will see them driving into walls i think what we'll see is people suddenly realizing that the driving preferences have changed subtly so that when you drive and you say take me to the shops the choice of shop changes or it drives you past an advert that it wants to see now we already saw this in las vegas many many many years ago that if you tried to connect years and years and years ago to a certain service you tried to call a local pizza place, there was some sort of weird and wonderful criminal gang who was controlling when I called the pizza place, which pizza place I got.

37:37So I might have a little card that says, I want to call this pizza place. Well, if another pizza place answers, do you really know which pizza place you call? Maybe they're trading under a different name. And that was happening for a whole range of services in Las Vegas. Ooh, 90s, because someone was controlling the uh the uh the telephone uh switch and just rerouting all the calls for these kind of services these services these services to whoever had paid the most money yeah i think we'll see the same with autonomous vehicles where you'll go interesting why am i always being driven past that one or just subtle changes yeah maybe there's a certain neighborhood that uh someone wants to win some votes in so drive a load of traffic through and then go hey if you vote for me i'll reduce the traffic in the neighborhood yeah and we already saw that in um not with autonomous vehicles but we saw that in one of the u.s one of the council people was accused of using traffic calming measures and traffic jams as a way of winning elections it was some mayoral election and people went to prison on the back of this they then started putting roadworks in inserting key strategic areas to make sure that there were massive traffic jams going through the people who that their candidate can then go hey vote for me and i'll get rid of the traffic jams but the traffic jams have been created deliberately by one of his people in city hall going well if we put jam here here i'll put roadworks here here and here yeah that's a big neighborhood we can make all the rich people annoyed and they're the ones i need to get on side yeah i think election campaigns just take it to another level in america don't they i don't think anyone would bother doing that in the uk but and i think the micro targeting i think ai is going to allow micro-targeting to make sure that all of us get different adverts, but that advert is specifically tuned to what will work for us.

39:24Just nudge. I think nudge advertising using AI to auto-generate. I think another area that's going to be really, really scary is I think Mikko Hipponen said it today. We are now out of the age of reality. I saw a quote from him today, and apologies to Mikko if I've just misquoted him, but I saw it pop up in my feed today. But he's absolutely right in that how do I know if I'm actually talking to Gareth right now? I could be talking to an AI avatar. We've not met physically yet. Hopefully we'll fix that. But I don't know if I'm talking to a real person or to an AI avatar that's coming back. I mean, if you played with the NVIDIA software that makes your eyes look straight at the camera, I mean, that's spooky, scary technology.

40:05I mean, who was it? Adobe even did the voice thing years ago where for video editing, the use case was if you're editing a video and your star said something slightly wrong and you wanted to say differently you could input all this uh this text in and suddenly or voice patterns they you could then regenerate the audio track what's saying what you wanted to say now they pulled that product but now 11 labs and various other places have got it where how do you know if if i've got the audio of quentin saying that horrible thing do you know quentin said that or was it just someone who had access to the podcast, fed that in, and then just typed in what they wanted Quentin to say.

40:42And well, now you've got an almost indistinguishable audio track with me saying it. That can be used for blackmail and all sorts of things, can't it? I mean, you know, that is quite scary. I think certainly the impersonation angle on it, I think it's already happening to celebrities, isn't it? Like, for example, I tell you once a security thing that happened just last week, and it always happens in my company. I get my colleagues receive emails from Gareth Davis, which is my name. But if you really look at it, it's some weird email address, which is normally Gmail. And claiming, obviously, when people look at it quickly, they just see my name.

41:17And I'm asking for, can you send me your, not bank details, it's not that brazen, but it's like, can you send me your number? I need to call you really quickly or something like that, you know? But this is happening every day in every company, isn't it? This type of stuff on a less sophisticated level. I think AI will just take that into the next level. Yeah, and it'll allow people to parallelize. I mean, this is the whole thing. I mean, we talked about this with email phishing. If I was a pickpocket and I had a 1 % success rate as a pickpocket, I wouldn't be a very successful pickpocket, unlike to get punched in the face as a very minimum within about five minutes.

41:53However, if I can then parallelize that and have zero consequences for failure, then I can suddenly become very effective. Now, imagine if AI could make it so I go from 1 % to 5%. Suddenly, at the scales I'm doing it at, That's huge. That means my profit margin goes up dramatically. And I think that's where the cyber criminals are going to jump in and start to say, actually, where can this thing start giving us marginal gains? Oh, actually, it can give us major, major gains. I mean, there was the case if you search for the French defense minister and the French defense minister from years ago was someone actually pretended to be him using a rubber mask.

42:31The story was that some French citizens and journalists have been captured by militants and the French government wanted to pay the ransom, but they couldn't pay the ransom directly because governments can't do this thing. But if you could pay the ransom on our behalf, we will pay you back and, well, we'll give you French citizenship. And this guy who was a well-known thief was got like millions out of various different high profile people just pulling off, just putting a rubber mask on and having a meeting with people as the French defense minister. Because of course, no one knew exactly what he sounded like because he was a relatively junior person.

43:09Now, imagine replaying that attack with the ability to have an AI generated or a human being controlling the AI at the moment. That is perfectly possible to have a completely fake face mapped on and a different voice mapped on. And we've seen some of the dating and romance scams using obviously pre-recorded messages kind of a la True Lies. You know, remember the scene with Jamie Curtis and Arnold Schwarzenegger. essentially people have been doing that with like different kind of things and blending them together well ai means that you can just take that and you can do that a lot better you can do it indistinguishable yeah i think identification theft is going to be a massive conversation over the next five ten years isn't it i mean i hope that innovation will solve that problem i mean things like blockchain maybe can help on that journey you know what i mean just in terms of having a bit of an like an nft for your personal brand or something i don't know but i hopefully that are very smart entrepreneurs working on the problem.

44:09Until they get stolen and then we're in a world. Yeah, then we're back to square one. So look, we're coming towards the end now. It's something I really wanted to ask you about. The YouTube channel, very impressed. You're a big gadgets guy. Definitely going to watch the RFID credit card blocker video you did. How did that come about? You've got a big following now. How did that come about? Where did this passion for gadgets come from? I suppose I've always had a passion for gadgets. I used to be into Wi-Fi security and more the unusual things you could do with Wi-Fi. And then I kind of moved on to RFID.

44:40I mean, that kind of came up because I had a certain card and the card broke and I had to pay£10 or something for a new one. And I went, there's got to be a better way of being able to not have to pay£10 when my wallet invariably breaks that card again. And lo, there was. And so I then don't have that problem anymore. So that's kind of how that whole thing started. I just decided that I just wanted to get involved and see what this technology was. And it's kind of, it's everywhere, RFID. I mean, I've got an entire drawer just down here of RFID bits and pieces from children's toys to computer game bits and pieces to hotel access cards.

45:18And people are always kind of interested when I demonstrate that a hotel access card is actually designed to protect the hotel's asset, not to protect your goods inside the hotel. They want the cheapest possible way of being able to protect their own asset and to lock you out when you haven't paid. But they don't really care about other people not being able to get into your particular room. And so we've seen some really, really poor implementations. And of course, that then segued across onto printing as well, because most people will use MyPrintAnywhere, which is where you use your access badge or some kind of token.

45:52You can use your mobile phone or whatever else to authenticate you to the printer. So instead of printing to that printer, you just print to the cloud printer, and then you use your access badge to then identify yourself, whichever is the most convenient printer, and then it comes out. So, of course, I was doing a lot of security work around there. And that's one about the credit card blockers came up because I was of the mistaken impression that you could utilize card clashes. I'm sure we've all seen the video of the man wandering around with the payment terminal and just touching it to people's back pockets and charging money.

46:21On the London Underground, it was going on for a while, wasn't it? Or maybe it still is. Well, I said, I didn't think that was possible. And then one of my followers, Tim O 'Unisoff, contacted me and said, Quentin, I think you're wrong. So I invited him onto the channel and my God, what he doesn't know about credit card security and RFID security is virtually nothing. I hope he wasn't the guy on the tube, Quentin. No, no, no, no, no. Actually, Tim works for me now. Tim works for me doing product security, doing the hardware security. And yeah, that's kind of how that whole thing came along. And he kind of showed me, he goes, actually Quentin, this is what people genuinely are doing.

46:56And he then demonstrated the other attack, which is where on the tube or other places, people use the tube because you've got close proximity and it's not unusual to be standing very close to someone with a phone out. And they use it to be able to clone the, or to copy the pan and the expiry and a few other details that they can get straight off the card. And then there are some vulnerabilities where you can actually put a real transaction through with a real card, with a real pin code, but at the network level swap the details around and so that was one of the videos where he demonstrated putting a pound on my card but actual fact the card that had been put in the reader and the pin code had been entered that was his card and yet it appeared on my monzo and it was like oh and he goes yeah and he goes obviously we've run in a pound because imagine if we did this for i don't know 50 pounds you might not even notice you might even notice that's gone and by the time I've already got the 50 pound.

47:52So by the time it's gone through all of the clearing and you've reported as fraud, I've already moved on. And so I can have someone wandering around, taking the card details from someone in some kind of transport situation, because that's probably the best. And then I can just start utilizing this elsewhere. And then we also demonstrate some other ones where we all use contactless payment and contactless payment is meant to only work if the machine is unlocked. So of course, you know, the pin code, but there are some scenarios where you want it to work locked such as transport, but in actual fact, it turns out that you can abuse this permission and you can use it in other scenarios and with a with a locked phone you can actually still pay for things in those scenarios and it's fascinating because the way i describe security a lot different between security and it is it is like playing a video game against bots against computer players whereas information security is like playing against real human beings because they do interesting and different things sometimes the attackers do stupid things many times they do really intelligent things whereas when you're in corporate IT, you're typically fighting against meantime before failure.

48:54You're fighting against physical issues. You're fighting against programmatical issues. And these are mainly in the main, all predictable. Whereas information security, you can predict that that would be attacked if you're connected to the internet, but you can't predict what that attacker would do because it's a human being. Who knows? Maybe when they broke into your website, they then didn't put the web shell because they got called for dinner. You don't know what happened in their mind. Yeah, sure. Sure. It's quite scary, isn't it? I mean, I tend to avoid coffee shop Wi-Fi if I can help it these days, because a security person who I know told me about the threats there, especially if you're accessing sensitive details like your bank account or something on coffee shop Wi-Fi.

49:34You could, if you had some dishonest hacker in the coffee shop, he could quite easily get into your machine. With things like HSTS and certificate pinning, those kind of risks are a lot less. I mean, was it FireSheep was the Firefox module ages ago that would allow you to scan the network and then just grab the sessions and literally just pick a session and just become that person? Are you a lot safer on hotspot Wi-Fi? Is it more difficult to get into that then? Yeah. I mean, as long as you picked a good password for the hotspot, then it's only you on that network. And it should be exactly the same as you just using your mobile phone to go out.

50:08and and the technologies have improved dramatically as well so every single banking app every single thing is using certificate pinning so that man in the middle attacks that we used to play around with ages ago a lot of these are so much harder and you can see this the attackers have just moved to other places and started attacking in different places that's very reassuring quentin very quickly where can you store where can people store their passwords i mean is evernote safe? Or would you just generally recommend to write stuff down and put it in a book in a safe in your house or whatever? I don't want to be overly, overly cautious.

50:42Where should you store them? So writing passwords down, it depends upon your threat model. For example, would I suggest you write down passwords for work? No, I absolutely wouldn't because there are many decent password managers out there, many decent online password managers out there that you can authenticate to with multi-factor authentication. And then those passwords can be shared between your PC, your mobile phone, et cetera, et cetera, et cetera. And they have revolutionized the world. And please, everyone, start to use a password manager. Is the Google password manager okay, do you think?

51:11It depends on how you've set it up and how you, see, it depends upon, like, have you got multi-factor authentication turned on? Have you turned on enhanced protection? Have you, are you just running this? And what machines are you authenticating to? Remember, when you authenticate to a machine, you're now trusting that particular machine. If you put your sensitive passwords in the Google Password Manager and Apple Keychain and whatever else, and then go around Dodgy Dave's house and then log on to the machine that has been used for surfing various interesting places and has 50 billion Chrome extensions and various unknown bits of software on there.

51:45Don't be surprised when you multi-factor authenticate to your online password repository if suddenly passwords can be taken out of that repository. So just be aware it's about context. And like writing passwords down, I recommend for old people, like my people, I might retire on my parents. I'm saying, look, what's your threat model? The threat model is people coming over the internet. If you've written them down, dad, it's fine to have them written down and stored in a locked drawer. For you, that's a perfectly safe place and more safe than storing them in an online password manager where you might forget the password.

52:19You may forget how to do multi-factor authentication. Someone might trick you into handing over your details and putting your fob in at various times to authenticate and steal a session. Kind of hard to steal a session if it's in a physical book. So it depends upon who you are, what you're using it, what your use case is. But for most people, an online password repository with multi-factor authentication guiding into it is probably about where you need to be. And then that means that you can have a different password for every single service because one of the biggest threats people have today, and this has been the biggest threat for the last 10 years, is reusing credentials across multiple sets.

52:53and we see that when a big load of passwords get compromised they zip along and try and use them elsewhere to see where else people have used that same username and password but if you use a password manager you don't need to know them yeah i mean the old joke about is where uh that there's an xkcd cartoon where it's like oh i've encrypted this document with 2040 bit rsa and the attacker goes oh well i can't get in and then in the next panel it's like a guy just saying oh well we'll drug him and hit him with his$5 wrench and he'll just tell us the passwords. But the advantage of a password manager is, I don't know most of my own passwords.

53:26The password manager does. I have a little fob that authenticates me to it and that's what I do. Yeah, absolutely. Well, that's really interesting. Maybe we can move on to our sort of closing questions. First of all, you're obviously a security guy. You like your gadgets. I'm sure you probably like the odd Chrome extension and stuff as well. So I wanted to ask you specifically about productivity. how do you stay productive, organized, any extensions, tools, tips you can give the listeners? So I'm old school. I like a pen and paper. I like to have a notebook and I write down things in a notebook.

54:00Otherwise I forget them. And just by writing them down, it kind of commits them to memory. I haven't really moved on to e-ink yet. I've been seeing some of the e-ink things and go, Ooh, that looks nice. But I like a notebook because I like the tactile feel of paper and I like a nice pen. That's just personal preference. I like the freeform nature. It's difficult to hack a book as well, isn't it? It is. It is. And I still remember in aeroplanes where they used to tell you to turn off all your electronics when the fastened seatbelt line came on. And of course, I could just keep my notebook out and just keep working.

54:32I could keep doing things. I like that. I like the instant recall. Okay. So last question then, Quentin. Looking back now, you're a very experienced guy. I'm sure you've got lots of your career left to go. but just looking back now, your 21-year-old self, what advice would you give to that guy? What would you say to that person right now? So my 21-year-old self, I would tell that person to buy stock in Apple and Google. Buy as much stock in Apple and Google and Facebook. And NVIDIA as well, by the way. Well, NVIDIA is relatively late. NVIDIA is relatively late into the game. But yeah, Apple, Google, and various other companies would have, well, I probably wouldn't be having this podcast.

55:09I'd be retired on an island somewhere. It's like I'd have told people to invest in cryptocurrency back then. Are you a Bitcoin guy? No, not really. Really? Oh, I am. Too late to the party. Late? Really? I think it's still early days, isn't it? Well, I saw it as a scam back then. And to be fair, I mean, there was someone I used to know who was always going on about, like I was going on about running a lot, who was always going on about how much cryptocurrency he had. And a friend of mine went, how much did he have? Because he disappeared completely. And we kind of like went, my God, if he's still got three quarters of that, there's a reason why he doesn't talk to us anymore.

55:44That's why he doesn't bother with us anymore. I think he's got different friends in a different category. So, yeah. So I'd say that. I mean, but if I was talking to a 21-year-old right now, I would say look at some of the what look to be obsolete technologies. Yeah. And get interested in them. Go and have a look at some of the things like AS400s. And don't specialize completely, but have a working knowledge. because that, when you get the technology and everyone's in cloud at the moment, and there's a lot of money in cloud, but there's also a lot of people in cloud. You take something AS400, there's a lot of money in AS400, at least there was going to be even more money in AS400, and there's not many people in there.

56:19So if you can get into certain technologies, certain niche technologies, and remember, you're not going to be able to make your career on something like AS400. Other legacy technologies are available, but you will be able to, say, identify the sets of legacy technologies which companies will still depend upon. And that's the point. Work out which ones people depend upon and say, actually, I'm still going to do my cool cloud stuff because that's going to be, I want to have that. But I'm also going to pick a couple of legacy ones and I'm going to have more than a working knowledge. And you'll then become indispensable.

56:50If you can become a security person who can look at that technology, you'll suddenly discover you're a pen tester. Well, people will have regulatory reasons to have to do that. And the only person they can call is you. Yeah, sure. Well, there you go, kids. learn COBOL. Learn about mainframes. I think that's brilliant advice. You can pick them up on eBay. Yeah, yeah. It's really good advice, Quentin. I think it was Elon Musk or someone said on a podcast before that half the world's banking system is held up by mainframes and COBOL code. And it's probably true. It's all legacy tech and no CTO wants to touch it.

57:29With an increasingly smaller portion of people who are able to maintain it. Exactly. So be one of those people. We need a new generation of AS400 experts. But yeah, no, that's really interesting. I love that. Thank you so much for your time. It's been a pleasure. Thanks for coming on the Tech Leaders podcast. Thank you for having me.

57:53Wow, that was amazing. What a great guy. Quentin, so interesting, so knowledgeable. I could have I could have spoken to him for a lot longer. It was fascinating to hear about Canon, such a global brand, to hear his version of the timeline of cybersecurity and the journey cybersecurity has been on to where we are now and what's really keeping CISOs up at night, so to speak. A couple of things stood out. I have to mention the idea or the advice to young people about learning legacy tech to be relevant. I thought it was a brilliant idea. if you're a young coder or not necessarily young, just a new coder or someone getting into the IT space.

58:34I mean, if you had a side project learning about IBM mainframes and AS400 or what have you, that would be just an absolutely brilliant addition to your portfolio then, which I think could be the difference between you getting a job and not getting a job because half the world is being held together by this legacy tech stuff and it ain't going away anytime soon. So I thought that was just absolute gold. But the other thing that stood out for me was Quentin's concern around identity theft and especially imitation and how AI will impact that. We talked about AI just taking that up a notch. We just need to start taking our online identity a lot more serious.

59:16Look, there was so much more I could bring up. But yeah, the interview speaks for itself. I hope you enjoyed it. if you found this episode valuable and thought-provoking we would really appreciate it if you could quite simply click the subscribe button and possibly even leave a review this helps us to spread the word and reach a wider audience so that we can make a bigger impact and bring you the best guest possible thank you so much for downloading

59:51Thank you.