Assurance Unknown

Noticed that the previous upload was only 3 minutes, this is the full upload to fix that. Sorry for the inconvenience and thanks for Xavi C. for letting me know (so you are the one who is listening, ha).

My guest of this episode is Pascal van Gimst. Pascal was my first manager in Brightsight when I joined in 2006. He joined Riscure in 2008 and resigned from Riscure earlier this year. In this episode we discussed about his career and experience in developing the Conditional Access security evaluation market. This time I didn't have a blog post with the episode. You can find this podcast available on Youtube, and also Spotify, Apple Podcast, Bilibili, and Xiaohongshu. Although sometimes some episodes could be refused by the Chinese platforms. In that case, please take a look at other sources. Hope you enjoy the conversation. Please like and subscribe if you think this conversation adds something to your life and knowledge!

Welcome back to the new episode of Assurance Unknown. This episode was recorded in May this year in Taiwan where I had a candid conversation with Alan on his career. Alan is a truly special and experienced person in the industry and worked in both functional and security evaluation worlds. He shared a lot of views about the industry and also what he is working on now and towards. I did some mistake with the microphone that time and learned ever since that you should not put the microphone at your throat. Make sure to turn on the subtitle if you are not able to hear some of the sentences I said. Hope you like this episode and if you do, please like and subscribe and join the conversation. The following episodes will be the two persons Alan specifically mentioned in the podcast. And there will be a special episode with surprise content from ICCC that is happening right now. Do not miss them! The podcast can be also found on Spotify, Apple Podcast, Xiaohongshu, and Bilibili. This time I do not have time to write a blog, so I will not promote it here, ha. Thanks for watching and listening!

In this episode I interviewed the founder and CEO of Riscure, Mark Witteman, at Riscure. It was actually my first time visiting Riscure and I was quite impressed by both the company and Mark. Like I said in the episode, although not too familiar with me, Mark showed real warmth and interest to accept my invitation to talk and shared with generosity. Riscure started out as a product company focusing on R&D in tools and later came into the formal evaluation business. Part luck, but mainly the hard work and dedication they become a unique existence and a truly nice company. Hope you enjoy the conversation and please like and subscribe so you do not miss the the future episodes.

The Assurance Unknown podcast can also be found on your favorite podcast platforms such as Spotify and Apple podcast

The substack blog:
https://certcle.substack.com/p/a-different-path

Welcome to the second part of my conversation with Wouter. This is the first time I publish two episodes within a month time. I just do not want to separate the two episodes for two long and also I truly am inspired from the discussion in this second part. We touched upon the difficulties and the future of certification. What would be required to cover all the devices that need to comply to regulations such as CRA. Finally we talked about AI and how it is and could be applied in the security evaluation and certification industry. It is really fun and I really appreciate Wouter's openness and sharing. As usual, I extended some thinking in the blog post below on the interesting topics discussed. Please feel free to share your thoughts, comments, and questions. And any advice or recommendation on the content would be welcome!

Substack blogpost:
https://certcle.substack.com/p/future...

In this episode of Assurance Unknown I talked with Wouter Slegers, founder and CEO of TrustCB, about his career and the set up of the Dutch scheme, alternative approach, and SESIP. This is only the first part of the conversation. It is a bit technical, but definitely a master class in security evaluation and certification. I have a blog post on the influence of culture on security evaluation and certification industry. You can find it here: https://open.substack.com/pub/certcle/p/culture-and-certification?r=3smzvo&utm_campaign=post&utm_medium=web&showWelcomeOnShare=true

Also, this podcast is also published in audio format on Apple podcast and Spotify. Look it up by typing the title "Assurance Unknown".

Hope you enjoy the episode and don't forget to like and subscribe so you will not miss part 2 of my conversation with Wouter, which will be published outside of normal publishing cycle. Please also feel free to leave your comments or ask your questions!

In this episode I had a discussion in a tea house with Dr. Gao from the IT security department in Institute of Information Industry in Taiwan and Hungwei Chen previously from Winbond. They shared their stories with high assurance security evaluation and the difficulties in promoting security evaluation in an ecosystem. Security is generally considered a cost for the developer and I have yet to see a developer to do security evaluation/certification by freewill when it’s not necessary. As a country or a company you need to make the conscious choice if security is important for your existence on the long run and if investment is needed or worth it. While most people will say that security is important, most companies do not want to invest because it hurts the short term results (costs) and makes the price of the product higher (competitiveness). This episode is purely in Chinese and I know it will make people who only listen to the podcast and do not speak Chinese quite difficult. However, it is really important that people who I interview to feel comfortable to speak out their mind freely and precisely. On the YouTube version you are able to find the subtitles in different languages. Hope you gain some new insights from the conversation.

As usual, there is a blog associated with this episode and you can find it here: https://certcle.substack.com/p/the-economy-of-security-certification?r=3smzvo

My website: www.certcle.com

Instagram: @certcle

Welcome to the second episode of Assurance Unknown. My guest for this episode is Ernst Bovelander. Ernst was the CEO of Brightsight for many years and played quite an important role for both Brightsight and for my career. In the interview we went into his career from his first job at the hardware security group of TNO, which became Brightsight. And his return to Brightsight to take over one of the previous owners Jan Pieters as the CEO. He had two tasks, one is to make Brightsight more "professional", the other is to prepare the company for a sale. We can hear the whole process from his point of view, which if we purely look at the two tasks, he had quite good results. We also went into the process of the growth and expansion of Brightsight. Overall a very interesting story of the history of Brightsight and high assurance payment security.

When Ernst was talking about making Brightsight more "professional", I was already thinking what does "more professional" actually mean? I wrote a blog post about it as the complimentary content and I welcome you all to share your views and comments on that. You can find the blogpost here:

https://certcle.substack.com/p/what-is-a-professional-lab

Hope you enjoy this episode. I am keeping a monthly update cycle at this moment so the episodes are still in the long format. Feel free to leave your comments and join the conversation. Do not forget to subscribe and like the video if you do! Thanks!

Welcome to the first episode of Assurance Unknown podcast, a podcast about the untold stories of the high assurance security evaluation and certification industry. My guest of this episode is Martin Schaffer. We touched upon different topics in this episode including:

• The career path of Martin in this industry and how he created a dedicated security evaluation and certification department in NXP
• What was the strategy of NXP in choosing the evaluation labs for different products
• Why a faster CC evaluation and certification process was needed and how smart CC was born
• The creation of SESIP for the security evaluation of IoT products and how the idea of composition was applied
• The challenges for the future of security evaluation and certification in the era of AI

For a full experience of the podcast, please also check out the following channels:

blog: https://substack.com/@certcle

instagram: @certcle

my company website: www.certcle.com

Hope you enjoy the episode and feel free to comment, ask questions, and share your ideas with me. Special thanks to Narasimha for the cover art and Shiqi for the intro and outro music!