Episode 39 of The Security Podcast of Silicon Valley aired on March 9, 2024, with Jon McLachlan hosting. The guest was Steve Orrin, the federal chief technology officer and a senior principal engineer at Intel (Podbean, LinkedIn). The episode is called “Steve Orrin, Federal CTO at Intel, on Tech, Trust, and Transformation.”
“That’s where confidential compute comes in.”
Steve Orrin, at 18:06
Steve’s LinkedIn lists him as chief technology officer and senior principal engineer at Intel Federal since 2013, after eight years as a director of security architecture at Intel. Before Intel he was chief security officer of Sarvega, chief technology officer of Sanctum, co-founder and chief technology officer of LockStar, and chief technology officer of SynData Technologies (LinkedIn).
The show notes list the topics: AI, trusted execution environments, cloud computing, team building, mergers and acquisitions, and entrepreneurship. They say Steve leads Intel’s work with the Defense Department and the federal government (Podbean). In December 2022, WashingtonExec put him on its list of top chief technology officers to watch in 2023. Its profile says his team covers AI, cybersecurity, edge and high-performance computing (WashingtonExec).
This page follows the conversation in order: a section for each part of it with the sources beside it, sixteen figures, fifteen clips from the tape, the full transcript, and five tools: a quiz, a scorecard for how well you protect data in use, a calculator for how many people three data points can single out, a timeline, and a to-do list. Where the decodes of the tape disagree on a word, the transcript puts its best guess in brackets, and the page doesn’t quote those words.
Three roles in one title
Jon notes from Steve’s LinkedIn that he has been at Intel for almost 20 years. Steve says Intel acquired him in 2005. He then led what Intel called security pathfinding: security innovation above the chip, into the operating system, virtualization and the web. For about nine years he drove trusted cloud, trusted virtualization, anti-malware and web security. In 2013 he became the federal CTO and took over Intel’s federal technology practice.
“As the federal CTO, I really have sort of three roles inside the company.”
Steve Orrin, at 1:28
The first role is helping federal customers and their ecosystem use Intel’s architecture, hardware and software for the government’s enterprise and mission goals. The second is translating government requirements back into Intel’s business units, so they build what the government will need. The third is advanced innovation: taking the big hairy problems to agencies, the primes and Intel’s technologists, and showing what is possible in AI and data science, security and high-performance computing.
A run of security startups
Jon asks about Steve’s startup years before Intel. Steve did a series of security startups through the 1990s and 2000s. The first, in 1995, made a desktop file encryption and security product. The second, founded in 1998, went to the other end of the spectrum with mainframe security. As CTO of Sanctum he helped create the web security market, and after Sanctum was acquired he did the same for XML security. Intel bought that last company, and then gave him the chance to keep innovating on Intel’s budget.
“No more VC calls.”
Steve Orrin, at 3:40
His LinkedIn gives the names and dates. SynData Technologies, 1995 to 1998, made desktop email and file security. LockStar, which he co-founded and ran as CTO from 1998 to 2001, secured legacy applications and opened them up to web services. Sanctum, where he was CTO from 2002 to 2004, made the AppScan testing tool and the AppShield firewall. Watchfire bought Sanctum, and he was its VP of security and technology until 2005. Sarvega, where he was chief security officer in 2005, made products to secure and scale XML web services (LinkedIn). IBM bought Watchfire on July 20, 2007 (Wikipedia).
Jon has heard this called intrapreneurship, and Steve agrees.
Federalize commercial solutions
Jon asks what it is like to face outward in the government security space, with a finger on the pulse so Intel can build what agencies will need. Steve says part of it is good people at your side. AI changes fundamentally every six months or faster, and new threats keep coming. The other part is talking to customers: sitting down with the people who own the problem, seeing the environment they live in, and bringing what other industries have done.
Intel is inside quite literally everything, he says, so his federal work is never far from financial services, healthcare, or industrial and manufacturing.
“I like to joke that I federalize commercial solutions often, taking what worked really well in oil and gas, and I can apply that to a Navy ship, or taking what worked really well for health insurance and applying that to the VA, that is, for all intents and purposes, one of the largest health providers in the world.”
Steve Orrin, at 5:31
The VA’s health arm, the Veterans Health Administration, runs 146 medical centers and 772 community clinics and employs over 350,000 people (Wikipedia).
The 80-20 rule
Jon says it comes back to never reinventing the wheel, and to falling in love with the problem itself. Steve has a name for it.
“Like 80% of a solution in one space with 20% customization can solve multiple different things.”
Steve Orrin, at 6:21
It goes both ways, he says. A commercial solution gets modified for a government use case, or something that worked for the government scales out to other verticals.
AI takes the mundane
Jon asks where AI, hardware acceleration, security and privacy meet, and how Intel is positioning itself. Steve says AI has a hype cycle, but things really are changing, faster than with other technologies. Regulators and policymakers are trailing. Businesses are unsure what AI will mean for them, while their data scientists are off adopting it.
He expects AI to transform cybersecurity by automating manual and time-consuming work. Today, he says, people rely on reams of data and gut instinct to say a set of indicators is an APT campaign, the work of an advanced persistent threat (Wikipedia). Steve wants AI to make that call without 40 hours of top-tier security people. He isn’t trying to replace the security team.
“the problem is we’re burning them out by having them look at every firewall hit”
Steve Orrin, at 8:30
“AI is going to be able to tackle the sort of the 70 to 80% of what I call the mundane or the stupid stuff.”
Steve Orrin, at 8:36
Let AI identify, categorize, mitigate and patch those, he says. Your top-skilled people, whom you don’t have the budget to add to, can then go after the hard things you can’t yet train an AI to find. They get the interesting work, and everything else gets fixed faster.
Attackers already use it
Steve says AI is already changing how threat actors work. He has seen phishing campaigns written by GPT-style tools. They are much better when you can ask for a phishing email in the English of the South than when someone in Russia has to guess what that looks like.
“their adversaries are using the tools”
Steve Orrin, at 9:47
That’s the challenge he sees for CISOs, whose own teams aren’t taking advantage of the tools. The message he wants to get across is that these tools won’t stress your organization. They could help.
The iceberg
The other side of AI is what everyone focuses on: the transformer, the GPT, the large language model. Steve calls that the sexy stuff, and says people don’t recognize the work it took to get there.
“The tip of the iceberg is what everyone sees and everyone’s excited about.”
Steve Orrin, at 10:29
Under the water is data curation, ingestion, normalization, weighting and labeling, the work that gets quality out the other end. That is where infrastructure matters: faster training, tuning, and faster inferencing so you can make decisions quicker.
Scale out, scale up
By infrastructure Steve means the hardware and software the AI runs on. A lot of people think putting it in the cloud is enough.
“One thing is, cloud is great at scale-out, but it’s not that great at scale-up.”
Steve Orrin, at 11:02
Scale-out can also be costly and slow, he says. For massive language models, dedicated hardware accelerators or heterogeneous computer architectures can be more efficient. Each stage of the life cycle can have its own best hardware and software: data ingestion, curation, initial training, feedback and tuning, and inferencing. The biggest GPU you can find is the right answer for some use cases, and not for all of them.
From the pointy end of the spear to Gaudi
Jon asks whether Steve’s day-to-day pulls him into Intel’s AI projects. Steve lists Intel hardware for different parts of the AI use case. Low-SWaP capabilities do inferencing and iterative learning at the pointy end of the spear, next to the camera or the sensor. The Gaudi chip architecture is available in the cloud for high-speed training at scale. Intel unveiled Gaudi3, an AI chip for generative AI, in December 2023, and it launched in 2024 (Wikipedia).
Often the question is how to use the hardware you already have, he says, which is why Intel invests in software. You don’t want a custom implementation for every architecture. Intel’s software abstractions, such as oneAPI, let you build once and deploy everywhere. They compile for each hardware architecture, so you don’t have to be an expert in FPGAs, GPUs or custom AI accelerators. Wikipedia describes oneAPI as an open standard Intel adopted for one programming interface across GPUs, AI accelerators and FPGAs, so developers don’t keep a separate code base for each (Wikipedia).
The government has every side of the problem, he says. There are massive data sets to train on, normalize and curate. There is also what he calls spot training: you’ve seen a thing once, and you need to infer what it is.
Who secures the AI?
Steve says most of the talk is about how AI can help secure an enterprise, or how adversaries use it.
“One thing we forget is how do we secure this AI?”
Steve Orrin, at 14:00
Jon brings up the privacy implications and poisoning. He isn’t sure we realize how much data is ending up in the cloud. That data can train models and add a lot of value to people’s lives, and a lot of people hand it over willingly in exchange for services.
Three data points
Steve says that in large data sets, pieces that don’t seem interesting on their own add up once you pull them together. It used to take six points, he says.
“six points of data could uniquely identify an individual.”
Steve Orrin, at 14:57
He thinks it’s down to three or four now, with the power of these AIs. What we thought wasn’t private data can get to private information fairly quickly, with a powerful enough AI or a big enough data set.
In 1997, Latanya Sweeney found from census records that a five-digit ZIP code, gender and date of birth could identify up to 87 percent of the U.S. population (Wikipedia). The calculator below runs that math on your own numbers.
Whatever you query, it learns
The other side of the problem shows up in large language models like ChatGPT.
“whatever you query it, it learns.”
Steve Orrin, at 15:22
Steve describes a large technology manufacturer whose engineers asked ChatGPT questions that contained confidential IP. ChatGPT trained on those questions, so the IP became part of the model. If you know what to ask, he says, you can pull it back out. Ask for the API between two pieces of software, and you learn about the software modules.
Companies answered with policies on the proper use of ChatGPT. Some knee-jerked and blocked it, which didn’t do them much good. Others told staff not to post or query anything confidential. Steve calls those policies needed, because it was the Wild West. Jon says maybe it still is, to some extent. Our post on shadow AI has an AI-use policy that lets a team use AI without a ban.
On-prem is one approach
Jon puts himself in a large company’s shoes. It cares deeply about its IP, wants to keep its next big thing under wraps until release, and still wants this technology. He suggests going on-prem. Steve says that’s one approach.
“there’s another that’s gaining popularity, and that’s confidential computing.”
Steve Orrin, at 17:00
Data in use
Steve calls confidential computing a relatively new concept, around for the past couple of years. It protects personal data, corporate IP and trade secrets, or government information in the cloud, from other tenants and from the cloud provider itself. Hardware and software from Intel, the other hardware makers and the cloud providers work together, so the memory and the code the CPU is processing are encrypted.
He walks through the life cycle of data. Data at rest has full disk encryption. Data in transit has TLS, IPsec and other transport encryption. Data in use was the missing piece.
Run a model or a training job inside what Steve calls a secure enclave, or a confidential computing container, and the protection covers the memory.
“it’s protected from both physical and virtual attacks, as well as the access by the admin or anyone else”
Steve Orrin, at 18:17
Even a co-tenant on the same system can’t get at that memory, because it’s encrypted. You still need controls on who can query the model, he says. Where it pays off for business is domain-specific LLMs. A model trained on patient records to predict drug interactions gets cloud scale, and the data stays protected for regulation and confidentiality.
Wikipedia defines confidential computing as a technique focused on protecting data in use, working alongside storage and network encryption for data at rest and in transit (Wikipedia). The Confidential Computing Consortium formed in 2019 under the Linux Foundation, with Intel among its founding premier members (Wikipedia).
Jon names HIPAA for healthcare patient data, DSS, and classified information in government contracts. HIPAA became law on August 21, 1996 (Wikipedia), and PCI DSS sets how companies store, process and transmit cardholder data (Wikipedia). Those verticals stand to gain from AI, Jon says, as long as we move into that future responsibly.
An overlay on memory
Jon describes trusted compute as cryptography and hardware mechanisms that wall off a section of the CPU and memory, so only authorized parts of the system can reach the enclave. Jon checks his understanding: inside the enclave, the code runs within an encrypted space. Steve says exactly. New hardware in the platform encrypts memory from the CPU out, as an overlay. A database, an AI training set or a web server runs in the enclave as it did before, in an environment the CPU controls and encrypts.
“It doesn’t have to change your code.”
Steve Orrin, at 21:06
Other than calling a special instruction to launch it, the application doesn’t know it’s inside. Open source and commercial tools move existing code into an enclave without changes. Steve names Graphene and Gramine among the open source ones, and Fortanix among the products.
Graphene and Gramine are the same project. Graphene began at Stony Brook University in 2011, Intel Labs started contributing in 2015, and in 2021 it joined the Confidential Computing Consortium under the new name Gramine. Its site says it runs unmodified applications inside Intel SGX (Gramine). SGX, Intel Software Guard Extensions, is the set of instructions behind Intel’s enclaves. It first shipped in 2015 with the sixth generation of Intel Core processors. Intel deprecated it on 11th and 12th generation Core processors in 2021 and kept developing it on Xeon for cloud and enterprise use (Wikipedia). Intel Trust Domain Extensions, which isolates a whole virtual machine, arrived in 2023 on 4th Gen Xeon Scalable processors through select cloud providers (Wikipedia).
Peacemakr and the iPod
Jon says the startup he led, Peacemakr, did almost the same thing in software.
“And we did almost exactly the same thing, but entirely in software without any of the hardware support.”
Jon McLachlan, at 21:44
The market didn’t catch on. He’s glad Intel took the security down to the CPU and the system architecture, which he calls much stronger than software alone.
At Apple, Jon was on the DRM team, with a similar threat model. Purchased movies, books and music had to reach iPhones, desktops and iPods and get decrypted for playback. He recalls the Napster era of content theft, and imagines how Apple’s pitch to the music labels about selling their music online first went over. That kind of security opened up the business, he says, and gave Apple and the iPod a refresh.
Napster launched in June 1999 and shut down in July 2001 (Wikipedia). Apple launched the iTunes Store on April 28, 2003 (Wikipedia). Apple’s family of DRM technologies is called FairPlay (Wikipedia), and DRM is one of the uses Wikipedia lists for SGX (Wikipedia).
Jon then raises homomorphic encryption as another path, one that may work alongside trusted compute. He likes to think of security in layers, and says no single door blocks every attack.
“There’s no such thing as mitigating all of your risks.”
Jon McLachlan, at 23:52
An absolute dog
Steve calls homomorphic encryption an exciting field, with a bunch of startups and some large investments. Wikipedia describes it as encryption that lets you compute on encrypted data without decrypting it first (Wikipedia).
“one of the challenges with homomorphic encryption is that it is an absolute dog when it comes to performance and resources required to run.”
Steve Orrin, at 24:06
The math is an unnatural act for a computer, he says, so it needs a real need and a narrow data set. Today’s uses are mostly transactional, like a database with secure query access. You have to turn your whole database and query engine homomorphic to get there.
Hardware accelerators and software optimizations are coming, including Intel’s own optimizations for commercial hardware. Steve expects different transactions to live in different places, based on who owns the data. If you own the data and the query, homomorphic encryption works once its speed catches up. Where many parties have to coordinate, confidential computing may fit. He hopes the two converge into homomorphic encryption running inside a hardware-protected enclave.
“give me my fully homomorphic VM, if you will.”
Steve Orrin, at 26:08
He puts that a couple of years away. Craig Gentry described the first plausible fully homomorphic scheme in 2009 (Wikipedia).
A cryptographer at Zama
Jon admits he doesn’t follow the bleeding edge of homomorphic encryption closely, and agrees it’s a pig on CPU. At Apple he worked on the compiling and obfuscation side of DRM, and a cryptographer there delivered the white box AES mechanisms he integrated. That cryptographer later joined Zama, a startup based in Paris, and from time to time Jon hears of a big improvement. Wikipedia’s list of homomorphic encryption libraries includes TFHE-rs, a Rust library from Zama (Wikipedia).
Exfiltration becomes a non-point
Steve says it will take a lot of innovative thinkers to get there. Once confidential computing or fully homomorphic encryption scales, a whole slew of threats come off the table, and the budget can go to other threats because the data is secure by default.
“if the data never gets decrypted in a fully homomorphic environment, then exfiltration attacks become a non-point in some respects.”
Steve Orrin, at 28:09
Build or buy
Jon asks the question he says every entrepreneur listening wants answered: how does Intel think about acquisitions, and build versus buy? Steve says it’s domain specific. For any large company, Intel, Oracle or Microsoft, the first test is whether a deal is strategic to a business you’re in or want to get into.
“Those successful acquisitions advanced the strategic goals that were already in place for the company.”
Steve Orrin, at 29:19
Companies struggle when they buy something interesting that doesn’t line up with the core business. In the 2000s, he says, a lot of companies on acquisition sprees never fully integrated what they bought. If you’re a small company, ask whose business your widget helps: faster time to market, faster time to closing the deal, a bigger addressable market, or a way to leapfrog the competition.
x86 alone
When Intel bought AI companies, Steve says, it was to speed up its core strategy of heterogeneous compute.
“x86 alone isn’t going to solve every workload.”
Steve Orrin, at 30:30
Jon asks if he’ll get fired for saying that. Steve says not anymore. Altera was the example. Intel’s core is building hardware at scale and getting it through manufacturing and the ecosystem to the end user, so adding FPGAs was a natural move. AI accelerators let Intel go after those markets with the same channel, manufacturing capacity and engineering.
“do I spend two years and $800 million or whatever to go build that capability? Or do I buy it and then tweak it as needed to get it into what I need it to be?”
Steve Orrin, at 31:46
Intel acquired Altera, an FPGA maker, for $16.7 billion in cash in December 2015 (Wikipedia). Wikipedia’s list of Intel acquisitions includes Nervana Systems, an AI company, in August 2016, and Habana Labs, a machine learning company, for $2 billion in December 2019 (Wikipedia).
The non-obvious acquirer
Steve’s example is Sarvega, where he was chief security officer. Intel didn’t look like the logical buyer for a software company that secured and accelerated XML, because Sarvega thought of itself as an XML service.
“What if I could accelerate and secure XML web services from the hardware up was the question that Intel was asking.”
Steve Orrin, at 32:25
Intel saw a gap and a new market to accelerate, and wondered if Sarvega’s technology could take it there in hardware. When Intel first reached out, Steve, his CEO and the rest of the team went to hear what it had to say. Down the road it made a lot of sense. In a market of XML firewalls and XML acceleration gateways, Intel wasn’t the acquirer they had in mind.
“Sometimes it’s who do you give an inorganic opportunity to that they don’t have today?”
Steve Orrin, at 33:08
Wikipedia lists Intel’s purchase of Sarvega, an XML software company, on August 17, 2005, and of Conformative Systems, another XML software company, on February 8, 2006 (Wikipedia).
For the technology and the people
Jon asks if Intel bought them for the talent, the product or the market share. Steve says the technology and the people. Sarvega had good market share and key customers, but Intel has everyone as a customer. In 2005, Intel had smart chip engineers, designers, architects and a software enabling team. It didn’t have XML or application security expertise. It bought that expertise and Sarvega’s way of processing XML transactions in software, to put into hardware and scale.
A lab at the office
Jon notes that Intel has kept Steve around for 18 and a half years, and asks about a typical day. Meetings, or hands dirty? Steve wishes he could spend more time on code, and he still gets to play with new technology.
“I have my own lab at the office where we get to play with the cool technologies, deploying them, trying things out.”
Steve Orrin, at 35:28
Most of his time goes to customers and Intel’s internal architects: understanding what the government needs, getting deep into the challenges, and working with Intel’s teams on them. Intel’s technology runs from the pointy end of the spear and sensor platforms to high-performance computing and networking, so one day is IoT and the next is high-performance computing or cloud. The government has every use case, from security of patient records at the VA to object recognition for manufacturing at a Navy base.
On the security side, new platforms still excite him: testing new capabilities, plugging in the probes and pulling up Kali Linux to see what happens. Kali Linux is a Linux distribution for digital forensics and penetration testing, maintained by Offensive Security (Wikipedia).
Enough rope
Jon mentions demo days, and the team Steve has surrounded himself with. Steve gives the mantra he has had for most of his career.
“you surround yourself with really smart people”
Steve Orrin, at 37:03
Then listen to them, he says, and give them enough rope to cause trouble and break glass. Jon puts it as autonomy and a safe space to take risks. As federal CTO, Steve has a team of solution architects, technology architects, technology specialists and subject matter experts across AI, cybersecurity, scale computing, sensing and sensor fusion, and the edge. WashingtonExec’s 2022 profile gives his motto in other words: “Surround yourself with people who are smarter than you and listen to their feedback” (WashingtonExec).
How would you tackle it?
Jon asks for Steve’s favorite interview question. Steve wants to see one thing.
“how an individual processes information to solve a problem.”
Steve Orrin, at 37:57
He presents a scenario and asks how the candidate would go about tackling it. He doesn’t like to micromanage, so the answer tells him two things: whether they have the tools to take on hard problems, and what he’ll need to feed them once they join. Do they need detailed requirements documents, or pointers to the right subject matter experts? It’s a hard question, he says, because it isn’t about their best day or worst day. You never get the same answer twice.
Download it, then ask
Jon asks for a green flag, one that would make Steve fight to bring someone on board. Steve has two checkboxes. The first is the candidate who goes and gets hands-on.
“where they go and they download the thing and they play with it.”
Steve Orrin, at 39:22
Jon calls that rolling your sleeves up. The other checkbox is a candidate whose first step is to go talk to somebody and learn. No one can know everything, Steve says. At Intel the expert is often close by: USB and PCI came out of Intel, and you can ping the person who did it.
Seven companies, Intel among them, began developing USB in 1995. Ajay Bhatt and his team worked on the standard at Intel, and Intel produced the first USB chips that year (Wikipedia). Work on PCI began at Intel Architecture Labs around 1990 (Wikipedia).
Successful architects, he says, are the ones who reach out to an expert they can call. Jon calls it the humility to say the more you know, the more you know you don’t know.
From research biology
Jon asks how Steve got into security. His degree wasn’t in security. It was research biology.
“I had biology and computers and hacking around.”
Steve Orrin, at 41:17
He was a hacker who liked to see how things fell apart and how systems worked. In the late 80s there wasn’t a career in cybersecurity yet, and computer science was basically COBOL programming, which didn’t excite him either. So he went the bio route, in microbiology and biochemistry, got his degree and did graduate research. His LinkedIn lists him as a research associate in a biochemistry and molecular biology lab at New York Medical College from 1993 to 1995 (LinkedIn). COBOL is an English-like programming language designed for business use, still widely used on mainframes (Wikipedia).
In the mid-90s, one of his grants ran out. A friend of a friend with some money wanted to do a startup in this new thing people were talking about, the internet, and a friend said Steve was a hacker who knew security. They started the company in 1995. Three months later he was all in.
“This is like right before Netscape’s IPO.”
Steve Orrin, at 42:20
Netscape went public on August 9, 1995, sixteen months after the company was formed (Wikipedia). Steve’s company talked about security before anyone major did, and he got in on the ground floor of the security market we know today. Three months after joining, he was its CTO and chief architect, and he never looked back. One of his mentors was Bruce Schneier, who published Applied Cryptography in 1994 (Wikipedia).
Tore it to shreds
Jon asks whether Steve worked with Schneier himself. Steve says Schneier was an advisor at his first company and a partner at his second. At SynData, building desktop encryption, Steve came up with his own algorithms, because there wasn’t a standard set in those days. He pinged Schneier out of the blue and hired his consultancy to look at one.
“And we hired him and he tore it to shreds, literally tore it to shreds”
Steve Orrin, at 43:56
Jon calls it the best type of love there is. Schneier’s advice stuck with Steve.
“You shouldn’t be building security defenses unless you understand the offense.”
Steve Orrin, at 44:15
You shouldn’t build a new algorithm unless you know how to take one apart, Schneier told him, so learn cryptanalysis first. Steve applies the same idea to cyber defense: you can’t defend well unless you understand how the adversary gets in. After the review, Schneier worked with them to build a better box.
Schneier’s law, a name Cory Doctorow coined in a 2004 speech, says anyone can invent a security system so clever that they can’t think of how to break it (Wikipedia).
A launch pad
Jon asks what advice Steve would give his younger self. After a few investment jokes, Walmart stock and Amazon from Steve and bitcoin from Jon, Steve gets serious. He never regrets decisions, even the bad ones, because we learn from our failures.
“think of the failures not as, oh my gosh, the world’s crashing around you, but learn from those.”
Steve Orrin, at 46:03
It’s usually a year or so after a major failure that you see it was a good learning experience, he says. A couple of his early startups weren’t successful, and when your babies don’t make it, it crushes you. He would tell himself each of them was a launch pad, even if it takes longer than you think to get up and do the next one.
Diversify
In the 90s, Steve says, you went 100% all in on your startup. The other advice he’d give himself is something he has been doing more recently: diversify, and spread the wealth a little. His mainframe security company learned along the way that the opportunity went beyond mainframe security, into webification of the mainframe. Expanding your horizons early makes the leap easier, he says, even if you don’t act on it.
“Think more broadly, at least have it in the back of your head so that you’re better prepared for the curveballs that are absolutely going to come your way.”
Steve Orrin, at 47:40
Change is inevitable
Jon agrees: change is inevitable, and we have to move with it. He closes at the top of the hour, thanks Steve for the extra minute, invites him back anytime, and offers to buy him a coffee or a beer.
After the tape
Steve is still Intel’s federal CTO. His LinkedIn lists him as chief technology officer and senior principal engineer at Intel Federal from 2013 to the present (LinkedIn).
Post-quantum in silicon. On August 31, 2026, Steve talked with Yuval Boger on The Superposition Guy’s Podcast about post-quantum cryptography deadlines for U.S. agencies and their supply chains. The show notes cover migration deadlines in 2030 and 2031, a January 2027 requirement for national security system purchases, and a standard Windows laptop that can hold 20,000 crypto assets. They say Intel started building post-quantum signing algorithms such as XMSS and LMS into silicon five hardware generations ago, because chip design has a five-year lead time (The Superposition Guy’s Podcast).
Chip supply chains. Steve wrote “Why Semiconductor Visibility Is Becoming a Supply Chain Priority” for Supply Chain 24/7 on June 22, 2026 (Supply Chain 24/7), and “New Visibility Challenges in the Modern Supply Chain and How to Solve Them” for LogisticsMatter on July 15, 2026 (LogisticsMatter).
On a committee with Bruce Schneier. [un]prompted II, the AI Security Practitioner Conference, was set for October 27 to 29, 2026, in San Francisco. Its committee page lists Steve and Gary McGraw as track chairs for the Build track, and Bruce Schneier as one of that track’s members ([un]prompted).
Altera went its own way. Altera became an independent subsidiary of Intel on January 1, 2025, and on April 14, 2025, Intel agreed to sell a 51% controlling stake to Silver Lake (Wikipedia).
More on this show. On episode 75, Jonathan Mortensen of Confident Security explains private AI inference where nothing in the infrastructure can see inside the confidential compute module, and what runs inside it is attested to. On episode 69, Riad Wahby of Cubist talks about hardware-backed key management. On episode 70, Sasha Sinkevich jokes that homomorphic encryption is right around the corner. On episode 61, Taher Elgamal, Netscape’s chief scientist from April 1995, explains where SSL came from. For post-quantum cryptography, listen to episode 32 and episode 96 with Kevin Kane of American Binary.
![A timeline. March 2024: this episode, aired on March 9, 2024. January 2025: Altera on its own, an independent subsidiary of Intel from January 1, 2025. April 2025: Silver Lake, Intel agrees to sell a 51% controlling stake in Altera. June 2026: Supply Chain 24/7, Steve on why semiconductor visibility is becoming a supply chain priority. July 2026: LogisticsMatter, Steve on new visibility challenges in the modern supply chain. August 2026, filled: post-quantum, Steve on The Superposition Guy's Podcast, about post-quantum deadlines for U.S. agencies. October 2026, filled: [un]prompted II, track chair for the Build track, with Bruce Schneier on the same track.](/images/inuse-fig-after.svg)
Did you catch it? A seven-question quiz
Seven questions from the episode. Each answer links the moment in the transcript.
Quiz · seven questions
Did you catch it?
Pick an answer to see whether you caught it, and where it is on the tape.
-
How many roles does Steve say he has inside Intel as federal CTO?
b. "As the federal CTO, I really have sort of three roles inside the company." Transcript, 1:28.
-
What does Steve joke that he often does with commercial solutions?
a. "I like to joke that I federalize commercial solutions often" Transcript, 5:31.
-
How much of the security team's work does Steve think AI can tackle?
a. "AI is going to be able to tackle the sort of the 70 to 80% of what I call the mundane or the stupid stuff." Transcript, 8:36.
-
What picture does Steve use for the data work behind an AI model?
b. "The tip of the iceberg is what everyone sees and everyone's excited about." Transcript, 10:29.
-
Where does Steve say confidential compute comes in?
c. "protect data when it's in memory and the CPU is processing and doing transactions? That's where confidential compute comes in." Transcript, 18:02.
-
How does Steve describe homomorphic encryption's performance today?
a. "it is an absolute dog when it comes to performance and resources required to run." Transcript, 24:10.
-
What did Bruce Schneier do with the algorithm Steve hired him to review?
b. "And we hired him and he tore it to shreds, literally tore it to shreds" Transcript, 43:56.
Is your data protected in use?
Steve walks through data at rest, data in transit and data in use. This scorecard checks all three, plus the AI and re-identification risks he raises.
Scorecard · eight questions
Is your data protected in use?
Answer for your most sensitive data. If two answers fit, pick the lower one.
-
Do you know where your most sensitive data lives, and who runs those systems?
- No
- Roughly
- Yes, written down
"I'm not sure we realize how much data is ending up in the cloud." See Who secures the AI?
-
Is that data encrypted at rest and in transit, inside your network too?
- No
- One of the two
- Both, everywhere
"data at rest protection, that's full disk encryption." See Data in use.
-
Do you know whether the AI tools your staff use train on what they type in?
- No
- For some tools
- Yes, for every tool we allow
"whatever you query it, it learns." See Whatever you query, it learns.
-
Do you have a written policy on what staff may put into public AI tools?
- No
- We block the tools
- Yes, and people know it
"Some companies knee-jerked and just blocked it." See Whatever you query, it learns.
-
Before you share or train on a data set, do you remove ZIP codes, birth dates and other fields that point to a person?
- No
- Sometimes
- Every time
"six points of data could uniquely identify an individual." See Three data points.
-
How do you protect sensitive data while it is being processed?
- We don't
- We keep it on-prem
- Enclaves or confidential VMs
"there's another that's gaining popularity, and that's confidential computing." See On-prem is one approach.
-
Who can read the memory of the hosts that process that data?
- Any admin, and the provider
- A short, named list
- Nobody outside the enclave
"even a co-tenant that's co-resident on that system, can't get access to that memory container because it's encrypted and it's protected." See Data in use.
-
Do you test your defenses from the attacker's side?
- No
- Once a year
- After every big change
"You shouldn't be building security defenses unless you understand the offense." See Tore it to shreds.
Start with a written AI-use policy and a map of where your sensitive data lives and who can reach it.
Your data is safe on disk and on the wire. Next, strip the fields that point to a person before you share data, and move one sensitive workload into an enclave.
Keep testing from the attacker's side, and plan your move to post-quantum encryption.
How many people do three data points pin down?
Steve thinks three or four data points may now be enough to identify a person. This calculator estimates how many people in a population are the only one with their ZIP code, birth date and sex, the three fields in Latanya Sweeney’s 1997 study.
Calculator
How many people do three data points pin down?
Three numbers: people in the data, ZIP codes they live in, and the span of birth years.
With 300,000,000 people, 40,000 ZIP codes and 80 years of birth dates, there are 2,336,000,000 combinations of ZIP code, birth date and sex. About 88% of people would be the only one with theirs.
The 300 million people, 40,000 ZIP codes and 80 years are our example. The math assumes people spread evenly over ZIP codes, birth dates and two values for sex, and real populations are lumpier. Sweeney's study of census records found up to 87 percent.
From PCI in 1992 to post-quantum deadlines in 2026
Steve’s path, the technology and deals he talks about, the ideas behind them, and the episodes on this show that pick up the thread. Filter by topic.
Timeline
From PCI in 1992 to post-quantum deadlines in 2026
- PCI
Intel's local computer bus, after work that began at Intel Architecture Labs around 1990 (Wikipedia, on this show).
- New York Medical College
Steve is a research associate in a biochemistry and molecular biology lab, to 1995 (LinkedIn, on this show).
- Applied Cryptography
Bruce Schneier publishes his book on the design, use and implementation of cryptographic algorithms (Wikipedia, on this show).
- SynData Technologies
Steve's first startup, desktop email and file security, where he is CTO to 1998 (LinkedIn, on this show).
- USB
Seven companies, Intel among them, begin developing USB, and Intel produces the first USB chips (Wikipedia, on this show).
- Netscape's IPO
Sixteen months after the company was formed (Wikipedia, on this show).
- HIPAA
The Health Insurance Portability and Accountability Act becomes law (Wikipedia, on this show).
- Three fields
Latanya Sweeney finds that ZIP code, gender and date of birth can identify up to 87 percent of the U.S. population (Wikipedia, on this show).
- LockStar
Steve co-founds the company and is its CTO to 2001, securing legacy applications and opening them to web services (LinkedIn, on this show).
- Napster
The file sharing application launches, and shuts down in July 2001 (Wikipedia, on this show).
- Sanctum
Steve is CTO to 2004, with the AppScan testing tool and the AppShield firewall (LinkedIn, on this show).
- iTunes Store
Apple launches its store for Mac OS X (Wikipedia, on this show).
- Watchfire
Watchfire acquires Sanctum, and Steve is its VP of security and technology to 2005 (LinkedIn).
- Schneier's law
Cory Doctorow coins the name in a speech (Wikipedia, on this show).
- Intel buys Sarvega
An XML software company, where Steve is chief security officer (Wikipedia, on this show).
- IBM buys Watchfire
A security software testing company (Wikipedia).
- Fully homomorphic encryption
Craig Gentry describes the first plausible construction (Wikipedia, on this show).
- Graphene
Development starts in the OSCAR Lab at Stony Brook University (Gramine, on this show).
- Federal CTO
Steve becomes chief technology officer of Intel Federal (LinkedIn, on this show).
- SGX
Software Guard Extensions ship with sixth generation Intel Core processors (Wikipedia, on this show).
- Intel acquires Altera
For $16.7 billion in cash (Wikipedia, on this show).
- Nervana Systems
Intel buys the AI company (Wikipedia, on this show).
- Confidential Computing Consortium
Forms under the Linux Foundation, with Intel among its founding premier members (Wikipedia, on this show).
- Habana Labs
Intel buys the machine learning company for $2 billion (Wikipedia, on this show).
- Gramine
Graphene joins the Confidential Computing Consortium under the new name, and Gramine 1.0 ships (Gramine, on this show).
- SGX on Xeon
Intel deprecates SGX on 11th and 12th generation Core processors and keeps developing it on Xeon (Wikipedia).
- WashingtonExec
Steve makes its list of top chief technology officers to watch in 2023 (WashingtonExec).
- Trust Domain Extensions
Confidential virtual machines on 4th Gen Intel Xeon Scalable processors, through select cloud providers (Wikipedia, on this show).
- Gaudi3
Intel unveils the AI chip for generative AI, which launches in 2024 (Wikipedia, on this show).
- Episode 39
Steve on the show (on this show).
- Altera on its own
Altera becomes an independent subsidiary of Intel (Wikipedia).
- Episode 61
Taher Elgamal, the father of SSL, on why passwords are holding us back (episode 61).
- Silver Lake
Intel agrees to sell a 51% controlling stake in Altera (Wikipedia).
- Episode 69
Riad Wahby of Cubist on hardware-backed key management (episode 69).
- Episode 70
Abhi Sharma of Relyance AI on what it takes for a business to trust AI (episode 70).
- Episode 75
Jonathan Mortensen of Confident Security on provably private AI (episode 75).
- Episode 96
Kevin Kane of American Binary on encrypted data stolen today and decrypted later (episode 96).
- Semiconductor visibility
Steve's article in Supply Chain 24/7 (Supply Chain 24/7).
- Supply chain visibility
Steve's article in LogisticsMatter (LogisticsMatter).
- Post-quantum deadlines
Steve on The Superposition Guy's Podcast (The Superposition Guy's Podcast).
- [un]prompted II
Steve is a track chair for the Build track, with Bruce Schneier on the same track ([un]prompted).
What to do this week
Five things, in the order of the episode.
- Write the AI-use policy. Say what staff may and may not put into public AI tools, starting with confidential IP. Our post on shadow AI covers a policy that doesn’t ban AI, and Shadow-AI Detection inventories the AI tools already touching company data.
- Strip the fields that point to a person. Before you share or train on a data set, look for ZIP codes, birth dates and sex, and run the calculator on your numbers. Training Data PII & Secret Scrubbing finds and removes personal information, including the quasi-identifiers in free text.
- Map data at rest, in transit and in use. Take the scorecard with your team, then ask your cloud provider which confidential computing options it offers for your regulated workloads.
- Try one workload in an enclave. Pick a service that handles sensitive data and test it in an enclave with a tool that needs no code changes, such as Gramine.
- Test it like an attacker. Schneier told Steve to learn the offense first. A penetration test does that for your systems, and you can book 15 minutes with us.