CEOs of Mastercard & Microsoft Discuss the Digital Transformation of Financial Services

But that's quite an introduction from Tim. And if you keep going like that, the only thing my mother would have said is that I'm strikingly handsome. But the rest of it you did pretty good on. And the only other part of our introduction you left out was that between us the average of hair is pretty good. So Satya, thank you for being here.

What we're going to do is we're going to go back and forth with a couple of questions for each other and we'll run through. We've got about 29 minutes left. So we'll try and run through as much as we can and in the process if we can get a couple of questions in from the audience we will. That fair? So Satya, let's start with you. You're on this journey of change. You've been CEO for close to three years. You've got that stock price up and humming again. It's 50% up from what it used to be. It's probably crossed the level it was at its peak. And the company has got a different energy. I can attest to that. Both from visiting you, but also from meeting your people. There's a whole series of things you're doing ranging from directing it in a different place to changing the culture to changing where you're putting your money and your investments. You want to walk us through a little bit about what transformation you're doing, how you're doing it, what part of it was easier, what part of it a little tougher, and we'll go from there.

So you've got, I've heard you say that your principles are that you can learn it all but not know it all. Talk to us a little bit about what's behind that.

So in that context, what do you think is the role that your connections back to developers and outside innovators, startups, how do you think that has enabled Microsoft to go through this journey that you're going through as compared to what you already had built into the company? Most companies of your size and scale and success in its earlier days would have said, 'I can do this. I can create it from inside. I can figure this out.' But you've embraced developers. You've embraced startups. You've embraced a bunch of things. Walk us through that a little.

So Satya, think through all what you just said. You've laid out four or five things that probably impact all of us in financial services and the fintech sector as you try and find ways to work together. How would you tease out what you've learned over these three years and the journey you're still on and think about how that can apply to us guys in our effort to move our companies to the next stage of growth? What do you think we can steal from you a little bit?

So, what you're saying is that kind of we started this out today by saying you got to design for this digital space. We're going to not try and do patchwork on it, but basically design for that by reinventing the entire experience for the end consumer by thinking through how all these tools and technologies can be used to make that more interesting and at the same time demand more from your partnerships to be able to deliver for you those kinds of features. What's next in your... in fact I was going to ask you, I know that you have spent time in the cyber security space in the Obama administration and you in fact came out of the report because one of the things that I'm very interested in is to understand even how you in the financial services space think about cyber security, how do you even think about the dimensionality of the problem?

First of all by being suitably petrified by what it means for all of us but I think that this cyber commission which by the way had one of Satya's colleagues Peter Lee who is an ex-DARPA guy who was part of the commission and actually became friends over the course of that six-month period. The commission was set up not to look at encryption, not to look at defense as in military defense that was clearly outside of the purview. The idea was to create a group of recommendations for whichever the new administration would be to be able to hit the ground running in its first 100 days with specific things we could do to change the level of awareness and capability of cyber security in commerce. That's kind of where the briefing came from. We there were a ton of principles we put together about what we should be worrying about and what we shouldn't be worrying about. I'll give you a few of them. One was clearly that you wanted government to have a lighter touch. You wanted market forces to have the maximum impact so that you wouldn't have a heavy regulatory environment. None of us in this room are excited about heavier regulatory environments. If anything, we'd like to run the other direction from that. But knowing that we are a responsibility within a frame, within guide rails but not cloistering us. So that was the first kind of premise. The second premise was that you needed better cooperation before, during, and after a cyber event between government and the private sector. And while some strides have been made in that space, we're still kind of at nascent stages of getting that right. So, for example, if there were to be a cyber event, different law enforcement agencies have different ways of approaching an institution that goes through a cyber event. You'll have your local cops will ask you for certain kind of data. The Secret Service and the FBI will ask you for different kinds of data. Very often there's conflicts between what you can give to one versus what you can give to the other without exposing your company to litigation. That's not rocket science. It's fixable. If you don't fix that, you put companies into a rigorous bind when you're asking to cooperate with government institutions. A third one was the realization that the United States being the leader in the space has the responsibility of trying to figure out how the global rules in the space will evolve. So for companies like ours that get more than 50% of our revenue from outside of the US, the tragedy is that the way cyber security rules and laws are evolving in different parts of the world, it'll balkanize our capability to actually use scale to deliver quality and in fact they're being used in a way to create competitive barriers for us in different countries and we need to get some rules of the road. At the end of the day, if today you feel that North Korea is a complicated country that does not have our best interest at heart, we can go to public bodies. We can go to global bodies. We can introduce sanctions. We can go and say they're bad guys. In the cyber world, there's no such thing. It's the wild west. It's everybody for themselves and no one can go to somebody else to point a finger. That's being played out as we see right now in this whole electoral debate on cyber security. And the fourth principle that I found very interesting was the principle of we're only as strong as our weakest link. And I must have made this point at every single meeting. To me, the weakest links in cyber security are small business and the individual consumer. And when Erin was up here a little while ago talking about the individual consumer and introducing two-factor authentication, the fact is that we've got this stupid system today where we expect our average consumer to change their password every 30 days for every one of the things they use. Well, the average guy has 18 different things they're working on. That's 18 times 30. That's way too many passwords for you to remember. So what you do is you create simple passwords. Either password itself or 1234567 or Satya1, Satya2 or if you want to be really clever capital S, a, t, y, a, 1 or capital S, a, t, y, a, 1, hash, all of which a 5-year-old can break into with a small computer in about 5 seconds. The other little factor that banks, all of us know is that 70% of those who've opened an online banking account with us, which by the way is the majority of our consumers in the banking world, 70% of them have not changed their password from the first date that they opened their online banking room. So expecting a consumer to behave differently just because you scare the crap out of them isn't going to happen. The same is true of small business. To expect a small dentist shop to actually spend money, effort, and energy on creating some form of cyber security capability is to expect the wrong thing to happen. So I think the weakest link needs protection. And the truth is that no matter how big one of our companies is or Jamie Dimon was here a little while ago, you're here now. You're two of the largest companies who care about the space. No matter how much you spend or how much we spend or how much all the institutions in this room spend, we cannot compete with state actors in different parts of the world who have got relatively deep pockets to fight with us. And therefore having a combination of public-private work done before, during and after an event is kind of important. When you put all that together, we put a few recommendations and I'll give you a sense of some of them. The most important one to me was to fix today. So I have joint cyber defense and response exercises between the government and us and Bill Rogers is deeply involved with BITS and the organization that's part of the Financial Services Roundtable. These guys have commissioned a series of exercises between us and Treasury to see how we respond. I actually think that's really important. All of us need to do that in whichever industry we're in because learning on the fly is a really bad way to respond to a very sophisticated antagonist at the other end. The second one is to get a simple sort of thought going on the reverse Miranda equivalent. Meaning if I were to, my regulator is Treasury. If I were to go to them in advance of an event and talk to them about things that worry me, if in turn they come back and say we gotcha, that's a bad idea. So if I can go to them without the fear of retaliation, then that reverse Miranda equivalent or what stays, what happens in Vegas stays in Vegas. In this case, what I tell you is between us, let's work together to make it better as compared to use it as a way to catch me. That's going to be really important. So there were a series of those things, harmonization of different regulatory bodies and rules. Then there was a bunch of things to do with the future, the internet of things, the fact that no default passwords should be allowed. So if your refrigerator and your toaster are supposed to not be talking to each other, but they do start talking to each other. First of all, it probably was because they were default passwords all set to 0000. Second, there is no way to figure out the anomalous data that's flowing there because the refrigerator and the toaster may not have an individually identifiable IP address for you to track it down. So, we've got this internet of things coming our way and it sounds really good, but it needs a few standards to be put into place. Back to your point about standards to ensure that we get this done the right way. We kind of put into that the fact that updates and patches should become part of reality. Otherwise, if you can't update that darn fridge, not much use having it. Then of course there's the consumer's point of view. I don't know whether this fridge is better attuned for cyber security than that fridge. I have to be a geek to figure it out or I got to be Satya to figure it out. I can't do that. So, how about giving me a food nutrition label equivalent that tells a layman like me, a bit like today when I go to buy something, I know I'm getting 20% of my trans fats and 6% of my cholesterol and 8% of my sodium. Well, give me that saying this is a better grade on cyber security as a fridge than that one. So, I can know what I'm getting signed up for. Those were all part of recommendations we put in. Simple stuff, not that complicated, but they're going to need a very different way of thinking between government and the private sector. And then we got into workforce issues and how do you get the right kind of people into the workforce and into issues around global rules and global governance. But that's kind of what this panel tried to do.

I agree. And I'm glad that the recommendations that you're pushing are really taking us in that direction but we'll have to just get that next level and it can't be done just in the US and this is a place where we got to be very very careful that this is actually, it's those global rules of engagement, global rules, those are the hardest to get done. We're going to have to figure that out. Right, we've got about a minute and a half left and I'm just wondering if we got a question from the audience maybe that we can get at Satya. Somebody here with a question, sir?