>> Narrator: From Las Vegas, it's theCUBE. Covering Qualys Security Conference 2019. Brought to you by Qualys. >> Hey, welcome back, you ready with Jeff Frick here with theCUBE. We are at the Qualys Security Conference in Las Vegas. This show's been going on, I think, 19 years. This is our first time here. We're excited to be here, and we've got, there's always these people that go between the vendor and the customer and back and forth. We've had it go one way, now we've got somebody who was at Qualys and now is out implementing the technology. We're excited to welcome Grant Johnson. He is the director of Risk and Compliance for Ancestry. Grant, great to see you. >> Thank you for having me, great to be here. >> Yeah, it is always interesting to me and there's always a lot of people at these shows that go back and forth between, and their creating the technology and delivering the technology versus implementing the technology and executing at the customer side. So, you saw an opportunity at Ancestry, what opportunity did you see and why did you make that move? >> Well it's a good question, I was really happy where I was at, I worked for here at Qualys for a long time. But, I had a good colleague of mine from way back just say, hey look, he took over as the chief information security officer at Ancestry and said, "they've got an opportunity here, do you want it?" I said, "hey sure." I mean, it was really kind of a green field. It was the ability to get in on the ground floor, designing the processes, the environment, the people and everything to, what I saw is really a really cool opportunity, they were moving to the cloud. Complete cloud infrastructure which was a few years ago, you know, a little uncommon so it was just and opportunity to learn a lot of different things and kind of be thinking through some different processes and the way to fix it. >> Right, right, so you've been there for a little while now. Over three years, what was the current state and then what was the opportunity to really make some of those changes, as kind of this new initiative with this new see, so? >> No, yeah, we were traditional. You know, a server data center kind of background and everything like that. But with the way the company was starting to go as we were growing it, really just crazy, just at a crazy clip, to where we really couldn't sustain. We wanted to go global, we wanted to move Ancertry out to Europe and to other environments and just see the growth that was going to happen there, and there just wasn't a way that we could do it with the traditional data center model. We're plugging those in all over the place, so the ideas is, we're going to go to a cloud and with going to the cloud, we could really rethink the way that we do security and vulnerability management, and as we went from a more traditional bottle which is, where you scan and tell people to patch and do things like that, to where we can try to start to bake vulnerability management into the process and do a lot of different things. And you know, we've done some pretty cool things that way, I think as a company and, always evolving, always trying to be better and better every day but it was a lot of fun and it's been really kind of a neat ride. >> So, was there a lot of app redesign and a whole bunch of your core infrastructure. Not boxes, but really kind of software infrastructure that had to be redone around a cloud focus so you can scale? >> Yeah. There absolutely was. We really couldn't lift and shift. We really had to take, because we were taking advantage of the cloud environment, if we just lifted and shifted our old infrastructure in there, it wasn't going to take advantage of that cloud expansion like we needed it to. >> Right. >> We needed it to be able to handle it tide, of high tide, low tide, versus those traffic times when we're high and low. So it really took a rewrite. And it was a lot of really neat people coming together. We basically, at the onset of this right when I started in 2016, our chief technology officer got up and said, "we're going to burn the ships." We have not signed the contract for our data center to renew at 18 months. So we have to go to the cloud. And it was really neat to see hundreds of people really come together and really make that happen. I've been involved in the corporate world for a long time in IT. And a lot of those projects fail. And it was really neat to see a big project like that actually get off the ground. >> Right, right. It's funny, the burning the ship analogy is always an interesting one. (grant laughs) Which you know, Arnold Schwarzenegger never had a plan B. (grant laughs) Because if you have plan B, you're going to fall back. So just commit and go forward. >> A lot of truth to that. Right, you're flying without a net, whatever kind of metaphor you want to use on that one. Yeah, but you have to succeed and there is a lot that'll get it done I think, if you just don't have that plan B like you said. >> Right, so talk about kind of where Ancestry now is in terms of being able to roll out apps quicker, in terms of being able to scale much larger, in terms of being able to take advantages of a lot more attack surface area, which probably in the old model was probably not good. Now those are actually new touch points for customers. >> It's a brave new world on a lot of aspects. I mean, to the first part of that, we're just a few days away from cyber Monday. Which is you know, our normal rate clip of transactions is about 10 to 12 transactions a second. >> So still a bump, is cyber Monday still a bump? >> It's still huge for us. >> We have internet at home now. We don't have to go to work to get on the internet to shop. >> You know, crazy enough, it still is. You know, over the course of the week, and kind of starting on Thanksgiving, we scale to have about 250 transactions a second. So that was one of the good parts of the cloud, do you invest and the big iron and in the big piping for your peak times of the year. Or and it sits, your 7-10% utilization during the rest of the year, but you can handle those peaks well. So I mean, we're just getting into the time of year, so that's where our cloud expansion, where a lot of the value for that has come. In terms, of attack surface, yeah, absolutely. Five years ago, I didn't even know what a container was. And we're taking advantage a lot of that technology to be able to move nimbly. You can't spin up a server fast enough to meet the demands of user online clicking things. You really have to go with containers and that also increases what you really need to be able to secure with people and the process and technology and everything like that. >> Right. >> So it's been a challenge. It's been really revitalizing and really, really neat to me to get in there and learn some new things and new stuff like that. >> That's great. So I want to ask you. It may be a little sensitive, not too sensitive but kind of sensitive right. Is with 23 and Me and Ancestry, and DNA registries, et cetera, it's opened up this whole new conversation around cold case and privacy and blah blah blah. I don't want to get into that. That's a whole different conversation, but in terms of your world and in terms of risking compliance, that's a whole different type of a data set I think that probably existed in the early days of Ancestry.com >> Yeah >> Where you're just trying to put your family tree together. So, how does that increased value, increased sensitivity, increased potential opportunity for problems impact the way that you do your job and the way that you structure your compliance systems? >> Boy. Honestly, that is part of the reason why I joined the company. Is that I really kind of saw this opportunity. Kind of be a part of really a new technology that's coming online. I'd have to say. >> Or is it no different than everyone else's personal information and those types of things? Maybe it's just higher profile in the news today. >> Not it all, no. It kind of inherent within our company. We realized that our ability to grow and stay affable or just alive as a business, we pivot on security. And security for us and privacy is at the fore front. And I think one of the key changes that's done for maybe in other companies that I get is, people from our development teams, to our operations teams, to our security department, to our executives. We don't have to sell security to em. They really get it. It's our customer privacy and their data that we're asking people to share their most personal data with us. We can give you a new credit card. Or, you can get a new credit card number issued. We can't give you a new DNA sequence. >> Right. >> So once that's out there, it's out there and it is the utmost to us. And like I said, we don't have to sell security internally, and with that we've gotten a lot of support internally to be able to implement the kind of things that we needed to implement to keep that data as secure as we can. >> Right, well that's nice to hear and probably really nice for you to be able to execute your job that you don't have to sell securities. It is important, important stuff. >> Grant: Yes, that's absolutely true. >> All right, good. So we are jamming through digital transformation. If we talk a year from now, what's on your plate for the next year? >> We just continue to evolve. We're trying to still continue the build in some of those processes that make us better, stronger, faster, as we go through, to respond to threats. And just really kind of handle the global expansion that our company's undergoing right now. Just want to keep the lights on and make sure that nobody even thinks about security when they can do this. I can't speak for them, but I think we really want to lead the world in terms of privacy and customer trust and things like that. So there are a lot of things that I think we've got coming up that we really want to kind of lead the way on. >> Good, good. I think that is a great objective and I think you guys are in a good position to be the shining light to be, kind of guiding in that direction 'cause it's important stuff, really important stuff. >> Yeah, we hope so, we really do. >> Well Grant, nothing but the best to you. Good luck and keep all that stuff locked down. >> Thank you, thank you so much! Thanks for having me. >> He's Grant, I'm Jeff. You're watching theCube. We're at the Qualys Security Conference at the Bellagio in La Vegas. Thanks for watching. We'll see you next time. (upbeat music)