>> Announcer: From Hell's Kitchen in New York City, it's the Cube on the ground at Serverlessconf Brought to you by SiliconAngle Media. >> Hi, I'm Stu Miniman with the Cube, here at Serverlessconf in Hell's Kitchen, New York City. Our first time doing the Cube here. Happy to welcome back to the program, a multi-time guest, Mark Nunnikhoven who is the Vice President of Cloud Research at Trend Micro. Mark, great to see you. >> Thanks for having me. Great to see you Stu. >> Alright, so Mark repeat after me. >> Stu and Mark: Security is everybody's responsibility. >> Yeah. >> So you did a keynote talking about security, and I love, unfortunately I didn't get to see it in person, but I feel like I was there 'cause we had the Twitter's and the commentary. >> Yeah. >> And stuff like that. So security, it's a non-issue right? Serverless it's all set, containers and everything before it, everything's secure right? >> Yeah. As you know from looking at the headlines, we do security really well in the IT community. So you can sleep well at night. We don't have to worry about anything. No, unfortunately it continues to be a challenge, and the point of the keynote yesterday was, sort of, give the state of the nation, how we're doing in the Serverless environment. And the good news is we're doing well in security for Serverless designs, but the bad news is not through any individual or purpose action. Simply by just building in these methods, we get a huge amount of security advantages. >> Yeah. >> But we can do better. >> Alright so Mark, what can we learn? It's funny, we see these repetitive things go on in the industry. It's like "Oh well, I'm just going to use Sass." "I don't need to worry about security, right?" "Oh, I'm going to go public Cloud, they'll take care of it for me." >> Yeah. >> Now containers, Serverless it feels like we have the same trope over, and over, and over again, right? >> We do, very very much so. And one of the things I called out yesterday was actually highlighting how the OWASP Top 10, which is the 10 most common vulnerabilities in web applications, have not really changed since 2010. Yet we didn't have even the concept of Serverless in 2010, but we're still making the same mistakes. SQL injection, still the top mistake that we've been making for the last decade. >> Alright, so we're talking about security. Let's step back for a second. So I believe a lot of the people watching these interviews are going to be like "Serverless, I don't get it." I love the, the Cloud Guru folks have the t-shirt, the update of the Cloud one. There is no Cloud, it's just somebody else owns the computer now. I forget the full thing. >> Somebody else's informal execution environment that last's for milliseconds, something along that. >> So what from your standpoint, you've been talking to a lot of customers >> Yeah. >> that you're speaking at this conference. You know, the what and the why of Serverless? >> Yeah, so Serverless is really that sort of, I won't say conclusion, but the logical next step of Cloud where you start to realize, when you move out of your own data center where you were doing everything, and you move into the Cloud and go, well half of the responsibility is on Amazon, or Google, or Microsoft, or whoever. And then you go, well hold on a second, why am I even managing Windows or Linux? What advantage is that to me? I make widgets, or I sell shirts or whatever. And so you move up into something like containers, and you ask the same question. Go, well why am I even running those? Serverless is that last step on the current line of going, I don't have to run any of this stuff. I can just write code that's directly tied to my business. >> Yeah, and I like how you said it's the next step. I think back to science, and it was like when we found the atom. Everybody was super excited, and then oh, there were protons and neutrons, and they were like oh my gosh, and electrons and everything. And then they're like "Oh and then there's the quark." >> Yeah. >> Everything like that. So the digger, the further down we deep, but what is the value of that? So we went from the server, to virtualized environments, to microservices, to containers. Why is that important? What's the business outcome that people are getting when they get excited and start playing with Serverless? >> For sure, so there's really two main points for me. One is that you have a direct tie between IT and the business, both from performance as well as cost. So now you can actually say that application had cost me $1.10 per transaction, and I normally make $9 on each transaction. So this is good, let's continue to invest there. So there's finally a breakdown between the separation, and you get that unity with the business and IT. And the second is accessibility. Because there's far less infrastructure and plumbing to worry about, you have people who aren't traditionally viewed as developers, more of the business analysts, starting to actually write solutions that are far more directly in line with what you want to do as a business. >> Alright, one of the things I liked seeing in the keynotes was can we do today and what can't we do today? So web applications, great, IOT, things like the Amazon Button, or the Amazon Alexa. >> Yeah. >> All leverage that. What are some of the cool applications that you've seen leveraging Serverless today? >> Yeah, so a lot of cool robots. A friend of mine, Ben Kehoe from iRobot gave a great talk on it. A lot of their stuff leverages that, and I'm a nerd, I love robots. >> Who doesn't like robots? >> Exactly, right? >> We welcome our robot overlords here at the Cube. >> Absolutely. And if they're listening, when they process this, thank you for your service. But yeah, there's a lot of great things where we're crossing out of the digital world into the real world. Because we can connect these things up with the advantage of Serverless. We don't have to build out a huge infrastructure. If you need smart lighting, if you need smart appliances, all of the IOT world, it's all Serverless. >> Yeah. So I'm going to bring up this word >> Yeah. >> That has some weight to it enterprise. >> Uh oh, let me brace. Yeah. >> So companies, we're talking, the Cloud is being used for whole businesses and everything like that. Is Serverless for, it's web, and robots, and cool toys, and everything like this. What are you seeing? What are the limitations, and does this become a predominant operating model in the future? >> Yeah, there's a lot of hesitancy in the enterprise because they're not familiar with it. >> Yeah. >> But realistically, any enterprise today should have a very simple, sort of, fall down model. When they're building something new, start at Serverless. If that doesn't meet your needs, put it in a container. If that doesn't meet your needs, build a server. Again, you want to do less work. The challenge, again, is comfort level. Serverless breaks a lot of our tooling. >> Yeah. >> So you need to learn a lot of stuff, but it's definitely where enterprises should be looking today if they want to get ahead. >> Okay, and Mark what advice do you give to companies today as they think about security across some of these various environments? >> Well you led the cheer at the start. Security is everybody's responsibility. From a security practitioners side, point of view, we've done ourselves a disservice in isolating ourselves in teams and not talking to people. We need to be educators within our organizations to help people understand what they can do. It goes all the way back to the Mythical Man-Month. It's easier to squash a bug before you ever write it, rather than when it's deployed to millions of people. Same thing for security, the earlier you're on it, the more people are looking at it, the better off you're going to be. >> Alright Mark, I want to give you the final word. Take aways, the event isn't done, but for people that aren't familiar where do they get started? Where should they dig in for Serverless? >> Yeah, there's a ton of great content here. So this is the fifth Serverless event. A lot of the old talks are up on YouTube, and Cloud Guru's done a fantastic job on pulling this community together. Check out all that stuff. The major providers, all of them are here. All of them have excellent entry level projects to help you get rolling and really that's the best way to start. Fire up the console, start building something. Why not? >> Alright Mark, really appreciate you joining. Thank for sharing with the community here, our community. Look forward to seeing you at many more events, and thank you so much for watching the Cube. (upbeat music)