>>Hello, and welcome to the cube conversation here in Palo Alto, California. I'm John furier host of the cube. We got a great guest, a chief information security officer CISO, Alex Shukman who's with Colgate Paul mall of company, Alex. Thanks for coming on this cube conversation. >>Thanks for having me, >>John. So fresh off the heels of RSA in San Francisco was quite the spectacle people back in person. Um, a lot of great conversations, kind of the old conversations, moving to the new, uh, really good to see, but CISO, the CISO agenda was clear on everyone's mind, more attacks, no surface area. Perimeter's dead. You got cloud native shift left, SBOs open sourced, supply chain and technology. Uh, software's now open source. How do you deal with that? A lot of complicated issues all through the prism of constantly being hacked with ransomware, everything else going on, you're in the middle of it. You gotta protect manufacturing assets, people, assets, intellectual property, you're in the middle of it. What's, what's the view. What's your current scope, the problem that you're dealing with every day. >>Yeah, it's really interesting world we live in today. Um, and, and definitely, uh, you know, the key topics were jumping around in RSA. Um, you know, everyone seems to be really trying to understand the, the environment better. And, you know, I, I think in the past we saw a lot of attacks against financial sector, a a lot of, of tax against critical infrastructure, but now many of us in the private sector, uh, especially in the non-critical manufacturing areas, you know, we're seeing the same thing that those industries have seen for many years. And so the criminals are getting, you know, less picky about their targets and, and they're targeting, uh, publicly traded companies, as much as they're targeting critical infrastructure. They're not as, uh, picky as they used to be. >>Yeah. You know, you see healthcare, financial services, uh, manufacturing, um, all there, intellectual, property's a big one, but you have, you know, now as you guys have your business, you're dealing with a global, um, borderless environment. You know, that's a big thing. You also have service providers probably work with. So you gotta have the business operations run modern in a modern way at the same time, protect in the modern way. What is the top agenda item for you in your sector, in, in manufacturing, in this area? What's the main high level, um, important task that you usually face every day? >>Yeah. When we talk to a lot of our, our peer companies or peers in the security industry, uh, especially in, in, at RSA, you know, a lot of 'em are very focused on their, their us business, a as well as you know, how to protect themselves. You know, I think one of the things that's really interesting about FGI Pala is that we are a global company and we really do have operations everywhere, uh, both from an, an office presence, a business presence, as well as manufacturing. So, you know, everything that, that those companies have to deal with who are primarily us based, and maybe they're aligning with some us intelligence, uh, we have to, to really incorporate global threats into our security program. Uh, and, and I think that's one of the really interesting things about Colgate, especially for people, uh, maybe who are familiar with our products, cuz they grew up using them. Mm-hmm <affirmative>, uh, you know, we have products, uh, all over the world and depending on which area you're in, you know, we are the one security team who's responsible for protecting the entire Colgate world. >>How has the pandemic pulled forward issues or highlighted more necessity around certain areas? Obviously the work from home thing is pretty obvious for many people and who would've thought you'd have to provision a hundred percent VPNs or whatever endpoint protection. Um, what, how has that affected you, your, your area, your company and your sector, um, how has the pandemic impacted your security? >>Yeah, and I think this is a really interesting topic. You've I I've heard many other people, uh, talk about their response to the COVID 19 pandemic over the last few years. Um, you know, I, I think the, the, the best way to answer it from, from my personal perspective is if, if you were prepared for remote work or you were prepared for a partially remote workforce, then you really could have been very prepared for the pandemic. So even prior to the pandemic, you had people traveling on business and you needed to provide system access, but in a secure way, you had people doing short term assignments, you had a remote sales force and you had a number of different, especially being a global company, uh, people working out of an office, that's not their traditional office. Mm-hmm <affirmative>. If, if you look at all the security prepared, preparedness that you need to do to enable all that, it's not that much different than the pandemic, except that it's really on steroids and it's gone a hundred times further. >>It makes everyone work harder. Yeah. You have to prepare for the a hundred percent scenario, not, you know, not some, uh, um, estimate, um, good, good call out. And the other thing too, is that there's also these, these markets where it gets pulled forward, but then pulls back when the pandemic is over. Have you seen any of that as we kind of come into our third year of, I guess, hybrid being steady state, what has kind of gone away, fell off the plate? What's been, what's the steady state. How do you, have you seen anything kind of go back? >>Yeah, I, I think one of the things that kind of seems to ping pong back and forth is, is our ability to really rely on suppliers to, to deliver it equipment. So, you know, being a, a global company we're, we have employees all over the world, we have it infrastructure that we're supporting across the globe. And, and as you see, different countries go into lockdowns, as you see different suppliers faced with, with different pressures, you know, that seems to be something that kind of ebbs and flows over the last few years, uh, being able to get laptops, being able to get multiple devices, being able to get communications equipment. So, um, you know, I think some of those industries are still trying to evolve, uh, post pandemic. Right. >>You know, I always, I always like to ask the question privately, but I won't do it on camera, how much budget you have and how much you spend on cyber. Um, but you know, generally speaking, I think it's pretty safe to say the number's going up and up, um, cuz of the threats and you got more vectors coming in, but on the question of what tools and platforms work best for you, what are you looking for? What works best from your perspective, as you evaluate new things, right? You gotta look at the new, then you gotta keep up with the state of the art to, to be ahead of the bad guys and obvious you take risk management very seriously, as well as prepare. Right. So what are some of the tools that work for you? What do you see out there that that's getting your attention? >>Yeah, you know, I, I look at a lot of different vendor solutions. I think, uh, that's pretty prevalent in our industry. I look for solutions from large names, suppliers that have been around for a number of years, but I also like to, to look at startup companies who are really trying to innovate and, and make a solution, that number one is easy to implement. And number two is, is easy to keep working. If, if we're spending more time keeping a solution working than we are using the solution. I think that's one of the pain points that than other security, uh, programs are, are fighting with. You know, we try to really avoid those types of solutions, put something in, make sure that it works well so that we can really focus on getting the value out of the solution versus trying to keep it running. >>You know, the old SAS equation, helping the enterprise get better at the old enterprise playbook, which was how do you solve complexity by adding more complexity and, you know, lock in or, you know, <laugh> more costs, hidden costs under the water, so to speak or the shark fan or the iceberg, uh, cost of ownership. I mean, so it's a time to value shift, um, cuz your time's valuable and you've got staff and the hiring's not easy. This is a huge point. >>Yeah. We're a manufacturing organization. Obviously our, our goal as a company is to produce, to sell to consumers. You know, it is a cost center. We're trying to be as efficient as possible yet still support our business and keep it safe. So, uh, if we're investing in a security solution or if we're investing in, in a, a vendor solution that that does provide some layer of protection, you know, we wanna make sure that that's efficient as possible for us and, and that we get value out of it immediately. Uh, you know, that's always the, the hardest thing to try to find a solution that, that fits your business, but also delivers value to your organization. >>You know, it's interesting, you mention it as a cost center and you're talking about cyber security, which is the, the jewels of the company. You're talking about the criticality of the business model. One hat could really take down companies. So you, you it's really offense you're it's profit center in inherently. If you look at it that way. Um, and a lot of people are looking at this this way because you're a private company, you're not a government, you don't have a militia, you got cyber protection issues. So there's a real trend for CISOs to come together. And we're seeing this, uh, about sharing for instance, you know, sharing a threat information. So there's been a big movement in the CISO community. Uh, and I'm curious to get your reaction to this and what your conversations are, where sharing is really about collective intelligence and winning and ex and helping each other. And there's this, it's a, it's a, it's an enable user enablement, a CISO enablement kind of vibe. How do you have those conversations? What is, uh, when you huddle with your CISO buddies and friends and colleagues, what's the conversations like, is this sharing thing real is how do you do it effectively? Is it data rooms? Is it, how do you protect the information? Can you share your perspective on that? Cause this is a kind of a real cutting edge area right now. >>Yeah, I think in the, in the public sector, especially in, in, uh, in the government side, as well as critical manufacturing, critical infrastructure, you know, they really do it best in class and have done it for years out, out of necessity. Uh, what's really nice to see, especially on CS a and some of the latest initiatives like shields up is, is a lot more public private sharing going on. There's a lot more information available to us as a private company. Who's not part of, of the DIB or any of the intelligence community, but at the same time, we need to protect ourselves from the bad guys as much as they do. So, you know, I like the fact that that we're seeing CS a do more and more outreach to connect public and private sector, plus there's more and more sharing initiatives going on in the ISAC communities and making sure that barrier is low and, and they're, they're sharing, uh, threat Intel IOCs, but in a safe way among a, a community of security practitioners, security practitioners are, are great at sharing. They just need the permission to do so. >>Exactly. And then getting that, getting that mindset of, we're not just a cost setter, we're a critical division or group that protects the assets. And I think that's where I seen security elevate from the it world where yeah, King's born in it, cuz that's where that, where everything is, assets are all there. And then as assets change it, you guys have a lot of operational technology called OT on your manufacturing. You gotta deal with that. Now that's usually locked down. Pretty good. Right. <laugh> so as you bring OT and it together, you guys are in the middle of that industrial I OT world. >>Yeah. What's really interesting about my, uh, career at Colgate. I I've been here for, for 25 years and uh, actually the majority of my career has been in it supporting business applications, uh, either for our sales force or our manufacturing organization, our finance and HR teams. So I really got a, a good partnership with our business teams and really understood what they were trying to deliver. Then in the last few years, when I shifted over security, it really helped me bridge that gap and understand, you know, what the business systems are doing, what the OT systems are doing and then how to best secure them. >>Yeah, it's interesting. It's it kind of goes away. It's everything now it's digital, right? Digital digitization, digital transformation. This is what what's awesome. And this is what I love about the cloud scale and it's about bringing the two worlds together and the hybrid is a steady state. Now, both workforce and environment, Alex. Great to get your perspective. Um, thanks for sharing, um, insight here on the cube. Final question, give a plug for what you're working on. What's the cool projects you got going. If you can share a little bit without getting confidential information out there, what's going on at Colgate? Uh what's on your plate. What are you excited about? Put a plug. Are you looking for hiring, give a quick plug for what you got working on? >>I mean, we have a great team. Uh, we've been growing the team steadily, uh, building out our, our security program. Uh, you know, we're always looking to hire new talent, uh, from different industries. Uh, we've been very focused on making sure that that we're building a diverse talent group inside my security program. So I'm not just looking for, uh, security practitioners. Who've been doing this for 25 years, but I've been hiring from various places like, uh, infrastructure service provider consultants, pen testers, and really trying to build, uh, uh, the best team possible. >>Yeah, just as a side to real quick note is I was chatting with a friend of mine the other day were old, old Foggie. Um, the young guns have never racked gear before. Right. They don't, they've never loaded Linux on a box. So, you know, as you start hiring some of the young talent, what's it like, what are they coming in? Obviously they probably probably have a broader CS perspective. Maybe they're probably more familiar, but you know, some of the different really rack gear all. So what is it like, what, what are some of the new, new, new young folks looking at right now? What's the, what's the skill. >>Yeah, they they're, they're used to cloud consoles and right clicking to, uh, to spin up a computer. And in an our day we unboxed the computer, put racks on, you know, had to plug in power and network and figure out, uh, you know, the right way to, to, to hook everything up and even load an OS. I mean, uh, you know, you're right out of, uh, university today, you, you probably right. Click spin up a, uh, an image in, in one of the public clouds and the OS boom comes up automatically for you, like imagine. So they >>Probably are like fish to water on the, on the dashboards and the, on some of the security challenges I can imagine they have a nice fit there, >>But at the same time, uh, you know, they have a great understanding of, uh, containers. They have a great understanding of server list. So you can really, uh, kind of marry the, the old school technology with some of the new ways of working. >>Yeah. Great stuff. Great. We'll have to do a segment on, uh, on talent and what the new roles are. A lot of openings, a lot of new opportunities. It really is a great time to be in this new digital, I don't know what the call it's nearly not it anymore. It's just digital transformation. Uh, it's just, it's just the way it is. Thanks for coming on. Appreciate it, Alex. Thanks for your time. >>Thanks a lot, John. Okay. Take >>Care. Just a cube conversation here in Palo Alto. I'm John fur host of the cube. Thanks for watching.