>> Announcer: Live from Nashville, Tennessee, it's theCUBE. Covering Commvault GO 2018. Brought to you by Commvault. >> Welcome back to Nashville, Tennessee. This is Commvault GO, and you are watching theCUBE. I'm Stu Miniman, with my co-host Keith Townsend. Happy to welcome to the program, this is a user conference, so we love digging in with the users. I've got David Mccurdy, who's the CTO from the great state of Colorado. Thanks so much for joining us. >> Great to be here. It's a great event, I'm happy to be here. We're here to evangelize the great work Colorado's been doing, with Commvault, and just in general. >> Alright great, so we're from Chicago, Boston, and Colorado, Denver. So we're not going to talk football, but tell us a little bit about, you know, you're CTO, love talking to the CTOs. What's your technology charter? Give us a little bit of the thumbnail, as to kind of, you know, what divisions you support, how many people you have, that sort of thing. >> Yeah, so the way the state's set up is I work underneath the Governor. We're an office of the Governor, so it's actually the Governor's Office of Information Technology. We support all the traditional branches of government, that people think of, in terms of agencies, like the Department of Health and Human Services, Medicaid, Department of Corrections, DMV, Department of Revenue. So all the big agencies all fall under our department. And then about 800 of the 900 staff inside of OIT report to me directly. And that's all the infrastructure and application stacks, all the strategy. Chief Data office, Chief Transformation office. A lot of responsibility, lots of fun, lots of long weekends, but it's been a good row for the last four years. >> David before we dig into some of the data protection stuff, I love, you talk about innovation. You talk about technology transformation. First of all, IT in general, and government specifically, often get, you know, labeled with the, oh well they do things the old way, and they've got no budgets, and they never make any changes. I've had some great case studies. I've talked with people in roles like yours, so give us a little bit of, what's it like to be working under state government this day and age, with 2018, with technology. >> It's very exciting. It's very exciting to work for Colorado specifically. I don't know if it translates to all other states. I've talked to other CIOs and CTOs around the country, but we have a very supportive governor. He just announced his campaign to run for president, maybe, we'll see how that goes. But outside of that, he's very innovative. He took a business trip to Israel, came back, and set up a cyber security lab in the state, because he thinks there's a major need for more cyber security and those disciplines. In Colorado, today, we're running negative 14% unemployment for security jobs, so it's just, huge opportunity. Outside of that, my boss, Suma Nallapati, is state CIO. Right underneath him, is all about innovation. How can we make Colorado number one in everything we do. And that's really the goal. What the governor said, the way he talks about technology, he wants technology to be elegant. That's not word you hear a lot. But when you think about that and apply it to technology, there's a very specific outcome you're trying to get out of that. >> Alright, well David, at this show, we're all talking about data. And everybody's, you know, it's what can I do with my data? And how do I make sure that things don't get wrong? Well, anybody that's been in the IT for a while is, Murphy's Law sometimes does play out. So you've actually had a couple of experiences. Some good things you've learned, but some challenges that you had, maybe share with us what happened. >> Yeah, I mean one of the things I'm here to talk about is we kicked off an initiative called Backup Colorado. And what it was is, it was consolidating all the backup and recovery services for all those agencies I just named, plus some more, right. Monster project, monster task. It was all born out of a major data failure the state had. We were a fairly new organization. We were immature. We were still running things in a siloed environment. Most of the country, most large organizations have gone down the IT consolidation path. We were a few years down the road, and we got hit with a major data loss event. And it was specific to marijuana data, which makes some people smile, some people frown, but it's a very interesting topic. It wasn't interesting to lose customer data though. I don't care if you're a private organization, or a public organization, this was real data loss. And it highlighted the need for a focused approach to solving those problems. So we went about just kind of transforming the whole space. First, put a proposal on the table. Going to the general assembly. Going to the Governor saying, this is what we need to do. They signed off on it, and then we implemented it, right. We got tens if not hundreds of people together around the state. We coordinated agencies. We got people on board that didn't want to be on board. They liked the silo approach. They liked their agencies doing their own thing. But you can't do anything right 16 different ways. You don't have to do it one way, but it can't be 16. But we took a standardized approach, and we worked with Commvault as our partner to deploy a complete backup and recovery system for the state. Highly successful project. Rolled out, standardized. Everything you could want. While we're doing that, we are completely changing our application and infrastructure stacks. We are consolidating all of our servers into three data centers in the state. We're bursting into the cloud. We're replatforming on software, the service. You know, all those. I'm responsible for each one of those stacks. My guidance was just go and change the world, right. In a very non-senile way, we went out there, and we were like, how can we do this thoughtfully. How can we do it, but push, blaze new trails, that type of thing. And the story that I've been sharing is, we got to see the end results of that. What kicked it off, was a public disaster, but the state was hit with a ransomware attack. Very targeted, very coordinated. They hit one of our larger agencies. We had good security in place, but there's always stuff that can happen, as you've kind of eluded to. And because of this project, because of the team coordinated effort, because of the technology, because of the stuff we were leveraging, we were able to bring that agency back whole. Which a lot of organizations cannot say. A lot of the technologies cannot say, with as many systems that were impacted for the time period they were, to bring that agency back whole, and actually have the executive director of that agency, doing very similar conversations as we're doing now. How can dots around the country, roll out a plan very similar to this? >> Well David, people process technology, you guys are changing processes, you're changing technology, extremely disruptive. Talk about the impact on your people. What mindset, or what changes did you have to make organization wide. 800 people was a lot of people to get in line. What did you start, what did you do? What was successful, well not so much. >> Well first I had to get my customers on board, right. And compelling events helped bring customers on board. I don't think that's the best way of doing it, but always leverage a compelling event. In this case, we had a compelling event. We had the onus from our executive branch and a legislative branch. So we had the hammer if we needed it to get it done. The team actually came together. We ran a very successful RFP. We baked off competitors in the space. And it was a beautiful thing to see all my server engineers, all my desktop guys, all my database guys and gals comin' in and working together to make this project happen. I didn't have to sell them on it. They came to me and said, we think this is the best technology stack for the state. When I recognized, when I heard them, they all got on board and we were able to roll it out. And so I think it was that team approach, not top down, but you know, let's all come together and find the right thing for the state. I think that was why it was so successful. It was a team approach, and we had executive buy in, we were able to get it done. >> You talked about how Commvault helped with that transition, 16 different backup products, if the state was like any other organization, there's at least 15, 16 different backup products, people like what they use. And transitioning to something new requires training, support. How did Commvault help you guys in that transition? >> You know, they were a great partner, all the way through the RFP process, to bringing it in and doing training. We have a big thing at the state, the technology stack, we do luncheon learns, so there's lots of training. Commvault brought a lot of resources. We had engineers specifically assigned from Commvault to help with the project, the roll out, and then the transition. So a very effective partner, in terms of helping us along the way. It never helps to have that kind of hammer, as I said before, to push it forward. I really couldn't have asked for anything more. I spoke a little bit about this the other day. When we had this compelling event with the ransomware this year, I picked up the phone, and I got an answer right away. And I said we're going to need you once again. And they showed up. Commvault showed up. The great thing was, we didn't need them, right. My engineers had an effective turnover and training. They got the initial alerts before anybody did, before any of our security groups, anybody, Commvault detected this ransomware really before any of my tool suites because of the way it came into our organization. Which was kind of cool. But just in general, a great partnership. They were there all the way through the recovery of CDOT as support for our team. Really weren't needed just because of the effective transition. >> That's an interesting point. You talk about, you would think it would be the security tool that would be alerting you. Commvault and companies like it, sit in an interesting position. You've got data, you've got metadata. That surprise you that that was the tool that helped alert you in the first? >> Shocked me, shocked me, right. I mean we spent a lot of money building stacks of tools to protect the state, and very effective tools. There's nothing against those tool suites specifically. We were actually rolling out another tool that week that ultimately would've prevented it. That being said, stuff happens and the way this ransomware came in, bypassed that visibility. But Commvault, looking at our backups every night, taking differentials of 'em, saw encrypted files on disk, sent out an alert. The teams knew exactly what to do. Got executives on the phone. Got security ops on the phone. And it kicked off from there, so yeah, shocked, you know, happy that we caught it. Not the way I would have wanted, but that's why you've got layers of security. That's why you've got layers of teams to support each other. >> So specifies, outside of the support capability that Commvault provided and one, helping you guys get alerted to the event, and then the support reacting to the event, talk to us. What did they take to recover from the event? Was this a multi-month thing? Multi-week, multi-hour? How did you guys recover and how much did you recover? >> It took us a little over a month to recover. It's actually a great conversation maybe for another time. But building a structure in an open attack. Like when you have a coordinated resources from other countries, trying to do the United States, or the state of Colorado harm, the first thing you're going to do is make sure they're outside of your environment. So for about the first two weeks, we had everybody from the National Guard to the Defense Department there, helping us evaluate the situation. Getting it to a place where we felt comfortable bringing the department back up. Once we reached that point, and there is never a clear line in the sand. There's a role for the CIO and the CTO in that place to say, hey, now's time we've done everything we can and then we've very methodically started bringing desktops online and servers online. And Commvault played a huge role in that as well as some other vendors. But, in all, we restored about 192 servers. Some were infected, some weren't, but just from a sensibility stake, we wanted to go back to clean backups, clean restores, a place where the customer felt comfortable. We were able to do it in a way that there was no data loss to the customer or at least manage data loss. Meaning, in some cases, their systems, they wanted to go really back on, because their data didn't change very much in there. My biggest pinpoint in this whole process is, I want to bring that department up much faster, right. There's two sides that you're looking at: How do you protect the department in the short term? And how do you protect them in the long term? So I had to look at both sides of it. Very interesting experience. Don't wish it on anybody. >> David, last thing I want to ask is, the role of data, how do you, inside the state of Colorado, look at the role of data and the changing role of data? And if you look at Commvault, they are really expanding where they play. They're playing in multi-cloud. They've got artificial intelligence helping them. They're helping with governance and compliance. How do you see them lined up? Where do you see your relationship going with them in the future? >> Well, obviously, I like to stay with partners that take care of me, so there's obviously an affinity there, in terms of how they've helped the state in the last year. The data is really two parts, the agencies data, and then the resident, and the customers of the state of Colorado's data, right. So you first got to look at who owns and who is the steward of the data. And as IT for the state, our role is protecting that data, both in the short and long term. But as it becomes more and more of an asset, and we all know data is an asset today, it's almost the most critical asset. So protecting it is just as important as how you're going to innovate with it. So we are very excited about how we're going to be leveraging data in the future. Some of the issues we're talking about, the Department of Transportation wants to take their data for Road X and change how people drive. You know, very similar as to how you may use Waze and stuff like that. The DOTs around the country want to take that data and leverage it all over the place. So you're not only taking an asset that was leveraged for a very different purpose 10 years ago and completely transforming industries, you're doing that all across state government, right. The impetus, the need for protecting it, using it, I'm very excited with where they're going and how they look at data, Commvault specifically. I had a great conversation with our CTO last year about, I'm storing all this data on FASTDISK anyway. Why can't I use this as a data lake? How can I get metadata for your customers? How can I take this in places where maybe the founders of this company didn't even envision 20 years ago. It's very exciting how they're looking at the technology and where they can take it. AI is one of my focus areas for the year. I'm going to listen to everybody's pitch and I'm going to choose the right ones, because I do think it's transformative. If they can do it correctly and ultimately lessen the burden on IT, that's what we're looking for, right. That's what AI should bring to the table, is the ability for IT to do more with less. So that's what we're looking for and I'm excited what they're going to do with it. >> Alright, well David Mccarthy, we really appreciate you joining us, sharing your story. For Keith Townsend, I'm Stu Miniman. We'll be back with more coverage here from Commvault GO in Nashville, Tennessee. Thanks for watching theCUBE. >> David: Thank you. (lively tech music)