>>from around the globe. It's the Cube presenting accelerating automation with definite brought to you by >>Cisco We're back. This is Dave Volonte and TK Kia Ninis here he's a distinguished engineer at Cisco TK My friend. Good to see you again. >>How are you? >>Good. I mean, you and I were in Barcelona in January and, you know, way saw this thing coming, But we didn't see it coming this way, did we? >>No, I have. No one did, but yeah, it, uh that was right before everything happened. >>Well, it's weird, right? I mean, we were you know, we it was in the back of our minds in January. We said Barcelona hasn't really been hit yet. Looked like it was really isolated in China. But But wow, what a change. And I guess I guess I'd I'd start with that. We're seeing really a secular change in your space and security identity access management, cloud security, endpoint security. I mean, all of a sudden, these things have exploded as the work from home pivot has occurred on it. It feels like these changes are permanent or semi permanent. What are you seeing out there? >>Yeah, I don't I don't think anybody thinks the world's gonna go back the way it waas. Um, to some degree, it's it's changed forever. Um, you know, I I do a lot of my work remotely on bond. And so, you know, being a remote worker isn't such a big deal for me. But for some, it was, ah, huge impact. And like I said, you know, remote work, remote education, you know, everybody's on Thea opposite side of a computer. And so the digital infrastructure has just become a lot more important to protect. And the integrity of it essentially is almost our own integrity these days. >>Yeah, And when you see that you know that work from home pivot I mean, you know, our estimates are along with a partner GTR. About 16% of the workforce was at home working from home prior to co vid, and now it's, you know, north to 70% plus and and that's going to come down maybe a little bit over the next six months. We'll see what happens with the fall surge. But people essentially, except expect that to the you know, at least double that 16% you know, going forward and definitely So what is that? What kind of pressure does that put on the security infrastructure and and how? How organizations are approaching security. >>Yeah, I just think from a mindset standpoint, you know what Waas optional? Uh, maybe, uh, last year, eyes no longer optional. And I don't think it's going to go back. I think I think a lot of people have changed the way you know they live and the way they work. Um and they're doing it in ways. Hopefully that, you know, in some cases, yield more productivity again. Um, you know, usually with technology that's severely effective, it doesn't pick sides. So the security slant to it is it frankly works Justus Well, for the bad guys. And so that's That's the balance we need to keep. Which is we need Thio be extra diligent on how we go about securing infrastructure, how we go about securing even our our social channels. Because remember all our social channels now our digital so that's has become the new norm. >>You know, you've helped me understand over the years. I remember the line you shared with me in the Cube one time. Is it the adversary is highly capable of sort of the phrase that you used And essentially the way you describe it is you know, your job as a security practitioner is to decrease the bad guys, return on investment, you know, increase their cost, increase the numerator. But as as works just from home, Yeah, I'm in my house, you know, by my wife, I and my you know, router with my you know, dog's name is the password. You know, it's much, much harder for me. Thio, increase that denominator at home. So how can you help? >>Yeah, I mean, it is It is truly when you think when you get into the mind of the adversary and, uh, you know, cybercrime out there, there, honestly, there, like any other business they're trying toe, you know, operate with high margin. And so if you can get there, if you can get in there and erode their margin, they'll they'll frankly go find something else to do. Um, and and again, you know, you know, the shift we experience day to day is you know, it's not just our kids are online in school, and our work is online, but all the groceries we order, You know, this Thanksgiving and holiday season Ah, lot more online shopping is going to take place. Eso you know, everything's gone digital. And so the question is you know how How do we up our game there so that, um we can go about our business effectively and make it very expensive for the adversary toe operate on take care of their business because it's nasty stuff. I want to >>ask you about automation, you know, generally and then specifically how it applies to security. So we, I mean, we certainly saw the ascendancy of the hyper scale er's. And of course, they really attacked the I t labor problem. We learned a lot from that, and an I T organizations have applied much of that thinking and the it's critical at scale. I mean, you just can't scale humans at the pace that technology scales today. How does that apply to security? And specifically, how is automation affecting security? >>Yeah, it z the topic these days. Um, you know, businesses, I think, realize that they can't continue to grow at human scale. And so the reason why automation and things like ai and machine learning have a lot of value is because everyone's trying to expand on operate at machine scale. Now. I mean that for for businesses. I mean that for, you know, education and everything else. Now, so are the adversaries, right. So it's expensive for them to operate at human scale, and they are going to machine scale, go into machine scale. A necessity is that you're going to have to harness some level of automation, have the machines work on your behalf, Have the machines carry your intent. Andi, when you do that, you can do it, uh, safely or you could do it dangerously. And that that's that's really kind of your choice. Um, you know, just because you can automate something doesn't mean you should. You wanna make sure that, frankly, the adversary can't get in there and use that automation on their behalf. So it's a tricky thing because, you know, when you take the phrase you know, how do we How do we automate security? Well, you actually have to take care of of securing the automation first. >>Yeah, we talked about this in Barcelona, where you were explaining that you know, the bad guys, the adversaries essentially, you know, weaponizing using your own tooling, which makes them appear safe because they're hiding in plain sight. Right there >>is a, um Well, there's they're clever, Given that, you know, there's this phrase that they always talk about called living off the land. Um, there's no sense in them coming into your network and bringing their tools and and being detected. You know, if they can use the tools that's already there, then they have, ah, higher degree of evading your protection. If they can pose as Alice or Bob who's already been credential and move around your network, then they're moving around the network as Alice or Bob. They're not, you know, marked as the adversary. So again, you know, having the detection methods available to find their behavioral anomalies and things like that become, ah, Paramount. But also, you know, having the automation to contain them, to eradicate them, to minimize their effectiveness. Um, without e mean ideally without human interaction, because you just can you move faster, you move quicker. Andi, I say that with an asterisk because, um, if done wrong, frankly you're just making their job or effect. >>I wonder if I could talk about the market a little bit. Uh, it's, I mean, security space cybersecurity 80 plus billion, which, by the way, it's just a little infant testable component of our GDP. So we're not spending nearly enough to protect that It that massive, uh, GDP. But guys, I wonder if you could bring up the the chart. Because when you talk to CSOs and you ask them what you're what, your biggest challenge to say, lack of talent and and so what? This chart shows this is from e T. R R R survey partner, and on the vertical axis is net score. And that's an indication of spending momentum. On the horizontal axis is market share, which is a measure of presence. Pervasiveness, if you will, inside the data sets. And so there's a couple of key points here I wanted toe put forth to our audience and then get your reaction. So you see Cisco I highlighted in red. Cisco's business and security is very, very strong. We see it every quarter. It's a growth area that Chuck Robbins talks about on the on the conference call, and so you can see on the horizontal axis you've got, you know, big presence in the data set. I mean, Microsoft is out there, but they're everywhere. But you're right there, Um, in that in that data set and then you've got for such a large presence, you've got a lot of momentum in the marketplace, so that's very impressive. The other point here is you've got this huge buffet of options. There's just a zillion vendors here, and that just adds to the complexity. This is, of course, only a subset of what's in the security space. You know, the people who answered for the survey. So my question is, how can Cisco help you simplify this picture? Is it automation? Is it? You know, you guys have done some really interesting tuck in acquisitions, and you're bringing that integration together. Can you talk about that a little bit? >>Yeah. I mean, that's an impressive chart. I mean, when you look to the left There it z, I had a customer, you know, Tell me once that you know, I I came to this trade show looking for transportation, and these people are trying toe Selmi car parts. That's the frustration customers have, you know? And I think What Cisco has done really well is to really focus on outcomes. Um, what is the customer outcome? Because, ultimately that's that is what the customer wants. You know, there might be a few steps to get to that outcome, but the closest you closer you can get to delivering outcomes for the customer, the better you are. And I think I think security in general has just year over year been just written with. You need to be an expert. You need to buy all these parts and put it together yourself. And I think I think those days are behind us. But particularly as as security becomes more pervasive and we're, you know, we're selling to the business. We're not selling to the, you know, T shirt wearing hacker anymore. >>Yeah, well, how does cloud fit in here? Because I think there's a lot of misconceptions about Cloud. People think I put my data in the cloud. I'm safe. But you know, of course, we know it's a shared responsibility model, so I'm interested in your your thoughts on that. Is it really? Is it a sense of complacency? A lot of the cloud vendors, by the way, say no state of security is great in the cloud where, as you know, many of us out there saying, Wow, it z not so great. Eso What are your thoughts on that? That whole narrative and what Cisco's play in cloud? >>I think. Cloud, um, when you look at the services that are delivered via the cloud, you see that exact pattern, which is you see customers paying for the outcome or as close to the outcome as possible? Um, you know, no, no data center required. No, this Dr required, you just get storage. You know, it Z all of those things that are again closer to the outcome. I think the thing that interests me about cloud to is it's really been It's really punctuated the way we go about building systems, um, again, at machine scale. So, you know, before when I write code and I think about what computer is it going to run on? Are you know what servers are gonna Is it gonna run on those? Those thoughts never crossed my mind anymore. You know, I'm modeling the intent of what the service should do and the machines then figure it out. So you know, for instance, on Tuesday, if the entire Internet shows up the system, you know, works without fail. And on Wednesday Onley North America shows up, you know, so what? But there's no way you could staff that right. There is just no human scale approach that gets you there. And that's that's the beauty of all of this cloud stuff. Is, um, it really is the next level of how we do computer science. >>So you're talking about infrastructure is code, and that applies to you know, security is code. That's what you know definite is really all about. I've said many times. I think Cisco of the large established enterprise companies is one of the few, if not the only that really has figured out. You know that developer angle because it's practical. You're not trying to force your way into developers. But, you know, I wonder if you could you could talk a little bit about that trend. Andi, where you see it going? >>Yeah. No, that is That is truly the trend. Every time I walk into Devon yet, um, the big halls at at Cisco Live it is Cisco as code. Everything about Cisco is being presented through an A P I. It is automation ready, and and frankly, that is that is the love language of the cloud. Um, it's machines. It's the machines talking to machines in very effective ways. So, you know, it is the I think I think necessary maybe not sufficient but necessary for, um, you know, doing all the machine scale stuff. What? What's also necessary Eyes thio to secure if infrastructure is code. Therefore, um what what secure what security methodologies do we have today that we used to secure code? While we have automated testing, we have threat modeling, right? Those things actually have to be now applied to infrastructure. So when I when I talk about how do you do automation securely, You do it the same way you secure your code, you test it, you threat model, you say, You know, Ken, my adversary exhibit something here that drives the automation in a way that I didn't intended to go. Eso all of those practices apply. It's just everything as code these days. >>Today I've often said that security and privacy or sort of two sides of the same coin and I wanna ask you a question and it's really you know, to me, it's not necessarily Cisco, and companies like companies like Cisco is responsibility, but I wonder if there's a way in which you could help. And of course, this this, you know, Netflix documentary circling around the social dilemma. I don't know if you have a chance to see it, but basically dramatizes the way in which companies air appropriating our data, tell us ads and, you know, creating our own little set of facts, etcetera. And that comes down to sort of how we think about privacy. And I mean, it's good from the standpoint of awareness, you know, you may or may not care if you're, you know, social media user. I love tic tac. I don't care, but but But they sort of laid out This is pretty scary scenario with a lot of the inventors of those technologies. You have any thoughts on that? And, you know, can Cisco play a role there in terms of protecting our privacy? I mean, beyond GDP R and California Consumer Privacy Act. Um, what do you think? >>Yeah, um, I'll give you my You know, my humble opinion is you you fix social problems with social tools, you fix technology problems with technology tools. Um, I think there is a social problem. Um, that needs to be rectified. You know, um, we we weren't built as human beings to live and interact with an environment that agrees with us all the time. Just It's just pretty wrong. So, yeah, that that that that serious did really kind of wake up a lot of people. It is. It is. You know, it's probably every day I hear somebody asked me if I saw um but I do think it also, you know, with that level of awareness, I think we we overcome it or we we compensate by what number one? Just being aware that is happening. Um, number two. You know how you go about solving it. I think maybe come down Thio an individual or even a community's solution And what might be right for one community might be, you know, not the same for the other. So you have to be respectful in that manner. >>Yeah. So it's it's It's almost I think if I could, you know, play back. What I heard is is yeah, technology, Maybe got us into this problem. But technology alone is not going to get us out of the problem. It's not like some magic A I bought is going to solve this. It's gonna be, you know, society has to really, really take this on. Is your premise good one? >>When I when I first started playing online games, I'm going back to, you know, the text based adventure stuff like muds and moos. I did a talk it at m i t one time and this old curmudgeon in the back of the room, um, we were talking about democracy and we were talking about, you know, the social process that we had modeled in our game and this and that, and this guy just gave us the Smackdown. He basically walked up to the front of the room and said, You know, all you techies, you judge efficiency by how long it takes. He says, democracy that completely the opposite, which is you need to sleep on it. In fact, you should be scared. If somebody can decide in a minute what is good for the community, it two weeks later, they probably have a better idea of what's good for the community, so it almost has the opposite dynamic. And that was super interesting to me. >>That's really interesting. You know, you read the Lincoln historians, and he was criticized in the day for having taken so long, you know, to make certain decisions. But, you know, ultimately, when he acted, he acted with with confidence. So to that point, but So what else you working on these days? That is interesting that maybe you want to share with our audience anything. It's really super exciting for you or you. >>Yeah. You know, generally speaking, um, trying, trying to make it a little harder for the bad guys to operate. I guess that's Ah general theme making it simpler for the common person to use tools again. You know, all of these security tools, no matter how fancy it is, it's not that we're losing the complexity. It's that we're moving the complexity away from the user so that they can drive at human scale and we can do things. That machine scale and kind of working those two together is it's sort of the magic recipe. Um, it's not easy, but but it is. It is fun So that's that's what keeps me engaged. >>I'm definitely seeing I wonder if you see it. Just sort of Ah, obviously a heightened organization awareness. But I'm also seeing shifts in the organizational structures. You know, the, You know, it used to be the SEC ops team in an island. Okay, it's your problem. You know, the CSO cannot report into the to the CEO, because that's like the fox in the hen house. A lot of those structures are are changing, it seems, and becoming this responsibility is coming much more ubiquitous across the organization. What are you seeing there and what do >>you know? It's so familiar to me because, you know, um, I started out as a musician. So, you know, bands bands are great analogy. You know, you play bass, I big guitar. You know, somebody else plays drums. Everybody knows their role, and you create something that's larger than you know, some of all parts. And so that that analogy, I think is coming to, you know, way saw it. Sort of with Dev ops where, you know, the developer doesn't just throw their quote over the wall and it's somebody else's problem. They moved together as a band. And and that's what I think organizations air seeing is that you know why? Why stop there? Why not include marketing? Why not include sales? Why don't we move together as a business? Not just. Here's the product. And here's the rest of the business s. Oh, that's that's That's pretty awesome. I think we see a lot of those patterns, particularly for the highly high performance businesses, >>you know, In fact, it's interesting you for great analogy, by the way. And you actually seeing that within Cisco, you're seeing sort of, uh and I know sometimes you guys, you know, I don't like to talk about the plumbing, but I think it matters. I mean, you gotta leadership structure. Now, I I've talked to many of them. They seem to really be more focused on how their connect connecting, you know, across organizations. And it's increasingly critical in this world of you know, of silo busters, isn't it? >>Yeah. No. And you, you Almost as you move further and further away, you know, you can see how ridiculous it was before it would be like acquiring a band and say, Okay, all you guitar players go over here. All you bass players go over there like what happened to the band s. So that's that's what I'm talking about is, you know, moving all of those disciplines moving together, um, and servicing the same backlog and achieving the same successes together is just so awesome. >>Well, I was I always, uh, feel better after talking to you. You know? I remember. I remember Art. Coviello used to put out his, uh, his letter every year. And I was reading I get depressed. Yeah, we spend all this money now, we're less secure. But when I talked to you, t k I I feel like much more optimistic. So I really appreciate the time you spend on the cubits. It's awesome to have you as a guest. >>Right on. I love these. I love these sessions, So thanks. Thanks for inviting me. >>And I miss you. You know, hopefully you know, next year's we could get together at some of the Cisco shows or other shows, but be well and stay weird like the sign says >>doing my part. >>All right, T k. Kennedy. Thanks so much for coming in the queue. We we really appreciate it. And thank you for watching everybody. This is Dave Volonte. We've right back with our next guest right after this short break.