>>And welcome back to the cubes coverage of AWS summit public sector here live in Washington, DC, where we're actually having a physical event, but also broadcasting to a hybrid audience digitally. I'm John, your hosted, like you've got a great panel here. Martin Rieger's chief solutions, officer stack armor, the thin poli who's with Splunk group vice president of partner go to market Americas and public sector, and Troy Bertram, vice president sales, a telos. Good to see you guys. Thanks for coming on. It's great to be. So you guys stuck on them to have a great solution on AWS called faster. Okay. Which is nice name what's what's it all about? >>So faster is about getting cloud service providers to an authorization, to operate with the federal government, uh, basically as fast as possible. It is the collection of threat alert, which is a fed ramp designed solution and boundary solution. That includes all those key security stack components. Uh, primarily our partners over at Splunk and telos. Uh, those products are scripted, streamlined, and designed to get customers there as fast as possible in a compliant manner. >>I love the acronym fast tr faster on AWS. Uh, how did you guys come up with the threat alerts concept? What did, what's this all about? How did it all come together? >>Uh, threat alert was, was born out of one of our primary services, which is migration and, uh, for roughly about a five-year stretch migrating federal agency systems, um, to Amazon, both east, west and gov cloud, uh, we recognized quickly that there was a need to include a security stack of common components, such as vulnerability scanning, uh, security incident event monitoring, uh, as well as a number of other key components designed around the continuous monitoring aspect of it. And so we quickly realized that, you know, the packaging of this solution and putting together a dashboard that allows us to tie everything in, uh, deploy very, very quickly through infrastructure as a code, um, was a vehicle that could help, uh, our customers and CSPs as well as agencies get through the FedRAMP ATO process. Um, quickly >>Talk about the relationship with Splunk and telos. How's this all connecting with? Just what's your role? >>Yeah, so really with the support of NIST and the new Oscar standard, which I'm going to make sure I get the acronym right. Open securities controls, assessment language, or asked gal, um, with our release of Exacta and automation of the compliance standards working with, and the framework, we've been able to look at best of breed partners in the industry, and it is all around acceleration of how can we move faster to deliver the end customer, the controls they need and want in a secure compliant manner. Um, and as someone that served in the government, right, it's, it's passion for the mission. And that's really what brought the three companies together >>And my opinion, by the way, congratulations on Telus going public. You guys do a lot of great cyber work. Congratulations. Now that data is the heart of this. I mean, Splunk that's all you guys do is think about data. How do you guys connect into, into the product? >>Well, it's exactly that really providing that data platform, then they analytics capability to enable the subject matter experts to bring the data to life. Right. And that's what we, that's why these partnerships are so important to Splunk because, uh, they have the subject matter expertise and can really leverage the power of the data platform to provide services to customers. >>Yeah. One of the big trends that's kind of underreported, in my opinion, is that partnerships required to kind of get the cyber security equation, right? This is a huge trend. People are sharing, but also working together. How, how do you guys see that evolving? Because you know, there has to be an openness around the data. There has to be more open solutions. How do you guys see that evolving? Um, >>Well you kind of hit the hammer on the heads. Splunk is, is essentially the heart and soul of our auditing logging and continuous monitoring piece. Um, in terms of, of the relationships and how we all work together. We we've evolved now to a point where we are able to pre-stage customers well in advance. Um, and in working with our partners, uh, tell us on Splunk. By the time we get started with a customer, we, we reduced the amount of time this takes, uh, on average by 40%, um, and even faster with the exact piece because, uh, as, as Troy kind of mentioned, the OSC gal component, um, is the future of accreditation. And it's certainly not limited to fed ramp, but that machine language, that XML Yammel Jason code, we've got things to the point where not only are we deploying Splunk in a, in a scripted pre-configured manner to work with our technology, we're also doing the same thing with Exacta. >>So the controls are three documented for everything that we provide, which means we don't have to spend the time going through the process of saying, okay, tell me what you're doing. We already have that down. The other best of breed type components that were mentioned by Troy. Um, it's the same thing, right? So customers, when they show up, they have a security stack that's ready to go. They already have FIPs compliance for encryption. They already have hardening in place so that when, when they approach us, all they've really got to do is deploy their application and close a very small gap in documentation, which we do with Exacta and then auditors can come in, hit the, they can jump, get what they need out of Exacta. And eventually once everyone else catches up to OSC gal, we'll be connecting systems to other systems and just pushing the package, the days of PDFs. And those are almost gone >>As someone that went through, um, achieving an ATO, the paper process and the Excel spreadsheets. It's a nightmare. And you've got sales engineers, you've got solution architects that are spending their time, not focused on delivering mission outcomes or new products and services to our public sector customers, but on the process and the paperwork, >>Can you share order of magnitude the old way, time wasting versus this solution? What's, what's gained cause that's key. This needs a resources when people are >>Every CFO ad in ISV wants to do two things, right? They want to support the sales efforts to move into the federal or state environment, right? We're talking about fed ramp, but state ramp is upon us now. So they want two things. How do I do this at the lowest cost possible limit my resources that are really expensive on the engineering side and how do I shrink the amount of time? So 40% is a very conservative estimate. I believe that we can continue with implementations of Bosco and other ingestation points, especially across government. We can shrink that time, which reduces the cost immensely >>The time savings day. What about the stack? >>But if you want to put it in perspective, right? I've been doing this since the beginning in 2012, and I've stood up three different three pills. I've audited over 200 companies. I've been doing this a long time. And in the beginning it was an average of 12 months just to get someone ready, just to get ready. That didn't include the audit time. So we've evolved to a point now where on average, that's down to 12 weeks. And that was before the inclusion of the exact piece. We were able to shave off four more weeks with that, to the point where we're down to eight weeks and the government is pushing to try to get towards a 30 day ATO. And I think Oscar was the answer for that. And so to give you an idea of where we were to where we are now, we went from 12 months to 12 weeks. >>That's huge. So the data is the key in here. And then you got faster on AWS. Love the name wa how does that compare to other ATO solutions? How do you guys see that comparing a wonder place? >>I think in terms of the other solutions that are available out there, there, there's a couple key things that, that I think the rest of the market is trying to do to catch up. And one of those is the dashboard technology that we have in place integrates directly with Splunk and with Exacta, it pulls in from all the AWS sources that are available in terms of security and information and centralizes it in one spot. And so nobody else is doing that and we've been doing it for years. And this, this to me, OSS gal, and the addition of the exact component was the next evolution. >>Um, on the partnership side, how do you guys see it evolving? What's next >>More continuous monitoring, I think, right. It's not just about a FedRAMP authorization, but continuous monitoring in general for, for all of our public sector. >>That's day two operations continues ongoing AI operations. There's gotta be some machine learning in here somewhere. Is there? >>Yeah. I'll speak to the partnerships a little bit. And I think even back to AWS, right? Why we're here and it's great to be in person is it's around us working together as an industry and companies, right? The authority to operate on AWS, the ATO and AWS was started to bring like-minded companies together to help solve these problems. Yeah. >>I mean, it's a real benefit. It really shows that you can put a stack together, right. And then save time like that 12 months to 12 weeks. That's what cloud's about right now. Then the question is security. Think you should get that right. That is going to be an evolution. What's the vision of the product? >>Um, well, there's two things around that we, we, we talked about, yes, it's, it's planned prepare authorized, right? That is the current fed ramp mantra and post ATO. The continuous monitoring piece is really a core element. But in terms of the future three PAOs, the third-party assessment organizations that, that audit our customers, that, that we're all preparing together. Eventually they're systems, they're all developing audit systems around. And so where we're going is the auditor will connect to Exacta and they will simply over API or whatever calls they make. They will pull all of that audit information control information, which is only going to accelerate this even more. >>Yeah. I mean, the observability, the data, the automation all plays into more speed, more agility, faster, >>And, and meeting all of the standards, right? Whether it's smart Z or it's HIPAA state Ram home in Austin, Texas Tex ramp is, is a thing, right? How do we help each one of these customers with their own compliance or super smart, >>You know, the business model of reduce the steps it takes to do something, make it easier and faster is a good business model. Wow. >>It's not, it's becoming an ecosystem right. In the sense that, um, you know, Oscar has been under development for three years and, and, and stack armor, we've been supporting some components at NIST, but to the point where, uh, once we eliminate the, the traditional paper, you know, word doc XL PDF, um, and get to a point where everything is tied together. But one there's one important aspect to this is that it's all in boundary. So the authorization boundary is that invisible red line. We draw around everything in scope for an audit. And so that, by the way, is another critical component. The Splunk servers are in boundary. The exact servers are in boundary, which is a huge, huge element to this. >>Yeah. Good. Great. To see the spunk partnership, adding value here with telos, good, your cybersecurity expertise, pulling it all together. It's a great solution. >>It is, and great partners to work with, right? And I know that we will have additional solutions and product offerings in the future. >>Martin treadmill, Bethann. Thanks for coming on the queue. Appreciate it. Enjoy the rest of the show. As we wind down day two of cube live coverage in-person event, AWS public sector summit in Washington, DC. This is the cube. We right back after this short break,

from Austin Texas it's the cube covering cube con and cloud native con 2017 brought to you by Red Hat the Lenox foundations and the cubes ecosystem partners well everyone welcome back to our exclusive coverage from the cube here in Austin Texas we're live on the floor at cloud native con and cube con cubic on like kubernetes gone not the cube con us but cute con we're Michele norelli who's the senior software engineer at Microsoft also the co-chair with Kelsey Heights our great event record-setting attendance I'm John ferry your host with stew minimun Michele welcome to the cube thank you so much for having me so people don't know about if they might have watch the street if you had a stream you're on stage keynoting and managing the whole program here congratulations more attendees here at this event than all the other cube cause of cloud native combined shows the growth and interest in a new way to develop new way to engage with other developers and create value yeah kubernetes has been the heart of it explain cloud native con and cube con what's the difference because I love cloud native but what's this Cooper Denny's thing I love that too yeah was it related a intertwine Wayne take him into his plane there's a there's a really big kubernetes audience and community and they need time to engage and just like work with each other and learn from each other and that's where coop Connie came from soku-kun with the original conference and the first one was a November in Seattle in 2016 and I was actually at that wine was a few hundred people and it was just so small people were actually asking like what is a pod what is kubernetes which are fine questions asked today as well but it was everyone was asking this question nobody was past that point and then you know kubernetes was donated to the CNCs and there were also these other cloud native projects that came about in the space and so we wanted a conference that encompasses both all of the cloud native projects as well as serbs the kubernetes community as well so that's where both of them came from some of the other cloud native projects have their own conferences like Prometheus has prom time and that's been growing as well I think the last one was 200 people up from 70 the last so I gotta ask you because we even cover us we were there at the cube con I was actually having drinks with Luke Tucker at JJ we're like hey we should do this Cuban Eddie's thing and bolted onto the Linux Foundation so you're president creates with the whole team it's been fun to watch Wow yeah but it's the tale of two stories in the community in the industry companies that got funded and we're building open-source and our participants who are building projects out and then a new onboarding of new developers coming into the community a lot of first-timers here you're seeing a visibility into the success of cloud yeah and they're Rieger engaged so you got a lot of folks who have invested into the community and new entrants a migration into the community yeah what does that dynamic mean to the CN CF how is that impacting how you structure in the programming and what are some of the insiders talking about what it is what's the reality yeah I think a lot of it has to do with you know this is a really positive community and there are just like so many people working together and collaborating not just because they I mean it looks like nice to be in a positive community right but you kind of have to like these problems are really hard and it's good to learn from different organizations that have like come across these projects or problems starting in the in the space before and they'll come and collaborate I think some of the things that we've been talking about inside the community is how to actually how to onboard people so the kubernetes community is starting up a new mentorship program to help people that are new to the community start learning how to review code and then PR code and and be productive members in the community and whatever they whatever area they want miss Michelle want to hear about kind of some of the breadth and depth of the community here yeah you know we went there's so many announcements there's a bunch of wando's yeah it's a brand new project I think what it was four projects a year ago and it's now 14 you know right how does somebody's supposed to get their arms around it should they be beat me about that you know where should somebody start you know what do you recommend yeah start with the that's a great question by the way I think that people should start with with a solution to a problem they already have so just know that people have run into these problems before and you should just go into the thing that you know about first and then if that leads you to a different problem and there's a solution that the CNCs you know has already come across then you can go into and dive into the other palms for example I am really interested in kubernetes and have been in that space but I think tracing is really interesting too and I want to start learning how to incorporate that into my workflow as well so show you you're also one of the diversity chairs yeah for the event you talk about kind of a diverse global nature of this community yeah we are spread across all time zone so I actually want to share an experience I have as a sake lead in kubernetes so at first I really wanted to serve all of the time zones and so we have these weekly sick meetings at 9:30 a.m. Pacific and I was like no maybe we should have like alternate meetings like alternate weekly meetings for other time zones but after talking to those the people in the other time sounds like they're very far off actually like China Asia Pacific I realize that they're actually more interested in reading notes and watching videos which is something I didn't actually know you know it's it's you think like oh you have to serve every community in the same way but what I've learned and face to face yeah base to base exactly and that's not actually how that's not how actually everybody wants to interact and so that's been an interesting thing I've learned from the diverse nature and this in the space let's see a challenges I mean we've been talking we're just that reinvent last week at Amazon obviously the number of services that they're rolling out is pretty strong there's a leader in the cloud but as multi cloud becomes the choice for most most enterprises and businesses the service requirements the baseline is got to be established seeing your community rolling out a lot of great new services but storage old storage is transferring to machine learning in AI and you got I Oh tea right around the corner new new kinds of applications yeah okay it's changing the game on the old card storage and security obviously two important areas you got to store the data data is that the card of the value proposition and then security security how are you guys dealing with that those challenges those political grounds that people are have a lot of making a lot of money in an old storage you mean ship a storage drive and here's an architecture those are being disrupted yeah I think they I mean they'll continue to be disrupted I think people are just going to bring in new and new more new and new use cases and then people will come and meet them meet those customers where they are and people just have to change I guess get used to it yeah shifter die yeah I think that some that that we are getting to that point but I can't only time will tell we'll see what are something exciting things that you see from the new developers I just recognize some friends here that I've haven't that dark wondering the community are new and they're kind of like licking their chops like wow what an excitement I could feel value and I could have a distribution I got a community and I can make money and then Dan said you know project products profits you put the product profit motive right on the table but he's clear at the same not pay to play it's okay to have profits if you have a good product for me project I buy that but the new developers like that because as an end scoreboard what are you guys doing with that new community what survived there around those kinds of opportunities you guys creating any programs for them or yeah I think just to just they can get involved you know I think knowledge is power perspective is power also so being involved helps give you a perspective to see where those gaps are and then come up with those services that are profitable or those tools that are profitable and I think this space can be very lucrative based on the number of people he sponsors I think he said he said the show was wondering if you can comment when you're building the schedule how do you balance you know all those platinum sponsors versus you know some of the you know practitioner companies that are also getting involved how do you there are there are different levels of sponsorship right like you mentioned the events team has a sponsorship section or sponsorship team and they handle most of placing sponsors and all of that and so they'll get whatever level they want but actually Kelsey and I do a lot of research and see like what's happening in the community what's interesting what's new and and we'll find time to highlight that as well which one is research what's your role in Microsoft share with the audience what are you working on what's your day-to-day job is it just foundation work are you doing coding what do you coding what's your fav is the VI MX what do you prefer yes my work is 30% community and 70% engineering I really love engineering but I also really love the community and just getting these opportunities to give back you know build skills as well learning how to speak in front of people as well these are both valuable skills to learn and it gives me an opportunity to just give back what I've learned so I appreciate those but I mostly work on developer tools that are open source that help people use containers and kubernetes a little more easily so I work on projects like Helms drafts and Brigade and these are just like things that we've seen the pain points that we've experienced and we want to kind of share our solutions with them so draft is the one I've been working on a lot have you heard of drops okay let me do the two second draft is a tool for application developers to build containerized apps without really understanding or having to understand all of what is kubernetes and containers so that's my favorite space to know you know one of the things we look at coming in here is there's that balance between there's complexity but there's flexibility you know I've heard Kelsey talking about our on when I talk to customer they're like oh I love kubernetes because I take vault and I take envoy and I take all these different things that put together and it does what I want but a lot of people are daunted and they say oh I want to I want to just go to Microsoft Azure and they'll take care of that so how do you look at that and what is the balance that we should be looking for as an industry yeah we've been emphasizing in the community a lot on plug ability across contracts it's like a theme that I think almost every project hurts and a word that you'll hear a lot I'm sure you already have heard a lot and I think that's because you can't meet everyone's needs so you build this modular component that does one thing very well and then you learn how to extend it and or you give people the ability to extend it and so that's really great for scaling a project I I do really appreciate the clouds coming out all of them with their own managed services because it's hard to operate and understand all of these things it's it takes a lot of depth in knowledge context and just prior experience and so I think that'll just make it a lot easier for people to onboard onto these technologies I was going to ask you I was going to ask so you brought up fug ability we saw you know Netflix on stage was his phenomenal of the culture yeah dynamic I think that the Schumer important conversation you know something we've been talking about silage is a real part of what we're seeing tech being a part of but the the things that popped out at me in the keynote were service mesh and pluggable architecture so I want to get your thoughts for the folks that aren't there is that in the trenches and inside the ropes what is a pluggable architecture and what is a service mesh these days because you got lyft and uber and all these great companies who have built hyper scale and large-scale systems in open source and now our big tech success stories donating these kinds of approaches pluggable architectures and service man talk a minute to explain so pluggable architectures this is why you have one layer of your stuff there's a piece of software that does something does one thing very well but you know every I like to say that every company is a snowflake and that's okay and so you may have some workflow or need that is specific to your company and so we shouldn't limit you to just what we think is the right solution to a problem we should allow you to extend or extend these pieces of software with modular components or just extensible components that that work for you does that make a little more sense yeah I work on helm and we also have a pluggable architecture because we were just getting so many requests from the community and it didn't make sense to put everything in the core code based if we did if we accepted one thing it would really just interrupt somebody else's workflow so that that's helped us a lot in in my personal experience I really like plug water it's actually that means you can go build a really kick butt app yeah nail it down to your specifications but decoupler from a core or avoiding kind the old spaghetti code mindset but kind of creating a model where it can be leveraged yeah plugin we all know plugins are but right so so that someone else could take advantage of it exactly yeah a service mesh that's evolved yeah heard a lot of that what is that yeah it's um so developers this is actually the lift story is really interesting to me so at lyft developers were really uneasy about moving from the monolith to the micro-services architecture just because they didn't early understand the network component and we're like network reliability would not be so reliable would fail and time service meshes have allowed engineers at lyft to understand where their failures happen and in terms like of a network standpoint and so you're basically abstracting with network layer and allowing more transparency into it this is like very useful for when you have lots of Micra services and you want this kind of reliability and stability awesome so one point 9s coming Spence support Windows that's what key and now a congratulations just go to the next level I mean growth talk about the growth because it's fun for us to watch you know kind of a small group core young community less than three years old really to kubernetes kind of had some traction but it really is going to be commoditized and that's not a bad thing so how do you what's your take on this what's the vibe what's that what's the current feeling inside the community right now excited pinching ourselves no I think everybody's in awe everybody is in awe and we're just like we want to make this the best experience possible in terms of an open source experience you know we want to welcome people to the community we want to serve the people's needs and we just we just want to do a good job because this is really fun and I think the people working on these problems are having a lot of fun with with seeing this kind of growth and support it's been great certainly for US president creation president and creation of this whole movement it's been fun to watch a document final question what should people expect this week what is the show going to hopefully do what's your prediction what's your purpose here what should people expect this week and the folks that didn't make it what do they miss okay there are so many things happening it's insane you're going to get a little bit of everything there's lots of different tracks lots of diverse content I think I'm when I go to conferences in my personal experience I really love technical salons those are really great because you can get your hands dirty and you can get questions answered by the people who created the project that's an experience that is is really powerful for me I went to the first open tracing salon and that's where I kind of got my hands dirty with tracing and been siegelman who's doing the keynote today this afternoon was the person who was teaching me how to like do this stuff so yeah it was awesome like some marketing fluff no it's not and it's just like it's it's real experienced very expert like experts you know in the in the space teaching you these things so that that definitely can't be replicated I think the cig sessions will be really cool there's a big focus on not just learning stuff but also collaborating and and just talking about things before they get documented so that's a really good experience here it's an action-packed schedule I tweeted that it feels like I'm you know when Burning Man had like a hundred people announced this big thing I think this is the beginning of a amazing industry people are cool they're helpful they're getting you're getting involved answering questions open-book here yeah at cloud native Punk you've got thanks Michele Farrelly been coming on co-chair senior engineer at Microsoft great to have her on the cube great keynote great color great fun exciting times here at cloud native con I'm John furry the founders look at angle media with too many men my co-hosts more live coverage after the short break