>> Hello friends and welcome back to Fabulous Las Vegas, Nevada. We are here at AWS re:Invent in the heat of day three. Very exciting time. My name is Savannah Peterson, joined with John Furrier here on theCUBE. John, what's your, what's your big hot take from the day? Just from today. >> So right now the velocity of content is continuing to flow on theCUBE. Thank you, everyone, for watching. The security conversations. Also, the cost tuning of the cloud kind of vibe is going on. You're hearing that with the looming recession, but if you look at the show it's the bulk of the keynote time spent talking is on data and security together. So Security, Security Lake, Amazon, they continue to talk about security. This next segment's going to be awesome. We have a multi-, eight-time CUBE alumni coming back and great conversation about security. I'm looking forward to this. >> Alumni VIP, I know, it's so great. Actually, both of these guests have been on theCUBE before so please welcome Dan and Haiyan. Thank you both for being here from F5. How's the show going? You're both smiling and we're midway through day three. Good? >> It's so exciting to be here with you all and it's a great show. >> Awesome. Dan, you having a good time too? >> It's wearing me out. I'm having a great time. (laughter) >> It's okay to be honest. It's okay to be honest. It's wearing out our vocal cords for sure up here, but it is definitely a great time. Haiyan, can you tell me a little bit about F5 just in case the audience isn't familiar? >> Sure, so F5 we specialize in application delivery and security. So our mission is to deliver secure and optimize any applications, any APIs, anywhere. >> I can imagine you have a few customers in the house. >> Absolutely. >> Yeah, that's awesome. So in terms of a problem that, well an annoyance that we've all had, bots. We all want the anti-bots. You have a unique solution to this. How are you helping AWS customers with bots? Let's send it to you. >> Well we, we collect client side signals from all devices. We might study how it does floating point math or how it renders emojis. We analyze those signals and we can make a real time determination if the traffic is from a bot or not. And if it's from a bot, we could take mitigating action. And if it's not, we just forward it on to origin. So client side signals are really important. And then the second aspect of bot protection I think is understanding that bot's retool. They become more sophisticated. >> Savannah: They learn. >> They learn. >> They unfortunately learn as well. >> Exactly, yeah. So you have to have a second stage what we call retrospective analysis where you're looking over all the historical transactions, looking for anything that may have been missed by a realtime defense and then updating that stage one that real time defense to deal with the newly discovered threat. >> Let's take a step back for a second. I want to just set the table in the context for the bot conversation. Bots, automation, that's, people know like spam bots but Amazon has seen the bot networks develop. Can you scope the magnitude and the size of the problem of bots? What is the problem? And give a size of what this magnitude of this is. >> Sure, one thing that's important to realize is not all bots are bad. Okay? Some bots are good and you want to identify the automation from those bots and allow listed so you don't interfere with what they're doing. >> I can imagine that's actually tricky. >> It is, it is. Absolutely. Yeah. >> Savannah: Nuanced. >> Yeah, but the bad bots, these are the ones that are attempting credential stuffing attacks, right? They're trying username password pairs against login forms. And because of consumer habits to reuse usernames and passwords, they end up taking over a lot of accounts. But those are the bookends. There are all sorts of types of bots in between those two bookends. Some are just nuisance, like limited time offer bots. You saw some of this in the news recently with Ticketmaster. >> That's a spicy story. >> Yeah, it really is. And it's the bots that is causing that problem. They use automation to buy all these concert tickets or sneakers or you know, any limited time offer project. And then they resell those on the secondary market. And we've done analysis on some of these groups and they're making millions of dollars. It isn't something they're making like 1200 bucks on. >> I know Amazon doesn't like to talk about this but the cloud for its double edged sword that it is for all the greatness of the agility spinning up resources bots have been taking advantage of that same capability to hide, change, morph. You've seen the matrix when the bots attacked the ship. They come out of nowhere. But Amazon actually has seen the bot problem for a long time, has been working on it. Talk about that kind of evolution of how this problem's being solved. What's Amazon doing about, how do you guys help out? >> Yeah, well we have this CloudFront connector that allows all Amazon CloudFront customers to be able to leverage this technology very, very quickly. So what historically was available only to like, you know the Fortune 500 at most of the global 2000 is now available to all AWS customers who are using CloudFront just by really you can explain how do they turn it on in CloudFront? >> Yeah. So I mean CloudFront technologies like that is so essential to delivering the digital experience. So what we do is we do a integration natively. And so if your CloudFront customers and you can just use our bot defense solution by turning on, you know, that traffic. So go through our API inspection, go through our bot inspection and you can benefit from all the other efficiencies that we acquired through serving the highest and the top institutions in the world. >> So just to get this clarification, this is a super important point. You said it's native to the service. I don't have to bolt it on? Is it part of the customer experience? >> Yeah, we basically built the integration. So if you're already a CloudFront customer and you have the ability to turn on our bot solutions without having to do the integration yourself. >> Flick a switch and it's on. >> Haiyan: Totally. >> Pretty much. >> Haiyan: Yeah. >> That's how I want to get rid of all the spam in my life. We've talked a lot about the easy button. I would also like the anti-spam button if we're >> Haiyan: 100% >> Well we were talking before you came on camera that there's a potentially a solution you can sit charge. There are techniques. >> Yeah. Yeah. We were talking about the spam emails and I thought they just charge, you know 10th of a penny for every sent email. It wouldn't affect me very much. >> What's the, are people on that? You guys are on this but I mean this is never going to stop. We're going to see the underbelly of the web, the dark web continue to do it. People are harvesting past with the dark web using bots that go in test challenge credentials. I mean, it's just happening. It's never going to stop. What's, is it going to be that cat and mouse game? Are we going to see solutions? What's the, when are we going to get some >> Well it's certainly not a cat and mouse game for F5 customers because we win that battle every time. But for enterprises who are still battling the bots as a DIY project, then yes, it's just going to be a cat and mouse. They're continuing to block by IP, you know, by rate limiting. >> Right, which is so early 2000's. >> Exactly. >> If we're being honest. >> Exactly. And the attackers, by the way, the attackers are now coming from hundreds of thousands or even millions of IP addresses and some IPs are using one time. >> Yeah, I mean it seems like such an easy problem to circumnavigate. And still be able to get in. >> What are I, I, let's stick here for a second. What are some of the other trends that you're seeing in how people are defending if they're not using you or just in general? >> Yeah, maybe I'll add to to that. You know, when we think about the bot problem we also sort of zoom out and say, Hey, bot is only one part of the problem when you think about the entire digital experience the customer experiencing, right? So at F5 we actually took a more holistic sort of way to say, well it's about protecting the apps and applications and the APIs that's powering all of those. And we're thinking not only the applications APIs we're thinking the infrastructure that those API workloads are running. So one of the things we're sharing since we acquired Threat Stack, we have been busy doing integrations with our distributed cloud services and we're excited. In a couple weeks you will hear announcement of the integrated solution for our application infrastructure protection. So that's just another thing. >> On that Threat Stack, does that help with that data story too? Because it's a compliance aspect as well. >> Yeah, it helps with the telemetries, collecting more telemetries, the data story but is also think about applications and APIs. You can only be as secure as the infrastructure you're running on it, right? So the infrastructure protection is a key part of application security. And the other dimension is not only we can help with the credentials, staffing and, and things but it's actually thinking about the customer's top line. Because at the end of the day when all this inventory are being siphoned out the customer won't be happy. So how do we make sure their loyal customers have the right experience so that can improve their top line and not just sort of preventing the bots. So there's a lot of mission that we're on. >> Yeah, that surprise and delight in addition to that protection. >> 100% >> If I could talk about the evolution of an engagement with F5. We first go online, deploy the client side signals I described and take care of all the bad bots. Okay. Mitigate them. Allow list all the good bots, now you're just left with human traffic. We have other client side signals that'll identify the bad humans among the good humans and you could deal with them. And then we have additional client side signals that allow us to do silent continuous authentication of your good customers extending their sessions so they don't have to endure the friction of logging in over and over and over. >> Explain that last one again because I think that was, that's, I didn't catch that. >> Yeah. So right now we require a customer to enter in their username and password before we believe it's them. But we had a customer who a lot of their customers were struggling to log in. So we did analysis and we realized that our client side signals, you know of all those that are struggling to log in, we're confident like 40% of 'em are known good customers based on some of these signals. Like they're doing floating point math the way they always have. They're rendering emojis the way they always have all these clients that signals are the same. So why force that customer to log in again? >> Oh yeah. And that's such a frustrating user experience. >> So true. >> I actually had that thought earlier today. How many time, how much of my life am I going to spend typing my email address? Just that in itself. Then I could crawl back under the covers but >> With the biometric Mac, I forget my passwords. >> Or how about solving CAPTCHA's? How fun is that? >> How many pictures have a bus? >> I got one wrong the other day because I had to pick all the street signs. I got it wrong and I called a Russian human click farm and figured out why was I getting it wrong? And they said >> I love that you went down this rabbit hole deeply. >> You know why that's not a street sign. That's a road sign, they told me. >> That's the secret backdoor. >> Oh well yeah. >> Talk about your background because you have fascinating background coming from law enforcement and you're in this kind of role. >> He could probably tell us about our background. >> They expunge those records. I'm only kidding. >> 25, 30 years in working in local, state and federal law enforcement and intelligence among those an FBI agent and a CIA cyber operations officer. And most people are drawn to that because it's interesting >> Three letter agencies can get an eyebrow raise. >> But I'll be honest, my early, early in my career I was a beat cop and that changed my life. That really did, that taught me the importance of an education, taught me the criminal mindset. So yeah, people are drawn to the FBI and CIA background, but I really value the >> So you had a good observation eye for kind of what, how this all builds out. >> It all kind of adds up, you know, constantly fighting the bad guys, whether they're humans, bots, a security threat from a foreign nation. >> Well learning their mindset and learning what motivates them, what their objectives are. It is really important. >> Reading the signals >> You don't mind slipping into the mind of a criminal. It's a union rule. >> Right? It actually is. >> You got to put your foot and your hands in and walk through their shoes as they say. >> That's right. >> The bot networks though, I want to get into, is not it sounds like it's off the cup but they're highly organized networks. >> Dan: They are. >> Talk about the aspect of the franchises or these bots behind them, how they're financed, how they use the money that they make or ransomware, how they collect, what's the enterprise look like? >> Unfortunately, a lot of the nodes on a botnet are now just innocent victim computers using their home computers. They can subscribe to a service and agree to let their their CPU be used while they're not using it in exchange for a free VPN service, say. So now bad actors not, aren't just coming from you know, you know, rogue cloud providers who accept Bitcoin as payment, they're actually coming from residential IPs, which is making it even more difficult for the security teams to identify. It's one thing when it's coming from- >> It's spooky. I'm just sitting here kind of creeped out too. It's these unknown hosts, right? It's like being a carrier. >> You have good traffic coming from it during the day. >> Right, it appears normal. >> And then malicious traffic coming from it. >> Nefarious. >> My last question is your relationship with Amazon. I'll see security center piece of this re:Invent. It's always been day zero as they say but really it's the security data lake. A lot of gaps are being filled in the products. You kind of see that kind of filling out. Talk about the relationship with F5 and AWS. How you guys are working together, what's the status? >> We've been long-term partners and the latest release the connector for CloudFront is just one of the joint work that we did together and try to, I think, to Dan's point, how do we make those technology that was built for the very sophisticated big institutions to be available for all the CloudFront customers? So that's really what's exciting. And we also leverage a lot of the technology. You talked about the data and our entire solution are very data driven, as you know, is automation. If you don't use data, you don't use analytics, you don't use AI, it's hard to really sort of win that war. So a lot of our stuff, it's very data driven >> And the benefit to customers is what? Access? >> The customer's access, the customer's top line. We talked about, you know, like how we're really bringing better experiences at the end of the day. F5's mission is try to bring a better digital world to life. >> And it's also collaborative. We've had a lot of different stories here on on the set about companies collaborating. You're obviously collaborating and I also love that we're increasing access, not just narrowing this focus for the larger companies at scale already, but making sure that these companies starting out, a lot of the founders probably milling around on the floor right now can prevent this and ensure that user experience for their customers. throughout the course of their product development. I think it's awesome. So we have a new tradition here on theCUBE at re:Invent, and since you're alumni, I feel like you're maybe going to be a little bit better at this than some of the rookies. Not that rookies can't be great, but you're veterans. So I feel strong about this. We are looking for your 30-second Instagram reel hot take. Think of it like your sizzle of thought leadership from the show this year. So eventually eight more visits from now we can compile them into a great little highlight reel of all of your sound bites over the evolution of time. Who wants to give us their hot take first? >> Dan? >> Yeah, sure. >> Savannah: You've been elected, I mean you are an agent. A former special agent >> I guess I want everybody to know the bot problem is much worse than they think it is. We go in line and we see 98, 99% of all login traffic is from malicious bots. And so it is not a DIY project. >> 98 to 99%? That means only 1% of traffic is actually legitimate? >> That's right. >> Holy moly. >> I just want to make sure that everybody heard you say that. >> That's right. And it's very common. Didn't happen once or twice. It's happened a lot of times. And when it's not 99 it's 60 or it's 58, it's high. >> And that's costing a lot too. >> Yes, it is. And it's not just in fraud, but think about charges that >> Savannah: I think of cloud service providers >> Cost associated with transactions, you know, fraud tools >> Savannah: All of it. >> Yes. Sims, all those things. There's a lot of costs associated with that much automation. So the client side signals and multi-stage defense is what you need to deal with it. It's not a DIY project. >> Bots are not DIY. How would you like to add to that? >> It's so hard to add to that but I would say cybersecurity is a team sport and is a very data driven solution and we really need to sort of team up together and share intelligence, share, you know, all the things we know so we can be better at this. It's not a DIY project. We need to work together. >> Fantastic, Dan, Haiyan, so great to have you both back on theCUBE. We look forward to seeing you again for our next segment and I hope that the two of you have really beautiful rest of your show. Thank you all for tuning into a fantastic afternoon of coverage here from AWS re:Invent. We are live from Las Vegas, Nevada and don't worry we have more programming coming up for you later today with John Furrier. I'm Savannah Peterson. This is theCUBE, the leader in high tech coverage.