(funky music) >> From our studios in the heart of Silicon Valley, Palo Alto, California. This is a CUBE conversation. >> Welcome back everybody, Jeff Frick here with the CUBE. We're in our Palo Alto studios havin' a CUBE conversation, but for a little bit of something different. Instead of having our guest here locally in Palo Alto we've got him all the way across the country, across the pond, all the way over to Holland, and he's in Utrecht, and we're happy to welcome Erik Klein. He is the infrastructure architect for FrieslandCampina. Erik thanks for joining us today. >> Thank you for having me. >> Absolutely, so before we get started, a little background on FrieslandCampina for people that aren't familiar with the company. >> FrieslandCampina is a co-operative company owned by farmers, predominantly in the Netherlands, Belgium and Germany. It's a international company. We have about 34 countries with, we have, at our sales offices, our plans in there, we are one of the biggest dairy companies in the world, and love to be there. It's a very good company to work for. >> It's amazing, I was doing a little research, I mean the scale is amazing. You guys, you operate in 100 countries, exporting. You've got offices in 34 countries. I think it said of 23,000 plus employees. It's quite a big operation. >> Yup. >> So, >> A big operation doing about 10 billion liters, or kilograms, of milk a year. >> Great, so, it's a dairy, we're here talking about digital transformation; it's always fascinating to me, kind of, the reach of digital transformation in everybody's company. Everyone says everyone's really a software company, you know, kind of built around a different product or service. So what were some of the challenges that you were looking towards in 2018-2019 in terms of digital transformation in this mature industry of dairy? >> The challenges that we're having is that you have to make sure that everything is safe. The products are safe, but also the data is safe. But also that we have a lot of things move through the Cloud, and also that the performance of those applications moves through the Cloud, is to the end user's satisfaction as well. So you're not looking only at transferring data safely from the Cloud into our offices, into our production environment, also protecting our production environments from everything that's going bad on the Internet, but also having to make sure that the applications are performing to the liking of the end user, so to speak, to our customer and our consumers. >> And was the objective to build new applications in the Cloud, or was it more kind of lift-and-shift some of your older applications in the Cloud? Because those are two very different challenges. >> Yeah, it's a lift-and-shift of our older applications. For example we're now in the middle of moving our SAP environment to the Cloud, at least the development test and user environments are moved to the Cloud. The other ones remain still within a traditional data center environment, and we have moved all of our Office 365, so that's Skype for Business, SharePoint, but all the other applications to the Cloud as well. >> Ha ha. >> And there we have all this additional transformation, the challenges that really comes back to the end user. >> Those are huge applications; SAP and Office 365. Those are not insignificant >> Yup. >> applications at all. So what were some of the challenges, I'm sure we have a lot of your peers watching this. What is some of the tips and tricks that you can share with them? Big challenges that you had to overcome? Things you thought about, maybe some things that you didn't think about in that transformation? >> If you look at the SAP landscape, it's the sheer amount of interfaces between the different components of SAP. That's was something that made us decide not to move SAP to the Cloud, not the production environment and the systems Environment. That was too big of an impact. That would take too long to do and we don't have that time. If you look at Office 365, the fact that Microsoft is very averse in having anything in the middle, that brought us some real challenges. And and we did that already in 2014-2015 and we had our fair share of all fun and games. >> Ha ha ha, so what was different about it then than today? I mean obviously the Cloud has moved quite a bit. I don't know if you can mention which Cloud you put it in? >>Yeah correct, the fact that Zscaler now, does the updating, and all the changes within the Microsoft environment. So you don't have to do it yourself. You don't have to constantly monitor the ARS feeds from Microsoft, do all the changes yourself. Now it's all done by Zscaler, all the SSL bypass, the authentication bypass has been set correctly. So when that came on board that made our life a lot easier. >> Wow. >> The first part of the migration that we did in in Europe, especially in the bigger locations like Amersfoort, which has our headquarters, we really had our challenges to keep the end user satisfied. >> So just, again, kind of the scale of the end users. You mentioned that a couple of times. Is this in support of all the 23,000 people that are employed at FrieslandCampina? Is it a subset, or is it remote workers? How are you, kind of, allocating this effort? >> It is indeed all users, except for the factory workers. We don't allow people that work in production direct access to the internet. So those people are not as much excluded, but they have special PCs where they work on. So you're looking currently at about 15,000 people that are working with Office 365 directly on a day-to-day basis within FrieslandCampina. >> Wow, so the other thing you've talked about repeatedly is not only satisfaction with the users who are interfacing with the systems, but security. So what were some of the >> Yup. >> security considerations that you considered? How did you, kind of, bake security into your process? And, as we hear all the time as we go to different shows, including security shows, you know, it's not a bolt-on anymore; you have to be thinking security throughout the whole pipeline of the process. So how did you think about it? How did you attack it? How did you solve some of those problems? >> We started thinking about it already in 2012. We had, at that time within FrieslandCampina, a program specifically driven out of the LT environment, so the operational technology, so the production IT, so to speak, and they come up with an architecture based on the ISO 9599 norm, and we took that on board as IT and continued to work on that. So from 2014 we already had in our plans, the architecture to separate the various layers of the ISO 9599 framework into security zones, and we're constantly building on that one. We're refining it, we're improving it. >> Another question on security, really, and kind of the network architecture. Did you have to re-do anything within your network architecture to make this move to the Cloud possible? How did you address the network? >> It was a completely redesigned. It was a complete redesign. In the, previous to that, we just had IT, and we had one or two firewalls on-site that connects to a certain part of OT, and that was it. And now we have an architecture where we can integrate all different flavors of OT. There's no need for OT to have their own internet connections for maintenance, for support, et cetera. It's all integrated and secure. We made, and the reason for that is that you can't, in this day and age, have an island structure. Everything needs to be integrated. Everything needs to talk to each other, et cetera. >>  So Erik, this interview is sponsored by Zscaler. You're a customer of theirs. I'm just curious if you can talk a little bit about how, you know, their offering enabled you to do stuff that maybe you couldn't do before. How did you get involved with them? How are they working with them throughout this project? And how has that really been an enabler for your, you know, your move to the Cloud? >> In 2013-2014 there was a request from the business, a very strong drive from the business, that looked into breakouts, specifically to get localized contact, driven out of the, how do say that, marketing department. And then we looked at, okay, how can we enable that without creating firewalls on every location we're having, making it very expensive, etcetera. And at that time our provider, Verizon, came up, let's do a Cloud security with Verizon, with Zscaler, and do a proof of concept, and build on that one. So that worked. That gave us more regularity, if the people in the countries that needed localized content got the localized content, speeding up the application for the specific countries, so no happening from Tokyo, Japan, back to Singapore, back to websites in Japan. So that helps a lot, but like I said it was early days so we had our challenges in getting that working, getting it secure, getting the traffic to the correct Zscaler node, and so on. So we did make, from the initial set-up of this network, a number of iterations to come to where we are today. >> Great. >> So it's not one decision and then it works. No, it's a decision, see what has worked, which challenge you're getting, and then take it to the next level. >> Right. >> If we do the same thing with Zscaler as they're offering today it will be a lot quicker. We will have a number of those challenges that we had at that time, we will not have today. >> So as you look forward, what's kind of next. As you mentioned this isn't a one-stop shop. This is an ongoing process. What are, kind of, your next priorities, you know, over the next six months or so as you guys continue on this journey? >> To another data center, so not to the Cloud but to a different data center, so that's a big, really a big program. The other thing we're looking at is how can we improve remote access, provide extra benefits as part. We also look at the ZPA product of Zscaler. We're doing a proof of concept, probably in the second half of this year. So, but on the other side, this year, 2019, FrieslandCampina is a, how do you say that in proper English, stop and look back and see what's really important, what we need to go forward. So it's not going crazy on all different kind of projects. It is, okay, what will actually contribute to the profitability of FrieslandCampina going forward. >> I think that's a really great close. I know it's late in Utrecht. I appreciate you taking some time out of your evening, and I was going to ask you the last question, you know, what advice would you have for your peers, for other practitioners that are looking at this, and, you know, either in the process or planning out their journey, but I think you hit on a big one right there which is really focus on the things that matter, focus on the things that really make a difference, and just don't start doing science experiments all over the place because you can, or it's fun, or it's interesting. >> Well, what my worries are for the future, and what, not keeps me awake at night, but that that's too much, is the bad that's going around in this world is getting stronger. They have more resources than we, as a company, has to defend for us against, and the acute challenge would be, is identifying what is your traffic that is good flowing in your network. Because if you're knowing what is good everything that's not defined as being good can be immediately defined as being bad. In that case you'll have a better position in preventing yourself against everything that's going wrong, like WannaCry. If you know that WannaCry is using a well known port used all over the place in FrieslandCampina. But if you then see that same port being used to communicate between servers that never communicated before, or to workstations to servers that never communicated before, then you say, okay, stop that one immediately, because that's not good. >> Right. >> And at that moment our biggest challenge is identifying what is the traffic that's good within our network. >> Well that's a great tip, you know, that's great. You know what the positives are, and if it doesn't make the the green list then shut 'er down and (chuckling) find out what's going on. >> Correct. >> All right. >> Correct. And the reason why we identified WannaCry is that somebody, for some reason, identified Hey this server never talked with that device: Why? >> Yeah, we're hearing that, >> And because, all. >> because with IOT you have to do that, right? >> You have to do that. >> 'Cause everything's IP connected, right? Whether it's the shades and the HVAC system all the way down to all your manufacturing processes, distribution processes, >> Correct. >> IT systems. >> Correct, correct. Our big advantage was that the call back to the command and control servers was already blocked by Zscaler so it didn't hurt us that much. >> Yeah, well good, we got to keep the cows safe, keep the milk safe, and the, >> Yeah, absolutely. >> what did you say, the 10 billion gallons of milk that you guys kick out a year, or something like that? >> Yep. >> It's amazing, ha ha. >> It's amazing. >> All right Erik, well thanks for sharing your story. Good luck on your future transformations, and good luck next week; thanks for stopping by. >> Thank you very much. >> All right. >> All right. >> All right, he's Erik, I'm Jeff, you're watching the CUBE. We're in our Palo Alto studios and Utrecht, Holland. Thanks for watching, we'll see you next time. (funky music)

(funky music) >> From our studios in the heart of Silicon Valley, Palo Alto, California. This is a CUBE conversation. >> Welcome back everybody, Jeff Frick here with the CUBE. We're in our Palo Alto studios havin' a CUBE conversation, but for a little bit of something different. Instead of having our guest here locally in Palo Alto we've got him all the way across the country, across the pond, all the way over to Holland, and he's in Utrecht, and we're happy to welcome Erik Klein. He is the infrastructure architect for FrieslandCampina. Eric thanks for joining us today. >> Thank you for having me. >> Absolutely, so before we get started, a little background on FrieslandCampina for people that aren't familiar with the company. >> FrieslandCampina is a co-operative company owned by farmers, predominantly in the Netherlands, Belgium and Germany. It's a international company. We have about 34 countries with, we have, at our sales offices, our plans in there, we are one of the biggest dairy companies in the world, and love to be there. It's a very good company to work for. >> It's amazing, I was doing a little research, I mean the scale is amazing. You guys, you operate in 100 countries, exporting. You've got offices in 34 countries. I think it said of 23,000 plus employees. It's quite a big operation. >> Yup. >> So, >> A big operation doing about 10 billion liters, or kilograms, of milk a year. >> Great, so, it's a dairy, we're here talking about digital transformation; it's always fascinating to me, kind of, the reach of digital transformation in everybody's company. Everyone says everyone's really a software company, you know, kind of built around a different product or service. So what were some of the challenges that you were looking towards in 2018-2019 in terms of digital transformation in this mature industry of dairy? >> The challenges that we're having is that you have to make sure that everything is safe. The products are safe, but also the data is safe. But also that we have a lot of things move through the Cloud, and also that the performance of those applications moves through the Cloud, is to the end user's satisfaction as well. So you're not looking only at transferring data safely from the Cloud into our offices, into our production environment, also protecting our production environments from everything that's going bad on the Internet, but also having to make sure that the applications are performing to the liking of the end user, so to speak, to our customer and our consumers. >> And was the objective to build new applications in the Cloud, or was it more kind of lift-and-shift some of your older applications in the Cloud? Because those are two very different challenges. >> Yeah, it's a lift-and-shift of our older applications. For example we're now in the middle of moving our SAP environment to the Cloud, at least the development test and user environments are moved to the Cloud. The other ones remain still within a traditional data center environment, and we have moved all of our Office 365, so that's Skype for Business, SharePoint, but all the other applications to the Cloud as well. >> Ha ha. >> And there we have all this additional transformation, the challenges that really comes back to the end user. >> Those are huge applications; SAP and Office 365. Those are not insignificant >> Yup. >> applications at all. So what were some of the challenges, I'm sure we have a lot of your peers watching this. What is some of the tips and tricks that you can share with them? Big challenges that you had to overcome? Things you thought about, maybe some things that you didn't think about in that transformation? >> If you look at the SAP landscape, it's the sheer amount of interfaces between the different components of SAP. That's was something that made us decide not to move SAP to the Cloud, not the production environment and the systems Environment. That was too big of an impact. That would take too long to do and we don't have that time. If you look at Office 365, the fact that Microsoft is very adverse in having anything in the middle, that brought us some real challenges. And and we did that already in 2014-2015 and we had our fair share of all fun and games. >> Ha ha ha, so what was different about it then than today? I mean obviously the Cloud has moved quite a bit. I don't know if you can mention which Cloud you put it in? >> Yeah correct, the fact that Zscaling now, does the updating, and all the changes within the Microsoft environment. So you don't have to do it yourself. You don't have to constantly monitor the ARS feeds from Microsoft, do all the changes yourself. Now it's all done by Zscaler, all the SSL bypass, the authentication bypass has been set correctly. So when that came on board that made our life a lot easier. >> Wow. >> The first part of the migration that we did in in Europe, especially in the bigger locations like Amersfoort, which has our headquarters, we really had our challenges to keep the end user satisfied. >> So just, again, kind of the scale of the end users. You mentioned that a couple of times. Is this in support of all the 23,000 people that are employed at FrieslandCampina? Is it a subset, or is it remote workers? How are you, kind of, allocating this effort? >> It is indeed all users, except for the factory workers. We don't allow people that work in production direct access to the internet. So those people are not as much excluded, but they have special PCs where they work on. So you're looking currently at about 15,000 people that are working with Office 365 directly on a day-to-day basis within FrieslandCampina. >> Wow, so the other thing you've talked about repeatedly is not only satisfaction with the users who are interfacing with the systems, but security. So what were some of the >> Yup. >> security considerations that you considered? How did you, kind of, bake security into your process? And, as we hear all the time as we go to different shows, including security shows, you know, it's not a bolt-on anymore; you have to be thinking security throughout the whole pipeline of the process. So how did you think about it? How did you attack it? How did you solve some of those problems? >> We started thinking about it already in 2012. We had, at that time within FrieslandCampina, a program specifically driven out of the LT environment, so the operational technology, so the production IT, so to speak, and they come up with an architecture based on the ISO 9599 norm, and we took that on board as IT and continued to work on that. So from 2014 we already had in our plans, the architecture to separate the various layers of the ISO 9599 framework into security zones, and we're constantly building on that one. We're refining it, we're improving it. >> Another question on security, really, and kind of the network architecture. Did you have to re-do anything within your network architecture to make this move to the Cloud possible? How did you address the network? >> It was a completely redesigned. It was a complete redesign. In the, previous to that, we just had IT, and we had one or two firewalls on-site that connects to a certain part of OT, and that was it. And now we have an architecture where we can integrate all different flavors of OT. There's no need for OT to have their own internet connections for maintenance, for support, et cetera. It's all integrated and secure. We made, and the reason for that is that you can't, in this day and age, have an island structure. Everything needs to be integrated. Everything needs to talk to each other, et cetera. >> So Erik, this interview is sponsored Zscaler. You're a customer of theirs. I'm just curious if you can talk a little bit about how, you know, their offering enabled you to do stuff that maybe you couldn't do before. How did you get involved with them? How are they working with them throughout this project? And how has that really been an enabler for your, you know, your move to the Cloud? >> In 2013-2014 there was a request from the business, a very strong drive from the business, that looked into breakouts, specifically to get localized contact, driven out of the, how do say that, marketing department. And then we looked at, okay, how can we enable that without creating firewalls on every location we're having, making it very expensive, et cetera. And at that time our provider, Verizon, came up, let's do a Cloud security with Verizon, with Zscaler, and do a proof of concept, and build on that one. So that worked. That gave us more regularity, if the people in the countries that needed localized content got the localized content, speeding up the application for the specific countries, so no happening from Tokyo, Japan, back to Singapore, back to websites in Japan. So that helps a lot, but like I said it was early days so we had our challenges in getting that working, getting it secure, getting the traffic to the correct Zscaler node, and so on. So we did make, from the initial set-up of this network, a number of iterations to come to where we are today. >> Great. >> So it's not one decision and then it works. No, it's a decision, see what has worked, which challenge you're getting, and then take it to the next level. >> Right. >> If we do the same thing with Zscaler as they're offering today it will be a lot quicker. We will have a number of those challenges that we had at that time, we will not have today. >> So as you look forward, what's kind of next. As you mentioned this isn't a one-stop shop. This is an ongoing process. What are, kind of, your next priorities, you know, over the next six months or so as you guys continue on this journey? >> To another data center, so not to the Cloud but to a different data center, so that's a big, really a big program. The other thing we're looking at is how can we improve remote access, provide extra benefits as part. We also look at the CPA product of Zscaler. We're doing a proof of concept, probably in the second half of this year. So, but on the other side, this year, 2019, FrieslandCampina is a, how do you say that in proper English, stop and look back and see what's really important, what we need to go forward. So it's not going crazy on all different kind of projects. It is, okay, what will actually contribute to the profitability of FrieslandCampina going forward. >> I think that's a really great close. I know it's late in Utrecht. I appreciate you taking some time out of your evening, and I was going to ask you the last question, you know, what advice would you have for your peers, for other practitioners that are looking at this, and, you know, either in the process or planning out their journey, but I think you hit on a big one right there which is really focus on the things that matter, focus on the things that really make a difference, and just don't start doing science experiments all over the place because you can, or it's fun, or it's interesting. >> Well, what my worries are for the future, and what, not keeps me awake at night, but that that's too much, is the bad that's going around in this world is getting stronger. They have more resources than we, as a company, has to defend for us against, and the acute challenge would be, is identifying what is your traffic that is good flowing in your network. Because if you're knowing what is good everything that's not defined as being good can be immediately defined as being bad. In that case you'll have a better position in preventing yourself against everything that's going wrong, like WannaCry. If you know that WannaCry is using a well known port used all over the place in FrieslandCampina. But if you then see that same port being used to communicate between servers that never communicated before, or to workstations to servers that never communicated before, then you say, okay, stop that one immediately, because that's not good. >> Right. >> And at that moment our biggest challenge is identifying what is the traffic that's good within our network. >> Well that's a great tip, you know, that's great. You know what the positives are, and if it doesn't make the the green list then shut 'er down and (chuckling) find out what's going on. >> Correct. >> All right. >> Correct. And the reason why we identified WannaCry is that somebody, for some reason, identified Hey this server never talked with that device: Why? >> Yeah, we're hearing that, >> And because, all. >> because with IOT you have to do that, right? >> You have to do that. >> 'Cause everything's IP connected, right? Whether it's the shades and the HVAC system all the way down to all your manufacturing processes, distribution processes, >> Correct. >> IT systems. >> Correct, correct. Our big advantage was that the call back to the command and control servers was already blocked by Zscaler so it didn't hurt us that much. >> Yeah, well good, we got to keep the cows safe, keep the milk safe, and the, >> Yeah, absolutely. >> what did you say, the 10 billion gallons of milk that you guys kick out a year, or something like that? >> Yep. >> It's amazing, ha ha. >> It's amazing. >> All right Erik, well thanks for sharing your story. Good luck on your future transformations, and good luck next week; thanks for stopping by. >> Thank you very much. >> All right. >> All right. >> All right, he's Erik, I'm Jeff, you're watching the CUBE. We're in our Palo Alto studios and Utrecht, Holland. Thanks for watching, we'll see you next time. (funky music)