(uptempo orchestral music) >> Welcome to theCubeConversations here in Palo Alto, California. theCube Studios, I'm John Furrier. The co-host of theCube, and co-founder of SiliconANGLE Media. Junaid Islam is the present CTO of Vidder that supports the public sector as well as the defense community as well as other criminalist oriented security paradigms. Expert in the field. Also part of coming Vidder that's doing a lot of work in the area. Thanks for sharing your time here with us. >> Well thanks for having me. >> We had a segment earlier on cybersecurity and the government. So that was phenomenal and also, we talked on the impact of hacking on business. So the number one issue on the boardroom agenda is security. Data, security, it's a big data problem. It's an AI opportunity, some things that are coming out. Embryonic, it's an early shift. Security is a challenge. The old model, the firewall, a moot, doors, access, you get in then you're done. It's over, it's a criminalist world. People can get access to these networks. Security is screwed right now. And we generally feels that. So the question for you is the Enterprise and in business as we're looking to show up security. Isn't it a do-over? >> Yeah, yeah, I think like other industries. Whether you talk about the PBS. Yes, yes, where you talk about computers shifting to the data center and then the cloud. I think last year or this year, Gartner said 100 billion will be spent on security. I cannot believe anybody who was involved in that 100 billion dollar expenditure is happy. In fact we have something interesting. Security expenditure has risen consistently over the past five or six years, and cyber attacks have also risen consistently. So that's not the kind of correlation you want. >> And they're buying anything that moves basically, they're desperate so it seems like they're like drunken sailors. Just like give me something. They're thirsty for solutions. So they're groping for something. >> Yeah and what we're seeing is a couple of things. One is the attackers have gotten much more sophisticated. And they basically can bypass all of the existing security appliances. So what we need is a new approach or a new security stack that really fits both the architectural environment of American companies where they use Clouds and data centers, and they have employees and contractors. But also cyber attacks which have gone much more sophisticated. The classic cyber attack used to be connecting to the Server remotely or stealing a password. We still have the classics but we have some new ones where we have malware that can actually go from the user's device to inside the network. And you find that existing security products just don't work well in this environment. >> What are some of the do over ideas? >> Absolutely malware, we see it ransomware, super hot, the HBO example recently. They didn't given, who knows what they actually did. They weren't public about it but actually they maybe get a little bit in but these are organized businesses. They're targeting with the Sony hacks well documented but again businesses, I'm not always funded this. And then you got the move to the clouds. Couple dynamics. Cloud computing. Amazon has done extremely well, they're leading. Now getting a lot more of the Enterprise. They won the CIA deal a few years ago over IBM. And you see a lot of government Cloud rocking and rolling, and then you've got the on premise data center challenges. That's the situation of the customer then now you have potentially an understaffed security force. >> Well actually so, I think let's start with that point. In terms of our theme of a do over. Talk about that first and then let's talk the techno part. I think one do over that America needs is security has to move out of the IT department, and become a stand alone department reporting ideally to the executive staff and not being on it. I think one of the unfortunate things is because security is a cost center within IT, it competes with other IT expenditures such as new applications, which are revenue generating. It's very hard to be a cost center asking for money when there's a guy sitting next to you who's doing something to make money. But unfortunately, unless security is properly funded and staffed, it never happens. And this unfortunately is a chronic issue through all US companies. One of the things we've seen that has worked for example in the financial world is most financial institutions, probably all now security is a pure organization to IT, that helps a lot. This is actually not a new idea, this was something the intelligence community probably started-- >> Cost structures, it's just the cost structures. Reduce the cost is the optimization behavior. What you're saying is just like applications are tied to top line in revenue, which gives them top line mojo. You got to think of security as a money saving table stake. >> That's right. >> People are losing money. The cost are now becoming obvious, in some cases crippling. >> Yeah so I think people need to think of security as fundamental to the life of a company, number one. I think the other thing that needs to happen from a security perspective. Now that we've broken off this entity is it security needs to become a threat based or risk based. Too much of security in the United States is based on compliance models. Unfortunately cyber attackers do not follow that model when they want to attack us. They basically work outside the model and come up with creative ways to get inside of organizations. >> Basically blindside. >> That's right. >> The company. >> I can't tell you how many meetings probably all where I meet the security team and they're totally busy just going through the list of 20 or 50 things that they're are supposed to do. So when you talk about attack vectors. They say you know that's really great and I know it's important but we can't get to it. So this is another important shift organizationally. First you break it out. Second, get focus on something that's important. once we have that we get to the next part which is technologies. And right now what happens is people buy a security point product for different networks. One for data center or one for Cloud. And this doesn't work so I think we have to move to security solutions that can work across hybrid environments, and can also work across different roles. I think that is critical and unless we get that in technically. >> Yeah, this is the thing with Cloud and (indistinct talking). I want to bring this up. I had multiple change to sit down with Andy Jassy. The CEO of Amazon web services. Fantastic executive, built a great business there. On his mind, what's been important for him for many years has been security, and Amazon has done an amazing job with security. But that's in the Cloud. Now Andy Jassy and Amazon thinks everyone should be in the public Cloud. Now they have a deal with VMware but they're just powering VMware's on prem in their Cloud. It's not really a VMware issue but Amazon's world is raising the public Cloud. But they've done really, really good on security, but yet most of the buyers would say hey, the Cloud is unsecure I can't trust it. So you have the dynamic between the data center on premise resource. So people default to the behavior of and leaving here with the on premise. Or I'll put a little bit in the cloud, a little bit of workloads here. A little bit in the Microsoft. Google's got some, I'll keep the tire on Google. But they never really leaving the home base of the data center. But yet some are arguing and Dave Vellante, my co-host on theCube talks about this all the time. There's actually more scale in the Cloud. More data sharing going in the cloud and that the cloud actually got better security. So how do you see that resolving because this is a key architectural opportunity and challenge for Enterprise. >> Actually I think there's an optimal model which is if you think about what the data center gives you. It gives you a lot of visibility and physical control as in with your hands. The problem is when you put everything in the data center. You don't have enough people to manage it all properly. The Cloud on the other hand gives you a lot of scale but you can't actually touch the Cloud. So the optimal mix is imagine your encryption and access control solutions live in your data center. But what they control access to is to Cloud resources. So you can actually, if you're just open your mind conceptually. >> So it's like saying, it's like segmenting a network. You're segmenting feasibility. >> That's right, so now you don't need a gigantic data center because what's in your data center which can be a lot smaller now are things like your identity-based access management solutions. You can keep your cryptographic elements. You can have your HSM, things that generate random numbers and search there. But now this is actually can be very tiny. It can just be a rack of gear. But through that rack of gear, you can have very fine control of people accessing Cloud resources. And I think this idea of building, it's not so much a hybrid network, but it's a notion that a small physically locked down asset can control a lot of virtual assets. It's gaining mind share in the banking world. In fact, just this summer, there was bank that implemented such an architecture where the control elements were the Cloud were their FFIC data center. And it include, it basically managed access to Amazon VPC and it worked well. >> So interlocking is a strategy. I can see that, by the way I see that playing out pretty well. So I got to ask the next question which comes to mind is that sounds great on paper. Or actually in certain situations it might perfect. But what about the geo-political landscape? because Amazon has people that develop on the Cloud that aren't US citizens. So the government might say wait a minute, you got to only employ Americans so they got to carve out and do some whatever weird doings with the numbers to get that certification. But they need data centers in Germany because the German government wants certain things. So you have geo-political issues now on the companies. How does that affect security? Because now a Cloud like Amazon or a multinational company has two things going on. I have multiple offices and I'm operating in multiple geo-political landscapes with these regional centers. The regional clouds, or at Amazon they're called regions. >> So actually Amazon has actually done a great job. They basically have their global market, but they also have data centers now which are only opened to US persons in US companies like Globe Cloud. As well as well as they support the C2S which is the intelligence communities Black Cloud, which is basically off net so I think now-- >> John: So they're doing a good job? >> Yeah, they're doing a good job but the key thing is how you use that resource is really still up to the enterprise. And that's where enterprises have to get good at creating the architecture and policies to be able to harness Amazon's compute capacity. Amazon, is the foundation but you really have to finish off the solution and the other thing going back full circle to your first question. Unless the security team has their freedom and the mandate to do that, they'll actually never get there. >> So it's staffing and architecture. >> That's right. >> Well they both architecture. It's one's organizational architecture. Debt funding and one is more of a hardcore virtual and physical touching. >> And you know what I put in the middle? I'd say know your risks and develop counter measures to them. because if you go to that security team and you say you have to build a counter measure for every attack. That's not going to work either. A company has to be realistic is what is really important? Maybe it's the data of our customers. >> So the answer to the first question then obviously is yes a security do over is needed. But there is no silver bullet and you can't buy an application, it's an architectural framework holistically >> Junaid: That's right. >> That everyone has to do, okay cool. So the question I have on the Amazon, I want to get your thoughts 'cause it's a debate we have all the time on theCube is. And certainly Amazon has competitors that say, Amazon is really not winning in the enterprise. They've got thousand of Enterprise customers. They are winning in the Enterprise so Oracle is catching up, barely in fourth place. But trying to get there and they're actually making that transformation. Looking pretty good, what more now assume that Oracle will (indistinct talking). But Amazon has one great gov Cloud deals. So they're convinced the government that they could do it. >> Junaid: Yeah. >> So to me that's, my argument is if the government is winning with Amazon. It should be a no brainer for the Enterprises so this comes back down to the number one question that's been holding back Cloud growth. Whoa, security, I don't want to put it in the Cloud. How real is that objection now? 'Cause the knee jerk reaction is you know what, I got an on prem, I don't trust the Cloud. But it seems like the Cloud is getting more trust. What's your thoughts on that objection? >> So one of the things as even though when we use the word Cloud, generically or Amazon generically. Amazon has evolved a lot in the last three to four years that I've been working on it. The number of embedded tools in Amazon is vast now. If we were having this conversation two years ago. The notion that granular encryption modules would be there and Amazon is apart of an offering. It would have been science fiction or the fact that-- >> More that S3 and AC2, what else could there be? >> That's right or they have things like virtual HSM. They have embedded identity and access control tools all there so I think first of all. All of the building blocks that you would want are there. Now unfortunately there's no short cuts. Amazon is not going to do the work for you, you still need a staff that knows how to use digital certificates. You still need your own identity based access control system to manage access of your employees and contractors and people in India to these assets in the Cloud. But having said that, we now actually have a model that is much cheaper than the classic data center model. That's basically usable. >> I'm smirking some people think I'm an Amazon web services fan boy but besides the fact that I love the company. They've done well and there's so many new services, and they literally have been skating rings around the competition. If you look at the complexity that they have been dealing with and the innovations. So the outputs put that out there. I'm a little biased 'cause I think they're doing a great job. But now, the game start to shift as Amazon continues to add more services. Welcome to the big leagues called the Enterprise and government, which they're doing some business in now. So the question is besides Amazon, those other guys. Verizon, the Telecos have really trying to figure out what to do with over the top for years. Now they're also powering a lot of multi tenet workloads as well, including their own stuff. So telecos and service providers out there, what are they doing because they're still critical infrastructure around the world. >> Actually, I think if we just use Amazon as a reference point or example. Amazon initially didn't worry about security but then over the last few years, worked hard to integrate security into their offering. We're now in the early stages of seeing that from for example carriers like Verizon. Where in the past Verizon was saying first secure yourself then in the last two years. Version okay, here's some products and services you can buy. But now where we're heading is they're trying to make the network inherently secure. A lot of the basic components like device matching to identity matching basically making that apart of the underlying fabric. So I think the good news is as-- >> So they're making advances there. They have networks. They know networking. >> So the good news is as bleak as it all seems as we are making significant progress as an industry and as a country. Having said that, my only and warning is you still need an executive team. A security team that knows how to leverage all of these components and pull them together. And that goes back to having a risk based approach and protecting the most important things. I think you can do that, I think the tool set that's come out now is actually pretty sophisticated. >> So final question, I want to get your thoughts and we can end the segment and then we'll take a little bit about Vidder, your company. But I asked Pat Gelsinger, CEO of VMware at VM World just recently about the security duo 'cause Dave Vellante asked him years ago. He said absolutely it's going to be (indistinct talking) so Pat Gelsinger has it right again. The guy is like Nostradamus when it comes to tech trend. He's a wave guy from Intel, so he gets the waves. But I asked him about that question again this year and I'll send the tip out on Twitter. I'll put it out on Twitter, I'll make a link to it. He said that 5G is going to be the big kahuna of the next 30 years. He thinks that as 5G starts to get out, it's going to develop 10X number of antennas, 100X of bandwidth, new spectrum allocations, 100X new devices, they're all going to be connected as well. As you mentioned we're a connected world. This brings up the edges of the network where he says, "Next thirty years is going to be massive build out." So okay, 5G is coming. Industrial IoT, IoT internet of things is happening. How is this going to change a security game because now you have networking and you see VMware. We're doing NSX and Cisco has been trying to the Enterprise figuring out the virtualization of network level. Everything comes back down to the network. Is that where the action is because it seems to me that the network guys have to figure this out. And that seems to be the point of reference in terms of opportunity. Or is it a challenge or is it moving up the stack. How does all the networking changes happen? >> So for IoT, we really need two things to happen. I think one is we actually don't have a security standard for IoT devices. And specifically the issue is malware. IoT devices and softwares made worldwide and I think one of the biggest policy weaknesses we have right now is there's no minimum standard. This needs to be solved, otherwise we're in a lot of problem but in parallel to that. There is a lot of technical development. One of the things that's happening in the networking world is for the past 20 years. We were driven by what's called a network VPN of Layer 3 VPN, it's your classic VPN, that connects a device to a server. The problem with that is if you have malware on the device it gets through. So there's this new kind of VPN which is an application VPN or we call it a Layer 4, which is basically a softer process in the device tool. A softer process in a server. So that's the new model, which is-- >> They're making them as dumb as possible and go up the stat. >> Not so much-- >> There were guys that are going to roll-- >> I could have used different terms. I could have say make the app network application aware so that it only lets the applications get through. Not any kind of connection, so I think that is something. >> Well the networks have to smarter and enable the smartness. >> So smarter networks are happening and it's an area that I worked in. It's very excited. >> John: I don't mean to offend you by saying dumb network-- >> But the application but to be clear though that's just one piece of the puzzle. The other piece of the puzzle which unfortunately is a little bit lacking is there's no standards for IoT software today. And unless we have concepts like secure boot, that is the software can't be tampered with. I think I've unfortunately there's a bit of risk but I'm hopeful-- >> And then IoT for folks watching, there might be any inside baseball. It's a surface area problem. There's more points of attack vectors, so we talk about the compliance thing. >> Not only are there more attacks, by and large IoT devices are made outside of the United States. Physically they are made in China and a lot of the software comes from India. And there's nothing wrong with that, but the global supply chain provides plenty of opportunities for cyber attackers to inject in their code. And this is something we need to watch very carefully and then like I said-- >> So this is actually one of those weird derivative results of outsourcing that American companies have realized that's a problem. >> Yeah so. >> Is that right? >> Yeah so it's something we need to watch carefully. >> Okay, thanks for coming on the theCube. Really appreciate you sharing your perspectives. Talk about Vidder, you're the president and CTO. You guys in the security business. Obviously you're an expert with (indistinct talking). We'll have you back and multiple times. I'd love to get your company as we follow all the security trends. We have a cyber connect conference with Centrified coming up in New York. We're covering gov Cloud AWS and other players out there. What's Vidder doing? What's the company do for products? How do you guys sell? Who's your customers and what are the cool things you're doing? >> We've developed a access control solution based on a new standard called software defined parameter. And there's two things that are unique about it. First with technology like software defined parameter. We work in the Cloud in the data center, but more importantly, we're able to stop existing attacks and emerging attacks. So things like password theft, credential theft of server exploitation we stop because we don't want to allow connections from unknown devices or people. The other thing is say you're known, and you connect with server. We basically look inside your laptop and only allow the authorized process to connect to the server. So if there's malware on the device, it can't actually make it through. >> John: So it shuts down the malware. >> That's right. >> John: So you're trying sneak through. >> That's right, the malware. We can't stop the malware from getting on the device, but we can make sure it doesn't get to the other side. >> So it doesn't cross pollinate. It doesn't go viral. >> That right so a lot of the stuff we do is very important. We work with a range of-- >> You have government, obviously contracts. I'm sure you have that can't talk about but you do right? >> Yeah we do a little bit of work with the government and we're just start working with Verizon, which is public. Where they wish to create services where malware actually can't go through the connections. So we're doing exciting stuff and we're-- >> Enterprise customers at all? >> Yeah, yeah we have banks. >> Who are on high alert. >> That's right. >> You guys do tier one or it's the houses are burning down, you're there. So we do banks and we're just started doing some work in a hospital were again it's (indistinct talking) compliant, and they need to make sure that data doesn't leave the hospital. >> So what's the number one thing that you guys have as ransomware something that you solve. What areas do you guys being called in? What's the big fire bell, if you will? They ring the bell when do you come in? What the thing, just in general? >> Our number one reason for existing is stopping attacks on application servers or service that old data. That's our focus. So if you have data or an application that someone is after. We will make sure nobody gets to that data. In fact, we'll even make sure if there's a spy, or insider attack, who comes into your organization. They'll only be able to what their allowed to do and won't be able to do anything else. >> So on the weekly Fox that was big. Would you guys have helped there is they were a customer or is that just different thing? >> I know we could have helped because one of the things that happened is they used their server exploit to basically propagate through their data center. So we probably wouldn't have done much on the initial exploit, but we would have kept it from going deeper into the system. >> And they hid for four months and they were poking around so you would have detected. >> Yeah and we certainly would have stopped all the poking around. Because we basically, you can think of us as an identity based access control mechanism. So based on your identity, you can only do very specific things. And in their case, they had the identity of the user. We wouldn't have let them do anything except maybe just go to one website. >> Yeah you would have shut them down. They should have been doing business with Vidder. Jay thank you for coming on theCube here for theCubeConversation in Palo Alto, California. I'm Jon Furrier with theCubeConversation. Thanks for watching. (slow orchestral music)

(light orchestral music) >> Hello, everyone. Welcome to special CUBEConversation here in theCUBE studio in Palo Alto, California. I'm John Furrier, the co-founder of SiliconANGLE Media and also the co-host of theCUBE. We're here with Junaid Islam, who is the President and CTO of a company called Vidder. Also supports the public sector and the defense community. Teaches a class on cyber intelligence and cyber warfare. Junaid, thank you for coming in. >> Well, thanks for having me, it's great to be here. >> Now, you see, we've been doing a lot of coverage of cyber in context to one, the global landscape, obviously >> Yeah >> And in our area of enterprise and emerging tech you see the enterprises are all shaking in their boots. But you now have new tools like IoT which increases the service area of attacks. You're seeing AI being weaponized for bad actors. But in general, it's just that it's really a mess right now. >> Yeah >> And security is changing. So, I'd like to get your thoughts on it and also talk about some of the implications around the cyber warfare that's going on. Certainly the election's on everyone's mind, you see fake news. But really, it's a complete new generational shift that's happening. With all the good stuff going on, block chain and everything else, and AI, there's also bad actors. Fake news is not just fake content. There's an underlying infrastructure, a critical infrastructure, involved. >> Yeah, you're 100% right. And I think what you have hinted on is something that is only, now, people are getting awareness of. That is, as America becomes a more connected society, we become more vulnerable to cyber attacks. For the past few years, really, cyber attacks were driven by people looking to make twenty bucks, or whatever, but now you really have state actors moving into the cyber attack business. And actually subsidizing attackers with free information. And hoping to make them more lethal attackers against the United States. And this really is completely new territory. When we think about cyber threats almost all of the existing models, don't capture the risks involved here. And it affects every American. Everybody should be worried about what's going on. >> And, certainly, the landscape has changed in security and tech with cloud computing, but more importantly, we have Trump in the office and all this brouhaha over just that in itself. But in concern to that, you're seeing the Russians, we're seeing them involved in the election, you're seeing China putting blocks and everything, and changing how the rules, again. It's a whole global economy. So I got to ask you the question that's on everyone's mind is cyber war is real. We do not have a West Point, Navy SEALs for cyber yet. There's some stuff at Berkeley that's pretty interesting to me. That Michael Grimes at Morgan Stanley is involved with. A bunch of other folks as well. Where a new generation of attacks is happening. >> Junaid: Yeah. >> In the US of A right now. Could you comment and share your thoughts and reactions to what's happening now that's different in the US from a cyber attack standpoint and why the government is trying to move quickly why companies are moving quickly. What's different now? Why is the attacks so rampant? What's changed? >> I think the biggest difference we have now is what I would call direct state sponsorship of cyber attack tools. A great example of that is the Vault 7 disclosure on WikiLeaks. Typically, when you've had intelligence agencies steal one thing from another country, they would keep it a secret. And, basically, use those vulnerabilities during a time of an attack or a different operation. In this case, we saw something completely different. We think the Russians might have stolen, but we don't know. But whoever stole it, immediately puts it back into the public domain. And why do they do that? They want those vulnerabilities to be known by as many attackers as possible, who then, in turn, will attack the United States at across not only public sector organizations, but as private. And one of the interesting outcomes that you've seen is the malware attacks or cyber attacks we saw this year were much more lethal than ever before. If you look at the WannaCry attack and then the NotPetya attack. NotPetya attack started with the Russians attacking the Ukraine. But because of the way that they did the attack, they basically created malware that moved by itself. Within three days, computers in China that were 20 companies away from the original target were losing their data. And this level of lethality we've never seen. And it is a direct result of these state actors moving into the cyber warfare domain. Creating weapons that basically spread through the internet at very high velocity. And the reason this is so concerning for the United States is we are a truly connected society. All American companies have supply chain partners. All American companies have people working in Asia. So we can't undo this and what we've got to do, very quickly, is develop counter measures against this. Otherwise, the impacts will just get worse and worse. >> So in the old days, if I get this right, hey I attack you, I get to see a backdoor to the US. And spy on spy kind of thing. >> Junaid: Yeah. >> Right, so now, you're saying is, there's a force multiplier >> That's right out there with the crowd. So they're essentially democratizing the tools. We used to call it kiddie scripts. Now they're not kiddie scripts anymore, they're real weapons of cyber weaponry that's open to people who want to attack or motivated to attack the US. Is that kind of, am I getting that right? >> That's right. I mean, if you look at what happened in WannaCry, you had people looking for $200 payout, but they were using tools that could have easily wiped out a country. Now, the reason this works for America's enemies, as it were, or adversaries, is in the short run, they get to test out weapons. In the long run, they're really learning about how these attacks propagated. And make no mistake, if there's a political event and it's in their interest to be able to shut down US computers. It's just something we need to worry about and be very conscious of. Of specifically, these new type of attack vectors. >> Now to put my fear mongering hat on because as a computer scientist, myself, back in the day, I could only imagine how interesting this is to attack the United States. What is the government doing? What is the conversations that you're hearing? What are some of the things going on in the industry around? OK, we're seeing so sophisticated, so orchestrated. At many levels, state actors, democratizing the tools for the bad guys, if you will, but we've seen fraud and cyber theft be highly mafia driven or sophisticated groups of organized, black market companies. Forms, I mean, really well funded, well staffed. I mean, so the HBO hack just a couple weeks ago. I mean, it's shaking them down with ransomware. Again, many, many different things. This has got to scare the cyber security forces of the United States. What are they doing? >> So I think, one thing I think Americans should feel happy about is within the defense and intelligence community, this has become one of the top priorities. So they are implementing a huge set of resources and programs to mitigate this. Unfortunately, they will, they need to take care of themselves first. I think it's still still up to enterprises to secure their own systems against these new types of attacks. I think we can certainly get direction from the US government. And they've already begun outreach programs. For example, the FBI actually has a cyber security branch, and they actually assign officers to American companies who are targets. And typically that's actually, I think, started last year. >> John: Yeah. But they'll actually come meet you ahead of the attack and introduce themselves. So that's actually pretty good. And that's a fantastic program. I know some of the people there. But you still have to become aware. You still have to look at the big risks in your company and figure out how to protect them. That is something that no law enforcement person can help you at. Because that has to be pro-active. >> You know we everyone who watches my Silicon Valley podcast knows that I've been very much, talk a lot about Trump, and no one knows if I voted for him or not or actually, didn't vote for him, but that's a different point. We've been critical of Trump. But also at the same time, the whole wall thing is kind of funny, in itself, building wall is ridiculous, but that's take that to the firewall problem. >> Junaid: Yeah. >> Let's talk about tech. The old days, you have a firewall. Right? The United States really has no firewall because the perimeters or the borders, if you will, are not clear. So in the industry they call it "perimeter-less". There's no more moat, there's no more front door. There's a lot of access points into networks in companies. This is changing the security paradigm. Not only at the government level, but the companies who are creating value but also losing money on these attacks. >> Junaid: Yeah. >> So what is the security paradigm today? Is it people putting their head in the sand? Are there new approaches? >> Junaid: Well, yeah. >> Is there a do over, is there a reset? Security is the number one thing. >> So I >> What are companies and governments doing? >> So I think, well first of all, there's a lot of thinking going on but I think there's two things that need to happen. I think one, we certainly need new policies and laws. I think just on the legal side, whether you look at the most recent Equifax breach we need to update laws on people holding assets that they need to become liable. We also need more policies that people need to lock down national critical infrastructure. Like power systems. And then the third thing is the technical aspect. I'd bring it. We actually in the United States actually do have technologies that are counter measures to all of these attacks and we need to bring those online. And I think as daunting as it looks like protecting the country, actually, it's a solvable problem. For example, there's been a lot of press that you know foreign governments are scanning US power infrastructure. And, you know, from my perspective as a humble networking person, I've always wondered why do we allow basically connectivity from outside the United States to power plants which are inside the United States. I mean, you could easily filter those at the peering points. And I know some people might say that's controversial, you know, are we going to spy on >> John: And ports too. >> Yeah. >> Like, you know, ports of New Orleans. I was talking to the CTO there. He's saying maritimes are accessing the core network. >> Yeah, so from my perspective as a technical, I'm not a politician, but I >> (laughs) That's good, thank God! We need more of you out there. >> I would and I've worked on this problem a little bit I would certainly block in-bound flows from outside the United States to critical infrastructure. There is no value or reason, logical reason, you would give a why someone from an external country should be allowed to scan a US asset. And that is technically quite simple for us to do. It is something that I and others have talked about you know, publically and privately. I think that's a very simple step we could do. Another very simple step we could do across the board is basically authenticated access. That is, if you are accessing a US government website, you need to sign in and there will be an MFA step-up. And I think that makes >> What's an MFA step-up. >> Well like some kind of secondary >> OK. >> Say your accessing the IRS portal and you just want to check on something you know, that you're going to sign in and we're going to send a message to your phone to make sure you are you. I know a lot of people will feel, hey, this is an invasion of privacy. But you know, I'll tell you what's an invasion of privacy. Someone stealing 140 million IDs or your backgrounds, and having everything. >> John: That just happened. >> That's a bigger >> John: That's multifactor authentication. >> So I think that >> Unless they hack your cell phone which the bitcoin guys have already done. >> Yeah >> So, it's easy for hackers to hack one system. It's harder for hackers to hack multiple systems. So I think at the national security level, there are a number of simple things we can do that are actually not expensive. That I think we as a society have to really think about doing. Because having a really governments which are very anti-American destabilizing us by taking all of our data out doesn't really help anyone. So that's the biggest loss. >> And there's no risk for destabilizing America enemies out there. They what's the disincentive. Are they going to get put in jail? There's no real enforcement. >> Junaid: Yeah. I mean, cyber is a great leverage. >> So one of the things that I think that most people don't understand is the international laws on cyber attacks just don't exist anymore. They have a long way to catch up. Let me give a counter-example, which is drugs. There are already multilateral agreements on chasing drug traffickers as they go from country to country. And there's a number of institutions that monitor and enforce that. That actually works quite well. We also have new groups focusing on human trafficking. You know, it's slowly happening but in the area of cyber we haven't even started a legal framework on what would constitute a cyber attack. And, sadly, one of the reasons that it's not happening, is America's enemies don't want it to happen. But this is where I think, as a nation, first you have to take care of yourself. And then on a multi-lateral perspective the US should start pushing a cyber security framework world wide, so that if you start getting emails from that friendly prince, who's actually a friend of mine How about you know about putting in some we can actually go back to that country and say hey, you know, we don't want to send you any more money anymore. >> John: Yeah, yeah exactly. Everyone's going to make 18 million dollars if they give them their username, password and social security number. Alright, final question on this segment, around the cyber security piece. What's the action, going forward? I would say it's early days and hardcore days right now. It's really the underbelly of the internet. Globally is attacking, we see that. The government doesn't have enough legal framework yet in place. They need to do that. But there's a lot of momentum around creating a Navy SEALs. You need a version of land, air and sea. Or multidisciplinary combat. >> Junaid: Yeah. >> Efforts out there there's been conversations certainly in some of our networks that we talk about. What's the young generation. I mean, you've got a lot of gamers out there that would love to be part of a new game if you will called cyber defense. What's going on? Is there any vision around how to train young people. Is there an armed forces concept? Is there something like this happening? What's the next what do we need to do as a government? >> So you've actually touched on a very difficult issue. Because if you think about security in the United States it's really been driven by a compliance model. Which is here's these set of things to memorize and this is what you do to become secure. And all of our cyber security training courses are based on models. If there's one thing we learned about cyber attackers is that these people are creative and do something new every time. And go around the model. So, I think one of the most difficult things is actually to develop training courses that almost don't have any boundaries. Because the attackers don't confine themselves to a set of attack vectors. Yet we, in our training do, we say, this is what you need to do. And time and time again people just do something that's completely different. So that's one thing we have to understand. The other thing we have to understand, which is related to that, is that all of US's cyber security plans are public and conferences. All of our universities are open. So we actually have. >> John: The playbook is out there. >> We actually, so one of the things that does happen is if you go to any large security conference you see a lot of people from the countries that are attacking us showing up everywhere. Actually going to universities and learning the course. I think there are two things. One we really need to think deeper about just how attacks are being done which are unbounded. And, two, which is going to be a bit more difficult we have to rethink how we share information on a worldwide basis of our solutions. >> John: Mmm-hmm. >> So probably not the easy answer you wanted. But I think >> Well, it's complex and required unstructured thinking that's not tied up. It's like the classic frog in boiling water dies and you put a frog in boiling water and it jumps out. We're in this false sense of security with these rules. >> Junaid: Yeah. >> Thinking we're secure And we're, people are killing us with this security >> Yeah >> It's scary >> And like I say, it's even worse when we figure out a solution the first thing we do is we tell everybody including our enemies, giving them all a lot of chance to figure out how to attack us. So I think >> So don't telegraph, don't be so open Be somewhat secretive in a ways, is actually helpful. >> I think, sadly, I think we've come to the very unfortunate position now where I think we need to, especially in the area of cyber rethink our strategies because as an open society we just love telling everybody what we do. >> John: So the final question. Final, final question. Is just, again, to end this segment. So cyber security is real or not real. How real is this? Can you just share some color for the folks watching who might say hey, you know I think it's all smoke and mirrors. I don't believe the New York Times. I don't believe this. Trump's saying this. And is this real problem? And how big is it? >> I think it is real. I think we have this calendar year, twenty seventeen, we have moved from the classic, you know, kind of like cyber, attack you know like someone's being fished to really a, the beginning of a cyber warfare. And unlike kinetic warfare where someone blows something up this is a new face that's long and drawn out. And I think one of the things that makes us very vulnerable as a society is we are an open society, we're interlinked with every other global economy. And I think we have to think about this seriously because unfortunately there's a lot of people who don't want to see America succeed. They're just like that. Even though we're nice people >> John: Yeah >> But, it's pretty important. >> It requires some harmony, it requires some data sharing. Junaid Islam, President and CTO of Vidder. Talking about the cyber security cyber warfare dynamic that's happening. It's real. It's dangerous. And our countries and other countries need to get their act together. Certainly, I think, a digital West Point, a digital Navy SEALs needs to happen. And I think this is a great opportunity for us to kind of do some good here and keep an open society while maintaining security. Junaid, thanks for sharing your thoughts. I'm John Furrier with theCUBE, here in Palo Alto. Thanks for watching. (dramatic orchestral music)

(perky music) >> Hello everyone. Welcome to a special CUBE Conversation here in the CUBE studio in Palo Alto, California. I'm John Furrier the co-founder of SiliconANGLE Media and also the co-host of the CUBE. We're here with Junaid Islam who's the president and CEO of a company called Vidder. Also supports the public sector and the defense community, teaches a class on cyber intelligence and cyber warfare. Junaid thank you for coming in. >> Well thanks for having me. It's great to be here. >> Okay, you know we've been doing a lot of coverage of cyber in context to one, the global landscape obviously. >> Yeah. >> In our area of enterprise and emerging tech, you see the enterprises are all, you know, shaking in their boots. But you now have new tools like IOT which increases the service area of attacks. You're seeing AI being weaponized for bad actors. But in general it's just really a mess right now. >> Yeah. >> And security is changing, so I'd like to get your thoughts on and also talk about, you know, some of the implications around the cyber warfare that's going on. Certainly the election is on everyone's mind. You see fake news. But really it's a complete new generational shift that's happening. With all the good stuff going on, block chain and everything else and AI, there's also bad actors. You know, fake news is not just fake content. There's an underlying infrastructure, critical infrastructure involved. >> Yeah, you're 100% right and I think what you have hinted on is something that is only now people are getting awareness of. As that is as America becomes a more connected society we become more vulnerable to cyber attacks. For the past few years really cyber attacks were driven by people looking to make $20 or whatever, but now you really have state actors moving into the cyber attack business and actually subsidizing attackers with free information and hoping to make them more lethal attackers against the United States. And this really is completely new territory. When we think about cyber threats almost all of the existing models don't capture the risks involved here and it affects every American. Everybody should be worried about what's going on. >> And certainly the landscape has changed in security and tech (mumble) cloud computing, but more importantly we have Trump in the office and there's all this brouhaha over just that in itself, but in concert to that you're seeing the Russians, we're seeing them involved in the election, you're seeing, you know, China putting, you know, blocks on everything and changing how the rules (mumble). It's a whole global economy. So I got to ask the question that's on everyone's mind, is cyber war is real? We do not have a West Point, Navy Seals for cyber yet. I know there's some stuff at Berkeley that's pretty interesting to me that Michael Grimes at Morgan Stanley's involved in with a bunch of other folks as well, where a new generation of attacks is happening. >> Junaid Islam: Yeah. >> In the US of A right now. Could you comment and share your thoughts in reaction to what's happening now that's different in the US from a cyber attack standpoint and why the government is trying to move quickly, why companies are moving quickly, what's different now? Why is the attacks so rampant? What's changed? >> I think the biggest difference we have now is what I would call direct state sponsorship of cyber attack tools. A great example of that is the Vault 7 disclosure on WikiLeaks. Typically when you've had intelligence agencies steal one thing from another country they would keep it a secret and basically use those vulnerabilities during a time of an attack or a different operation. In this case we saw something completely different. We think the Russians might has stolen it but we don't know. But whoever stole it immediately puts it back into the public domain. And why do they do that? They want those vulnerabilities to be known by as many attackers as possible who then in turn will attack the United States at across not only a public sector organizations but as private, and one of the interesting outcomes you've seen is the malware attacks, or the cyber attacks we saw this year were much more lethal than ever before. If you look at the Wannacry attack and then the NotPetya attack. NotPetya started with the Russians attacking the Ukraine but because of the way they did the attack they basically created malware that moved by itself. Within three days computers in China that were 20 companies away from the original target were losing their data. And this level of lethality we've never seen and it is a direct result of these state actors moving into the cyber warfare domain, creating weapons that basically spread through the internet at very high velocity and the reason this is so concerning for the United States is we are a truly connected society. All American companies have supply chain partners. All American companies have people working in Asia. So we can't undo this and what we've got to do very quickly is develop counter-measures against this. Otherwise the impacts will just get worse and worse. >> So the old days, if I get this right, hey, I attack you, I get to see a back door to the US and spy on spy kind of thing- >> Junaid Islam: Yeah. >> So now you're saying is there's a force multiplier out there- >> That's right. >> John Furrier: With the crowd, so they're essentially democratizing the tools, not, we used to call it kiddie scripts. >> Junaid Islam: Yeah. Now they're not kiddie scripts any more. They're real weapons of cyber weaponry that's open to people who want to attack, or motivated to attack, the US. Is that kind of, am I getting that right? >> That's right. I mean if you look at what happened in WannaCry, you had people looking for a $200 payout but they were using tools that could have easily wiped out a country. Now the reason this works for America's enemies as it were, or adversaries, is in the short run they get to test out weapons. In the long run they're really learning about how these attacks propagated and, you know, make no mistake, if there's a political event and it's in their interests to be able to shut down US computers it's just something I think we need to worry about and be very conscious of specifically these new type of attack vectors. >> Now to put my fear mongering hat on, because, you know, as a computer scientist myself back in the day, I can only imagine how interesting this is to attack the United States. What is the government doing? What's the conversations that you're hearing? What are some of the things going on in the industry around okay, we're seeing something so sophisticated, so orchestrated at many levels. You know, state actors, democratizing the tools for the bad guys, if you will, but we've seen fraud and cyber theft be highly mafia-driven or sophisticated groups of organized, you know, under the, black market companies. Forms, I mean really well-funded, well-staffed, I mean so the HBO hack just a couple weeks ago, I mean, shaking them down with ransom-ware. Again there's many, many different things. This has got to scare the cyber security forces of the United States. What are they doing? >> So I think, one thing I think Americans should feel happy about is within the defense and intelligence community this has become one of the top priorities. So they are implementing a huge set of resources and programs to mitigate this. Unfortunately, you know, they need to take care of themselves first. I think it's still up to enterprises to secure their own systems against these new types of attacks. I mean I think we can certainly get direction from the US government and they've already begun outreach programs, for example, the FBI actually has a cyber security branch and they actually assign officers to American companies who are targets and typically that's actually, I think it started last year, but they'll actually come meet you ahead of the attack and introduce themselves so that's actually pretty good. And that's a fantastic program. I know some of the people there. But you still have to become aware. You still have to look at the big risks in your company and figure out how to protect them. That is something that no law enforcement person can help you at because that has to be proactive. >> You know everyone who watches my silicon valley podcast knows that I've been very much, talk a lot about Trump and no one knows if I voted for him or not. I actually didn't vote for him but that's a different point. We've been critical of Trump but also at the same time, you know, the whole wall thing's kind of funny in and of itself. I mean, building a wall's ridiculous. But let's take that to the firewall problem. >> Junaid Islam: Yeah. >> Let's talk about tech. The old days, you had a firewall, all right? The United States really has no firewall because the perimeters or the borders, if you will, are not clear. So in the industry they call it perimeter-less. There's no more mote. There's no more front door. There's a lot of access points into networks and companies. This is changing the security paradigm not only at the government level but the companies who are creating value but also losing money on these attacks. >> Junaid Islam: Yeah. >> So what is the security paradigm today? Is it people putting their head in the sand? Are there new approaches? >> Junaid Islam: Well, yeah. >> Is it a do-over? Is there a reset? Security is a number one thing. What are companies and governments doing? >> So I think, well first of all there's a lot of thinking going on, but I think there's two things that need to happen. I think one, we certainly need new policies and laws. I think just on the legal side, whether if you look at the most recent Equifax breach, we need to update laws on people holding assets that they need to become liable. We also need more policies that people need to lock down national, critical infrastructure like power systems and then the third thing is the technical aspect (mumble). We actually, in the United States we actually do have technologies that are counter measures to all of these attacks and we need to bring those online. And I think as daunting as it looks like protecting the country, actually it's a solvable problem. For example, there's been a lot of press that, you know, foreign governments are scanning US power infrastructure. And, you know, from my perspective as a humble networking person, I've always wondered why do we allow basically connectivity from outside the United States to power plants which are inside the United States? I mean, you could easily, you know, filter those at the peering points and I know some people might say that's controversial, you know. Are we going to spy on- >> John Furrier: Yeah, and ports, too. Like- >> Yeah. >> John Furrier: You know, ports of New Orleans. I was talking to the CTO there. He's saying maritimes are accessing the core network. >> Yeah and so from my perspective as a technical, I'm not a politician, but- >> That's good! Thank God! >> But I- >> We need more of you out there. >> And I've worked on this problem a little bit. I would certainly block inbound flows from outside the United States to critical infrastructure. There is no value or reason, logical reason, you would give of why someone from an external country should be allowed to scan a US asset. And that is technically quite simple for us to do. It is something that I and others have talked about, you know, publicly and privately. I think that's a very simple step we could do. Another very simple step we could do across the board is basically authenticated access. That is if you are accessing a US government website you need to sign in and there will be an MFA step up. And I think this makes sense- >> What's an MFA step up? >> Well like some kind of secondary- >> Okay, yeah. >> So say you're accessing the IRS portal and you want to just check on something, you know, that you're going to sign in and we're going to send a message to your phone to make sure you are you. I know a lot of people will feel, hey, this is an invasion of privacy but you know I tell you what's an invasion of privacy: someone stealing 140 million IDs or your backgrounds and having everything. >> John Furrier: Which just happened. >> That's a bigger- >> So MFA multi- >> That's right, factor. Yeah, yeah. >> John Furrier: Multifactor Authentication. >> Yeah, so I think, again- >> John Furrier: Unless they hack your cellphone which the BitCoin guys have already done. >> Yeah. But, so it's easier for hackers to hack one system. It's hard for hackers to hack multiple systems. So I think at the national security level there are a number of simple things we could do that are actually not expensive that I think we as a society have been, have to really think about doing because having really governments which are very anti-American destabilizing us by taking all of our data out doesn't really help anyone, so that's the biggest loss. >> And it's no risk for the destabilizing America enemies out there. What's the disincentive? They're going to get put in jail? There's no real enforcement, I mean, cyber is great leverage. >> So one of the things that I think most people don't understand is the international laws on cyber attacks just don't exist anymore. They have a long way to catch up. Let me give a counter example which is drugs. There are already multilateral agreements on chasing drug traffickers as they go from country to country. And there's a number of institutions that monitor, that enforce that. That actually works quite well. We also have new groups focusing on human trafficking. You know, slowly happening. But in the area of cyber, we haven't even started a legal framework on what would constitute a cyber attack and sadly one of the reasons it's not happening is America's enemies don't want it to happen. But this is where I think as a nation first you have to take care of yourself and then on a multilateral perspective the US should start pushing a cyber security framework worldwide so that if you start getting emails from that friendly prince who's actually a friend of mine about, you know, putting in some, you know, we can actually go back to that country and say, hey, you know, we don't want to send you any more money anymore. >> John Furrier: Yeah, yeah, exactly. Everyone's going to make $18 million if they give up their user name, password, social security number. >> Junaid Islam: Yeah. >> All right, final question on this segment around, you know, the cyber security piece. What's the action going forward? I would say it's early days and hardcore days right now. It's really the underbelly of the internet globally is attacking. We see that. The government is, doesn't have a legal framework yet in place. They need to do that. But there's a lot of momentum around creating a Navy Seals, you know, the version of land, air, and sea, or multi-disciplinary combat. >> Junaid Islam: Yeah. >> Efforts out there. There's been conversations certainly in some of our networks that we talk about. What's the young generation? I mean, you got a lot of gamers out there that would love to be part of a new game, if you will, called cyber defense. What's going on, I mean, is there any vision around how to train young people? Is there an armed forces concept? Is there something like this happening? What's the next, what do we need to do as a government? >> So you actually touched on a very difficult issue because if you think about security in the United States it's really been driven by a compliance model, which is here's the set of things to memorize and this is what you do to become secure. And all of our cyber security training courses are based on models. If there's one thing we've learned about cyber attackers is these people are creative and do something new every time. And go around the model. So I think one of the most difficult things is actually to develop training courses that almost don't have any boundaries. Because the attackers don't confine themselves to a set of attack vectors, yet we in our training do. We say, well this is what you need to do and time and time again people just do something that's completely different. So that's one thing we have to understand. The other thing we have to understand which is related to that is that all of US's cyber security plans are public in conferences. All of our universities are open so we actually have, there's been- >> John Furrier: The playbook is out there. >> We actually, so one of the things that does happen is if you go to any large security conference you see a lot of people from the countries that are attacking us showing up everywhere. Actually going to universities and learning the course, so I think there's two things. One, we really need to think deeper about just how attacks are being done which are unbounded. And two, which is going to be a little bit more difficult, we have to rethink how we share information on a worldwide basis of our solutions and so probably not the easy answer you wanted but I think- >> It's complex and requires unstructured thinking that's not tied up. I mean- >> Yeah. >> It's like the classic, you know, the frog in boiling water dies and they put a frog in boiling water it jumps out. We're in this false sense of security with these rules- >> Yeah. >> Thinking we're secure, and people are killing us with this. >> Junaid Islam: Yeah and like I say, it's even worse when we figure out a solution. The first thing we do is we tell everybody including our enemies. Giving them a lot of chance to- >> John Furrier: Yeah. >> Figure out how to attack us. So I think, you know, we do have some hard challenges. >> So don't telegraph, don't be so open. Be somewhat secretive in a way is actually helpful. >> I think sadly, I think we've come to the very unfortunate position now where I think we need to, especially in the area of cyber. Rethink our strategies because as an open society we just love telling everybody what we do. >> John Furrier: Yeah, well so the final question, final, final question is just to end the segment. So cyber security is real or not real, I mean, how real is this? Can you just share some color for the folks watching who might say, hey, you know, I think it's all smoke and mirrors? I don't believe The New York Times, I don't believe this, Trump's saying this and is this real problem and how big is it? >> I think it is real. I think we have this calendar year 2017, we have moved from the classic, you know, kind of like cyber attack, you know, like someone's being phished for too, really the beginning of the cyber warfare and unlike kinetic warfare where somebody blows something up, this is a new phase that's long and drawn out and I think one of the things that makes us very vulnerable as a society is we are an open society. We are interlinked with every other global economy. And I think we have to think about this seriously because unfortunately there's a lot of people who don't want to see America succeed. They're just like that. Even though we're nice people. >> John Furrier: Yeah. >> But and so it's pretty important. >> It requires some harmony, it requires some data sharing. Junaid Islam, president and CTO of Vidder talking about the cyber security, cyber warfare dynamic that's happening. It's real. It's dangerous. And our country and other countries need to get their act together. Certainly I think a digital West Point, a digital Navy Seals needs to happen and I think this is a great opportunity for us to kind of do some good here and keep an open society while maintaining security. Junaid thanks for sharing your thoughts. I'm John Furrier with the CUBE here in Palo Alto. Thanks for watching.

(the Cube jingle) >> Hello, welcome to the CUBEConversation here in Palo Alto, California in theCUBE Studios. I'm John Furrier, the co-host of the CUBE and co-founder of SiliconANGLE Media. Junaid Islam is president and CTO of Vidder, supports the public sector as well as the defense community as well as other perimeterless oriented security paradigms, expert in the field, also part of up and coming Vidder that's doing a lot of work in the area. Thanks for sharing your time here with us. >> Well thanks for having me. >> We had a segment earlier on cyber security in the government so that was phenomenal but also we talked about the impact of hacking on business. So the number one issue on the board room agenda is security. >> Yeah. >> Data, security, it's all, it's a big data problem, it's a AI opportunity. Some things that are coming out is embryonic early shifts. Security is a challenge. The old model of the firewall, a mode, doors, access, you get in, then you're done. It's over, it's a perimeterless world. People can get access to these networks. Security is screwed right now. Everyone kind of generally feels that. So the question for you is in the enterprise and in businesses who are looking to sure up security, is it a do-over? >> Yeah, yeah, I think, like other industries, whether you talk about-- >> Yeah, so that's a yes? >> The PBS-- Yes, yes. >> Yes, it's a do-over. >> This is where you're talking about computers shifting to the data center and then the cloud, I think last year, or I think this year, Gardner said 100 billion will be spent on security. I cannot believe anybody who is involved in that 100 billion dollar expenditure is happy. In fact, we have something interesting. Security expenditure has risen consistently over the past five or six years. And cyber attacks have also risen consistently. That's not the kind of correlation you want. >> Yeah, they'll buy anything that moves basically. They're desperate-- >> That's correct. >> So it seems like they're like drunken sailors. Just like, "Give me something." They're like thirsty for solution so they're groping for something. >> Yeah, what we're seeing is a couple of things. One is the attackers have gotten much more sophisticated and they basically can by-pass all of the existing security appliances. So what we need is a new approach or a new security stack that really fits both the architectural environment of American companies where they use clouds and data centers, and they have employees and contractors, but also cyber attacks which have gotten much more sophisticated. And the classic cyber attack used to be connecting to the server remotely or stealing a password. We still have the classics but we have some new ones where we have malware that can actually go from the users device to inside the network. And you find that existing security products just don't work well in this environment. And so it'-- >> So what is in the do-over ideas. Obviously malware, we see it. Ransomware is super hot, the HBO example recently. They didn't give in, who knows what they actually did. They weren't public about it but I'm sure they did maybe give a little bit in. But these are organized businesses. >> Yeah. >> Right? They're targeting... The Sony hack's well documented, but again, businesses have not always funded this. And then you got the move to the clouds. Couple dynamics. Cloud computing. Amazon's done extremely well, they're leading now getting a lot more in the enterprise. They won the CIA deal a few years ago over IBM. >> Yeah. >> And you've seen a lot, GovCloud rockin' and rollin'. And then you got the on-premise data center challenges. So that's the situation of the customer. But then now you have potentially an understaffed security force. >> Well, actually it's so. I think let's start with that point in terms of our theme of a do-over. Talk about that first-- >> Yeah, all right. >> Then let's talk the techno part. I think one do-over that America needs is security has to move out of the IT department and become a standalone department reporting ideally to the executive staff, if not being on it. I think one of the unfortunate things is because security is a cost center within IT it competes with other IT expenditures such as new applications which are revenue generating. It's very hard to be a cost center asking for money when there's a guy sitting next to you who's doing something to make money. But unfortunately, unless security is properly funded and staffed, it never happens. And this unfortunately is a chronic issue through all U.S. companies. One of the things we've seen that has worked, for example, in the financial world, is most financial institution, probably all, now security is a pure organization to IT and that helps a lot. This is actually not a new idea. This was something the intelligence community probably started 15 years ago. >> And the cost structure-- >> Yeah. >> Is just a cost structure. >> Reduce the cost as-- >> Yeah. >> As the optimization behavior. What you're saying is just like Apple cases are tied to top line revenue, which gives them power-- >> Yeah. >> And mojo, you got-- >> Security. >> You got to think of security as a money saving table stake. >> That's right. >> People are losing money. The costs are now becoming obvious. >> Yeah. >> And in some cases crippling. >> Yes, so I think people need to think of security as fundamental to the life of a company, number one. I think the other thing that needs to happen from a security perspective, now that we've broken off this entity, is that security needs to become threat based or risk based. Too much of a merit security in the United States is based on compliance models. Unfortunately cyber attackers do not follow that model when they want to attack us. They basically work outside the model and come up with creative ways to get inside-- >> Yeah. >> Of organization. >> And basically blindside-- >> That's right. >> bleeding the companies. >> Yeah, so I can't tell you how many meetings, probably all, where I meet the security team and they're totally busy just going through this list of 20 or 50 things they're supposed to do. So when you talk about attack vectors, they say, "You know that's really great and I know "it's important but we can't "get to it." So this is another important shift organizationally. First break it out, second get focus on something that's important. >> Yeah. >> Once we have that, we get to the next part, which is technologies, and right now what happens is people buy a security point product for different networks; one for data center, one for cloud, and this doesn't work. So I think we have to move to security solutions that can work across hybrid environments and can also work across different roles. I think that is kind of critical. Unless we get that in technically, I-- (laughs) >> Yeah, and this is the dynamic with cloud and the data center. I want to bring this up. I had a multiple chance to sit down with Andy Jassy who's the CEO of Amazon Web services. Fantastic executive, built a great business there. What's on his mind and what's been important for him for many years has been security. And Amazon has done an amazing job with security. But that's in the cloud. Now, Andy Jassy and Amazon thinks everyone should be in the public cloud. >> Yeah. >> Now they have a deal with VMware but they're just powering VMware's OnPrem in their cloud. It's not really their... VMware issue, but Amazon's world is everything's in the public cloud. But they've done really, really good on security. But yet most of the buyers would say, "Hey, the cloud "is unsecure, I can't trust it." So you have the dynamic between the data center on premise resource. So people kind of default to the behavior of I'm leaving everything on premise or I'm only putting a little on the cloud, a little bit of work loads here, a little bit in the Microsoft. Google's got some, I'll keep the tires on Google. But they're never really leaving the home base of the data center. >> Yeah. >> But yet some are arguing, and Dave Vellante my co-host on theCUBE talks about this all the time, there's actually more scale in the cloud, more data sharing going on in the cloud-- >> Yeah. >> And that the cloud actually has got better security. >> Yeah. >> So how do you see that resolving because this is a key architectural opportunity and challenge for enterprises. >> So I actually, I think there's an optimal model which is if you think about what the data center gives you, it gives you a lot of visibility and physical control, as in with your hands. The problem is when you put everything in the data center you don't have enough people to manage it all properly. The cloud on other hand gives you a lot of skill but you can't actually touch the cloud. So the optimal mix is, imagine your encryption and access control solutions live in your data center but what they control access to is to cloud resources. So you can actually... If you just open your mind conceptually, as-- >> So instead of saying... It's like segmenting a network, you're segmenting capability. >> That's right. So now you don't need a gigantic data center because what's in your data center which can be a lot smaller now, are things like your identity based access management solution, you can keep your cryptographic elements, you can have your HSM, things that generate random numbers and certs there. But now this is, actually can be very tiny. It could just be a rack of year. >> Yeah. >> But through that rack of year, you can have very fine control of people accessing cloud resources. And I think this idea of building, it's not so much a hybrid network, but it's a notion that a small physically locked down asset can control a lot of virtual assets is gaining a mind share in the banking world. In fact, just this summer there was a bank that implemented such an architecture where the control elements for the cloud when their FFIAC data center and it include... It basically managed access to Amazon DPCs and it worked well. >> So interlocking is a strategy, I can see that playing-- >> Yeah. >> And by the way I can see that playing very well. So I got to ask the next question which kind of comes to mind as, that sounds great-- >> Yeah. >> On paper, or actually in certain situations, it might be perfect. But what about the geopolitical landscape because Amazon has people that develop on the cloud that aren't U.S. citizens. >> Yeah. >> So the government might say, "Wait a minute. "You got to only employ Americans." So they got to carve out and do some whatever weird things with the numbers to get the certification. But they need data centers in Germany because the German government wants certain things. So you have geopolitical issues now on the companies. How does that affect security because now a cloud like Amazon or a multi-national company has two things going on. I had multiple offices and I've been operating in multiple geopolitical landscapes with these regional centers, the regional cloud, or on Amazon they're called regions. >> Yeah. >> Or zones. >> So actually Amazon actually has done a great job. They basically have their global market but they also have data centers now which are only open to U.S. persons and U.S. companies like GovCloud as well as the support C2S which is the intelligence community's black cloud, which is basically off net. So I think now-- >> So they're doing a good job, you think? >> Yeah, they're doing a good job. But the key thing is how you use that resource is really still up to the enterprise. And that's where enterprises have to get good at creating the architecture and policies to be able to harness Amazon's kind of compute capacity. Amazon can, it's kind of the foundation but you really have to finish off the solution. And the other thing, going back full circle to your first question, unless the security team has the freedom and the mandate to do that, they'll actually never get there. >> So it's staffing and architecture-- >> That's right. >> Well they're both architectural. It's just one's organizational architecture and funding and one is more of a hard core virtual and physical touching and understanding. >> Yeah, and you know what I'd put in the middle? I'd say know your risks and then develop counter measures to them. Because if you go to that security team and you say you have to build a counter measure for every attack, that's not going to work either. A company has to be realistic is what is really important (laughs) and maybe it's the data of our customers. (laughs) >> So the answer to the first question then, obviously is yes. >> Yeah. >> A security do-over is needed but there's no silver bullet. You can't buy an application. It's an architectural framework, wholistically. >> That's right. >> That everyone has to do. Okay, cool. So the question I have on the Amazon, I want to get your thoughts on this because the debate we have all the time on theCUBE is, and certainly Amazon has competitors that say, "Oh, Amazon's really not winning in the enterprise." They got thousands of enterprise customers. They are winning in the enterprise so Oracle's catching up, barely in fourth place, but trying to get there. And they're actually making that transformation, looking pretty good, we'll have more analysis on that Oracle open role. But Amazon has won great GovCloud deals. >> Yes. >> So they've kind of convinced the government that they could do it. >> Yeah. >> To me that's... My argument is if the government's winning with Amazon, it should be a no brainer (laughs) for the enterprises. So this comes back down to the number one question that's been, quote, holding back cloud growth. Whoa, security, I don't want to put it in the cloud. How real is that objection now? 'Cause knee jerk reaction is, "You know what, "I got it OnPrem, I don't trust the cloud." But it seems like the cloud is getting more trust. What's your thoughts on that on changing? >> Yeah, actually, so one of the things is even though we use the word cloud kind of generically or Amazon generically, Amazon has evolved a lot in the last three to four years that I've been working on it. The number of embedded tools on Amazon is vast now. If we were having this conversation two years ago the notion that granular encryption modules would be there in Amazon as a part of an offering, it would've been science fiction. Or the fact that-- >> More than S3 and EC2. What else could they do? (laughs) >> That's right, or they have things like virtual HSM, they have embedded identity access control tools all there. So I think, first of all, all of the building blocks that you would want are there. Now unfortunately there's no short cuts. Amazon's not going to do the work for you. You still need a staff that knows how to use digital certificates. You still need your own identity based access control system to manage access of your employees and contractors and people in India to these assets in the cloud. But having said that, we now actually have a model that is much cheaper than the classic data center model that's basically usable. >> I'm smirking because some people think I'm an Amazon Web services fan boy but besides the fact that I love the company, they've done well and there's so many new services. >> Yeah. >> And they've literally been skating rings around the competition. >> Yeah. >> If you look at the complexity that they've been dealing with and the innovation, so I'll put that out there, a little bit biased because I think they're doing a great job, but now the game starts to shift. As Amazon continues to add more services welcome to the big leagues called the enterprise in government which they're doing some business in now. So the question is, besides Amazon, there's other guys. >> Yeah. >> Verizon, the Telco's have been really trying to figure out what to do with over the top for years. (laughs) Now they're also powering a lot of multi-tenant workloads as well including their own stuff. >> Yeah. >> So Telco and service providers out there, what are they doing because they're still critical infrastructure around the world? >> So actually I think if we just use Amazon as a reference point or example, Amazon initially didn't worry about security but then over the last few years, worked hard to integrate security into their offering. We're now in the early stages of seeing that from, for example carriers like Verizon, where in the past Verizon was saying first secure yourself then in the last two years, Verizon said, "Okay, here's "some products and services you can buy." Now where we're heading is what they're trying to make the network inherently secure. A lot of the basic components like device matching to identity matching, basically-- >> Yeah. >> Making that a part of the underlying fabric. So I think the good news is as-- >> So they're making advances there? >> Yeah. >> Well they have networks. >> Yeah. >> They know networking. >> Yeah, so the good news is as bleak as this all seems, we are making significant progress as an industry and as a country. Having said that, my only warning is you still need an executive team, a security team that knows how to leverage all of these components and pull them together. And that goes back to having a risk based approach and protecting the most important things. And I think if you can do that, I think the tool set that's come out now is actually pretty sophisticated. >> So final question, I want to get your thoughts and we can end this segment and then we'll talk a little bit about Vidder and your company. But I asked Pat Gelsinger, CEO of VMware, at VMworld just recently about the security do-over. Because Dave Vellante asked him years ago. >> Yeah. >> He said, "Absolutely, there's going to be a do-over!" So Pat Gelsinger is right again. The guy's like Nostradamus when it comes to tech trends. He's a wave guy from Intel so he gets the waves. But I asked him about that question again this year and I'll send the clip on Twitter. I'll put it out on Twitter, I'll make a link to it. He said that 5G is going to be the big kahuna of the next 30 years and he thinks that 5G starts to get out it's going to deliver 10 X number of antennas, 100 extra bandwidth, new spectrum allocations, 100 X new devices, that are all going to be connected as well. As you mentioned we're a connected world. This brings up the edge of the network he says, "Next five years is going to... "Next 30 years is going to be a massive build out." >> Yeah. >> So okay, 5G is coming. Industrial IOT, IOT, the Internet of Things is happening. How is this going to change the security game? Because now you have networking and you see VMware doing NSX and Cisco's been trying to get to the enterprise figuring out the virtualization on a network level. Everything comes back down to the network. Is that where the action is because it seems to me that the network guys have to figure this out and that seems to be the point of reference of the terms of opportunity or is it a challenge or is it moving up the stack? How does all the networking changes happen? >> So for IOT we really need two things to happen. I think one is we actually don't have a security standard for IOT devices and specifically the issue is malware. IOT devices and their software is made worldwide. And I think one of the biggest policy weaknesses we have right now is there's no minimum standard. This needs to be solved otherwise we're in a lot problem. But in parallel to that, there is a lot of technical development. One of the things that's happening in the networking world is for the past 20 years we were driven by what's called a network VPN, or layer three VPN, it's your classic VPN that connects a device to a server. The problem with that is if you have malware on the device it gets through. So there's this new kind of VPN which is an application VPN, or we call it a layer four, which is basically a softer process in the device to a softer process in a server. So that's kind of the new model which is-- >> So make the network as dumb as possible and go up the stack and attack it? >> Yeah, well not so much-- >> Well I'm over simplifying-- >> Or reaction-- >> The network guys are going to roll in the-- >> I was going to use a different term. I was going to say make the-- >> The dumb pipes. >> Make the network application aware so that it only lets applications get through not any kind of connection. So I think that is something happening. >> Well the networks have to be smarter. >> Yeah, so-- >> That enable the smartness. >> So smarter networks are happening and it's an area that I work in, it's very excited. >> I don't mean to offend you by saying dumb network. >> Yeah, but the application... To be clear though, that's just one piece of the puzzle. The other piece of the puzzle, which unfortunately is a little bit lacking, is there's no standards for IOT software today. >> Yeah. >> And unless we have concepts like secure boot that is the software can't be tampered with, I think unfortunately there's a bit of risk. But I'm hopeful-- >> And then IOT, for the folks watching that might not be in the inside baseball know it's a surface area problem. There's more points of attack-- >> Yeah. >> Vectored. So we're talking about the compliance thing. >> Not only are there more attacks, by and large IOT devices are made outside the United States. Physically they're made in China and a lot of the software comes from India and there's nothing wrong with that but the global supply chain provides plenty of opportunities for cyber attackers to inject in their code. >> Yeah. >> And this is something we need to watch very carefully and then like I said-- >> So this is actually one of those weird derivative results of outsourcing. >> Yeah. >> That American companies have realized that it's a problem. >> Yeah. So it's-- >> Is that right? >> Yeah so it's something we need to watch carefully. >> Okay, thanks for coming on theCUBE. >> Thank you. >> We really appreciate you sharing your perspectives. Tell me what Vidder, your president and CTO, you guys are in the security business, obviously you're an expert. With great call we'll have you back on multiple times. We'd love to get your commentary as we follow all the security trends. We have a Cyber Connect Conference with Centrify-- >> Yeah. >> Coming up in New York. We're covering GovCloud, AWS, and all the other players out there. What's Vidder doing? What's the company do for products? How do you guys sell, who's your customers, and what are the cool things you're doing? >> We've developed a access control solution based on a new standard called Software Defined Perimeter. And there's two things that are unique about it. First with a name like, technology is like Software Defined Perimeter, we work in the cloud in the data center but more importantly we're able to stop existing attacks and emerging attacks. So things like password theft, credential theft, or server exploitation, we stop because we don't allow connections from unknown devices or people. But the other thing is say you're known and you connect to a server, we basically look inside your laptop and only allow the authorized process to connect to the server. So if there's malware on the device it can actually make it through. >> So it's just on the malware? >> That's right. >> If you want to sneak through-- >> That's right. >> You're going to shut that down. >> We can't stop the malware from getting on the device but we can make sure it doesn't get to the other side. >> So it doesn't cross-pollinate. >> Yeah, yeah. >> It doesn't go viral. >> That's right. So a lot of the stuff we do is very important. We work with a range of big-- >> You have government, obviously, contracts. >> Yeah, we-- >> I'm sure you have, that you can't talk about, but you do, right? >> We do a little bit of work with the government and we're just working with Verizon which is public, where they wish to create services where malware actually can't go through the connections. So we're doing exciting stuff and we're-- >> Enterprise customers at all? >> Yeah, yeah. We have banks-- >> People who are on high alert. >> That's right, yeah. >> You guys are the tier one. >> That's right. >> Where if the houses are burning down-- >> Yeah. >> You're there. >> So we do banks and we just started doing work at a hospital where, again, it's HIPAA compliant and they need to make sure that data doesn't leave the hospital. So what's the number one thing that you guys have? Is Ransomware something that you solve? What areas do you guys... Being called in? What's the big fire bell, if you will, they ring the bell, when do you come in? What's the thing? Just in general or? >> Our number one reason for existing is stopping attacks on application servers or servers that hold data. That's kind of our focus so if you have data or an application that someone is after, we will make sure that nobody gets to that data. In fact we'll even make sure if there's a spy or insider attacker who comes into your organization they'll only be able to do what they're allowed to do and won't be able to do anything else. >> So on the Equifax news that was big, would you guys help there if they were a customer or is that just a different thing? >> No, we could've helped because one of the things that happened is they used a server exploit to basically propagate through their data center. So we probably wouldn't have done much on the initial exploit but we would've kept it from going deeper into the system. >> And they hid for four months and they were poking around so you would've detected them as well. >> Yeah, we certainly would've stopped all the poking around because we basically... You can think of us as identity based access control mechanism so based on your identity you can only do very specific things. And in their case, they had the identity of the user. We wouldn't have let them do anything except maybe just go to one website. >> Yeah, you would shut them down manually. >> That's right. >> They should've been doing business with Vidder. Junaid thank you for coming on theCUBE here for the CUBEConversation. In Palo Alto, California I'm John Furrier with the CUBEConversation. Thanks for watching. (the Cube jingle)

>> Host: New York City, it's The Cube covering Cyber Connect 2017, brought to you by Centrify and the Institute for Critical Infrastructure Technology. >> Hey, welcome back, everyone. This the Cube's live coverage in New York City. This is the Cyber Connect 2017, presented by Centrify, underwritten by such a large industry event. I'm John Furrier, Dave Vellante. Our next guest is Byron Acohido who's the journalist at lastwatchdog.com. Thanks for joining us, welcome to The Cube. >> Thank you, pleasure to be here. >> So, seasoned journalist, there's a lot to report. Cyber is great, we heard a great talk this morning around the national issues around the government. But businesses are also struggling, too, that seems to be the theme of this event, inaugural event. >> It really is a terrific topic that touches everything that we're doing, the way we live our lives today. So, yeah, this is a terrific event where some of the smartest minds dealing with it come together to talk about the issues. >> What's the top level story in your mind in this industry right now? Chaos, is it data, civil liberties, common threats? How do you stack rank in level of importance, the most important story? >> You know, it really is all of the above. I had the privilege to sit at lunch with General Keith Alexander. I've seen him speak before at different security events. So it was a small group of the keynote speakers, and Tom Kemp, the CEO of Centrify. And he just nailed it. He basically, what resonated with me was he said basically we're kind of like where we were, where the world was at the start of World War I, where Russia and Germany and England, we're all kind of lining up, and Serbia was in the middle, and nobody really knew the significance of what lay ahead, and the US was on the sidelines. And all these things were just going to converge and create this huge chaos. That's what he compared it today, except we're in the digital space with that, because we're moving into cloud computing, mobile devices, destruction of privacy, and then now the nation states, Russia is lining up, North Korea, and Iran. We are doing it too, that was probably one of the most interesting things that came at you. >> His rhetoric was very high on the, hey, get our act together, country, attitude. Like, we got a lot to bring to the table, he highlighted a couple use cases and some war stories that the NSA's been involved in, but almost kind of teasing out, like we're kind of getting in our own way if we don't reimagine this. >> Yes, he is a very great advocate for the private sector industry, but not just industry, the different major verticals like especially the financial sector and the energy sector to put aside some of the competitive urges they have and recognize that this is going on. >> Okay, but I got to ask you, as a journalist, Last Watchdog, General Alexander definitely came down, when he sort of addressed privacy, and Snowden, and the whole story he told about the gentleman from the ACLU who came in a skeptic and left an advocate. As a journalist whose job is to be a skeptic, did you buy that? Does your community buy that? What's the counterpoint to that narrative that we heard this morning? >> Well, actually I think he hit it right on the head. As a journalist, why I got into this business and am still doing it after all these years is if I can do a little bit to shed a little bit of light on something that helps the public recognize what's going on, that's what I'm here to do. And this topic is just so rich and touches everything. We were talking just about the nation state level of it, but really it effects down to what we're doing as a society, what Google, and Facebook, and Twitter, how they're shaping our society and how that impacts privacy. >> We were talking last night, Dave, about the Twitter, and Facebook, and Alphabet in front of the Senate hearings last week, and how it means, in terms, he brought it up today. The common protection of America in this time, given the past election, that was the context of the Google thing, really has got a whole opportunity to reimagine how we work as a society in America, but also on the global stage. You got China, Russia, and the big actors. So, it's interesting, can we eventually reimagine, use this opportunity as the greatest crisis to transform the crap that's out there today. Divisiveness, no trust. We're living in an era now where, in my life time I can honestly say I've never seen it this shitty before. I mean, it's bad. I mean, it's like the younger generation looking at us, looking at, oh, Trump this, Trump that, I don't trust anybody. And the government has an opportunity. >> Alright, but wait a minute. So, I'm down the middle, as you know, but I'm going to play skeptic here a little bit. What I basically heard from General Alexander this morning was we got vetted by the ACLU, they threw sort of holy water on it, and we followed the law. And I believe everything he said, but I didn't know about that law until Snowden went public, and I agree with you, Snowden should be in jail. >> John: I didn't say that. >> You did, you said that a couple, few years ago on The Cube, you said that. Anyway, regardless. >> I'm going to go find the archive. >> Maybe I'm rewriting history, but those laws were enacted kind of in a clandestine manner, so I put it out to both of you guys. As a citizen, are you willing to say, okay, I'll give up maybe some of my privacy rights for protection? I know where I stand on that, but I'm just asking you guys. I mean, do all your readers sort of agree with that narrative? Do all of The Cube? >> If you look at the World War I example the general, he brought up at lunch, I wasn't there, but just me thinking about that, it brings up a good perspective. If you look at reinventing how society in America is done, what will you give up for safety? These are some of the questions. What does patriotizing mean for if industry's going to work together, what does it mean to be a patriot? What I heard from the general onstage today was, we're screwed if we don't figure this out, because the war, it's coming. It's happening at massive speeds. >> Again, I know where I stand on this. I'm a law-abiding citizen. >> - Byron, what do you think? >> Go ahead and snoop me, but I know people who would say no, that's violating my constitutional rights. I dunno, it's worth a debate, is all I'm saying. >> It's a core question to how we're living our lives today, especially here in the US. In terms of privacy, I think the horse has left the barn. Nobody cares about privacy if you just look at the way we live our lives. Google and Facebook have basically thrown the privacy model-- >> GPS. >> That came about because we went through World War I and World War II, and we wanted the right to be left alone and not have authoritative forces following us inside the door. But now we don't live in just a physical space, we live in a cyberspace. >> I think there's new rules. >> There is no privacy. >> Don't try and paint me into a corner here, I did maybe say some comments. Looking forward the new realities are, there are realities happening, and I think the general illuminated a lot of those today. I've been feeling that. However, I think when you you define what it means to be a patriot of the United States of America and freedom, that freedom has to be looked through the prism of the new realities. The new realities are, as the General illuminated, there are now open public domain tools for anyone to attack the United State, industry and government, he brought it up. Who do they protect, the banks? So, this ends up, I think will be a generational thing that the younger generation and others will have to figure out, but the leaders in industry will have to step up. And I think that to me is interesting. What does that look like? >> I think leadership is the whole key to this. I think there's a big thread about where the burden lies. I write about that a lot as a central theme, where is the burden? Well, each of us have a burden in this society to pay attention to our digital footprint, but it's moving and whirling so fast, and the speaker just now from US Bank said there is no such thing as unprecedented, it's all ridiculous the way things are happening. So, it has to be at the level of the leaders, a combination, and I think this is what the general was advocating, a combination of the government as we know it, as we've built it, by and for the people, and industry recognizing that if they don't do it, regulations are going to be pushed down, which is already happening here in New York. New York State Department of Financial Services now imposes rules on financial services companies to protect their data, have a CSO, check their third parties. That just went in effect in March. >> Let's unpack that, because I think that's what new. If they don't do this, they don't partner, governments and industry don't partner together, either collectively as a vertical or sector with the government, then the government will impose new mandates on them. That's kind of what you're getting at. That's what's happening. >> It'll be a push and shove. Now the push is because industry has not acted with enough urgency, and even though they were seeing them in the headlines. California's already led the way in terms of its Data Loss Disclosure law that now 47 states have, but it's a very, I mean, that's just the level the government can push, and then industry has to react to that. >> I got to say, I'm just being an observer in the industry, we do The Cube, and how many events will we hear the word digital transformation. If people think digital transformation is hard now, imagine if the government imposes all these restrictions. >> What about GDPR? >> Byron: That's a good question, yeah. >> You're trying to tell me the US government is going to be obliged to leak private information because of a socialist agenda, which GDPR has been called. >> No, that's another one of these catalysts or one of these drivers that are pushing. We're in a global society, right? >> Here's my take, I'll share my opinion on this, Dave, I brought it up earlier. What the general was pointing out is the terror states now have democratized tools that other big actors are democratizing through the public domain to allow any enemy of the United States to attack with zero consequences, because they're either anonymous. But let's just say they're not anonymous, let's just say they get caught. We can barely convert drug dealers, multiple jurisdictions in court and around the world. What court is out there that will actually solve the problem? So, the question is, if they get caught, what is the judicial process? >> Navy SEALs? >> I mean, obviously, I'm using the DEA and drug, when we've been fighting drug for multiple generations and we still have to have a process to multiple years to get that in a global court. I mean, it's hard. My point is, if we can't even figure it out for drug trade, generations of data, how fast are we going to get cyber criminals? >> Well, there is recognition of this, and there is work being done, but the gap is so large. Microsoft has done a big chunk of this in fighting botnets, right? So, they've taken a whole legal strategy that they've managed to impose in maybe a half-dozen cases the last few years, where they legally went and got legal power to shut down hosting services that were sources of these botnets. So, that's just one piece of it. >> So, this World War I analogy, let's just take it to the cloud wars. So, in a way, Dave, we asked Amazon early on, Amazon Web Services how their security was. And you questioned, maybe cloud has better security than on premise, at that time eight years ago. Oh my God, the cloud is so insecure. Now it looks like the cloud's more secure, so maybe it's a scale game. Cloud guys might actually be an answer, if you take your point to the next level. What do you think? >> Correct me if I'm wrong, you haven't seen these kind of massive Equifax-like breaches at Amazon and Google. >> That we know about. >> That we know about. >> What do you think? Don't they have to disclose? >> Cloud players have an opportunity? >> That we know about. >> That's what I was saying. The question on the table is, are the cloud guys in a better position to walk around and carry the heavy stick on cyber? >> Personally, I would say no question. There's homogeneity of the infrastructure, and standardization, and more automation. >> What do you think? What's your community think? >> I think you're right, first of all, but I think it's not the full answer. I think the full answer is what the general keeps hammering on, which is private, public, this needs to be leadership, we need to connect all these things where it makes sense to connect them, and realize that there's a bigger thing on the horizon that's already breathing down our necks, already blowing fire like a dragon at us. It's a piece of the, yeah. >> It's a community problem. The community has to solve the problem at leadership level for companies and industry, but also what the security industry has always been known for is sharing. The question is, can they get to a data sharing protocol of some sort? >> It's more than just data sharing. I mean, he talked about that, he talked about, at lunch he did, about the ISAC sharing. He said now it's more, ISACs are these informational sharing by industry, by financial industry, health industry, energy industry, they share information about they've been hacked. But he said, it's more than that. We have to get together at the table and recognize where these attacks are coming, and figure out what the smart things are doing, like at the ISP level. That's a big part of the funnel, crucial part of the funnel, is where traffic moves. That's where it needs to be done. >> What about the the balance of power in the cyber war, cyber warfare? I mean, US obviously, US military industrial complex, Russia, China, okay, we know what the balance of power is there. Is there much more of a level playing field in cyber warfare, do you think, or is it sort of mirror the size of the economy, or the sophistication of the technology? >> No, I think you're absolutely right. There is much more of a level playing field. I mean, North Korea can come in and do a, this is what we know about, or we think we know about, come in and do a WannaCry attack, develop a ransomware that actually moves on the internet of things to raise cash, right, for North Korea. So there, yeah, you're absolutely right. >> That's funding their Defense Department. >> As Robert Gates said when he was on The Cube, we have to be really careful with how much we go on the offense with cyber security, because we have more to lose than anybody with critical infrastructure, and the banking system, the electrical grid, nuclear facilities. >> I interviewed a cyber guy on The Cube in the studio from Vidder, Junaid Islam. He's like, we can look at geo and not have anyone outside the US access our grid. I mean, no one should attack our resources from outside the US, to start with. So, core network access has been a big problem. >> Here's something, I think I can share this because I think he said he wouldn't mind me sharing it. At the lunch today, to your point that we have more to lose is, the general said yeah, we have terrific offensive capability. Just like in the analog world, we have all the great bombers, more bombers than anybody else. But can we stop people from getting, we don't have the comparable level of stopping. >> The defense is weak. >> The defense, right. Same thing with cyber. He said somebody once asked him how many of your, what percentage of your offensive attacks are successful? 100%. You know, we do have, we saw some of that with leaks of the NSA's weapons that happened this year, that gone out. >> It's like Swiss cheese, the leaks are everywhere, and it's by the network itself. I ran into a guy who was running one of the big ports, I say the city to reveal who it was, but he's like, oh my God, these guys are coming in the maritime network, accessing the core internet, unvetted. Pure core access, his first job as CIO was shut down the core network, so he has to put a VPN out there and segment the network, and validate all the traffic coming through. But the predecessor had direct internet access to their core network. >> Yeah, I think the energy sector, there's a sponsor here, ICIT, that's in the industrial control space, that I think that's where a lot of attention is going to go in the next couple of years, because as we saw with these attacks of the Ukraine, getting in there and shutting down their power grid for half a day or whatever, or with our own alleged, US own involvement in something like Stuxnet where we get into the power grid in Iran, those controls are over here with a separate legacy. Once you get in, it's really easy to move around. I think that needs to be all cleaned up and locked down. >> They're already in there, the malware's sitting in there, it's idle. >> We're already over there probably, I don't know, but that's what I would guess and hope. >> I don't believe anything I read these days, except your stuff, of course, and ours. Being a journalist, what are you working on right now? Obviously you're out there reporting, what are the top things you're looking at that you're observing? What's your observation space relative to what you're feeding into your reports? >> This topic, security, I'm going to retire and be long gone on this. This is a terrific topic that means so much and connects to everything. >> A lot of runway on this topic, right? >> I think the whole area of what, right there, your mobile device and how it plugs into the cloud, and then what that portends for internet of things. We have this whole 10-year history of the laptops, and we're not even solving that, and the servers are now moving here to these mobile devices in the clouds and IOT. It's just, attack surface area is just, continues to get bigger. >> And the IT cameras. >> The other thing I noticed on AETNA's presentation this morning on the keynote, Jim was he said, a lot of times many people chase the wrong attack vector, because of not sharing, literally waste cycle times on innovation. So, it's just interesting market. Okay, final thoughts, Byron. This event, what's the significance of this event? Obviously there's Black Hat out there and other industry events. What is so significant about CyberConnect from your perspective? Obviously, our view is it's an industry conversation, it's up-leveled a bit. It's not competing with other events. Do you see it the same way? What is your perspective on this event? >> I think that it's properly named, Connect, and I think that is right at the center of all this, when you have people like Jim Ralph from AETNA, which is doing these fantastic things in terms of protecting their network and sharing that freely, and the US Bank guy that was just on, and Verizon is talking later today. They've been in this space a long time sharing terrific intelligence, and then somebody like the general, and Tom Kemp, the CEO of Centrify, talking about giving visibility to that, a real key piece that's not necessarily sexy, but by locking that down, that's accessing. >> How is the Centrify message being received in the DC circles? Obviously they're an enterprise, they're doing very well. I don't know their net revenue numbers because they're private, they don't really report those. Are they well-received in the DC and the cyber communities in terms of what they do? Identity obviously is a key piece of the kingdom, but it used to be kind of a fenced off area in enterprise software model. They seem to have more relevance now. Is that translating for them in the marketplace? >> I would think so, I mean, the company's growing. I was just talking to somebody. The story they have to tell is substantive and really simple. There's some smart people over there, and I think there are friendly ears out there to hear what they have to say. >> Yeah, anything with identity, know your customer's a big term, and you hear in blockchain and anti-money laundering, know your customer, big term, you're seeing more of that now. Certainly seeing Facebook, Twitter, and Alphabet in front of the Senate getting peppered, I thought that was interesting. We followed those guys pretty deeply. They got hammered, like what's going on, how could you let this happen? Not that it was national security, but it was a major FUD campaign going on on those platforms. That's data, right, so it wasn't necessarily hacked, per se. Great stuff, Byron, thanks for joining us here on The Cube, appreciate it. And your website is lastwatchdog.com. >> Yes. >> Okay, lastwatchdog.com. Byron Acohido here inside The Cube. I'm John Furrier, Dave Vellante, we'll be back with more live coverage after this short break.

>> Announcer: Live from midtown Manhattan, it's theCUBE. Covering Big Data New York City 2017. Brought to you by SiliconANGLE Media and its ecosystem sponsors. >> Okay welcome back everyone, live here in New York City it's theCUBE's coverage of Big Data NYC. It's our event we've been doing for five years in conjunction with Strata Hadoop now called Strata Data right around the corner, separate place. Every year we get the best voices tech. Thought leaders, CEO's, executives, entrepreneurs anyone who's bringing the signal, we share that with you. I'm John Furrier, the co-host of theCUBE. Eight years covering Big Data, since 2010, the original Hadoop world. I'm here with Amit Walia, who's the Executive Vice President, Chief Product Officer for Informatica. Welcome back, good to see you. >> Good to be here John. >> theCUBE alumni, always great to have you on. Love product we had everyone on from Hortonworks. >> I just saw that. >> Product guys are great, can share the road map and kind of connect the dots. As Chief Product Officer, you have to have a 20 mile stare into the future. You got to know what the landscape is today, where it's going to be tomorrow. So I got to ask you, where's it going to be tomorrow? It seems that the rubber's hit the road, real value has to be produced. The hype of AI is out there, which I love by the way. People can see through that but they get it's good. Where's the value today? That's what customers want to know. I got hybrid cloud on the table, I got a lot of security concerns. Governance is a huge problem. The European regulations are coming over the top. I don't have time to do IoT and these other things, or do I? I mean this is a lot of challenges but how do you see it playing out? >> I think, to be candid, it's the best of times. The changing times are the best of times because people can experiment. I would say if you step back and take a look, we've been talking for such a long time. If there was any time, where forget the technology jargon of infrastructure, cloud, IoT, data has become the currency for every enterprise right? Everybody wants data. I say like you know, business users want today's data yesterday to make a decision tomorrow. IT has always been in the business of data, everybody wants more data. But the point you're making is that while that has become more relevant to an enterprise, it brings into the lot of other things, GDPR, it brings governance, it brings security issues, I mean hybrid clouds, some data on-prem, some data on cloud but in essence, what I think every company has realized that they will live and die by how well do they predict the future with the data they have on all their customers, products, whatever it is, and that's the new normal. >> Well hate to say it, admit pat myself on the back, but we in theCUBE team and Wikibon saw this early. You guys did too, and I want to bring up a comment we've talked about a couple of years ago. One, you guys were in the data business, Informatica. You guys went private but that was an early indicator of the trend that everyone's going private now. And that's a signal. For the first time, private equity finance have had trumped bigger venture capital asset class financing. Which is a signal that the waves are coming. We're surfing these little waves right now, we think they're big but they big ones are coming. The indicator is everyone's retrenching. Private equity's a sign of undervaluation. They want to actually also transform maybe some of the product engineering side of it or go to market. Basically get the new surfboard. >> Yeah. >> For the big waves. >> I mean that was the premise for us too because we saw as we were chatting right. We knew the new world, which was going towards predictive analytics or AI. See data is the richest thing for AI to be applied to but the thing is that it requires some heavy lifting. In fact that was our thesis, that as we went private, look we can double down on things like cloud. Invest truly for the next four years which being in public markets sometimes is hard. So we step back and look where we are as you were acting from my cover today. Our big believers look, there's so much data, so many varying architecture, so many different places. People are in Azure, or AWS, on-prem, by the way, still on mainframe. That hasn't gone away, you go back to the large customers. But ultimately when you talk about the biggest, I would say the new normal, which is AI, which clearly has been overtalked about but in my opinion has been barely touched because the biggest application of machine learning is on data. And that predicts things, whether you want to predict forecasting, or you predict something will come down or you can predict, and that's what we believe is where the world is going to go and that's what we double down on with our Claire technology. Just go deep, bring AI to data across the enterprise. >> We got to give you guys props, you guys are right on the line. I got to say as a product person myself, I see you guys executing great strategy, you've been very complimentary to your team, think you're doing a great job. Let's get back to AI. I think if you look at the hype cycles of things, IoT certainly has, still think there's a lot more hype to have there, there's so much more to do there. Cloud was overhyped, remember cloud washing? Pexus back in 2010-11, oh they're just cloud washing. Well that's a sign that ended up becoming what everyone was kind of hyping up. It did turn out. AI thinks the same thing. And I think it's real because you can almost connect the dots and be there but the reality is, is that it's just getting started. And so we had Rob Thomas from IBM on theCUBE and, you know we were talking. He made a comment, I want to get your reaction to, he said, "You can't have AI without IA." Information architecture. And you're in the information Informatica business you guys have been laying out an architecture specifically around governance. You guys kind of saw that early too. You can't just do AI, AI needs to be trained as data models. There's a lot of data involved that feeds AI. Who trains the machines that are doing the learning? So, you know, all these things come into play back to data. So what is the preferred information architecture, IA, that can power AI, artificial intelligence? >> I think it's a great question. I think of what typically, we recommend and we see large companies do look in the current complex architectures the companies are in. Hybrid cloud, multicloud, old architecture. By the way mainframe, client server, big data, you pick your favorite archit, everything exists for any enterprise right. People are not, companies are not going to move magically, everything to one place, to just start putting data in one place and start running some kind of AI on it. Our belief is that that will get organized around metadata. Metadata is data about data right? The organizing principle for any enterprise has to be around metadata. Leave your data wherever it is, organize your metadata, which is a much lighter footprint and then, that layer becomes the true central nervous system for your new next gen information architecture. That's the layer on which you apply machine learning too. So a great example is look, take GDPR. I mean GDPR is, if I'm a distributor, large companies have their GDPR. I mean who's touching my data? Where is my data coming from? Which database has sensitive data? All of these things are such complex problems. You will not move everything magically to one place. You will apply metadata approach to it and then machine learning starts to telling you gee I some anomaly detection. You see I'm seeing some data which does not have access to leave the geographical boundaries, of lets say Germany, going to, let's say UK. Those are kind of things that become a lot easier to solve once you go organize yourself at the metadata layer and that's the layer on which you apply AI. To me, that's the simplest way to describe as the organizing principle of what I call the data architecture or the information architecture for the next ten years. >> And that metadata, you guys saw that earlier, but how does that relate to these new things coming in because you know, one would argue that the ideal preferred infrastructure would be one that says hey no matter what next GDPR thing will happen, there'll be another Equifax that's going to happen, there'll be some sort of state sponsor cyber attack to the US, all these things are happening. I mean hell, all securities attacks are going up-- >> Security's a great example of that. We saw it four years ago you know, and we worked on a metadata driven approach to security. Look I've been on the security business however that's semantic myself. Security's a classic example of where it was all at the infrastructure layer, network, database, server. But the problem is that, it doesn't matter. Where is your database? In the cloud. Where is your network? I mean, do you run a data center anymore right? If I may, figuratively you don't. Ultimately, it's all about the data. The way at which we are going and we want more users like you and me access to data. So security has to be applied at the data layer. So in that context, I just talked about the whole metadata driven approach. Once you have the context of your data, you can apply governance to your data, you can apply security to your data, and as you keep adding new architectures, you do not have to create a paddle architecture you have to just append your metadata. So security, governance, hybrid cloud, all of those things become a lot easier for you, versus clearing one new architecture after another which you can never get to. >> Well people will be afraid of malware and these malicious attacks so auditing becomes now a big thing. If you look at the Equifax, it might take on, I have some data on that show that there was other action, they were fleeced out for weeks and months before the hack was even noticed. >> All this happens. >> I mean, they were ten times phished over even before it was discovered. They were inside, so audit trail would be interesting. >> Absolutely, I'll give you, typically, if you read any external report this is nothing tied to Equifax. It takes any enterprise three months minimum to figure out they're under attack. And now if a sophisticated attacker always goes to right away when they enter your enterprise, they're finding the weakest link. You're as secure as your weakest link in security. And they will go to some data trail that was left behind by some business user who moved onto the next big thing. But data was still flowing through that pipe. Or by the way, the biggest issue is inside our attack right? You will have somebody hack your or my credentials and they don't download like Snowden, a big fat document one day. They'll go drip by drip by drip by drip. You won't even know that. That again is an anomaly detection thing. >> Well it's going to get down to the firmware level. I mean look at the sophisticated hacks in China, they run their own DNS. They have certificates, they hack the iPhones. They make the phones and stuff, so you got to assume packing. But now, it's knowing what's going on and this is really the dynamic nature. So we're in the same page here. I'd love to do a security feature, come into the studio in our office at Palo Alto, think that's worthy. I just had a great cyber chat with Vidder, CTO of Vidder. Junaid is awesome, did some work with the government. But this brings up the question around big data. The landscape that we're in is fast and furious right now. You have big data being impacted by cloud because you have now unlimited compute, low latency storage, unlimited power source in that engine. Then you got the security paradigm. You could argue that that's going to slow things down maybe a little bit, but it also is going to change the face of big data. What is your reaction to the impact to security and cloud to big data? Because even though AI is the big talk of the show, what's really happening here at Strata Data is it's no longer a data show, it's a cloud and security show in my opinion. >> I mean cloud to me is everywhere. It was the, when Hadoop started it was on-prem but it's pretty much in the cloud and look at AWS and Azure, everyone runs natively there, so you're exactly right. To me what has happened is that, you're right, companies look at things two ways. If I'm experimenting, then I can look at it in a way where I'm not, I'm in dev mode. But you're right. As things are getting more operational and production then you have to worry about security and governance. So I don't think it's a matter of slowing down, it's a nature of the business where you can be fast and experiment on one side, but as you go prod, as you go real operational, you have to worry about controls, compliance and governance. By the way in that case-- >> And by the way you got to know what's going on, you got to know the flows. A data lake is a data lake, but you got the Niagara falls >> That's right. >> streaming content. >> Every, every customer of ours who's gone production they always want to understand full governance and lineage in the data flow. Because when I go talk to a regulator or I got talk to my CEO, you may have hundred people going at the data lake. I want to know who has access to it, if it's a production data lake, what are they doing, and by the way, what data is going in. The other one is, I mean walk around here. How much has changed? The world of big data or the wild wild west. Look at the amount of consolidation that has happened. I mean you see around the big distribution right? To me it's going to continue to happen because it's a nature of any new industry. I mean you looked at securities, cyber security big data, AI, you know, massive investment happens and then as customers want to truly go to scale they say look I can only bet on a few that can not only scale, but had the governance and compliance of what a large company wants. >> The waves are coming, there's no doubt about it. Okay so, let me get your reaction to end this segment. What's Informatica doing right now? I mean I've seen a whole lot 'cause we've cover you guys with the show and also we keep in touch, but I want you to spend a minute to talk about why you guys are better than what's out there on the floor. You have a different approach, why are customers working with you and if the folks aren't working with you yet, why should they work with Informatica? >> Our approach in a way has changed but not changed. We believe we operate in what we call the enterprise cloud data management. Our thing is look, we embrace open source. Open source, parks, parkstreaming, Kafka, you know, Hive, MapReduce, we support them all. To us, that's not where customers are spending their time. They're spending their time, once I got all that stuff, what can I do with it? If I'm truly building next gen predictive analytics platform I need some level of able to manage batch and streaming together. I want to make sure that it can scale. I want to make sure it has security, it has governance, it has compliance. So customers work with us to make sure that they can run a hybrid architecture. Whether it is cloud on-prem, whether it is traditional or big data or IoT, all in once place, it is scale-able and it has governance and compliance bricked into it. And then they also look for somebody that can provide true things like, not only data integration, quality, cataloging, all of those things, so when we working with large or small customers, whether you are in dev or prod, but ultimately helping you, what I call take you from an experiment stage to a large scale operational stage. You know, without batting an eyelid. That's the business we are in and in that case-- >> So you are in the business of operationalizing data for customers who want to add scale. >> Our belief is, we want to help our customers succeed. And customers will only succeed, not just by experimenting, but taking their experiments to production. So we have to think of the entire lifecycle of a customer. We cannot stop and say great for experiments, sorry don't go operational with us. >> So we've had a theme here in theCUBE this week called, I'm calling it, don't be a tool, and too many tools are out there right now. We call it the tool shed phenomenon. The tool shed phenomenon is customers aren't, they're tired of having too many tools and they bought a hammer a couple years ago that wants to try to be a lawn mower now and so you got to understand the nature of having great tooling, which you need which defines the work, but don't confuse a tool with a platform. And this is a huge issue because a lot of these companies that are flowing by wayside are groping for platforms. >> So there are customers tell us the same thing, which is why we-- >> But tools have to work in context. >> That's exactly, so that's why you heard, we talked about that for the last couple, it was the intelligent data platform. Customers don't buy a platform but all of our products, like are there microservices on our platform. Customers want to build the next gen data management platform, which is the intelligent data platform. A lot of little things are features or tools along the way but if I am a large bank, if I'm a large airline, and I want to go at scale operational, I can't stitch hundred tools and expect to run my IT shop from there. >> Yeah >> I can't I will never be able to do it. >> There's good tools out there that have a nice business model, lifestyle business or cashflow business, or even tools that are just highly focused and that's all they do and that's great. It's the guys who try to become something that they're not. It's hard, it's just too difficult. >> I think you have to-- >> The tool shed phenomenon is real. >> I think companies have to realize whether they are a feature. I always say are you a feature or are you a product? You have to realize the difference between the two and in between sits our tool. (John laughing) >> Well that quote came, the tool comment came from one of our chief data officers, that was kind of sparked the conversation but people buy a hammer, everything looks like a nail and you don't want to mow your lawn with a hammer, get a lawn mower right? Do the right tool for the job. But you have to platform, the data has to have a holistic view. >> That's exactly right. The intelligent data platform, that's what we call it. >> What's new with Informatica, what's going on? Give us a quick update, we'll end the segment with a quick update on Informatica. What do you got going on, what events are coming up? >> Well we just came off a very big release, we call it 10-2 which had lot of big data, hybrid cloud, AI and catalog and security and governance, all five of them. Big release, just came out and basically customers are adopting it. Which obviously was all centered around the things we talked in Informatica. Again, single platform, cloud, hybrid, big data, streaming and governance and compliance. And then right now, we are basically in the middle, after Informatica, we go on as barrage of tours across multiple cities across the globe so customers can meet us there. Paris is coming up, I was in London a few weeks ago. And then separately we're getting up for coming up, I will probably see you there at Amazon re:Invent. I mean we are obviously all-in partner for-- >> Do you have anything in China? >> China is a- >> Alibaba? >> We're working with them, I'll leave it there. >> We'll be in Alibaba in two weeks for their cloud event. >> Excellent. >> So theCUBE is breaking into China, CUBE China. We need some translators so if anyone out there wants to help us with our China blog. >> We'll be at Dreamforce. We were obviously, so you'll see us there. We were at Amazon Ignite, obviously very close to- >> re:Invent will be great. >> Yeah we will be there and Amazon obviously is a great partner and by the way a great customer of ours. >> Well congratulations, you guys are doing great, Informatica. Great to see the success. We'll see you at re:Invent and keep in touch. Amit Walia, the Executive Vice President, EVP, Chief Product Officer, Informatica. They get the platform game, they get the data game, check em out. It's theCUBE ending day two coverage. We've got a big event tonight. We're going to be streaming live our research that we are going to be rolling out here at Big Data NYC, our even that we're running in conjunction with Strata Data. They run their event, we run our event. Thanks for watching and stay tuned, stay with us. At five o'clock, live Wikibon coverage of their new research and then Party at Seven, which will not be filmed, that's when we're going to have some cocktails. I'm John Furrier, thanks for watching. Stay tuned. (techno music)