hi everybody welcome back to boston you're watching thecube's coverage of reinforce 2022 last time we were here live was 2019. had a couple years of virtual merit bear is here she's with the office of the cso for aws merit welcome back to the cube good to see you thank you for coming on thank you so much it's good to be back um yes cso chief information security officer for folks who are acronym phobia phobic yeah okay so what do you do for the office of the is it ciso or sizzo anyway ah whatever is it sim or theme um i i work in three areas so i sit in aws security and i help us do security we're a shop that runs on aws i empathize with folks who are running shops it is process driven it takes hard work but we believe in certain mechanisms and muscle groups so you know i work on getting those better everything from how we do threat intelligence to how we guard rail employees and think about vending accounts and those kinds of things i also work in customer-facing interactions so when a cso wants to meet awssc so that's often me and then the third is product side so ensuring that everything we deliver not just security services are aligned with security best practices and expectations for our customers so i have to ask you right off the bat so we do a lot of spending surveys we have a partner etr i look at the data all the time and for some reason aws never shows up in the spending metrics why do you think that is maybe that talks to your strategy let's double click on that yeah so first of all um turn on guard duty get shield advanced for the you know accounts you need the 3k is relatively small and a large enterprise event like this doesn't mean don't spend on security there is a lot of goodness that we have to offer in ess external security services but i think one of the unique parts of aws is that we don't believe that security is something you should buy it's something that you get from us it's something that we do for you a lot of the time i mean this is the definition of the shared responsibility model right everything that you interact with on aws has been subject to the same rigorous standards and we aws security have umbrella arms around those but we also ensure that service teams own the security of their service so a lot of times when i'm talking to csos and i say security teams or sorry service teams own the security of their service they're curious like how do they not get frustrated and the answer is we put in a lot of mechanisms to allow those to go through so there's automation there are robots that resolve those trouble tickets you know like and we have emissaries we call them guardian champions that are embedded in service teams at any rate the point is i think it's really beautiful the way that customers who are you know enabling services in general benefit from the inheritances that they get and in some definition this is like the value proposition of cloud when we take care of those lower layers of the stack we're doing everything from the concrete floors guards and gates hvac you know in the case of something like aws bracket which is our quantum computing like we're talking about you know near vacuum uh environments like these are sometimes really intricate and beautiful ways that we take care of stuff that was otherwise manual and ugly and then we get up and we get really intricate there too so i gave a talk this morning about ddos protection um and all the stuff that we're doing where we can see because of our vantage point the volume and that leads us to be a leader in volumetric attack signatures for example manage rule sets like that costs you nothing turn on your dns firewall like there are ways that you just as a as an aws customer you inherit our rigorous standards and you also are able to benefit from the rigor with which we you know exact ourselves to really you're not trying to make it a huge business at least as part of your your portfolio it's just it's embedded it's there take advantage of it i want everyone to be secure and i will go to bad to say like i want you to do it and if money is a blocker let's talk about that because honestly we just want to do the right thing by customers and i want customers to use more of our services i genuinely believe that they are enablers we have pharma companies um that have helped enable you know personalized medicine and some of the copic vaccines we have you know like there are ways that this has mattered to people in really intimate ways um and then fun ways like formula one uh you know like there are things that allow us to do more and our customers to do more and security should be a way of life it's a way of breathing you don't wake up and decide that you're going to bolt it on one day okay so we heard cj moses keynote this morning i presume you were listening in uh we heard a lot about you know cool tools you know threat detection and devops and container security but he did explicitly talked about how aws is simplifying the life of the cso so what are you doing in that regard and what's that that's let's just leave it there for now i talk to c sales every day and i think um most of them have two main concerns one is how to get their organization to grow up like to understand what security looks like in a cloudy way um and that means that you know your login monitoring is going to be the forensics it's not going to be getting into the host that's on our side right and that's a luxury like i think there are elements of the cso job that have changed but that even if you know cj didn't explicitly call them out these are beauties things like um least privilege that you can accomplish using access analyzer and all these ways that inspector for example does network reachability and then all of these get piped to security hub and there's just ways that make it more accessible than ever to be a cso and to enable and embolden your people the second side is how csos are thinking about changing their organization so what are you reporting to the board um how are you thinking about hiring and um in the metrics side i would say you know being and i get a a lot of questions that are like how do we exhibit a culture of security and my answer is you do it you just start doing it like you make it so that your vps have to answer trouble tickets you may and and i don't mean literally like every trouble ticket but i mean they are 100 executives will say that they care about security but so what like you know set up your organization to be responsive to security and to um have to answer to them because it matters and and notice that because a non-decision is a decision and the other side is workforce right and i think um i see a lot of promise some of it unfulfilled in folks being hired to look different than traditional security folks and act different and maybe a first grade teacher or an architect or an artist and who don't consider themselves like particularly technical like the gorgeousness of cloud is that you can one teach yourself this i mean i didn't go to school for computer science like this is the kind of thing we all have to teach ourselves but also you can abstract on top of stuff so you're not writing code every day necessarily although if you are that's awesome and we love debbie folks but you know there's there's a lot of ways in which the machine of the security organization is suggesting i think cj was part to answer your question pointedly i think cj was trying to be really responsive to like all the stuff we're giving you all the goodness all the sprinkles on your cupcake not at all the organizational stuff that is kind of like you know the good stuff that we know we need to get into so i think so you're saying it's it's inherent it's inherently helping the cso uh her life his life become less complex and i feel like the cloud you said the customers are trying to become make their security more cloudy so i feel like the cloud has become the first line of defense now the cso your customer see so is the second line of defense maybe the audit is the third line what does that mean for the role of the the cso how is that they become a compliance officer what does that mean no no i think actually increasingly they are married or marriable so um when you're doing so for example if you are embracing [Music] ephemeral and immutable infrastructure then we're talking about using something like cloud formation or terraform to vend environments and you know being able to um use control tower and aws organizations to dictate um truisms through your environment you know like there are ways that you are basically in golden armies and you can come back to a known good state you can embrace that kind of cloudiness that allows you to get good to refine it to kill it and spin up a new infrastructure and that means though that like your i.t and your security will be woven in in a really um lovely way but in a way that contradicts certain like existing structures and i think one of the beauties is that your compliance can then wake up with it right your audit manager and your you know security hub and other folks that do compliance as code so you know inspector for example has a tooling that can without sending a single packet over the network do network reachability so they can tell whether you have an internet facing endpoint well that's a pci standard you know but that's also a security truism you shouldn't have internet facing endpoints you don't approve up you know like so these are i think these can go in hand in hand there are certainly i i don't know that i totally disregard like a defense in-depth notion but i don't think that it's linear in that way i think it's like circular that we hope that these mechanisms work together that we also know that they should speak to each other and and be augmented and aware of one another so an example of this would be that we don't just do perimeter detection we do identity-based fine-grained controls and that those are listening to and reasoned about using tooling that we can do using security yeah we heard a lot about reasoning as well in the keynote but i want to ask about zero trust like aws i think resisted using that term you know the industry was a buzzword before the pandemic it's probably more buzzy now although in a way it's a mandate um depending on how you look at it so i mean you anything that's not explicitly allowed is denied in your world and you have tools and i mean that's a definition if it's a die that overrides if it's another it's a deny call that will override and allow yeah that's true although anyway finish your question yeah yeah so so my it's like if there's if there's doubt there's no doubt it seems in your world but but but you have a lot of capabilities seems to me that this is how you you apply aws internal security and bring that to your customers do customers talk to you about zero trust are they trying to implement zero trust what's the best way for them to do that when they don't have that they have a lack of talent they don't have the skill sets uh that it and the knowledge that aws has what are you hearing from customers in that regard yeah that's a really um nuanced phrasing which i appreciate because i think so i think you're right zero trust is a term that like means everything and nothing i mean like this this notebook is zero trust like no internet comes in or out of it like congratulations you also can't do business on it right um i do a lot of business online you know what i mean like you can't uh transact something to other folks and if i lose it i'm screwed yeah exactly i usually have a water bottle or something that's even more inanimate than your notebook um but i guess my point is we i don't think that the term zero trust is a truism i think it's a conceptual framework right and the idea is that we want to make it so that someone's position in the network is agnostic to their permissioning so whereas in the olden days like a decade ago um we might have assumed that when you're in the perimeter you just accept everything um that's no longer the right way to think about it and frankly like covid and work from home may have accelerated this but this was ripe to be accelerated anyway um what we are thinking about is both like you said under the network so like the network layer are we talking about machine to machine are we talking about like um you know every api call goes over the open internet with no inherent assurances human to app or it's protected by sig v4 you know like there is an inherent zero trust case that we have always built this goes back to a jeff bezos mandate from 2002 that everything be an api call that is again this kind of like building security into it when we say security is job zero it not only reflects the fact that like when you build a terraform or a cloud formation template you better have permission things appropriately or try to but also that like there is no cloud without security considerations you don't get to just bolt something on after the fact so that being said now that we embrace that and we can reason about it and we can use tools like access analyzer you know we're also talking about zero trust in that like i said augmentation identity centric fine grained controls so an example of this would be a vpc endpoint policy where it is a perm the perimeter is dead long live the perimeter right you'll have your traditional perimeter your vpc or your vpn um augmented by and aware of the fine-grained identity-centric ones which you can also reason about prune down continuously monitor and so on and that'll also help you with your logging and monitoring because you know what your ingress and egress points are how concerned should people be with quantum messing up all the encryption algos oh it's stopping created right okay so but we heard about this in the keynote right so is it just a quantum so far off by the time we get there is it like a y2k you're probably not old enough to remember y2k but y2k moment right i mean i can't take you anywhere what should we um how should we be thinking about quantum in the context of security and sure yeah i mean i think we should be thinking about quantum and a lot of dimensions as operationally interesting and how we can leverage i think we should be thinking about it in the security future for right now aes256 is something that is not broken so we shouldn't try to fix it yeah cool encrypt all the things you can do it natively you know like i love talking about quantum but it's more of an aspirational and also like we can be doing high power compute to solve problems you know but like for it to get to a security uh potentially uh vulnerable state or like something that we should worry about is a bit off yeah and show me an application that can yeah and i mean and i think at that point we're talking about homomorphic improvements about another thing i kind of feel the same way is that you know there's a lot of hype around it a lot of ibm talks about a lot you guys talked about in your keynote today and when i really talk to people who understand this stuff it seems like it's a long long way off i don't think it's a long long way off but everything is dog years in tech world but um but for today you know like for today encrypt yourself we will always keep our encryption up to standard and you know that will be for now like the the industry grade standard that folks i mean like i i have i have never heard of a case where someone had their kms keys broken into i um i always ask like awesome security people this question did you like how did you get into this did you have like did you have a favorite superhero as a kid that was going to save the world i um was always the kid who probably would have picked up a book about the cia and i like find this and i don't remember who i was before i was a security person um but i also think that as a woman um from an american indian family walking through the world i think about the relationship between dynamics with the government and companies and individuals and how we want to construct those and the need for voices that are observant of the ways that those interplay and i always saw this as a field where we can do a lot of good yeah amazing merritt thanks so much for coming on thecube great guest john said you would be really appreciate your time of course all right keep it ready you're very welcome keep it right there this is dave vellante for the cube we'll be right back at aws reinforced 2022 from boston keep right there [Music]

>> From The Cube studios in Palo Alto, in Boston, bringing you data driven insights from the cube and ETR. This is breaking analysis with Dave Vellante. >> Last year, we noted in a breaking analysis that the cloud ecosystem is innovating beyond the idea or notion of multi-cloud. We've said for years that multi-cloud is really not a strategy but rather a symptom of multi-vendor. And we coined this term supercloud to describe an abstraction layer that lives above the hyperscale infrastructure that hides the underlying complexities, the APIs, and the primitives of each of the respective clouds. It interconnects whether it's On-Prem, AWS, Azure, Google, stretching out to the edge and creates a value layer on top of that. So our vision is that supercloud is more than running an individual service in cloud native mode within an individual individual cloud rather it's this new layer that builds on top of the hyperscalers. And does things irrespective of location adds value and we'll get into that in more detail. Now it turns out that we weren't the only ones thinking about this, not surprisingly, the majority of the technology ecosystem has been working towards this vision in various forms, including some examples that actually don't try to hide the underlying primitives. And we'll talk about that, but give a consistent experience across the DevSecOps tool chain. Hello, and welcome to this week's Wikibon, Cube insights powered by ETR. In this breaking analysis, we're going to share some recent examples and direct quotes about supercloud from the many Cube guests that we've had on over the last several weeks and months. And we've been trying to test this concept of supercloud. Is it technically feasible? Is it business rational? Is there business case for it? And we'll also share some recent ETR data to put this into context with some of the players that we think are going after this opportunity and where they are in their supercloud build out. And as you can see I'm not in the studio, everybody's got COVID so the studios shut down temporarily but breaking analysis continues. So here we go. Now, first thing is we uncovered an article from earlier this year by Lori MacVittie, is entitled, Supercloud: The 22 Answer to Multi-Cloud Challenges. What a great title. Of course we love it. Now, what really interested us here is not just the title, but the notion that it really doesn't matter what it's called, who cares? Supercloud, distributed cloud, someone even called it Metacloud recently, and we'll get into that. But Lori is a technologist. She's a developer by background. She works at F-Five and she's partial to the supercloud definition that was put forth by Cornell. You can see it here. That's a cloud architecture that enables application migration as a service across different availability zones or cloud providers, et cetera. And that the supercloud provides interfaces to allocate, migrate and terminate resources... And can span all major public cloud providers as well as private clouds. Now, of course, we would take that as well to the edge. So sure. That sounds about right and provides further confirmation that something new is really happening out there. And that was our initial premise when we put this fourth last year. Now we want to dig deeper and hear from the many Cube guests that we've interviewed recently probing about this topic. We're going to start with Chuck Whitten. He's Dell's new Co-COO and most likely part of the Dell succession plan, many years down the road hopefully. He coined the phrase multi-cloud by default versus multi-cloud by design. And he provides a really good business perspective. He's not a deep technologist. We're going to hear from Chuck a couple of times today including one where John Furrier asks him about leveraging hyperscale CapEx. That's an important concept that's fundamental to supercloud. Now, Ashesh Badani heads products at Red Hat and he talks about what he calls Metacloud. Again, it doesn't matter to us what you call it but it's the ecosystem gathering and innovating and we're going to get his perspective. Now we have a couple of clips from Danny Allan. He is the CTO of Veeam. He's a deep technologist and super into the weeds, which we love. And he talks about how Veeam abstracts the cloud layer. Again, a concept that's fundamental to supercloud and he describes what a supercloud is to him. And we also bring with Danny the edge discussion to the conversation. Now the bottom line from Danny is we want to know is supercloud technically feasible? And is it a thing? And then we have Jeff Clarke. Jeff Clark is the Co-COO and Vice Chairman of Dell super experienced individual. He lays out his vision of supercloud and what John Furrier calls a business operating system. You're going to hear from John a couple times. And he, Jeff Clark has a dropped the mic moment, where he says, if we can do this X, we'll describe what X is, it's game over. Okay. So of course we wanted to then go to HPE, one of Dell's biggest competitors and Patrick Osborne is the vice president of the storage business unit at Hewlett Packet Enterprise. And so given Jeff Clarke's game over strategy, we want to understand how HPE sees supercloud. And the bottom line, according to Patrick Osborne is that it's real. So you'll hear from him. And now Raghu Raghuram is the CEO of VMware. He threw a curve ball at this supercloud concept. And he flat out says, no, we don't want to hide the underlying primitives. We want to give developers access to those. We want to create a consistent developer experience in that DevsSecOps tool chain and Kubernetes runtime environments, and connect all the elements in the application development stack. So that's a really interesting perspective that Raghu brings. And then we end on Itzik Reich. Itzik is a technologist and a technical team leader who's worked as a go between customers and product developers for a number of years. And we asked Itzik, is supercloud technically feasible and will it be a reality? So let's hear from these experts and you can decide for yourselves how real supercloud is today and where it is, run the sizzle >> Operative phrase is multi-cloud by default that's kind of the buzz from your keynote. What do you mean by that? >> Well, look, customers have woken up with multiple clouds, multiple public clouds, On-Premise clouds increasingly as the edge becomes much more a reality for customers clouds at the edge. And so that's what we mean by multi-cloud by default. It's not yet been designed strategically. I think our argument yesterday was, it can be and it should be. It is a very logical place for architecture to land because ultimately customers want the innovation across all of the hyperscale public clouds. They will see workloads and use cases where they want to maintain an On-Premise cloud, On-Premise clouds are not going away, I mentioned edge clouds, so it should be strategic. It's just not today. It doesn't work particularly well today. So when we say multi-cloud by default we mean that's the state of the world today. Our goal is to bring multi-cloud by design as you heard. >> Really great question, actually, since you and I talked, Dave, I've been spending some time noodling just over that. And you're right. There's probably some terminology, something that will get developed either by us or in collaboration with the industry. Where we sort of almost have the next almost like a Metacloud that we're working our way towards. >> So we manage both the snapshots and we convert it into the Veeam portable data format. And here's where the supercloud comes into play. Because if I can convert it into the Veeam portable data format, I can move that OS anywhere. I can move it from physical to virtual, to cloud, to another cloud, back to virtual, I can put it back on physical if I want to. It actually abstracts the cloud layer. There are things that we do when we go between cloud some use BIOS, some use UEFI, but we have the data in backup format, not snapshot format, that's theirs, but we have it in backup format that we can move around and abstract workloads across all of the infrastructure. >> And your catalog is control in control of that. Is that right? Am I thinking about that the right way? >> Yeah it is, 100%. And you know what's interesting about our catalog, Dave, the catalog is inside the backup. Yes. So here's, what's interesting about the edge, two things, on the edge you don't want to have any state, if you can help it. And so containers help with that You can have stateless environments, some persistent data storage But we not not only provide the portability in operating systems, we also do this for containers. And that's true. If you go to the cloud and you're using say EKS with relational database services RDS for the persistent data later, we can pick that up and move it to GKE or move it to OpenShift On-Premises. And so that's why I call this the supercloud, we have all of this data. Actually, I think you termed the term supercloud. >> Yeah. But thank you for... I mean, I'm looking for a confirmation from a technologist that it's technically feasible. >> It is technically feasible and you can do it today. >> You said also technology and business models are tied together and enabler. If you believe that then you have to believe that it's a business operating system that they want. They want to leverage whatever they can. And at the end of the day, they have to differentiate what they do. >> Well, that's exactly right. If I take that in what Dave was saying and I summarize it the following way, if we can take these cloud assets and capabilities, combine them in an orchestrated way to deliver a distributed platform, game over. >> We have a number of platforms that are providing whether it's compute or networking or storage, running those workloads that they plum up into the cloud they have an operational experience in the cloud and they now they have data services that are running in the cloud for us in GreenLake. So it's a reality, we have a number of platforms that support that. We're going to have a a set of big announcements coming up at HPE Discover. So we led with Electra and we have a block service. We have VM backup as a service and DR on top of that. So that's something that we're providing today. GreenLake has over, I think it's actually over 60 services right now that we're providing in the GreenLake platform itself. Everything from security, single sign on, customer IDs, everything. So it's real. We have the proofpoint for it. >> Yeah. So I want to clarify something that you said because this tends to be very commonly confused by customers. I use the word abstraction. And usually when people think of abstraction, they think it hides capabilities of the cloud providers. That's not what we are trying to do. In fact, that's the last thing we are trying to do. What we are trying to do is to provide a consistent developer experience regardless of where you want to build your application. So that you can use the cloud provider services if that's what you want to use. But the DevSecOp tool chain, the runtime environment which turns out to be Kubernetes and how you control the Kubernetes environment, how do you manage and secure and connect all of these things. Those are the places where we are adding the value. And so really the VMware value proposition is you can build on the cloud of your choice but providing these consistent elements, number one, you can make better use of us, your scarce developer or operator resources and expertise. And number two, you can move faster. And number three, you can just spend less as a result of this. So that's really what we are trying to do. We are not... So I just wanted to clarify the word abstraction. In terms of where are we? We are still, I would say, in the early stages. So if you look at what customers are trying to do, they're trying to build these greenfield applications. And there is an entire ecosystem emerging around Kubernetes. There is still, Kubernetes is not a developer platform. The developer experience on top of Kubernetes is highly inconsistent. And so those are some of the areas where we are introducing new innovations with our Tanzu Application Platform. And then if you take enterprise applications, what does it take to have enterprise applications running all the time be entirely secure, et cetera. >> Well, look, the multi-cloud by default today are isolated clouds. They don't work together. Your data is siloed. It's locked up and it is expensive to move and make sense of it. So I think the word you and I were batting around before, this is an interconnected tissue. That's what the world needs. They need the clouds to work together as a single platform. That's the problem that we're trying to solve. And you saw it in some of our announcements here that we're starting to make steps on that journey to make multi-cloud work together much simpler. >> It's interesting, you mentioned the hyperscalers and all that CapEx investments. Why wouldn't you want to take advantage of a cloud and build on the CapEx and then ultimately have the solutions machine learning as one area. You see some specialization with the clouds. But you start to see the rise of superclouds, Dave calls them, and that's where you can innovate on a cloud then go to the multiple clouds. Snowflakes is one, we see a lot of examples of supercloud... >> Project Alpine was another one. I mean, it's early, but it's its clearly where you're going. The technology is just starting to come around. I mean it's real. >> Yeah. I mean, why wouldn't you want to take advantage of all of the cloud innovation out there? >> Is that something that's, that supercloud idea is a reality from a technologist perspective. >> I think it is. So for example Katie Gordon, which I believe you've interviewed earlier this week, was demonstrating the Kubernetes data mobility aspect which is another project. That's exactly part of the it's rationale, the rationale of customers being able to move some of their Kubernetes workloads to the cloud and back and between different clouds. Why are we doing? Because customers wants to have the ability to move between different cloud providers, using a common API that will be able to orchestrate all of those things with a self-service that may be offered via the APEX console itself. So it's all around enabling developers and meeting them where they are today and also meeting them into tomorrow's world where they actually may have changed their mind to do those things. So yes we are walking on all of those different aspects. >> Okay. Let's take a quick look at some of the ETR data. This is an X-Y graph. You've seen it a number of times on breaking analysis, it plots the net score or spending momentum on the Y-axis and overlap or pervasiveness in the ETR dataset on the X-axis, used to be called market share. I think that term was off putting to some people, but anyway it's an indicator of presence in the dataset. Now that red dotted line that's rarefied air where anything above that line is considered highly elevated. Now you can see we've plotted Azure and AWS in the upper right. GCP is in there and Kubernetes. We've done that as reference points. They're not necessarily building supercloud platforms. We'll see if they ever want to do so. And Kubernetes of course not a company, but we put 'em in there for context. And we've cherry picked a few players that we believe are building out or are important for supercloud build out. Let's start with Snowflake. We've talked a lot about this company. You can see they're highly elevated on the vertical axis. We see the data cloud as a supercloud in the making. You've got pure storage in there. They made the public, the early part of its supercloud journey at Accelerate 2019 when it unveiled a hybrid block storage service inside of AWS, it connects its On-Prem to AWS and creates that singular experience for pure customers. We see Hashi, HashiCorp as an enabling infrastructure, as code. So they're enabling infrastructure as code across different clouds and different locations. You see Nutanix. They're embarking on their multi-cloud strategy but it's doing so in a way that we think is supercloud, like now. Now Veeam, we were just at VeeamON. And this company has tied Dell for the number one revenue player in data protection. That's according to IDC. And we don't think it won't be long before it holds that position alone at the top as it's growing faster than in Dell in the space. We'll see, Dell is kind of waking up a little bit and putting more resource on that. But Veeam, they're a pure play vendor in data protection. And you heard their CTO, Danny Allan's view on Supercloud, they're doing it today. And we heard extensive comments as well from Dell that's clearly where they're headed, project Alpine was an early example from Dell technologies world of Supercloud in our view. And HPE with GreenLake. Finally beginning to talk about that cross cloud experience. I think it in initially HPE has been more focused on the private cloud, we'll continue to probe. We'll be at HPE discover later on the spring, actually end of June. And we'll continue to probe to see what HPE is doing specifically with GreenLake. Now, finally, Cisco, we put them on the chart. We don't have direct quotes from recent shows and events but this data really shows you the size of Cisco's footprint within the ETR data set that's on the X-axis. Now the cut of this ETR data includes all sectors across the ETR taxonomy which is not something that we commonly show but you can see the magnitude of Cisco's presence. It's impressive. Now, they had better, Cisco that is, had better be building out a supercloud in our view or they're going to be left behind. And I'm quite certain that they're actually going to do so. So we have a lot of evidence that we're putting forth here and seeing in the marketplace what we said last year, the ecosystem is take taking shape, supercloud is forming and becoming a thing. And really in our view, is the future of cloud. But there are always risks to these predictive scenarios and we want to acknowledge those. So first, look, we could end up with a bunch of bespoke superclouds. Now one supercloud is better than three separate cloud native services that do fundamentally the same thing from the same vendor. One for AWS, one for GCP and one for Azure. So maybe that's not all that bad. But to point number two, we hope there evolves a set of open standards for self-service infrastructure, federated governance, and data sharing that will evolve as a horizontal layer versus a set of proprietary vendor specific tools. Now, maybe a company like Veeam will provide that as a data management layer or some of Veeam's competitors or maybe it'll emerge again as open source. As well, and this next point, we see the potential for edge disruptions, changing the economics of the data center. Edge in fact could evolve on its own, independent of the cloud. In fact, David Floria sees the edge somewhat differently from Danny Allan. Floria says he sees a requirement for distributed stateful environments that are ephemeral where recovery is built in. And I said, David, stateful? Ephemeral? Stateful ephemeral? Isn't that an oxymoron? And he responded that, look, if it's not ephemeral the costs are going to be prohibitive. He said the biggest mistake the companies could make is thinking that the edge is simply an extension of their current cloud strategies. We're seeing that a lot. Dell largely talks about the edge as retail. Now, and Telco is a little bit different, but back to Floria's comments, he feels companies have to completely reimagine an integrated file and recovery system which is much more data efficient. And he believes that the technology will evolve with massive volumes and eventually seep into enterprise cloud and distributed data centers with better economics. In other words, as David Michelle recently wrote, we're about 15 years into the most recent cloud cycle and history shows that every 15 years or so, something new comes along that is a blind spot and highly disruptive to existing leaders. So number four here is really important. Remember, in 2007 before AWS introduced the modern cloud, IBM outpost, sorry, IBM outspent Amazon and Google and RND and CapEx and was really comparable to Microsoft. But instead of inventing cloud, IBM spent hundreds of billions of dollars on stock buybacks and dividends. And so our view is that innovation rewards leaders. And while it's not without risks, it's what powers the technology industry it always has and likely always will. So we'll be watching that very closely, how companies choose to spend their free cash flow. Okay. That's it for now. Thanks for watching this episode of The Cube Insights, powered by ETR. Thanks to Stephanie Chan who does some of the background research? Alex Morrison is on production and is going to compile all this stuff. Thank you, Alex. We're all remote this week. Kristen Nicole and Cheryl Knight do Cube distribution and social distribution and get the word out, so thank you. Robert Hof is our editor in chief. Don't forget the checkout etr.ai for all the survey action. Remember I publish each week on wikibon.com and siliconangle.com and you can check out all the breaking analysis podcasts. All you can do is search breaking analysis podcast so you can pop in the headphones and listen while you're on a walk. You can email me at david.vellante@siliconangle.com. If you want to get in touch or DM me at DVellante, you can always hit me up into a comment on our LinkedIn posts. This is Dave Vellante. Thank you for watching this episode of break analysis, stay safe, be well and we'll see you next time. (upbeat music)

>> Narrator: From around the globe, It's theCUBE! Covering Fortinet Security Summit, brought to you by Fortinet. >> And welcome to the cube coverage here at the PGA champion-- Fortinet championship, where we're going to be here for Napa valley coverage of Fortinet's, the championships security summit, going on Fortinet, sponsoring the PGA, but a great guest Merritt Baer, who's the principal in the office of the CISO at Amazon web services. Great to see you. Thanks for coming on. >> Merritt: Thank you for having me. It's good to be here. >> So Fortinet, uh, big brand now, sponsoring the PGA. Pretty impressive that they're getting out there with the golf. It's very enterprise focused, a lot of action. A lot of customers here. >> Merritt: It seems like it, for sure. >> Bold move. Amazon, Amazon web services has become the gold standard in terms of cloud computing, seeing DevOps people refactoring. You've seen the rise of companies like Snowflake building on Amazon. People are moving not only to the cloud, but they're refactoring their business and security is top of mind for everyone. And obviously cybersecurity threats that Fortinet helps cover, you guys are partnering with them, is huge. What is your state of the union for cyber? What's the current situation with the threat landscape? Obviously there's no perimeter in the cloud. More end points are coming on board. The Edge is here. 5G, wavelength with outpost, a lot happening. >> That was a long question, but I'll, I'll try. So I think, you know, as always business in innovation is the driver. And security needs to be woven into that. And so I think increasingly we're seeing security not be a no shop, but be an enabler. And especially in cloud, when we're talking about the way that you do DevOps with security, I know folks don't like the term DevSecOps, but you know, to be able to do agile methodology and be able to do the short sprints that are really agile and, and innovative where you can-- So instead of nine months or whatever, nine week timelines, we're talking about short sprints that allow you to elastically scale up and down and be able to innovate really creatively. And to do that, you need to weave in your security because there's no like, okay, you pass go, you collect $200. Security is not an after the fact. So I think as part of that, of course the perimeter is dead, long live the perimeter, right? It does matter. And we can talk about that a little bit. You know, the term zero trust is really hot right now. We can dig into that if that's of interest. But I think part of this is just the business is kind of growing up. And as you alluded to we're at the start of what I think is an S curve that is just at the beginning. >> You know, I was really looking forward to Reinforced this year. It was got canceled last year, but the first inaugural event was in Boston. I remember covering that. This year it was virtual, but the keynote Steven gave was interesting, security hubs at the center of it. And I want to ask you, because I need you to share your view on how security's changed with the cloud, because there's now new things that are there to take advantage of if you're a business or an enterprise, yeah on premises, there's a standard operating procedure. You have the perimeter, et cetera. That's not there anymore, but with the cloud, there's a new, there's new ways to protect and security hub is one. What are some of the new things that cloud enables for security? >> Well, so just to clarify, like perimeters exist logically just like they do physically. So, you know, a VPC for example, would be a logical perimeter and that is very relevant, or a VPN. Now we're talking about a lot of remote work during COVID, for example. But one of the things that I think folks are really interested with Security Hub is just having that broad visibility and one of the beauties of cloud is that, you get this tactile sense of your estate and you can reason about it. So for example, when you're looking at identity and access management, you can look at something like access analyzer that will under the hood be running on a tool that our, our group came up with that is like reasoning about the permissions, because you're talking about software layers, you're talking about computer layer reasoning about security. And so another example is in inspector. We have a tool that will tell you without sending a single packet over the network, what your network reach ability is. There's just like this ability to do infrastructure as code that then allows you to do security as code. And then that allows for ephemeral and immutable infrastructures so that you could, for example, get back to a known good state. That being said, you know, you kill a, your web server gets popped and you kill it and you spin up a new one. You haven't solved your problem, right? You need to have some kind of awareness of networking and how principals work. But at the same time, there's a lot of beauties about cloud that you inherit from a security perspective to be able to work in those top layers. And that's of course the premise of cloud. >> Yeah, infrastructure as code, you mentioned that, it's awesome. And the program ability of it with, with server-less functions, you're starting to see new ways now to spin up resources. How is that changing the paradigm and creating opportunities for better security? Is it, is it more microservices? Is it, is, are there new things that people can do differently now that they didn't have a year ago or two years ago? Because you're starting to see things like server-less functions are very popular. >> So yes, and yes, I think that it is augmenting the way that we're doing business, but it's especially augmenting the way we do security in terms of automation. So server-less, under the hood, whether it's CloudWatch events or config rules, they are all a Lambda function. So that's the same thing that powers your Alexa at home. These are server-less functions and they're really simple. You can program them, you can find them on GitHub, but they are-- one way to really scale your enterprise is to have a lot of automation in place so that you put those decisions in ahead of time. So your gray area of human decision making is scaled down. So you've got, you know, what you know to be allowable, what you know to be not allowable. And then you increasingly kind of whittled down that center into things that really are novel, truly novel or high stakes or both. But the focus on automation is a little bit of a trope for us. We at Amazon like to talk about mechanisms, good intentions are not enough. If it's not someone's job, it's a hope and hope is not a plan, you know, but creating the actual, you know, computerized version of making it be done iteratively. And I think that is the key to scaling a security chain because as we all know, things can't be manual for long, or you won't be able to grow. >> I love the AWS reference. Mechanisms, one way doors, raising the bar. These are all kind of internal Amazon, but I got to ask you about the Edge. Okay. There's a lot of action going on with 5G and wavelength. Okay, and what's interesting is if the Edge becomes so much more robust, how do you guys see that security from a security posture standpoint? What should people be thinking about? Because certainly it's just a distributed Edge point. What's the security posture, How should we be thinking about Edge? >> You know, Edge is a kind of catch all, right, we're talking about Internet of Things. We're talking about points of contact. And a lot of times I think we focus so much on the confidentiality and integrity, but the availability is hugely important when we're talking about security. So one of the things that excites me is that we have so many points of contact and so many availability points at the Edge that actually, so for example, in DynamoDB, the more times you put a call on it, the more available it is because it's fresher, you've already been refreshing it, there are so many elements of this, and our core compute platform, EC2, all runs on Nitro, which is our, our custom hardware. And it's really fascinating, the availability benefits there. Like the best patching is a patching you don't have to do. And there are so many elements that are just so core to that Greengrass, you know, which is running on FreeRTOS, which has an open source software, for example, is, you know, one element of zero trust in play. And there are so many ways that we can talk about this in different incarnations. And of course that speaks to like the breadth and depth of the industries that use cloud. We're talking about automotive, we're talking about manufacturing and agriculture, and there are so many interesting use cases for the ways that we will use IOT. >> Yeah. It's interesting, you mentioned Nitro. we also got Annapurna acquisition years ago. You got latency at the Edge. You can handle low latency, high volume compute with the data. That's pretty powerful. It's a paradigm shift. That's a new dynamic. It's pretty compelling, these new architectures, most people are scratching their heads going, "okay, how do I do this, like what do I do?" >> No, you're right. So it is a security inheritance that we are extremely calculated about our hardware supply chain. And we build our own custom hardware. We build our own custom Silicon. Like, this is not a question. And you're right in that one of the things, one of the north stars that we have is that the security properties of our engineering infrastructure are built in. So there just is no button for it to be insecure. You know, like that is deliberate. And there are elements of the ways that nature works from it running, you know, with zero downtime, being able to be patched running. There are so many elements of it that are inherently security benefits that folks inherit as a product. >> Right. Well, we're here at the security summit. What are you excited for today? What's the conversations you're having here at the Fortinet security summit. >> Well, it's awesome to just meet folks and connect outside. It's beautiful outside today. I'm going to be giving a talk on securing the cloud journey and kind of that growth and moving to infrastructure as code and security as code. I'm excited about the opportunity to learn a little bit more about how folks are managing their hybrid environments, because of course, you know, I think sometimes folks perceive AWS as being like this city on a hill where we get it all right. We struggle with the same things. We empathize with the same security work. And we work on that, you know, as a principal in the office of the CISO, I spend a lot of my time on how we do security and then a lot of my time talking to customers and that empathy back and forth is really crucial. >> Yeah. And you've got to be on the bleeding edge and have the empathy. I can't help but notice your AWS crypto shirt. Tell me about the crypto, what's going on there. NFT's coming out, is there a S3 bucket at NFT now, I mean. (both laughing) >> Cryptography never goes out of style. >> I know, I'm just, I couldn't help-- We'll go back to the pyramids on that one. Yeah, no, this is not a, an advertisement for cryptocurrency. It is, I'm a fangirl of the AWS crypto team. And as a result of wearing their shirts, occasionally they send me more shirts. And I can't argue with that. >> Well, love, love, love the crypto. I'm big fan of crypto, I think crypto is awesome. Defi is amazing. New applications are going to come out. We think it's going to be pretty compelling, again, let's get today right. (laughing) >> Well, I don't think it's about like, so cryptocurrency is just like one small iteration of what we're really talking about, which is the idea that math resolves, and the idea that you can have value in your resolution that the math should resolve. And I think that is a fundamental principle and end-to-end encryption, I believe is a universal human right. >> Merritt, thank you for coming on the cube. Great, great to have you on. Thanks for sharing that awesome insight. Thanks for coming on. >> Merritt: Thank you. >> Appreciate it. Okay. CUBE coverage here in Napa valley, our remote set for Fortinet's security cybersecurity summit here as part of their PGA golf Pro-Am tournament happening here in Napa valley. I'm John Furrier. Thanks for watching.

from the cube studios in palo alto in boston bringing you data-driven insights from the cube and etr this is breaking analysis with dave vellante nvidia wants to completely transform enterprise computing by making data centers run 10x faster at one tenth the cost and video's ceo jensen wang is crafting a strategy to re-architect today's on-prem data centers public clouds and edge computing installations with a vision that leverages the company's strong position in ai architectures the keys to this end-to-end strategy include a clarity of vision massive chip design skills a new arm-based architecture approach that integrates memory processors i o and networking and a compelling software consumption model even if nvidia is unsuccessful at acquiring arm we believe it will still be able to execute on this strategy by actively participating in the arm ecosystem however if its attempts to acquire arm are successful we believe it will transform nvidia from the world's most valuable chip company into the world's most valuable supplier of integrated computing architectures hello everyone and welcome to this week's wikibon cube insights powered by etr in this breaking analysis we'll explain why we believe nvidia is in the right position to power the world's computing centers and how it plans to disrupt the grip that x86 architectures have had on the data center for decades the data center market is in transition like the universe the cloud is expanding at an accelerated pace no longer is the cloud an opaque set of remote services i always say somewhere out there sitting in a mega data center no rather the cloud is extending to on-premises data centers data centers are moving into the cloud and they're connecting through adjacent locations that create hybrid interactions clouds are being meshed together across regions and eventually will stretch to the far edge this new definition or view of cloud will be hyper distributed and run by software kubernetes is changing the world of software development and enabling workloads to run anywhere open apis external applications expanding the digital supply chains and this expanding cloud they all increase the threat surface and vulnerability to the most sensitive information that resides within the data center and around the world zero trust has become a mandate we're also seeing ai being injected into every application and it's the technology area that we see with the most momentum coming out of the pandemic this new world will not be powered by general purpose x86 processors rather it will be supported by an ecosystem of arm-based providers in our opinion that are affecting an unprecedented increase in processor performance as we have been reporting and nvidia in our view is sitting in the poll position and is currently the favorite to dominate the next era of computing architecture for global data centers public clouds as well as the near and far edge let's talk about jensen wang's clarity of vision for this new world here's a chart that underscores some of the fundamental assumptions that he's leveraging to expand his market the first is that there's a lot of waste in the data center he claims that only half of the cpu cores deployed in the data center today actually support applications the other half are processing the infrastructure all around the applications that run the software defined data center and they're terribly under utilized nvidia's blue field three dpu the data processing unit was described in a blog post on siliconangle by analyst zias caravala as a complete mini server on a card i like that with software defined networking storage and security acceleration built in this product has the bandwidth and according to nvidia can replace 300 general purpose x86 cores jensen believes that every network chip will be intelligent programmable and capable of this type of acceleration to offload conventional cpus he believes that every server node will have this capability and enable every packed of every packet and every application to be monitored in real time all the time for intrusion and as servers move to the edge bluefield will be included as a core component in his view and this last statement by jensen is critical in our opinion he says ai is the most powerful force of our time whether you agree with that or not it's relevant because ai is everywhere an invidious position in ai and the architectures the company is building are the fundamental linchpin of its data center enterprise strategy so let's take a look at some etr spending data to see where ai fits on the priority list here's a set of data in a view that we often like to share the horizontal axis is market share or pervasiveness in the etr data but we want to call your attention to the vertical axis that's really really what really we want to pay attention today that's net score or spending momentum exiting the pandemic we've seen ai capture the number one position in the last two surveys and we think this dynamic will continue for quite some time as ai becomes the staple of digital transformations and automations an ai will be infused in every single dot you see on this chart nvidia's architectures it just so happens are tailor made for ai workloads and that is how it will enter these markets let's quantify what that means and lay out our view of how nvidia with the help of arm will go after the enterprise market here's some data from wikibon research that depicts the percent of worldwide spending on server infrastructure by workload type here are the key points first the market last year was around 78 billion dollars worldwide and is expected to approach 115 billion by the end of the decade this might even be a conservative figure and we've split the market into three broad workload categories the blue is ai and other related applications what david floyer calls matrix workloads the orange is general purpose think things like erp supply chain hcm collaboration basically oracle saps and microsoft work that's being supported today and of course many other software providers and the gray that's the area that jensen was referring to is about being wasted the offload work for networking and storage and all the software defined management in the data centers around the world okay you can see the squeeze that we think compute infrastructure is gonna gonna occur around that orange area that general-purpose workloads that we think is going to really get squeezed in the next several years on a percentage basis and on an absolute basis it's really not growing nearly as fast as the other two and video with arm in our view is well positioned to attack that blue area and the gray area those those workload offsets and the new emerging ai applications but even the orange as we've reported is under pressure as for example companies like aws and oracle they use arm-based designs to service general purpose workloads why are they doing that cost is the reason because x86 generally and intel specifically are not delivering the price performance and efficiency required to keep up with the demands to reduce data center costs and if intel doesn't respond which we believe it will but if it doesn't act arm we think will get 50 percent of the general purpose workloads by the end of the decade and with nvidia it will dominate the blue the ai and the gray the offload work when we say dominate we're talking like capture 90 percent of the available market if intel doesn't respond now intel they're not just going to sit back and let that happen pat gelsinger is well aware of this in moving intel to a new strategy but nvidia and arm are way ahead in the game in our view and as we've reported this is going to be a real challenge for intel to catch up now let's take a quick look at what nvidia is doing with relevant parts of its pretty massive portfolio here's a slide that shows nvidia's three chip strategy the company is shifting to arm-based architectures which we'll describe in more detail in a moment the slide shows at the top line nvidia's ampere architecture not to be confused with the company ampere computing nvidia is taking a gpu centric approach no surprise obvious reasons there that's their sort of stronghold but we think over time it may rethink this a little bit and lean more into npus the neural processing unit we look at what apple's doing what tesla are doing we see opportunities for companies like nvidia to really sort of go after that but we'll save that for another day nvidia has announced its grace cpu a nod to the famous computer scientist grace hopper grace is a new architecture that doesn't rely on x86 and much more efficiently uses memory resources we'll again describe this in more detail later and the bottom line there that roadmap line shows the bluefield dpu which we described is essentially a complete server on a card in this approach using arm will reduce the elapsed time to go from chip design to production by 50 we're talking about shaving years down to 18 months or less we don't have time to do a deep dive into nvidia's portfolio it's large but we want to share some things that we think are important and this next graphic is one of them this shows some of the details of nvidia's jetson architecture which is designed to accelerate those ai plus workloads that we showed earlier and the reason is that this is important in our view is because the same software supports from small to very large including edge systems and we think this type of architecture is very well suited for ai inference at the edge as well as core data center applications that use ai and as we've said before a lot of the action in ai is going to happen at the edge so this is a good example of leveraging an architecture across a wide spectrum of performance and cost now we want to take a moment to explain why the moved arm-based architectures is so critical to nvidia one of the biggest cost challenges for nvidia today is keeping the gpu utilized typical utilization of gpu is well below 20 percent here's why the left hand side of this chart shows essentially racks if you will of traditional compute and the bottlenecks that nvidia faces the processor and dram they're tied together in separate blocks imagine there are thousands thousands of cores in a rack and every time you need data that lives in another processor you have to send a request and go retrieve it it's very overhead intensive now technologies like rocky are designed to help but it doesn't solve the fundamental architectural bottleneck every gpu shown here also has its own dram and it has to communicate with the processors to get the data i.e they can't communicate with each other efficiently now the right hand side side shows where nvidia is headed start in the middle with system on chip socs cpus are packaged in with npus ipu's that's the image processing unit you know x dot dot dot x pu's the the alternative processors they're all connected with sram which is think of that as a high speed layer like an layer one cache the os for the system on a chip lives inside of this and that's where nvidia has this killer software model what they're doing is they're licensing the consumption of the operating system that's running this system on chip in this entire system and they're affecting a new and really compelling subscription model you know maybe they should just give away the chips and charge for the software like a razer blade model talk about disruptive now the outer layer is the the dpu and the shared dram and other resources like the ampere computing the company this time cpus ssds and other resources these are the processors that will manage the socs together this design is based on nvidia's three chip approach using bluefield dpu leveraging melanox that's the networking component the network enables shared dram across the cpus which will eventually be all arm based grace lives inside the system on a chip and also on the outside layers and of course the gpu lives inside the soc in a scaled-down version like for instance a rendering gpu and we show some gpus on the outer layer as well for ai workloads at least in the near term you know eventually we think they may reside solely in the system on chip but only time will tell okay so you as you can see nvidia is making some serious moves and by teaming up with arm and leaning into the arm ecosystem it plans to take the company to its next level so let's talk about how we think competition for the next era of compute stacks up here's that same xy graph that we love to show market share or pervasiveness on the horizontal tracking against next net score on the vertical net score again is spending velocity and we've cut the etr data to capture players that are that are big in compute and storage and networking we've plugged in a couple of the cloud players these are the guys that we feel are vying for data center leadership around compute aws is a very strong position we believe that more than half of its revenues comes from compute you know ec2 we're talking about more than 25 billion on a run rate basis that's huge the company designs its own silicon graviton 2 etc and is working with isvs to run general purpose workloads on arm-based graviton chips microsoft and google they're going to follow suit they're big consumers of compute they sell a lot but microsoft in particular you know they're likely to continue to work with oem partners to attack that on-prem data center opportunity but it's really intel that's the provider of compute to the likes of hpe and dell and cisco and the odms which are the odms are not shown here now hpe let's talk about them for a second they have architectures and i hate to bring it up but remember the machine i know it's the butt of many jokes especially from competitors it had been you know frankly hpe and hp they deserve some of that heat for all the fanfare and then that they they put out there and then quietly you know pulled the machine or put it out the pasture but hpe has a strong position in high performance computing and the work that it did on new computing architectures with the machine and shared memories that might be still kicking around somewhere inside of hp and could come in handy for some day in the future so hpe has some chops there plus hpe has been known hp historically has been known to design its own custom silicon so i would not count them out as an innovator in this race cisco is interesting because it not only has custom silicon designs but its entry into the compute business with ucs a decade ago was notable and they created a new way to think about integrating resources particularly compute and networking with partnerships to add in the storage piece initially it was within within emc prior to the dell acquisition but you know it continues with netapp and pure and others cisco invests they spend money investing in architectures and we expect the next generation of ucs oh ucs2 ucs 2.0 will mark another notable milestone in the company's data center business dell just had an amazing quarterly earnings report the company grew top line revenue by around 12 percent and it wasn't because of an easy compare to last year dells is simply executing despite continued softness in the legacy emc storage business laptop the laptop demand continued to soar in dell server business it's growing again but we don't see dell as an architectural innovator per se in compute rather we think the company will be content to partner with suppliers whether it's intel nvidia arm-based partners or all of the above dell we think will rely on its massive portfolio its excellent supply chain and execution ethos to compete now ibm is notable for historical reasons with its mainframe ibm created the first great compute monopoly before it unwind and wittingly handed it to intel along with microsoft we don't see ibm necessarily aspiring to retake that compute platform mantle that once once held with mainframes rather red hat in the march to hybrid cloud is the path that we think in our view is ibm's approach now let's get down to the elephants in the room intel nvidia and china inc china is of course relevant because of companies like alibaba and huawei and the chinese chinese government's desire to be self-sufficient in semiconductor technology and technology generally but our premise here is that the trends are favoring nvidia over intel in this picture because nvidia is making moves to further position itself for new workloads in the data center and compete for intel's stronghold intel is going to attempt to remake itself but it should have been doing this seven years ago what pat gelsinger is doing today intel is simply far behind and it's going to take at least a couple years for them to really start to to make inroads in this new model let's stay on the nvidia v intel comparison for a moment and take a snapshot of the two companies here's a quick chart that we put together with some basic kpis some of these figures are approximations or they're rounded so don't stress over it too much but you can see intel is an 80 billion dollar company 4x the size of nvidia but nvidia's market cap far exceeds that of intel why is that of course growth in our view it's justified due to that growth and nvidia's strategic positioning intel used to be the gross margin king but nvidia has much higher gross margins interesting now when it comes down to free cash flow intel is still dominant as it pertains to the balance sheet intel is way more capital intensive than nvidia and as it starts to build out its foundries that's going to eat into intel's cash position now what we did is we put together a little pro forma on the third column of nvidia plus arm circa let's say the end of 2022. we think they could get to a run rate that is about half the size of intel and that can propel the company's market cap to well over half a trillion dollars if they get any credit for arm they're paying 40 billion dollars for arm a company that's you know sub 2 billion the risk is that because of the arm because the arm deal is based on cash plus tons of stock it could put pressure on the market capitalization for some time arm has 90 percent gross margins because it pretty much has a pure license model so it helps the gross margin line a little bit for this in this pro forma and the balance sheet is a swag arm has said that it's not going to take on debt to do the transaction but we haven't had time to really dig into that and figure out how they're going to structure it so we took a took a swag in in what we would do with this low interest rate environment but but take that with a grain of salt we'll do more research in there the point is given the momentum and growth of nvidia its strategic position in ai is in its deep engineering they're aimed at all the right places and its potential to unlock huge value with arm on paper it looks like the horse to beat if it can execute all right let's wrap up here's a summary look the architectures on which nvidia is building its dominant ai business are evolving and nvidia is well positioned to drive a truck right to the enterprise in our view the power has shifted from intel to the arm ecosystem and nvidia is leaning in big time whereas intel it has to preserve its current business while recreating itself at the same time this is going to take a couple of years but intel potentially has the powerful backing of the us government too strategic to fail the wild card is will nvidia be successful in acquiring arm certain factions in the uk and eu are fighting the deal because they don't want the u.s dictating to whom arm can sell its technology for example the restrictions placed on huawei for many suppliers of arm-based chips based on u.s sanctions nvidia's competitors like broadcom qualcomm at all are nervous that if nvidia gets armed they will be at a competitive disadvantage they being invidious competitors and for sure china doesn't want nvidia controlling arm for obvious reasons and it will do what it can to block the deal and or put handcuffs on how business can be done in china we can see a scenario where the u.s government pressures the uk and eu regulators to let this deal go through look ai and semiconductors you can't get much more strategic than that for the u.s military and the u.s long-term competitiveness in exchange for maybe facilitating the deal the government pressures nvidia to guarantee some feed to the intel foundry business while at the same time imposing conditions that secure access to arm-based technology for nvidia's competitors and maybe as we've talked about before having them funnel business to intel's foundry actually we've talked about the us government enticing apple to do so but it could also entice nvidia's competitors to do so propping up intel's foundry business which is clearly starting from ground zero and is going to need help outside of intel's own semiconductor manufacturing internally look we don't have any inside information as to what's happening behind the scenes with the us government and so forth but on its earning call on its earnings call nvidia said they're working with regulators that are on track to complete the deal in early 2022. we'll see okay that's it for today thank you to david floyer who co-created this episode with me and remember i publish each week on wikibon.com and siliconangle.com these episodes they're all available as podcasts all you're going to do is search breaking analysis podcast and you can always connect with me on twitter at dvalante or email me at david.valante siliconangle.com i always appreciate the comments on linkedin and in the clubhouse please follow me so you can be notified when we start a room and riff on these topics and don't forget to check out etr.plus for all the survey data this is dave vellante for the cube insights powered by etr be well and we'll see you next time [Music] you

(calm music)- Hello, and welcome to this CUBE conversation here in Palo Alto, California in theCUBE Studios, I'm John Furrier, host of theCUBE. We are here with the hot startup really working on some real, super important security technology for the cloud, great company, Orca Security, Avi Shua, CEO, and co founder. Avi, thank you for coming on theCUBE and share your story >> Thanks for having me. >> So one of the biggest problems that enterprises and large scale, people who are going to the cloud and are in the cloud and are evolving with cloud native, have realized that the pace of change and the scale is a benefit to the organizations for the security teams, and getting that security equation, right, is always challenging, and it's changing. You guys have a solution for that, I really want to hear what you guys are doing. I like what you're talking about. I like what you're thinking about, and you have some potentially new technologies. Let's get into it. So before we get started, talk about what is Orca Security, what do you guys do? What problem do you solve? >> So what we invented in Orca, is a unique technology called site scanning, that essentially enables us to connect to any cloud environment in a way which is as simple as installing a smartphone application and getting a full stack visibility of your security posture, meaning seeing all of the risk, whether it's vulnerability, misconfiguration, lateral movement risk, work that already been compromised, and more and more, literally in minutes without deploying any agent, without running any network scanners, literally with no change. And while it sounds to many of us like it can't happen, it's snake oil, it's simply because we are so used to on premise environment where it simply wasn't possible in physical server, but it is possible in the cloud. >> Yeah, and you know, we've had many (indistinct) on theCUBE over the years. One (indistinct) told us that, and this is a direct quote, I'll find the clip and share it on Twitter, but he said, "The cloud is more secure than on premise, because it's more changes going on." And I asked him, "Okay, how'd you do?" He says, "It's hard, you got to stay on top of it." A lot of people go to the cloud, and they see some security benefits with the scale. But there are gaps. You guys are building something that solves those gaps, those blind spots, because of things are always changing, you're adding more services, sometimes you're integrating, you now have containers that could have, for instance, you know, malware on it, gets introduced into a cluster, all kinds of things can go on in a cloud environment, that was fine yesterday, you could have a production cluster that's infected. So you have all of these new things. How do you figure out the gaps and the blind spots? That's what you guys do, I believe, what are the gaps in cloud security? Share with us. >> So definitely, you're completely correct. You know, I totally agree the cloud can be dramatically more secluded on-prem. At the end of the day, unlike an on-prem data center, where someone can can plug a new firewall, plug a new switch, change things. And if you don't instrument, it won't see what's inside. This is not possible in the cloud. In the cloud it's all code. It's all running on one infrastructure that can be used for the instrumentation. On the other hand, the cloud enabled businesses to act dramatically faster, by say dramatically, we're talking about order of magnitude faster, you can create new networks in matter of minutes, workloads can come and go within seconds. And this creates a lot of changes that simply haven't happened before. And it involves a lot of challenges, also from security instrumentation point of view. And you cannot use the same methodologies that you used for the on-prem because if you use them, you're going to lose, they were a compromise, that worked for certain physics, certain set of constraints that no longer apply. And our thesis is that essentially, you need to use the capabilities of the cloud itself, for the instrumentation of everything that can runs on the cloud. And when you do that, by definition, you have full coverage, because if it's run on the cloud, it can be instrumented on cloud, this essentially what Docker does. And you're able to have this full visibility for all of the risks and the importance because all of them, essentially filter workload, which we're able to analyze. >> What are some of the blind spots in the public cloud, for instance. I mean, that you guys are seeing that you guys point out or see with the software and the services that you guys have. >> So the most common ones are the things that we have seen in the last decades. I don't think they are materially different simply on steroids. We see things, services that are launched, nobody maintained for years, using things like improper segmentation, that everyone have permission to access everything. And therefore if one environment is breached, everything is breached. We see organization where something goes dramatically hardened. So people find a way to a very common thing is that, and now ever talks about CIM and the tightening their permission and making sure that every workload have only the capabilities that they need. But sometimes developers are a bit lazy. So they'll walk by that, but also have keys that are stored that can bypass the entire mechanism that, again, everyone can do everything on any environment. So at the end of the day, I think that the most common thing is the standard aging issues, making sure that your environment is patched, it's finger tightened, there is no alternative ways to go to the environment, at scale, because the end of the day, they are destined for security professional, you need to secure everything that they can just need to find one thing that was missed. >> And you guys provide that visibility into the cloud. So to identify those. >> Exactly. I think one of the top reasons that we implemented Orca using (indistinct) technology that I've invented, is essentially because it guarantees coverage. For the first time, we can guarantee you that if you scan it, that way, we'll see every instance, every workload, every container, because of its running, is a native workload, whether it's a Kubernetes, whether it's a service function, we see it all because we don't rely on any (indistinct) integration, we don't rely on friction within the organization. So many times in my career, I've been in discussion with customer that has been breached. And when we get to the core of the issue, it was, you couldn't, you haven't installed that agent, you haven't configured that firewall, the IPS was not up to date. So the protections weren't applied. So this is technically true, but it doesn't solve the customer problem, which is, I need the security to be applied to all of my environment, and I can't rely on people to do manual processes, because they will fail. >> Yeah, yeah. I mean, it's you can't get everything now and the velocity, the volume of activity. So let me just get this right, you guys are scanning container. So the risk I hear a lot is, you know, with Kubernetes, in containers is, a fully secure cluster could have a container come in with malware, and penetrate. And even if it's air gapped, it's still there. So problematic, you would scan that? Is that how it would work? >> So yes, but so for nothing but we are not scanning only containers, the essence of Orca is scanning the cloud environment holistically. We scan your cloud configuration, we scan your Kubernetes configuration, we scan your Dockers, the containers that run on top of them, we scan the images that are installed and we scan the permission that these images are one, and most importantly, we combined these data points. So it's not like you buy one solution that look to AWS configuration, is different solution that locate your virtual machines at one cluster, another one that looks at your cluster configuration. Another one that look at a web server and one that look at identity. And then you have resolved from five different tools that each one of them claims that this is the most important issue. But in fact, you need to infuse the data and understand yourself what is the most important items or they're correlated. We do it in an holistic way. And at the end of the day, security is more about thinking case graphs is vectors, rather than list. So it is to tell you something like this is a container, which is vulnerable, it has permission to access your sensitive data, it's running on a pod that is indirectly connected to the internet to this load balancer, which is exposed. So this is an attack vector that can be utilized, which is just a tool that to say you have a vulnerable containers, but you might have hundreds, where 99% of them are not exposed. >> Got it, so it's really more logical, common sense vectoring versus the old way, which was based on perimeter based control points, right? So is that what I get? is that right is that you're looking at it like okay, a whole new view of it. Not necessarily old way. Is that right? >> Yes, it is right, we are looking at as one problem that is entered in one tool that have one unified data model. And on top of that, one scanning technology that can provide all the necessary data. We are not a tool that say install vulnerability scanner, install identity access management tools and infuse all of the data to Orca will make sense, and if you haven't installed the tools to you, it's not our problem. We are scanning your environment, all of your containers, virtual machine serverless function, cloud configuration using guard technology. When standard risk we put them in a graph and essentially what is the attack vectors that matter for you? >> The sounds like a very promising value proposition. if I've workloads, production workloads, certainly in the cloud and someone comes to me and says you could have essentially a holistic view of your security posture at any given point in that state of operations. I'm going to look at it. So I'm compelled by it. Now tell me how it works. Is there overhead involved? What's the cost to, (indistinct) Australian dollars, but you can (indistinct) share the price to would be great. But like, I'm more thinking of me as a customer. What do I have to do? What operational things, what set up? What's my cost operationally, and is there overhead to performance? >> You won't believe me, but it's almost zero. Deploying Orca is literally three clicks, you just go log into the application, you give it the permission to read only permission to the environment. And it does the rest, it doesn't run a single awkward in the environment, it doesn't send a single packet. It doesn't create any overhead we have within our public customer list companies with a very critical workloads, which are time sensitive, I can quote some names companies like Databricks, Robinhood, Unity, SiteSense, Lemonade, and many others that have critical workloads that have deployed it for all of the environment in a very quick manner with zero interruption to the business continuity. And then focusing on that, because at the end of the day, in large organization, friction is the number one thing that kills security. You want to deploy your security tool, you need to talk with the team, the team says, okay, we need to check it doesn't affect the environment, let's schedule it in six months, in six months is something more urgent then times flybys and think of security team in a large enterprise that needs to coordinate with 500 teams, and make sure it's deployed, it can't work, Because we can guarantee, we do it because we leverage the native cloud capabilities, there will be zero impact. This allows to have the coverage and find these really weak spot nobody's been looking at. >> Yeah, I mean, this having the technology you have is also good, but the security teams are burning out. And this is brings up the cultural issue we were talking before we came on camera around the cultural impact of the security assessment kind of roles and responsibilities inside companies. Could you share your thoughts on this because this is a real dynamic, the people involved as a people process technology, the classic, you know, things that are impacted with digital transformation. But really the cultural impact of how developers push code, the business drivers, how the security teams get involved. And sometimes it's about the security teams are not under the CIO or under these different groups, all kinds of impacts to how the security team behaves in context to how code gets shipped. What's your vision and view on the cultural impact of security in the cloud. >> So, in fact, many times when people say that the cloud is not secure, I say that the culture that came with the cloud, sometimes drive us to non secure processes, or less secure processes. If you think about that, only a decade ago, if an organization could deliver a new service in a year, it would be an amazing achievement, from design to deliver. Now, if an organization cannot ship it, within weeks, it's considered a failure. And this is natural, something that was enabled by the cloud and by the technologies that came with the cloud. But it also created a situation where security teams that used to be some kind of a checkpoint in the way are no longer in that position. They're in one end responsible to audit and make sure that things are acting as they should. But on the other end, things happen without involvement. And this is a very, very tough place to be, nobody wants to be the one that tells the business you can't move as fast as you want. Because the business want to move fast. So this is essentially the friction that exists whether can we move fast? And how can we move fast without breaking things, and without breaking critical security requirements. So I believe that security is always about a triode, of educate, there's nothing better than educate about putting the guardrails to make sure that people cannot make mistakes, but also verify an audit because there will be failures in even if you educate, even if you put guardrails, things won't work as needed. And essentially, our position within this, triode is to audit, to verify to empower the security teams to see exactly what's happening, and this is an enabler for a discussion. Because if you see what are the risks, the fact that you have, you know, you have this environment that hasn't been patched for a decade with the password one to six, it's a different case, then I need you to look at this environment because I'm concerned that I haven't reviewed it in a year. >> That's exactly a great comment. You mentioned friction kills innovation earlier. This is one friction point that mismatch off cadence between ownership of process, business owners goals of shipping fast, security teams wanting to be secure. And developers just want to write code faster too. So productivity, burnout, innovation all are a factor in cloud security. What can a company do to get involved? You mentioned easy to deploy. How do I work with Orca? You guys are just, is it a freemium? What is the business model? How do I engage with you if I'm interested in deploying? >> So one thing that I really love about the way that we work is that you don't need to trust a single word I said, you can get a free trial of Orca at website orca.security, one a scan on your cloud environment, and see for yourself, whether there are critical ways that were overlooked, whether everything is said and there is no need for a tool or whether they some areas that are neglected and can be acted at any given moment (indistinct) been breached. We are not a freemium but we offer free trials. And I'm also a big believer in simplicity and pricing, we just price by the average number workload that you have, you don't need to read a long formula to understand the pricing. >> Reducing friction, it's a very ethos sounds like you guys have a good vision on making things easy and frictionless and sets that what we want. So maybe I should ask you a question. So I want to get your thoughts because a lot of conversations in the industry around shifting left. And that's certainly makes a lot of sense. Which controls insecurity do you want to shift left and which ones you want to shift right? >> So let me put it at, I've been in this industry for more than two decades. And like any industry every one's involved, there is a trend and of something which is super valuable. But some people believe that this is the only thing that you need to do. And if you know Gartner Hype Cycle, at the beginning, every technology is (indistinct) of that. And we believe that this can do everything and then it reaches (indistinct) productivity of the area of the value that it provides. Now, I believe that shifting left is similar to that, of course, you want to shift left as much as possible, you want things to be secure as they go out of the production line. This doesn't mean that you don't need to audit what's actually warning, because everything you know, I can quote, Amazon CTO, Werner Vogels about everything that can take will break, everything fails all the time. You need to assume that everything will fail all the time, including all of the controls that you baked in. So you need to bake as much as possible early on, and audit what's actually happening in your environment to find the gaps, because this is the responsibility of security teams. Now, just checking everything after the fact, of course, it's a bad idea. But only investing in shifting left and education have no controls of what's actually happening is a bad idea as well. >> A lot of people, first of all, great call out there. I totally agree, shift left as much as possible, but also get the infrastructure and your foundational data strategies, right and when you're watching and auditing. I have to ask you the next question on the context of the data, right, because you could audit all day long, all night long. But you're going to have a pile of needles looking for haystack of needles, as they say, and you got to have context. And you got to understand when things can be jumped on. You can have alert fatigue, for instance, you don't know what to look at, you can have too much data. So how do you manage the difference between making the developers productive in the shift left more with the shift right auditing? What's the context and (indistinct)? How do you guys talk about that? Because I can imagine, yeah, it makes sense. But I want to get the right alert at the right time when it matters the most. >> We look at risk as a combination of three things. Risk is not only how pickable the lock is. If I'll come to your office and will tell you that you have security issue, is that they cleaning, (indistinct) that lock can be easily picked. You'll laugh at me, technically, it might be the most pickable lock in your environment. But you don't care because the exposure is limited, you need to get to the office, and there's nothing valuable inside. So I believe that we always need to take, to look at risk as the exposure, who can reach that lock, how easily pickable this lock is, and what's inside, is at your critical plan tools, is it keys that can open another lock that includes this plan tools or just nothing. And when you take this into context, and the one wonderful thing about the cloud, is that for the first time in the history of computing, the data that is necessary to understand the exposure and the impact is in the same place where you can understand also the risk of the locks. You can make a very concise decision of easily (indistinct) that makes sense. That is a critical attack vector, that is a (indistinct) critical vulnerability that is exposed, it is an exposed service and the service have keys that can download all of my data, or maybe it's an internal service, but the port is blocked, and it just have a default web server behind it. And when you take that, you can literally quantize 0.1% of the alert, even less than that, that can be actually exploited versus device that might have the same severity scores or sound is critical, but don't have a risk in terms of exposure or business impact. >> So this is why context matters. I want to just connect what you said earlier and see if I get this right. What you just said about the lock being picked, what's behind the door can be more keys. I mean, they're all there and the thieves know, (indistinct) bad guys know exactly what these vectors are. And they're attacking them. But the context is critical. But now that's what you were getting at before by saying there's no friction or overhead, because the old way was, you know, send probes out there, send people out in the network, send packers to go look at things which actually will clutter the traffic up or, you know, look for patterns, that's reliant on footsteps or whatever metaphor you want to use. You don't do that, because you just wire up the map. And then you put context to things that have weights, I'm imagining graph technologies involved or machine learning. Is that right? Am I getting that kind of conceptually, right, that you guys are laying it out holistically and saying, that's a lock that can be picked, but no one really cares. So no one's going to pick and if they do, there's no consequence, therefore move on and focus energy. Is that kind of getting it right? Can you correct me where I got that off or wrong? >> So you got it completely right. On one end, we do the agentless deep assessment to understand your workloads, your virtual machine or container, your apps and service that exists with them. And using the site scanning technology that some people you know, call the MRI for the cloud. And we build the map to understand what are connected to the security groups, the load balancer, the keys that they hold, what these keys open, and we use this graph to essentially understand the risk. Now we have a graph that includes risk and exposure and trust. And we use this graph to prioritize detect vectors that matters to you. So you might have thousands upon thousands of vulnerabilities on servers that are simply internal and these cannot be manifested, that will be (indistinct) and 0.1% of them, that can be exploited indirectly to a load balancer, and we'll be able to highlight these one. And this is the way to solve alert fatigue. We've been in large organizations that use other tools that they had million critical alerts, using the tools before Orca. We ran our scanner, we found 30. And you can manage 30 alerts if you're a large organization, no one can manage a million alerts. >> Well, I got to say, I love the value proposition. I think you're bringing a smart view of this. I see you have the experience there, Avi and team, congratulations, and it makes sense of the cloud is a benefit, it can be leveraged. And I think security being rethought this way, is smart. And I think it's being validated. Now, I did check the news, you guys have raised significant traction as valuation certainly raised around the funding of (indistinct) 10 million, I believe, a (indistinct) Funding over a billion dollar valuation, pushes a unicorn status. I'm sure that's a reflection of your customer interaction. Could you share customer success that you're having? What's the adoption look like? What are some of the things customers are saying? Why do they like your product? Why is this happening? I mean, I can connect the dots myself, but I want to hear what your customers think. >> So definitely, we're seeing huge traction. We grew by thousands of percent year over year, literally where times during late last year, where our sales team, literally you had to wait two or three weeks till you managed to speak to a seller to work with Orca. And we see the reasons as organization have the same problems that we were in, and that we are focusing. They have cloud environments, they don't know their security posture, they need to own it. And they need to own it now in a way which guarantees coverage guarantees that they'll see the important items and there was no other solution that could do that before Orca. And this is the fact. We literally reduce deployment (indistinct) it takes months to minutes. And this makes it something that can happen rather than being on the roadmap and waiting for the next guy to come and do that. So this is what we hear from our customers and the basic value proposition for Orca haven't changed. We're providing literally Cloud security that actually works that is providing full coverage, comprehensive and contextual, in a seamless manner. >> So talk about the benefits to customers, I'll give you an example. Let's just say theCUBE, we have our own cloud. It's growing like crazy. And we have a DevOps team, very small team, and we start working with big companies, they all want to know what our security posture is. I have to go hire a bunch of security people, do I just work with Orca, because that's the more the trend is integration. I just was talking to another CEO of a hot startup and the platform engineering conversations about people are integrating in the cloud and across clouds and on premises. So integration is all about posture, as well, too I want to know, people want to know who they're working with. How does that, does that factor into anything? Because I think, that's a table stakes for companies to have almost a posture report, almost like an MRI you said, or a clean (indistinct) health. >> So definitely, we are both providing the prioritized risk assessment. So let's say that your cloud team want to check their security, the cloud security risk, they'll will connect Orca, they'll see the (indistinct) in a very, very clear way, what's been compromised (indistinct) zero, what's in an imminent compromise meaning the attacker can utilize today. And you probably want to fix it as soon as possible and things that are hazardous in terms that they are very risky, but there is no clear attack vectors that can utilize them today, there might be things that combining other changes will become imminent compromise. But on top of that, when standard people also have compliance requirements, people are subject to a regulation like PCI CCPA (indistinct) and others. So we also show the results in the lens of these compliance frameworks. So you can essentially export a report showing, okay, we were scanned by Orca, and we comply with all of these requirements of SOC 2, etc. And this is another value proposition of essentially not only showing it in a risk lens, but also from the compliance lens. >> You got to be always on with security and cloud. Avi, great conversation. Thank you for sharing nice knowledge and going deep on some of the solution and appreciate your conversation. Thanks for coming on. >> Thanks for having me. >> Obviously, you are CEO and co founder of Orca Security, hot startup, taking on security in the cloud and getting it right. I'm John Furrier with theCUBE. Thanks for watching. (calm music)

>> Announcer: From Austin, Texas it's theCube, covering Pure Storage Accelerate 2019. Brought to you by Pure Storage. >> Howdy from Austin, Lisa Martin with Dave Vellante we are on day one of our coverage of Pure Accelerate 2019. Welcoming a couple of guests to theCube. One is an alumni, Nathan Hall, VP of America's Systems Engineering from Pure, Nathan welcome back to theCube. >> Thanks, thanks very much. >> Lisa: And you brought a buddy from Cisco. We have Tom Sutliff, director of systems engineering and the America's data center, welcome to the Cube Tom. >> Thanks for having me. >> Dave: It's howdy you all. >> Howdy you all, okay. Thank you, it took the wicked smart guy from Boston to figure that out. >> A local. >> All right, so you all, let's talk about Cisco and Pure, you guys have been partners now since, Nathan we were chatting, since about the IPO, about four years ago. Let's start with you Nathan, our Pure guy. The Cisco, Pure partnership evolution, better together? What have you done over those last five years that sets you up for another first that you're going to share with us today? >> Sure, so it's a deep relationship that's only getting deeper and it's really at all levels. It starts with the executive alignment and think about Charlie Giancarlo from Cisco we've got a lot of just common, cross pollination there. But now it extends, certainly the field level, Tom and I are doing a lot of planning together in terms of having our teams go after common use cases. But now it extends to engineering as well, we had a UCS director plugin that we've had for some time now but Pure is now first in terms of having integration into Cisco intersight, so we are first and only to have storage integration of the Cisco intersight so that Cisco and Pure customers can really manage their environment from one console, so a lot of simplicity, just single SaaS interface for managing everything. >> Tom why Pure, why first with them? >> Well you know Nathan he articulated it well, we can look at the executive level, we talked about Charlie, but even, you know all of our Cisco executives but also to the engineering. We started really strong with the field sales teams but even if you look at the little things that our customers notice but a lot of people may not like the internal development of validated design guides, use cases. We churn them out with Pure as our top ecosystem partner, more than anybody and there's a lot of work being done, our customers see that and it's really helped drive our goal to market together it's really a very strong strategy. >> So there's a CVD around this is that right? >> Yeah there's many there's 22 right now and we're churning them out about one or two a quarter. With some vendors we might put out some initially we might do one or two things well, we do a lot of things well I guess you could say we do 22 things well with the CVD's but more than that. >> So this really started in the field if I understand correctly is that right? [Nathan] - Yes. >> So I always look for these deals and say is it a Barney deal, you know Barney deal I love you, you love me. And if there's real engineering going on then you say okay it's beyond a Barney deal. So it starts in the field with what, hey we should you know a customer wants us to work together and then how does the partnership evolve into where you're putting engineering resources and what does that look like? >> I think a lot of it evolves from just showing progress and showing success. If you look at, we just have a lot of common goals and from a portfolio perspective we fill in a lot of each others gaps so that's really where it started was having the success in the field and that drove, we should actually make greater investments in terms of engineering development, those 22 CVD's, the intersight integration, et cetera. >> So we were talking earlier about CI, HCI for audience members who it's kind of nuanced, how do you guys look at the intersection of those two? >> I say it's another better together story, for example we have a recent joint customer win where essentially across their entire SAP landscape we have Cisco hyper flex the HX managing the database portion, we have FlashStack with Pure Storage managing the Hanna portion, and really it all comes down to single console which is intersight. So we're really able to provide the best type of infrastructure for the right workload at the right time but all make it look like one single experience to the customer. >> So from a customer conversation perspective let's go back to you know we've talked about now this exciting new first engineering alignment. Going back to the field where customers have a multitude of workloads, SAP, Oracle, Microsoft, FEEdi, and there's FlashStack like 31 flavors of FlashStack right. What's that conversation like in terms of CI versus HCI when you guys come into play? Obviously FlashStack being I mentioned a number of flavors of that have been around for awhile, how do you help the customers determine what infrastructure is optimal for their workloads and their business objectives? >> You know there's a clear delineation between a hyper convergence, our HX platform, a hyper flex platform, and the converged infrastructure that we have with FlashStacks. If you look at a FlashStack it's an all in one solution, compute, fabric, storage. It's more for tier one apps, something that's you know scalable, something that's a highly dense tier one application. Latency obviously plays into this you know, I'd say it's a little less with the hyper flex platform and hyper convergence, much easier to stand up, much quicker to stand up within a half an hour. It's a storage play it does many of the similar same things but you know we're kind of closing the gap on both of them because even what you would call that smaller platform that started off at more tier one, excuse me tier two and tier three is now moving into the tier one space so. But it's really about scalability, ease of use, some of them are stronger in some markets like maybe a higher enterprise. But we can sell them across anywhere whether it be public sector, commercial, mid market, smaller customers. But they each have use cases that they fit in very well. >> This morning in the key notes we heard a lot about API's, I want to get into Multi Cloud in a second but before I do we talk a lot about infrastructures code, DevOps, we heard a lot about Kubernetes, a little bit about Kubernetes this morning. And the Cisco DevNet I've often said on theCUBE that they're the only large established company that's figured out how to do something for developers. Now does your partnership extend into sort of infrastructures code, how does that all sort of go through? Is DevNet a play here or even on the roadmap? >> Nathan: So from DevNet can you take that one? >> Well I can say yes it is a play, if you take a look at all of our solutions, primarily the compute and the fabric solutions, programmability is really a key function that we have and the customers can go in and they can actually working with our API's, API's that we work with separate with other vendors too that are dedicated to other vendors. It is a key thing and DevNet became to the forefront probably about five years ago and it was really built off of that development effort so that's critical for us going forward here there's a lot that we're doing I know we're going to talk about intersight and some other things where that was a key element of it. >> Yeah so this is important. You were at Cisco Live. >> And Cisco DevNet. >> And we were in the DevNet zone and you remember, you had many many booths, very specialized, then you have CCIE's learning python, learning how to program infrastructure for new use cases, edge comes in. Anything you'd add Nathan to sort of programmability? >> So I think just from day one from Pure Storage just having our restful API interface, having code.purestorage.com we've tried to make it as much automatable as possible, as easy for to really create a community of developers that can create these integrations very quickly, and honestly evidence of that is in intersight itself. How quickly we got that integration happening is because of that restful API interface. We were able to take the kind of AI Ops of Pure One and bring it into intersight, be able to get intersight to talk to Pure Storage very easily because of that strength of API first. >> What do we need to know about intersight? Add some color there, what is it, how's it work, what's the kind of history and how do you guys turn what you're doing in integration into customer value? >> So if I look at, going back to your comments around why converge versus hyper converge, it's often really a story of simplicity right? Customers want something simple for the data center, they know they can get it out in the Cloud but they can't always run their workloads out in the external Cloud. So simplicity is for intersight, no matter what it is, if it's converged or hyper converged, if it's Pure Storage, being able to have single interface to monitor your infrastructure, lifecycle it, to get really specific imagine a VMware administrator is able to in that single console, provision storage from Pure to a UCS server, format it for VMware ESX and VMFS, and in that single console so doesn't have to go to a bunch of different consoles, gets that Cloud like experience and that's what intersight delivers. So you get that simplicity whether its converged or hyper converged with intersight. >> Whether it's in the Cloud, it's the Edge, it's the Branch, Hybrid Cloud, instead of having to manage it I think that Nathan just hit on these single clusters of storage, compute, what have you. These can all be managed from one single console world wide no matter where they sit. >> So I want to talk about Multi Cloud if we can. So if I look at the players in Multi Cloud, the big whales, VMware, Red Hat, Google, Microsoft, and Cisco, you partner with all of those pretty much I think. AWS is not on the list but you figure they're kind of the facto part of the Multi Cloud scene but they're not going after Multi Cloud, Cisco was a relatively new entrant there. You got companies that have a Cloud like Microsoft and Google that want to participate, you've got companies that don't have a Cloud like Cisco that want to participate, where does Pure fit in to that Multi Cloud opportunity and how does it relate to the partnership? >> Well I think where we found a solid partnership with Cisco and Multi Cloud is the same approach to Multi Cloud and that is I'd call it open Multi Cloud. As opposed to having, forcing a single type of hyper visor on one side or a single Cloud, external Cloud on the other side, how do we make certain that our customers can run any app, anywhere? How do we appear and provide the data fabric having the most efficient amenity of fabric out there to kind of get around the data gravity problems of moving workloads, and we do that now with Pure Flash right on premises, Cloud block store out in the Cloud, our ability to Cloud snap to Azure, to AWS, and that's part of the story. The other part of the story is the fabric and the compute. So with ACI anywhere really that compeletes the any workload anywhere story, and keeping it open so it's not just one hyper visor or one Cloud provider on the other side. >> So you be the data plane in that equation, with the management of that data plane, and Cisco is the overall management framework the control plane I guess we could call that. Is that the right way to think about it? >> I'd say part of the control plane and the network fabric as well, and we're part of essentially the consistent data services no matter where you go. So really upleveling for example EBS to an enterprise grade of storage that it wasn't before, now we have something that whether you're on hardware on premises or in the cloud, you can run that monolithic application in places you couldn't do it before. >> So let's look at this in the real world in a customer environment, talk to me about whatever kind of whether it's a bank or an airline or what have you, what are the business benefits that, we'll use delta Airlines as an example, what would they get out of this if they think of all of the things that they need to achieve internally and be able to deliver to their customers? What's that you know TCO, ROI, what are all those sexy things that you guys are delivering? >> So I'd say they get essentially a lot of the barriers to getting the TCO you want for a given workload are based on compatibility. Maybe you want to run it out in Amazon but you can't get it there because it's this massive monolithic gap, the sync would take days, the SLA out there isn't quite what you want. Now being able to provide a consistent experience no matter where that data plane is, you get that choice. You can go and evaluate AWS or Azure and say that's ultimately the right TCO for my application and I know it could run out there because I've essentially standardized my data fabric anywhere, and it's the same story essentially now with ACI anywhere as well. So the ability to keep essentially the fundamental elements of the application, the infrastructure around it consistent no matter where it is, freeze that IT decision maker to put it in the right place. You don't have to be constrained by compatibility anymore. >> So internal operations can be dialed way up which means those folks are free to resources to work on other higher value projects, and the customer on the other end who doesn't know any of this stuff is under the hood is getting what they need when they want it. >> Exactly, yeah you can manage if you look at ACI you can manage the automation of the applications across the network fabric again wherever it may be, and there's robustness there, there's telemetry, there's measurements. So instead of just looking at the application you look at the robustness of that on the network and the network here us absolutely critical, none of this is going to run I think as Nathan hit on that it could be in the Cloud, it could be in the Branch, you still want the same level of performance the SLA, the five nines and that's where the network comes in that's what's critical. >> Well and the security piece as well. >> Absolutely. >> You guys are largely coming at the Multi Cloud from of course the network strength that you have but you've also got a security angle there because you can go deep packet inspection and that's a sweet spot for you guys. >> Tom: Absolutely. >> Talk about security and it's importance and so on. >> Well I think the security I mean one of the big plays that we have with ACI and with Tetration is being able to look in literally billions of packets a second and being able to track and make realtime decisions on any type of threat, threat defense that's built right in. So normally obviously you have firewall and you try to keep everything out but a lot of what will happen a lot of the penetration security hack happens inside. So this is able to look at all of the flows, at every single packet the flow of the application and the information to see if there's a threat in real time. It takes a lot of processing power a lot of storage and a lot of capacity but you know that's a Tetration product and it's a huge play, our security team is actually out selling that in addition to the data center teams. >> So is Wallingford Yankee's country or Red Sox country? >> Oh it's right on the border so I've got my in laws Yankee's, my parents Redsox, so it's very difficult at home. >> You're a Pat's fan of course, did you feel dirty watching the game on Sunday or? >> Tom: No not at all. >> Oh you felt good? >> Maybe 19 and O this year we'll see. >> And you're Switzerland in this whole debate? >> I try to be it's hard. >> Well you know this company is Warrior's so we can talk NBA too. >> You bet! >> There's a really interesting NBA season coming up now. Not so much for our team but. (laughter) >> Lisa: You never know! >> You never know. >> I had to try to be Switzerland too cause I was the West Coaster with the East Coaster boss, you know how it goes. So Tom last question for you, whole bunch of announcements that came out of Pure today as we look at all of the partnerships that Pure has we talked about that, that Cisco has as well, what are some of the things that as a partner as a valued strategic partner, that Cisco hears when they hear Pure talking about delivering everything as a service and what they're doing with AI and dialing up things there, what is Ciscos reaction to that news? >> Well the thing with Pure and it preceded this conference but you know I really heard it with the new announcements and Nate and I we have a lot of things we're going to work with our systems engineers on in the Americas, it's just the innovation which is pretty incredible. You know you kind of have the big four products here but primarily with the Flash arrays the CI platforms, the Flash blades, what's going on with Pure one, that's going to be critical going forward and we have very similar messages with Multi Cloud. We talked about the validated designs, this is really going to lead us to almost like it's kind of funny when you have an innovative partner you can do reboots every year and people don't think you're just throwing work at them or what have you. It's like now we really innovated again, 12, 15 months later we're going to hit this again and come at it. And so Pure is probably one of the only partners we have that type of relationship with. >> Alright well guys thank you so much for joining Dave and me on theCUBE today we appreciate it. We look forward to following the evolution of this Cisco Pure partnership, thanks for your time. >> Thank you. >> Thank you guys. >> For Dave Vellante, I'm Lisa Martin, you're watching theCUBE ya'll from Pure Accelerate in Austin, Texas. (upbeat music)

(dramatic music) >> Hey, welcome back everybody. Jeff Frick here with theCUBE. We're in our Palo Alto studio for a CUBE conversation. It's really a great thing that we like to take advantage of. A little less hectic than the show world and we're right in the middle of all the shows, if you're paying attention. So we're happy to have a CUBE alumni on. He's been on many, many times. Saar Gillai , he's now the CEO of Teridion. And Saar, welcome. I don't think we've talked to you since you've been in this new role. >> Yeah, it's been about a year I think. >> Been 'about a year. So give us kind of the update on Teridion. What it's all about and really more importantly, what attracted you to the opportunity? >> Sure. First of all, great to be here. I don't know where John is. I'm looking for him. He ran away. Maybe he knew I was coming. >> Somewhere over the Atlantic I think. 35,000 feet. >> I'll follow up on that later but hey, you're here. So, you know Teridion, let's talk about maybe the challenge that Teridion is addressing first so people will understand that, right. So if you look about what's going on these days with the advent of Cloud. and how people are really accessing stuff, things have really moved in the past. Most of the important services that people access were in a data center and were accessed through the LAN so the enterprise had control over them and if you wanted to access an app, if it didn't work, somebody when into the LAN, played around with some CISCO router and things maybe got better. >> But at least you had control. >> You had control and if you look at what's happened over the last decade, but certainly in the last five years, with SAS and the Cloud. Stating the obvious, more and more of your services now are actually being accessed through your WAN and in many cases, that actually means the internet itself. If you're accessing Salesforce or Box or Ignite or any of these services. The challenge with that is that now means that a critical part of your user experience, you don't control. The vendor doesn't control because you can make the best SAS up in the world but, and those apps are increasingly very dynamic. Caching doesn't solve this problem and the problem is now, okay, but I'm experiencing it over the internet. And while the internet is a great tool obviously, it's not really built for reliabilty, consistency, and consistent speed. Reality, if you look at the internet, it was designed to sent one packet to NORAD and tell them that some nuclear missile died somewhere. That's what it was designed for right? So the packet will get there but the jitter and all these things may work and so what happens is that, now you have a consistency problem. Historically, people will say well, that's all been addressed through traditional caching and that's true. Caching still has it's place. The reality is though that caching is more for stuff that doesn't change a lot and now, it's all very dynamic. If you're uploading a file, that's not a caching activity. If you're doing something in Salesforce, it's very dynamic. It's not cached. At Teridion, we looked at this problem. Teridion's been around about four years. I've been there for about a year. We felt that the best way to solve this problem was actually to leverage some of the Cloud technology that already exists to solve it. So what we do, actually, is we build an overlay network on top of the public Cloud surface area. So instead of traditionally, the way people did things is they would build a network themselves but today the public Cloud guys honestly are spending gazillions of dollars building infrastructure. Why not leverage it the same way that you don't buy CPUs, why buy routers? What we do is we create a massive overlay network on demand on the public Cloud surface area. And public Cloud means not just Amazon or Google but also people like AliCloud, DigitalOcean, Vulture, any Cloud provider really, some Russian Cloud providers. And then we monitor the internet conditions and then we build a fast path. If you think about it almost like a ways, a fast path for your packet from wherever the customer is to your service thereby dramatically increasing the speed but also providing much higher reliabilty. >> So, lot of thoughts. If I'm hearing right, you're leveraging the public Cloud infrastructure so they're pipes, if you will. >> And they're CPUs. >> And they're CPUs but then you're putting basically waypoints on that packet's journey to reroute to a different public Cloud infrastructure for that next leg if that's more appropriate. >> Yeah, and basically what I'm doing is I'm basically just saying if there's a, if your server's here whether they're on a public Cloud or somewhere else, it doesn't matter, and a customer is here, through some redirection, I will create a router on a public Cloud so a soft router, somewhere close from a network perspective to a user and somewhere close to the server and then between them, I'll create an overlay fast path. And then, what is goes over will be based on whatever the algorithm figures out. The way we know where to go over is we also have a sensor network distributed throughout the public Cloud surface areas and it's constantly creating a heat map of where there's capacity, where there's problems, where there's jitter and we'll create a fast path. Typically that fast path will give you, one of the challenges, I'll give you an example. So let's say you're on Comcast and let's say you've got 40 meg let's say, your connection at home. And then you connect to some server and theoretically that server has much more, right? But reality is, when you do that connection, it's not going to be 40 meg. Sometimes it's 5 meg, okay? So we'll typically give you almost your full capacity that you have from your first provider all the way there by creating this fast path. >> So how does it compare, we hear things about like Direct Connect between Equinix and Amazon or a lot of peer relationships that get set up. How does what you're doing kind o' compare, contrast, play, compare to those solutions? >> Direct Connect is sort of a static connection. If you have an office and you want to have a Direct Connection, it's got advantages and it's useful in certain areas. Part of the challenge there is that first of all, it has a static capacity. It's static and it has a certain capacity. What we do, because it's completely software oriented, is we'll create a connection and if you want more capacity, we'll just create more routers. So you can have as much capacity as you want from wherever you want where with Direct Connect, you say I want this connection, this connection, this much capacity and it's static. So if you have something very static, then that may be a good solution for you but if you're trying to reach people at other places and it's dynamic, and also you want variable capacities. For example, let's say you say I want to pay for what I use. I don't want to pay for a line. Historically, when you're using these things, you say okay, if the maximum I may want is 40 meg, you say okay, give me a 40 meg line. That's expensive. >> Right, right. >> But what if you say I want 40 meg only for a few hours a day right? So in my case, you just say look, I want to do this many terabytes. And if you want to do it at 40 meg, do it at 40 meg. It doesn't matter. So it's much more dynamic and this lends itself more to the modern way of people thinking of things. Like the same way you used to own a server and you had to buy the strongest server you needed for the end of the month because maybe the finance guy needed to run something. Today you don't do that right? You just go to public Cloud and when it's the end of the month, you get more CPUs. We're the same thing. You just set a connection. If you need more capacity, then you'll get more capacity that you need. We had a customer that we were working with that was doing some mobile stuff in China and all of a sudden, they needed to do 600,000 connections a minute from China. And so we just scaled up. You don't have to preconfigure any of this stuff. >> Right, right. So that's really where you make the comparison of public Cloud for networking because you guys are leveraging public Cloud infrastructure, you're software based so that you can flex so you don't have the old model. >> It's completely elastic, like I said. It's very similar. Our view is the compute in the last decade, obviously, compute has moved from a very static I own everything mode to let's use dynamic resources as much as possible. Of course, there's been a lot of advantage to that. Why wouldn't your connectivity, especially your connectivity outside which is increasing your connectivity also use that paradigm. Why do you need to own all this stuff? >> Right, right. As you said before we turned the cameras on the value proposition to your customers who are the people that basically run these big apps, is the fact that they don't have to worry about that but net is just flat out faster to execute the simple operations like uploading or downloading something to BOX. >> And again, you mentioned BOX, they're one of our big customers and we have a massive network if you thing about how much BOX uploads in a given day, right? 'Cause there's a lot of there traffic that goes through us. But if you think about these SAS providers, they really need to focus on making their app as good as possible and advancing it and making it as sophisticated as possible and so, the problem is then there's this last edge which is from their server all the way to the customer, they don't really control. But that is really important to the customer experience, right? If you're trying to upload something to BOX or trying to use some website and it's really slow, your user experience is bad. It doesn't matter if it's the internet's fault. You're still as a customer, So this gives them control. They give us that ability and then we have control that we can give it much faster speed. Typically in the US, it may be two to five times faster. If you're going outside the US, it could be much faster sometimes. In China, we go 15 times faster. But also, it's consistent and if you have issues, we have a knock, we monitor, we can go look at it. If some customer says I have a problem, right? We'll immediately be able to say okay, here's the problem. Maybe there's a server issue and so forth as opposed to them saying I have a problem and the SAS vendor saying well, it's fine on our side. >> Right, right. So, I'm curious on your go to market. Obviously, you said BOX is a example of a customer. You've got some other ones on the website. Who are these big application service providers, that term came up the other day, like flashback to 1990. 1998 >> I call them SAS >> It's funny, we were talking about the old days. >> To me, it's all the same, as a service guy. >> But then, as you go to market then going to include going out directly through the public Clouds in some of their exchanges so that basically, I could just buy a faster throughput with the existing service. Where do you go from here? I imagine, who doesn't want faster internet service period? >> Yeah, we started off going to the people who have the biggest challenge and easier to work with a small company right? You want to work with a few big guys. They also help you design your solution, make sure it's good. If you can run BOX and Traffic and Ignite. Traffic can probably handle other things, last year for example. We are looking at potentially providing some of the service, for example, if you're accessing S3 for example, we can access S3 at least three times faster. So we are looking potentially at putting something on the web where you could just go to Amazon and sign up for that. The other thing that we're looking at, which is later in the year, probably is that we haven't gotten a lot of requests from people that said hey, since the WAN is the new LAN, right, and they want to also try to use this technology for their enterprise WAN between branch offices where SD-WAN is sort of playing today, we've gotten a lot of requests to leverage this technology also in SD-WAN and so we're also looking at how that could potentially play out because again, people just say look, why can't I use this for all my WAN connectivity? Why is it only for SAS connectivity? >> Right, right. I mean it makes sense. Again, who doesn't want, the network never goes fast enough, right? Never, never, never. >> It's not only speed. I agree with you but it's not only speed. What you find, what people take for granted in the LAN but they only notice it when now they're running over the LAN is that it's a business critical service. So you want it to be consistent. If it's up, it needs to have latency, jitter, control. It needs to be consistent. It can't be one second it's great, the next second it's bad and you don't know why and visibility. No one's ever had that problem. >> I'm just laughing. I'm thinking of our favorite Comcast here. If they're not a customer, you need to get them on your list. Help make some introductions hopefully. >> So, people take that for granted when they're LAN and then when they move to the Cloud, they just assume that it's going to continue but it doesn't actually work that way. Then they get people from branch offices complaining that they couldn't upload a doc or the sales person was slow and all these problems happen and the bigger issue is, not only is this a problem, you don't have control. As a person providing a service, you want to have control all the way so you can say "yeah, I can see it. "I'm fixing it for you here. "I fixed it for you." And so it's about creating that connection and making it business critical. >> It's just a funny thing that we see over and over and over where cutting edge and brand new quickly becomes expected behavior very, very quickly. The best delivery by the best service, suddenly you have an expectation that that's going to be consistent across all your experiences with all your apps. So you got to deliver that QS. >> Yeah, and I think the other thing that we notice, of course, is because of the explosion of data right? It's true that the internet's capacity is growing but data is growing faster because people want to do more because CPUs are stronger, your handset is stronger and so, so much of it is dynamic. Like I said before, historically, some of this was solved by just let's cache everything. But today, everything is dynamic. It's bidirectional and the caching technology doesn't do that. It's not built for that. It's a different type of network. It's not built for this kind of capacity so as more and more stuff is dynamic, it becomes difficult to do these things and that's really where we play. And again, I think the key is that historically, you had to build everything. But the same way that you have all these SAS providers not building everything themselves but just building the app and then running on top of the public Cloud. The same thing is why would I go build a network when the public Cloud is investing a hundred billion dollars a year in building massive infrastructure. >> Yeah, and they are, big infrastructure. Well Saar, thanks for giving us the update and stopping by and we will watch the story unfold. >> Great to be here. >> Alright. And we'll send John a message. >> I'll have to track him down. >> Alright, he's Saar, I'm Jeff. You're watching theCUBE. It's a CUBE conversation at our Palo Alto Studio. Thanks for watching. We'll see you next time. (dramatic music)

(bright orchestral music) >> John: Hello there and welcome to this special cube conversation, I'm John Furrier, here in theCUBE's Palo Alto studio. We're here with Jonathan Nguyen, who's with, formerly Verizon, now with Fortinet. What's your title? >> Jonathan: Vice President of Strategy. >> John: Vice President of Strategy, but you're really, more of a security guru. You, notably, were the author of the Verizon data breach investigative report. Great report >> Jonathan: Thank you. >> John: It really has been the industry standard. Congratulations, great to have you here. >> Jonathan: Thanks, it was a great 16 years at Verizon in the security business, ran that data breach investigations team. So yeah, that was a great honor in my career. >> John: So you call it "strategy" because they don't want you to word cyber security in your title on LinkedIn in case they spearfish you. Is that right? (laughs) >> Jonathan: Yeah, having started my career as a US Foreign Service Officer, as a victim of the OPM data breach, everything about me is out there. I love in the perfect universe about how do you defend your identity when everything about you has been compromised to begin with. >> John: So many stories I had a Cube guest talk about LinkedIn and the tactics involved in spearfishing and the efforts that people go in to attack that critical resource that's inside a perimeter. This is a big problem. This is the problem with cyber warfare and security and crime. >> Jonathan: Yes. >> John: Talk about that dynamic, because this is, I mean, we always talk about the cloud changes, the perimeter, but of course, more than ever this is really critical. >> Jonathan: So, fundamentally as we begin going into digital transformation and notions about where data is today and the nature of computing, so everything has changed and the notion of a traditional perimeter has changed as well. So I'm going to borrow a great analogy from my friend Ed Amoroso and he said Look, let's pretend that this is your traditional enterprise network and all of your assets are in there, and we all agreed that that perimeter firewall is being probed every day by nation-state actors, organized criminal syndicates, hacktivists, anybody. Everyone's probing that environment. It's also dissolving because you've got staffers inside there using shadow IT, so they're opening up that firewall as well. Then, you've got applications and portals that need to be accessed by your stakeholders, your vendors, your customers. And so that traditional wall is gradually eroding, but yet that's where all of our data is, right? And against this environment you've got this group, this unstoppable force, as Ed calls it, these nation-state actors, these organize crime, these hacktivist groups, all highly sophisticated, and we all agree, that with time and effort, they can all penetrate that traditional perimeter. We know that because that's why we hire pin testers and red-teamers to demonstrate how to get into that network and how to protect that. So, if that's the case that we have this force, and they're going to break in eventually, why are we still spending all of our time and effort to defend this traditional perimeter that's highly vulnerable? Well the answer is, of course, that we need to distribute these work loads, into multiple clouds and into multi-hybrid cloud solutions. The challenge has been, well how do you do that with enough control and visibility and detection as you would have in a traditional perimeter, because a lot of folks just simply don't trust that type of deployment. >> John: That's the state of the art, that's the state of the art problem. How to deal with the complexity of IT as with digital transformation as it becomes so complicated and so important at the same time, yet cloud is also on the horizon and it's here. We see the results with Amazon Web Services. We see what Azur's doing and Google, etc., etc. And some companies are building their own cloud, so you have this new model, with cloud computing, data-driven applications, and it's complex, but does that change the security paradigm? How does the complexity play into it? >> Jonathan: Absolutely, so complexity has always been the enemy of security and at Fortinet, what we essentially do is that we help companies understand and manage complexities to manage risk. So complexity is only going to increase, so digital transformation, the widespread adoption of digital technologies to enable exponential and explosive productivity growth, right? Societal-level changes, right? >> John: Right. >> Jonathan: Also massive expand the inter connective nature of our society. More and more introductions. Accelerated cycles across the board. Greater levels of complexity. The challenge is going to be, not about whether you're moving into the cloud. Everyone is going to move into the cloud, that is the basis of computing moving next. So in the Australian government, the US government, all the agencies have a cloud-first migration initiative. It's not about whether. It's not about, it's really about when, so how do you move forward with moving your computing, your workload into the cloud? In many ways, it goes back to fundamentals about risk management. It's about understanding your users and your systems, the criticality, the applications you're associated with, and understanding what can you move into the cloud and what do you keep on prim in a private cloud as it were. >> John: I want to ask you more about global, more about cyber security, but first let's take a step back and set the table. What is the wholistic and the general trend in cyber security today. I mean, what is the, what's going on in the landscape and what are the core problems people are optimizing for? >> Jonathan: Sure. So, across my 20-odd years in cyber, what we've seen consistently has been the acceleration of the volume, the complexity, and the variety of cyber threats. 10 years ago, 2007 or so, there were about 500 threat factors. Today we're north of 5,000. Back in that point, there were maybe 200 vendors, today we're north of 5,000 vendors. There was less than $1 billion of cyber security spent. Today we're north of $80 billion of spend and yet the same challenges pervade. And what's happening now, they're only becoming more accelerated, so in the threat environment, the criminal environment, the nation-state threat actors, they're all becoming more sophisticated. They're all sharing information. They're sharing TTP and they're sharing in a very highly effective marketplace. The dark web cyber crime marketplace is an effective mechanism on sharing information, on matching threat actors to targets. So the frequency, the variety, the intelligence of attacks, automated ransomware attacks, is only going to grow. Across the board, all of us on this side of the fence, our challenge is going to be, how do we effectively address security at speed and scale. And that's the key because you can effect security very well in very discrete systems, networks, facilities, but how do you do it from the IoT Edge, from the home area network, the vehicle area network, the personal area network, to the enterprise network, then to a hybrid cloud. A highly distributed ecosystem and how do you have visibility and scale across that when the interval of detection between the detonation of malware to the point of irrecoverable damage, is in seconds. >> John: So tons of attack vectors, but also I would add to complicate the situation further is the surface area. You mentioned IoT. >> Jonathan: Yeah. >> John: We've seen examples of IoT increasing, more avenues in. >> Jonathan: Yeah. >> John: Okay, so you've got more surface area, more attack vectors with technology. Malware is one. We've seen that and ransomware certainly number one. But it's not just financial gain, it's also, there's terrorism involved. >> Jonathan: Absolutely. >> John: So, it's not just financial services, get the cash and embarrass a company. It's, I want to take down that power plant. >> Jonathan: Sure. >> John: So, is there a common thread, because you can, I mean, every vertical is going to have their own rendering issues, have their own kind of situation contextually. But is there a common thread across the industry that cyber security is run, is there a baseline that you guys are attacking and that problems are being solved on? Can you talk about that? >> Jonathan: Sure. So, at the heart of that is a convergence of operational technologies and information technology. Operational technologies were never designed to be IP enabled. They were air-gapped. Never designed to be integrated and interconnected with information technology systems. The challenge has been, as you said, is that as you go through digital transformation, become more interconnected, how do you understand when a thermostat has gone offline, or a conveyor belt has gone offline, or a furnace is going out of control, how do you understand that the HVAC system for the operating theater, the surgery theater, is operating properly? Now we have this notion of functional safety and you have to marry that with cyber security and so, in many ways, the traditional approaches are still relevant today. Understanding what systems you have, the users that use them, and what's happening in that and to detect those anomalies and mitigate that in a timely fashion. Those themes are still relevant, it's just that they're much, much larger now. >> John: Let's get back to the perimeter erosion issue because... >> Jonathan: Yeah. >> John: One of the things we're seeing on The Cube is digital transformation, it's out there, to kick around the buzzword, it's out there, but it's certainly, it's relevant. People are transforming to a digital business. Peter Burrows had (unintelligible) they talk about this all the time and it's a lot, a lot involves IT, business process, putting data to work, all that good stuff, transforming the business, drive revenue, but security is more coarse. And sometimes it's, we're seeing it being unbundled from IT and reporting directly up to either the board level or C level. So, that being said, how do you solve this? I'm a digital transformation candidate. I'm doing it. I got, my mind's full of security all the time. How do I solve the security problems, cyber security problem? Just prevention, other things? What's the formula? >> Jonathan: Okay, so at the heart of cyber security is risk management. So digital transformation is the use of digital technology to drive exponential productivity gains across the board and it's about data-driven decision making versus intuitive-led human decision making. So, the heart of digital transformation is making sure that the business leaders have the timely information to make decisions in a much more timely fashion. So that you have better business outcomes and better quality of life, safety, if you will. And so the challenge is about how do you actually enable digital transformation and it comes down to trust. And so, again across the pillars of digital transformation and they are first, IoT, these devices that are connected to collect and share information, to make decisions, the sheer volume of data, zetabytes of data that will be generated in a process of these transactions. Then you have ubiquitous access and you're going to have 5G. You have this notion of centralized and distributed computing. How will you enable those decisions to be made across the board? And then, how do you secure all of that? And so, at the heart of this is the ability to have automated, and that's key, automated deep visibility and control across an ecosystem. So you've got to be able to understand, at machine speed, what is happening. >> John: How do I do that? What do I do? Do I buy a box? Do I, is it a mindset? Is it everything? What's the, how do I stop those cyber attacks? >> Jonathan: So, you need a framework of automated devices that are integrated. So a couple of things you're going to need. You're going to need to have the points across this ecosystem where you can detect. So, whether that is a firewall on that IoT Edge or in the Home or there's an internally segmented firewall, across the enterprise network into the hybrid cloud. You're also going to need to have intelligence and by intelligence, I mean you're going to need a partner who has a global infrastructure of telemetry to understand what's happening in real time, in the wild. And once you collect that data, you're going to need to have intelligence analysts, researchers, that can put into context what that data means, because data doesn't become information on its own. You actively have to have someone analyze that. So you have to have a team. At Fortinet, we have hundreds of people who do just that. And once you have the intelligence, you've got to have a way of utilizing it, right? And so, then you've got a way of orchestrating that intelligence into that large framework of integrated devices so you can act. And in order to do that effectively, you have to do that at machine speed and that's what I mean by speed and scale. The big challenge about security is the ability to have deep visibility and control at speed, at machine speed, and at scale from that IoT Edge way across into the cloud. >> John: Scale's interesting, so I want to ask you about the Fortinet. How are you guys at Fortinet solving this problem for customers because you have to, is it, the totality of the offering? Is it some here, technology here and again, you've got 5,000 attack vectors, you mentioned that earlier and you did the defense report at Verizon, your former job. So you kind of know the landscape. What does Fortinet do? What do you guys, how do you solve that problem? >> Jonathan: So, from day one, every CISO has been trying to build the fabric. We didn't call it that, but from my first packet-filtering firewall to my first stateful firewall, then I deployed intrusion-detection systems and when all that generated far more lists than I can manage, I deployed an SEM. And then I went to intrusion prevention and I had to look at logs, and so I went to an SIEM. And when that didn't work, I deployed Sandbox, which was called dynamic malware inspection back in the day. And then when that didn't work, I had to go to analytics. And then I had to bring in third-party technology, third-party intelligence feeds and all along, I hoped I was able to make those firewalls, those defense sensors, that platform integrated with intelligence, work somehow to detect the attack and mitigate that in real time. Now, what we essentially do in the Fortinet security fabric is we reduce that complexity. We bring that level of automa-... >> John: And by the way, your ad hoc, you're reacting in that mode. You're just, ya know, I got to do this. I got to add that to it. So it's almost like sprawling, software sprawl. You're just throwing solutions at the wall. >> Jonathan: Right, and a lot of that time, no one knows if the devices are properly configured. No one has actually done the third party technology integration. No one has actually met the requirements that we'd employ three years ago through requirements today and the requirements three years from now. And so, that's a huge level of complexity and I think at the heart of that complexity, that's reflected in the fact that we're missing the basic elements in security across today. The reason the large data attacks and the data breaches didn't come because of advanced malware. They didn't happen of nation-state threats. These were known vulnerabilities. The patches existed. They weren't patched. In my experience, 80% of all the attacks could be mitigated through simple to intermediate controls. >> John: Deploying the patches. Doing the job. >> Jonathan: Complexity. Patch management sounds easy. It's hard. Some applications, there is no patch available. You can't take things offline. You have to have virtual patches or unintended consequences. And there are a lot of things that don't happen. There's the handoff between the IT team and the security team and it adds complexity. And if you think about this, if our current teams are so overwhelmed that they cannot mitigate known attacks, exploits against known vulnerabilities, how are they going to be able to grapple with the complexity of managing zetabytes of data with an ecosystem that spans around the world, that operates in milliseconds, where now it's not just digital issues. It's health, safety, physical security. How can we trust that a connected vehicle is secure or not. >> John: Talk about the dynamic between machines and humans because you mentioned patches, and this is, you can argue that it's a human mistake, but also you mentioned automation earlier. The balance between automation, using machines and humans, because prevention and risk management seem to be the axis of the practice. It used to be all prevention, now it's a lot more risk management. There's still a human component in here. >> Jonathan: Yeah. >> John: How are you guys talking about that and how is that rendering itself as a value proposition for customers? >> Jonathan: So, humans are the essence, both the challenge, in so many cases we have faulty passwords, we have bad hygiene. That's why security's awareness training is so critical, right? Because humans are part of the problem, on one end. On the other end, within the sock, humans are grappling with huge amounts of data and trying to understand what is malicious, what needs to be mitigated, and then prioritizing that. For us, it's about helping, the complexity, reducing the complexity of that challenge and helping automate those areas that should be automated so the humans can act better and faster, as it were. >> John: We're here with Jonathan Nguyen with Fortinet. I want to ask you about the ecosystem you mentioned that early and also the role of CISO, the Chief Information Security Officer and CIO, essentially the executives in charge of security. Say you have executives in charge of the risk management, don't get hacked, don't get breached, and also the ecosystem partners. So, you have a very interesting environment right not where people are sharing information, you mentioned that earlier as well. So you got the ecosystem of sharing and you have executives in charge of running their businesses effectively and not have security breaches happen. What's happening in... What are they working on? What are the key things that chief security officers are working on with CIOs? What specifics are on their plate and what's the ecosystem doing around that too? >> Jonathan: Sure. So digital transformation dominates all discussions today. And every CISO has two masters. They have a productivity master, which is always the business-side of the house and they have a security master, which is ensuring that reasonable level of security is, in the advent, managing risk, right? And that's the challenge, how do you balance that? So, across the board, CISOs are being challenged to make sure that the applications, the digital transformation initiatives are actually occurring and at the same time, in the advent of a data breach, understanding the risk and managing the risk. How do you tell your board of directors, your governments that you're not only compliant, but that you have handled risk to a reasonable level of assurance? And that means, in my opinion, across my experience, you've got to be able to demonstrate a couple of things: one, you have identified and adopted, with third-party implementation and attestation, a recommended best practices and controls. Second, you've implemented and used best-in-class products and technologies like Fortinet. Products that have gone through clearances, gone through common criteria, where things are properly certified and that's how you demonstrate a reasonable level. It's really about risk management, understanding what level of risk you will tolerate, what level of risk you will mitigate, and what level of risk you're going to transfer. And I think that's the discussion at the board level today. >> John: So more, make people feel comfortable, but also have a partner that can actually do the heavy lifting on new things. 'Cause there's always going to be a new attack vector out there. >> Jonathan: Absolutely. So I think the key to it is understanding what you're really good at and so then one of the questions I ask ever CISO is that when you look at technology, what is it that your organization is really good at? Is it using technology? Is it operationalizing that experience? Or is it really about ensuring that the firewall is integrated with your sim and that the sim works and trying to create your own threat intelligence. And I think that one of the things we do better than anybody else is that we reduce the level of complexity of that, allowing our clients to really focus on providing security, using the best-in-class technologies to do that. >> John: Jonathan, a final question. In 2018, what's your outlook for the year for CISOs and companies with cyber right now? >> Jonathan: I think it's going to be an exciting time. I think, is there going to be a focus back on basics? Because before we take this next evolutionary leap, in terms of cyber and computing and the digital nature of our society, we've got to get the basics done right. And I think the way Fortinet's going, our ability to use the fabric, to help manage risk, and reduce risk, is going to be the path forward. >> John: This is The Cube, bringing you commentary and coverage of cyber security of course, here in our Palo Alto studio. I'm John Furrier, thanks for watching. (orchestral music) The Cube.

(bright music) >> Hello everybody, welcome to this special CUBE Conversation. I'm John Furrier here in theCUBE's Palo Alto studio. We're here with Jonathan Nguyen, who's with, formally Verizon, now with Fortinet. What's your title? >> Vice President of Strategy. >> Vice President of Strategy, but you're really, I would say, more of a security guru. You had, notably, with the author of the Verizon Data Breach Investigative Report. Great report, it really has been interesting. Congratulations, it's great to have you here. >> Thanks, it was great, 16 years at Verizon, in the security business. ran the data breach investigations team, so that was a great honor in my career, yeah. >> John: So, you called strategy, 'cause they didn't want you to use the word cyber security on your title on LinkedIn in case they spearfish you, is that right, no? (laughs) >> Jonathan: You know, having started my career as a US foreign service officer, as a victim of the OPM data breach, everything about me is out there. >> Yeah. (laughs) >> I live in a perfect universe about how do you defend your identity when everything about you's been compromised to begin with? >> Some of these stories, I had a CUBE guest talk about LinkedIn, and attackers involved in spearfishing, and the efforts that people go into to attack that critical resources inside the parameter. This is a big problem. This is the problem with cyber warfare and security, and crime. >> Yes. Talk about that dynamic, 'cause this is, we always talk about the cloud change, the perimeter, of course. >> Sure. >> More than ever, this is really critical. >> Jonathan: Fundamentally, as we begin going into digital transformation and notions about where data is today and the nature of computing, everything has changed, and the notion of a traditional perimeter has changed as well. I'm going to borrow a great analogy from my friend, Ed Amoroso, and he said, "Look, let's pretend "this is your traditional enterprise network, "and all your assets are in there. "And we all agree that that perimeter firewall "is being probed everyday by nation state actors, "organized criminal syndicates, hacktivists, anybody. "Everyone's probing that environment." It's also dissolving because we've got staffers inside there using shadow IT, so they're opening up that firewall as well. Then you've got applications and portals that need to be accessed by your stakeholders, your vendors, your customers. And so that traditional wall is gradually eroding, yet, that's where all of our data is, right? And against this environment, you've got this group, this unstoppable force, as Ed calls it. These nation-state actors, these organized crime, these hacktivist groups, all highly sophisticated. And we all agree, that with time and effort, they can all penetrate that traditional perimeter. We know that because that's why we hire pin testers, and red teamers, to demonstrate how to get into that network and how to protect that. So if that's the case, that we have this force, and they're going to break in eventually, why are we still spending all of our time and effort to defend this traditional perimeter that's highly vulnerable? Well, the answer is, of course, that we need to distribute these workloads, into multiple clouds, into multi hybrid cloud solutions. The challenge has been, well, how do you do that with enough control and visibility and detection as you have with a traditional perimeter, because a lot of folks just simply don't trust that type of deployment. >> That's the state of the, I mean, that's the state of our problem. How to deal with the complexity of IT, with digital transformation, as it becomes so complicated, and so important, at the same time. Yet, cloud is also on the horizon, it's here. We see the results of Amazon Web Services, see what Azure is doing, Google, et cetera, et cetera. And some companies are doing their own cloud. So, you have this new model, cloud computing. Data driven applications. And it's complex, but does that change the security paradigm? How does the complexity play into it? >> Jonathan: Absolutely, so, complexity has always been the enemy of security. And at Fortinet, what we essentially do is that we help companies understand and manage complexity to manage risk. So complexity is only going to increase. So digital transformation, the widespread adoption of digital technology is to enable exponential explosive productivity growth. Societal level changes, right? Also, massively expand the inter-connective nature of our society. More and more connections, accelerated cycles across the board, greater levels of complexity. The challenge is going to be not about whether we're moving to the cloud, everyone is going to move into the cloud, that is the basis of computing moving next. So in the Australian government, the US government, all of the agencies have a cloud-first migration initiative. It's not about whether, it's not about, it's really about when. So how you move forward with moving your computing, your workloads into the cloud? In many ways it goes back to fundamentals about risk management. It's about understanding your users and your systems, the criticality, the applications you're associated with. And understanding what can you move into the cloud, and what do you keep on-prem, in a private cloud, as it were? >> I want to ask you more about global, more about cybersecurity, but first, take a step back and set the table. What is the holistic and the general trend, in cybersecurity today? What's going on in the landscape, and what are the core problems people are optimizing for? >> Sure. >> So, across my 20-odd years in cyber, what we've seen consistently has been the acceleration of the volume, the complexity, and the variety of cyber threats. So, 10 years ago, 2007 or so, there were about 500 threat factors; today, we're north of 5000. Back at that point, there were maybe 200 vendors; today, we're north of 5000 vendors. There was less than a billion dollars of cybersecurity spent; today, we're north of 80 billion dollars spent. And yet, the same challenges pervade. And what's happening now, they're only becoming more accelerated. So in the threat environment, the criminal environment, the nation-state threat actors, they're all becoming more sophisticated. They're all sharing information! (laughs) They're sharing TTP, and they're sharing it on a highly effective marketplace: the dark web cyber crime marketplace is an effective mechanism of sharing information, of matching threat actors to targets. So the frequency, the variety, the intelligence of attacks, automated ransomware attacks, is only going to grow. Across the board, all of us on this side of the fence, our challenge is going to be, how do we effectively address security at speed and scale? And that's the key. Because you can affect security very well, in very discreet systems, networks, facilities. But how do you do it from the IOT edge? From the home area network, the vehicle area network, the personal area network? To the enterprise network, to then, to a hybrid cloud. A highly distributed ecosystem. And how do you have visibility and scale across that, when the interval of detection, between the detonation of malware, to the point of irrecoverable damage, is in seconds. >> So, tons of attack vectors, but, also, I would add, to complicate the situation further is, the service area, you mentioned IOT. We've seen examples of IOT increasing more avenues in. Okay, so you've got more surface area, more attack vectors with technology. Malware, we see that in ransomware, certainly, number one. But it's not just financial gain, there's also this terrorism involved. >> Absolutely. It's not just financial services get the cash, and embarrass the company, it's, I want to take down that power plant. So, is there a common thread? I mean, every vertical is going to have their own, kind of situation, contextually. But is there a common thread across the industries, that cybersecurity, is there a baseline, that you guys are attacking, that problems are being solved? Can you talk about that? >> Sure. >> So, at the heart of that is a convergence of operational technologies and information technology. Operational technologies were never designed to be IP enabled, they were air gapped. Never designed to be integrated and interconnected, with information technology systems. The challenge has been, as you said, is that as you go through digital transformation, become more interconnected, how do you understand when a thermostat has gone offline, or a conveyor belt has gone offline, or a furnace is going out of control? How do you understand that the HVAC system for the operating theater, the surgery theater, is operating properly? Now we have this notion of functional safety, and you have to marry that with cybersecurity. So, in many ways, the traditional approaches are still relevant today. Understanding what systems you have, the users that use them, and what's happening, in that. And detect those anomalies and to mitigate that, in a timely fashion? Those same themes are still relevant. It's just that they're much, much larger now. >> John: Let's get back to the perimeter erosion issue because one of the things that we're seeing on theCUBE is digital transformations out there. And that's, I kicked a lot of buzzwords out there, but certainly, it's relevant. >> Yeah. People are transforming to digital business. Peter Burroughs had research, we keep on top of those all of the time. And it's, a lot involves IT. Business process, putting data to work, all that good stuff, transforming the business, drive revenue. But security is more coarse. And sometimes we're seeing it unbundled from IT, and we're reporting directly to the board level, or CEO level. That being said, how do you solve this? I'm a digital transformation candidate, I'm doing it, and I'm mindful of security all the time. How do I solve the security problem, cyber security problem? Just prevention, other things? What's the formula? >> Okay, so at the heart of cybersecurity is risk management. So digital transformation is the use of digital technologies to drive exponential productivity gains across the board. And it's about data driven decision making, versus intuitive led human decision making. So at the heart of digital transformation is making sure that the business leaders have their timely information to make decisions, in a much more timely fashion, so they have better business outcomes and better quality of life. Safety, if you will. And so the challenge is about, how do you actually enable digital transformation, it comes down to trust. And so, again, across the pillars of digital transformation. And they are, first, IOT. These devices that are connected collect, share information, to make decisions. The sheer volume of data, zettabytes of data, that will be generated in the process of these transactions. Then you have ubiquitous access. And you're going to have five G, you have this notion of centralized and distributed computing. How will you enable those decisions to be made, across the board? And then how do you secure all of that? And so, at the heart of this is the ability to have, automated, that's key, automated deep visibility and control across an ecosystem. So you've got to be able to understand, at machine speed, what is happening. >> John: How do I do that, what do I do? Do I buy a box, is it mindset, is it everything? How do I solve, how do I stop cyber attacks? >> You need a framework of automated devices that are integrated. So, a couple of things you're going to need: you're going to need to have the points, across this ecosystem, where you can detect. And so, whether that is a firewall on that IOT edge, or in the home, or that's an internally segmented firewall, across the enterprise network into the hybrid cloud. You're also going to need to have intelligence, and by intelligence, that means, you're going to need a partner who has a global infrastructure of telemetry, to understand what's happening in real time, in the wild. And once you collect that data, you're going to need to have intelligence analysts, researchers, that can put into context what that data means, because data doesn't come into information on its own, you actively have to have someone to analyze that. So you have to have a team, at Fortinet, we have hundreds of people who do just that. And once you have the intelligence, you've got to have a way of utilizing it, right? And so, then you've got to have a way of orchestrating that intelligence into that large framework of integrated devices, so you can act. And in order to do that, effectively, you have to do that at machine speed. And that's what I mean by speed and scale. The big challenge about security is the ability to have deep visibility, and control, at speed, at machine speed. And at scale, from that IOT edge, way across, into the cloud. >> Scale is interesting, so what I want to ask you about Fortinet, how are you guys, at Fortinet, solving this problem for customers? Because you have to, is it, the totality of the offering, is it, some technology here, and again, you have 5000 attack vectors, you mentioned that earlier, and you did the defense report at Verizon, in your former jobs. You kind of know the landscape. What does Fortinet do, what are you guys, how do you solve that problem? >> So, from day one, every CSO has been trying to build a fabric, we didn't call it that. But from my first packet-filtering firewall, to my first stateful firewall, then I employed intrusion detection systems, and all of that generated far more lists I can manage, and I deployed an SEM. And then I went to intrusion prevention. And I had to look at logs, so I went to an SIEM. And when that didn't work, I deployed sandboxing, which was called dynamic malware inspection, back in the day, and then when that didn't work, I had to go to analytics. And then, I had to bring in third party technology, third party intelligence feats, and all along, I hoped I was able to make those firewalls, and defense sensors, that platform, integrated with intelligence, work somehow to detect the attack, and mitigate that in real time. Now, what we essentially do, in the Fortinet security fabric is, we reduce that complexity. We bring that level of-- >> And by the way. >> John: You're Ed Hoff, you're reacting in that mode, you're just, I got to do this, I got to add that to it. So it's almost like sprawling, software sprawl. You're just throwing solutions at the wall. >> Right, and a lot of that time, no one knows if their vices are properly configured, no one has actually done the third party technology integration. No one has actually met the requirements that were deployed three years ago, there are requirements today, there are requirements three years from now. And so, that's a huge level of complexity, and I think, at the heart of that complexity. That's reflected in the fact that, we're missing the basic elements in security today. The reason, the large data attacks, and the data breaches, didn't come because of advanced malware, they didn't happen off nation-state threats. These were known vulnerabilities, the patches existed, they weren't patched! In my experience, 80% of all the attacks could be mitigated through simple to intermediate controls. >> Deploying the patches, doing the job. >> Complexity. Patch management sounds easy, it's hard. Some applications, there is no patch available. You can't take things offline, you have to have virtual patches, there are unintended consequences. And there are a lot of things that don't happen. There's the handoff between the IT team and the security team, and it adds complexity. And if you think about this, if our current teams are so overwhelmed that they cannot mitigate known attacks, exploits against known vulnerabilities. How are they going to be able to grapple with the complexity of managing zettabytes of data, with an ecosystem that spans around the world, and operates in milliseconds, where, now, it's not just digital issues, it's health, safety, physical security. How can we trust a connected vehicle, is it secure or not? >> Jon, talk about the digital transformation for industries. As we talked earlier about the commonalities of the industries, they all have their own unique use cases, contextually, I mean, oil and gas, financial services, healthcare, EDU, they all have different things. What is the digital transformation objective and agenda and challenges and opportunities for financial services, healthcare, education, and the public sector? >> So, digital transformation has some similar themes, across industry verticals. For financial services, it's about omnichannel customer engagement, it's about owning that customer experience, how will a financial service company be able to reach each connected consumer? Highly personalized way, highly customized services, suited for that customer so that they can interact, at any time, that they desire, on any device, any media they desire, across the entire experience? For when that person first becomes employed, and has a first checking account, to the point that they retire, the notion around digital transformation for financial services. How do we go about, as an FS company, to reach that customer, in an omnidirectional, omnichannel way, and maximize that experience? How do we do that with highly personalized, highly customized service, self-service, if you will, all with security, across massive amounts of data? How do you ensure that that's the challenge? And then you have to do that in a very distributed ecosystem, from the ATM, home, from the vehicle, and as we move into digitally enabled societies, from the connected car, all of those places will have transactions, all of that will have to be the purveyance of financial services companies. So the level of complexity that they're going to have to grapple with is going to be immense. >> John: And the app, too, is basically the teller, 'cause the app is driving everything, too. It brings up, essentially, the argument, not argument, our thesis, your thesis, on the obvious, which is, the perimeter is eroding. It's the app on the phone. (laughs) Okay, healthcare. Healthcare is one of those things that is near and dear to my heart because, I remember back in the days, when I was younger, HIPAA compliance, it created all of these databases. Creating complexity, but also, structured things. So, healthcare is being disrupted, and security is obviously concerned. More ransomware in hospitals, you see, everywhere these days, big, big issue. >> Yeah, so, challenges in healthcare are twofold. On the one hand, their targets are ransomware because that's where money is. They have compliance challenges, but in a very interesting way, based off of the research we've seen, is that healthcare is a lot more kin to the intelligence community than any other. Because it has insider threats. Large amounts, 7 out of 10 healthcare data breaches are the result of insider threat. So, like financial services, and the other verticals in digital transformation, again, it comes to the notion of the connected consumer and the connected citizen. How do you make sure that that person can be touched and served, irrespective of whether they're in the home, or in another healthcare facility, and all of their devices that are IP-enabled are safe and secure, and to monitor that. And to keep that secure, across a large distributed ecosystem, and for a long period of time, as well. >> Education, talk about insider threats probably there, too. Education is a huge vertical with a lot of, sure, students, but also the general EDU market is hot too. >> Jon: And it's incredibly challenging, because the environment ranges from kindergarten, preschool, to high school, to higher levels of education, that are government funded, with classified intelligence, and materials, and research labs. And the educational environment, how do you provide security, confidentiality, and availability, in an ecosystem that was designed for the free flow and access of information, and how do you do that across a highly distributed ecosystem? Again, constant themes of complexity, volumes of data, and personalized and customized services. >> John: And you got to be able to turn those services on fast, and turn them off and on. Okay, finally, my favorite area is the federal, or public sector market, of course, that also includes higher ed, whatnot. But really government and federal. Public sector, seeing govcloud booming. What are some of the challenges with digital transformation in federal? >> So the hard part of federal government is the notion of service to the connected citizen. And that connected citizen now wants to be able to access city hall, their members of Congress, the White House, in a digital way, at any time, on any device, so that they can log their opinion. It is a cacophony of demand from across the board. From state, local, to federal, that every citizen now demands access to services, on any digital media, and, at the same time, for everything from potholes, and snow removal, and trash removal, those are the types of services that are needed. So, government, now, needs to provide services in the digital way, and provide security across that. >> John: In respect to those verticals, especially public sector and education, transparency is critical. You can't hide, the government can't hide. They provide citizens connectivity, and services. There's no more excuses, they have to go faster. This is a big dynamic. >> I think that we all have expectations of what it is to grow up in a digital world. My children have only grown up in a digital world. They expect things to happen at digital speed, at machine speed, they expect a high level of customized services, so that when they go, and interact with a government agency or a vendor, that vendor, that service provider, needs to know his or her preference. And will automate that and deliver those services in an incredible fashion. As I said earlier, when my kids talk about, when they learned about Moses, and heard about Moses coming down from the mountain with tablets, they thought that he was an Apple user. You know, there was no notion of other types of tablets. The connected citizen is a digital citizen, with digital demands and expectations. And our job in cyber is to enable the digital transformation so that all of those things can be delivered, and expectations met. >> Talk about the dynamic between machines and humans, because you mentioned patches, this is, you could argue it's a human mistake. But also, you mentioned automation earlier. Balance between automation, and using machines and humans. Because prevention and risk management seem to be the axis of the practice. It used to be all prevention, now it's a lot more risk management. There's still a human component in here. How are you guys talking about that, and how is that rendering itself, as a value proposition for customers? >> Sure, so it's just, humans are the essence. Both the challenge, in so many cases, we have faulty passwords, we have bad hygiene. That's why security awareness training is so critical, right, because humans are part of the problem, on one end. On the other end, within the sock, humans are grappling with huge amounts of data, and trying to understand what is malicious, what needs to be mitigated, and then prioritizing that. For us, it's about helping reduce the complexity of that challenge, and helping automate those areas that should be automated, so that humans can act better and faster, as it were. >> We have Jonathan Nguyen with Fortinet. I wanted to ask you about the ecosystem, you mentioned that earlier, and also the role of CSOs, chief information security officers, and CIOs, essentially, they're the executives in charge of security. So, you have the executives in charge of the risk management, don't get hacked, don't get breached. And also, the ecosystem partners. So you have a very interesting environment right now where people are sharing information, you mentioned that earlier, as well. So you got the ecosystem of sharing, and you have executives in charge of running their businesses effectively, and not have security breaches happen. What's happening, what are they working on, what are they key things that chief security officers are working on with CIOs, what specifics are on their plate? And what's the ecosystem doing around that, too? >> So digital transformation dominates all discussions today. And every CSO has two masters. They have a productivity master, which is always the business side of the house, and they have a security master. Which is ensuring that reasonable level of security, in the advent, and managing risk, right? And that's the challenge, how do you balance that? So, across the board, CSOs are being challenged to make sure that the applications, those digital transformation initiatives are actually occurring. At the same time, in the advent of a data breach, understanding the risk and managing the risk. How do you tell your board of directors, your governments, that you're not only compliant, but that you have handled risk to a reasonable level of assurance? And that means, in my opinion, across my experience, you've got to be able to demonstrate a couple of things. One, you have identified and adopted, with third party implementation, and attestation, of recommended best practices and controls. Second, you have implemented and used best-in-class products and technology, like Fortinet. Products that have gone through clearances, gone through common criteria, where things are properly certified. And that's how you demonstrate a reasonable level, it's really about risk management. Understanding what level of risk you will tolerate, what level of risk you will mitigate, and what level of risk you're going to transfer. And I think that's the discussion at the board level today. >> So, make people feel comfortable. But also have a partner that can actually do the heavy lifting on new things. 'Cause there's always going to be a new attack vector out there. >> Absolutely, so, I think the key to it is understanding what you're really good at. And so one of the questions that I ask every CSO is that, when you look at technology, what is it that your organization is really good at? Is it using technology, operationalizing that experience? Or is it really about ensuring that that firewall is integrated with your sim, that the sim works in trying to create your own threat intelligence. And I think one of the things that we do better than anybody else is that we reduce the level of complexity, of that allowing our clients to really focus on providing security, using best-in-class technologies to do that. >> John: That's awesome. I want to just kind of go off the board, on a question that's a little bit more societal oriented, but it's mostly here in the US. You're seeing cryptocurrencies booming, blockchain, whatnot, and it is really kind of two vectors there, that conversation, it's attacks and regulation. So the regulatory environment in DC, on the hill, looks at tech companies these days, oh my god, the big bad, Google, Apple, Facebook. And that's kind of today's narrative. But in general, technology can be an innovation opportunity. So around cyber, it's a little bit more relevant. As govcloud becomes much more ingrained in public sector, what is the regulatory environment out there? Is it helping, is it hurting? What's your thoughts? >> Jonathan: I think, on the most part, it's helping, because regulatory and compliance environments typically lag behind technology. And that's been consistent across not just cyber, but just every field of human endeavor. And I think in cryptocurrency we're beginning to see the effects as governments around the world begin to grapple with, what does this mean, if they have no visibility, insight, or control, over a currency, and we're seeing that in East Asia today. We're seeing that in China, we're seeing that in South Korea. It will have implications, I mean, the question you have to ask, with regards to cryptocurrencies is, will governments allow a non-controlled currency to operate in their marketplace? And given that we are a more integrated and digital marketplace, unless it's adopted on a global basis, is it really compelling? Now, blockchain technology is compelling; what is going to be powering that is a different question. I think that regu-- >> And also. >> The profiteering mode of hackers, which, we talked before we came on camera, is a central part of the dynamic. So if you have a flourishing ecosystem of cryptocurrency, aka Bitcoin, you have, now, a clearinghouse for payments. And that's where ransomware is mostly paid off, in Bitcoin. >> Absolutely. So this is an interesting dynamic, I'm just trying to get a read from how that plays into some of these cybersecurity dynamics. >> I think cybersecurity is highly dynamic, as you said. It is move and countermove, active threat adversaries, active marketplaces coming up with new challenges. I think, for us, on this side of the fence, it's really about making sure, getting the fundamentals right first. I often tell people, first, do you really have all of the security controls in place? Do you really know what's operating in your system? Do you understand your users? Have you done the vulnerability scans? Where are you in those basic things, first? I mean, if you do the basics, you'll mitigate, eight, nine, out of 10 attacks. >> John: Well the costs are going up, obviously, we talked about it, global, earlier. The global impact is interesting, and that's not to say cloud is global, but you now have different regional aspects of cryptocurrencies as one example. But yeah, data breach is another, look at GEPR, the penalties involved. (laughs) And certain countries in Europe, it's going to be astronomical. So there seems to be a tax involved here. So the motivations are multifold. >> So, the motivations in cyber crime. Always consistent, whether they're monetary gain, social media gain, or some sort of political gain. And I think the way you address that is that you cannot take down the marketplace, you cannot take down the physical criminals themselves. You're going to have to take away the ability to monetize, or make gains from cyber attacks. And the way I look at it is that, if you make it so complex to actually launch a successful attack, and then, to go beyond that, and monetize what you've gained, or compromised, you effectively take away the root motivation for cyber crime. And that's, it's an interesting thought, because no one talks about that, because at an industry level, do you really have the ability to, what I call, affect the trajectory of cyber crime? That's a very different way to look at it. >> John: And it's interesting, in Jeff's position, he's basically saying, make it more complex, that'll be more effective against cybersecurity, yet, digital transformation is supposed to make it easier. With building blocks in cloud, you can almost argue that if you can make it easy to deploy in cloud, it's inherently complex. So, creating a very easy to use, complex environment, or complex system, seems to be the architecture. >> The essence of cyber, I think, moving forward, is managing complexity. If you can manage complexity then you have taken complexity and made it your advantage. Because now the cyber criminal has to figure out, where is the data? Is it in the traditional data center, that enterprise environment? Is it a multi-cloud environment, if so, which node, and if I'm successful at compromising one node, I can't get to the next node, because the security fabric separated it. >> John: Jon, the final question, 2018, what's your outlook for the year, for CSOs, and companies with cyber, right now? >> I think it's going to be an exciting time. I think, is there going to be a focus back on basics? Because before we take this next evolutionary leap, in terms of cyber, and computing, and the digital nature of our society, we've got to get the basics done right. And I think the way Fortinet is going, our ability to use the fabric, to help manage risk, and reduce risk, is going to be the path forward. >> Jonathan Nguyen, with Fortinet, former author of the Data Breach Investigation Report, which I've been a big fan of, been reading it for years. Super document, congratulations, it must have been fun working on that. >> It was the high point of my career, at this point. >> It really was a great doc, it was the Bible of state of the art, state of the union, for cyber security. This is theCUBE, bringing you commentary and coverage of cybersecurity, of course, here, in our Palo Alto studio. I'm John Furrier, thanks for watching. (bright music)

(light music) >> Hi, I'm Stu Miniman here at theCUBE studio in Palo Alto in the center of Silicon Valley. Happy to welcome back first of all a many time guest at theCUBE, Kevin Deierling with Mellanox, and also someone I've known for many years, but the first time we've actually gotten under the lights in front of the cameras, Marty Lans with Hewlett-Packard Enterprise. Here to talk a lot about networking today and not just networking but storage networking. So, you know, kind of one of the dark corners of the IT world that... There's those of us that have known each other for decades it seems. And, but you know, pretty critical to a lot of what goes on in the environment. Kevin, you know, let's start with you. You know, we've caught up with Mellanox a bunch. Obviously we do a lot of video with HPE. We'll be at the Discover show in Europe coming soon. But why'd you bring Marty along to talk about some of this stuff? >> Yeah, so HPE has been a long-time partner of Mellanox. We're really not necessarily known as a storage networking company, but in fact we're in a ton of storage platforms with our InfiniBand. So, we have super-high quality reliability. We're built into the major storage platforms in the world and Enterprise Appliances, and now with this new work that we're doing with Marty's team and HPE, we're really building what we consider to be the first Ethernet storage fabric that will scale out what we've done in other worlds with dedicated storage platforms. >> Okay, Marty, before we get into some of the things you're doing with Mellanox, tell us a little bit about your role, how you fit inside Hewlett-Packard Enterprise as it's made up today. >> I'm responsible for storage networking, or the connectivity for storage as well as our interoperability. So if you think about it, it's a very broad category from a role perspective. We have a lot of challenges with all the new types of storage technologies today. And that's where Mellanox gets to come in. >> So just elaborate a little bit. What products do you have? NICs and host bus adapters, switches, what falls under your purview? >> Pretty much everything, everything you just mentioned. We carry traditionally, all the traditional storage connectivity products, Fibre Channels, switches, adapters, optics cables, pretty much the whole ecosystem. >> So what we're talking about is the Ethernet storage fabric. So can one of you set it up for us, as to what that term means? And we talked about Fibre Channel. Fibre Channel is a bespoke network designed for storage, a lot of times run by storage people or storage networking people underneath that umbrella. What's happening with the Ethernet side? >> Yeah, I think when you look at the traditional SAN network it was Fibre Channel and the metrics that people evaluate that on are performance, and reliability, and intelligence, storage intelligence. Today when you look at that on all those metrics Ethernet actually wins. So we can get three times the performance for 1/3 the price. Everything is built in in terms of all of the new protocols like NVMe over Fabrics, which is a new one that's coming. Obviously iSCSI. And taking some of the things that we do in terms of intelligence, like RDMA, which is RoCE over Ethernet, that's what really enables NVMe over Fabrics. We have that end-to-end supply of switches, adapters, and cables. And working with HPE, we can bring all of the benefits of the platform that they have and all of the software to that world. Suddenly you've got something that's unmatched with Ethernet. And that's the internet storage fabric. >> So Marty, one of the things I've said a bunch over the last couple of years is nothing ever dies. But Fibre Channel, it's dead, right? Isn't that what this means? Why don't you help us a little bit with the nuance of what you're seeing, what customers are asking, and of course there are certain administrators that are like, I know it, I love it, I'm going to keep buying it for years. >> I guess Fibre Channel's still alive. It's doing very well. I think from a primary storage perspective, I mean that's where Fibre Channel is used, right? Today's storage has a lot of different technologies. And I like to look at this in a couple of ways. One, you look at the evolution of media. You're going from disk, we went from tape to disk, and now we're going from disk to Flash. And Flash to NVMe. And now we have things like performance and latency requirements that weren't there before. And the bottleneck is moved from the storage array to the network. So having a network that creates great latency is really the issue at stake. We have latency road maps. We don't have performance road maps from a storage perspective. So that's the big one. >> Kevin, I'm sure you want to comment on some of the latency piece. That's Mellanox's legacy. >> So with some of the things we're doing now, NVMe over Fabrics, we're adding 10 microseconds of latency. So you've got an NVMe Flash drive. When it was spinning rust, and it took 10 milliseconds, who cared what the network added? Today you really care. We're down to the tens of microseconds to access an NVMe Flash drive. When you move it out of the box, now you need to network it. And that's what we really do, is allow you to access NVMe over Fabrics and iSCSI and iSER and things like that in a remote box and you're adding less than 10 microseconds of latency. It's incredible. >> Yeah, Marty, I think back. Even 10 years ago, there was a lot of times, okay, do I want InfiniBand, do I want Ethernet, do I want Fibre Channel? And there were more political implications than there were technical, architectural implications. I said five years ago, the storage protocol wars are dead. That being said, it doesn't mean that we're still sorting those out. What do you hear from customers? Any more nuance you want to give on that piece? Architecturally, right, Ethernet can do it all today, right? >> Sure, yeah, yeah, it is. So I think those challenges are still there. You still have that... you mentioned political, and I think that's something that's still going to be there for quite some time. The nice thing we did with Mellanox, and what we did in our own technology for storage connectivity, we innovated in an area that I think really hasn't been innovated that was ripe for innovation. So creating an environment that gives the storage network administrator the same capabilities of what you get in Fibre Channel we can do on an Ethernet network today. >> And Marty, one of the things. When we get a partnership announcement like this, bring us inside. Talk to us about what engineering is being done. How is this more than just sticking a lovely new logo on it? What development, what's HPE been bringing to this offering? >> So we did, first when we started, before we get to the Ethernet side, we built something called Smart SAN. It's automation orchestration for Fibre Channel networks. And that was a big success. What we did after that was we looked at it from the Ethernet perspective. We said why can't we do it there? It's in-band, it's real-time access, and it gives you the ability to do all the nuances of what makes Ethernet hard. Automate and orchestrate all the Ethernet capabilities to behave much like a Fibre Channel network. So this is a four- to five-year development cycle that we're in, in terms of developing these products. And sitting down with Mellanox, this is not just a marketing relationship. There is a lot of engineering development work that we've done with Mellanox to storage optimize their products. To make them specifically designed to handle storage traffic. >> Kevin, it's interesting. I think back to, let's say the big other Ethernet company. When they got into Fibre Channel, they learned a lot from the storage side that they drove into some of their Ethernet products. So you kind of see learning going back and forth. It's a small industry we have here. What did HPE bring to the table, and more importantly, what's the latest as to what makes the Ethernet storage fabrics... What's going to move the needle on some of that storage adoption? >> I think the key thing is, as Marty said, if you look at it you've got to be able to be familiar with all of the same things. You need to provide the same level of protection. So whether you're using data center bridging to have a lossless network. We have zero packet loss switches, which means that our switches don't drop packets under the cases where you've actually over-subscribed a network. We can actually push back, we can use PFC, we can use ECN. All of that, and on top of that, what's happened is the look and feel to be able to manage things just like it's Fibre Channel. So all that intelligence that HPE has invested in so much over the years is now being brought to bear on Ethernet. One of the big things we see is in the cloud, people have already moved to a converged network where you're seeing compute and networking and storage all on the same fabric. And really that's Ethernet. And so what we're doing now is bringing all of those capabilities to the enterprise. So we think that 15 or 20 years ago there was really no choice. Fibre Channel was absolutely the right choice. Now we're really trying to make it as easy as possible to make that enterprise transformation to be cloud-like. >> It's funny. Marty, you and I worked for EMC back when that storage network was being designed. Architecturally, those of us who have been in networking since before Fibre Channel, we would have loved to do it with Ethernet, but there were limitations with CPU, the network itself. It would have been nice. But fast forward, it was like, Flash had been around for a long time before, oh wait, now it's ready for enterprise. Now it feels like Ethernet has gone through a lot of that journey. You're welcome to comment on that. But the question I want to have from the storage side, we're going through so many changes. HPE has a very large portfolio, a number of acquisitions as well as many things HPE's doing. We talked about NVMe, NVMe over Fabric, we talked about hyper-converge, we talked about scale-out NAS. Networking is not trivial when it comes to building out distributed architectures. And of course storage has very particular requirements when it comes to network. So what are you hearing from your customers from the storage side of the business? How does HPE pull those pieces together and how does this Ethernet storage fabric fit into it? >> I mentioned it earlier. We talked about the primary array being Fibre Channel. If you take a look at where storage has gone, you talk about the cloud, you talk about all these big data, now you've got secondary storage, you've got hyper-converged storage, you've got NAS scale-out, you've got object. I mean, you go on and on. And all these different storage technologies are representing almost 80% of all the data that's out there. Most of that data, or all that data, now that I think about it, is connected by Ethernet. Now what's interesting is, from our perspective, is that we have a purview of all that capability. I see that challenge that customers are having. And the problem that these customers are finding is they go through the first layer of the challenges which is the storage capabilities they need in these storage technologies. And then they get to the next layer that says oh, by the way, the network isn't that great. And so this is where we saw an opportunity to create something that created the same category of capabilities as you got in your primary to the rest of the storage technologies. They're already using Ethernet. It's a great opportunity to provide another dedicated network that does connectivity for all those other types of storage devices, including primary. >> Is there anything along the management of these type of environments? How similar, how much retraining do you need to do? If your customers are probably going to manage both for a while. >> From a usability perspective, it's quite easy. I think what customers are going to find. We use Fibre Channel as the lowest common denominator in terms of everything has to meet, the Ethernet network has to meet those kind of requirements. So what we did was we replicated that capability throughout the rest. With our automation orchestration capabilities it gives us the feature. From a customer perspective it's really a hands-off kind of solution. It's really nice. >> The other piece is... Kevin, how's the application portfolio changing? You mentioned a little bit, some of those really specific latencies that we have. What are you seeing from customers from the application portfolio? David Floyer from Wikibon has been talking for a long time. HPC is going to become mainstream in the enterprise which seems to pull all of these pieces together. >> That's Mellanox's heritage. We came from the InfiniBand world with HBC. We're really good at building giant supercomputers. And the cloud looks very much like that. And when you talk about things like big data, and Hadoop, and Spark, all of these activities for analytics, all these workloads. So it's not just the traditional enterprise database workloads that need the performance, but all of these new data intensive. And Marty really talked about the two different elements. One was the faster media, and the second was just the breadth of the offering. So it's not just primary block storage anymore. You're talking about object storage, and file storage, and hyper-converged systems. We're seeing all of that come into play here with the M-series switches that we're introducing with HPE. What's happening now is you've got a virtualized, containerized world that's using massive amounts of data on superfast storage media. And it needs the network to support that. All of the accelerations that we've built into our adapters all of the smarts that we're building into the switches and taking all of this management framework and automation that HPE's delivering, we've got a really nice solution together. >> Excellent. One thing I love when we talk networking here, is the containerized world, we're talking about serverless, some of this stuff is trying to explain it in a way that people can understand. Marty, an M-series is probably boxes. There's actually physical... You can buy the software, and everything critically important. Walk us through the product line and what sets it apart from what you've done before and what makes up the product line there. >> A lot of compliments to Mellanox and the way they've designed their products. We have, first and foremost I'd like to call out they have a smaller product that we're working with from an ASIC perspective. It's the 2100 series. It's nice because it's a half-width box. It allows you to get full redundancy on a single 1U tray if you want to think about it that way. From a real estate perspective it's really nice. And it's extremely powerful. So with that solution, you have the power and the cost savings being able to do what many different networks can do at three times the cost in a very small form factor. That's very nice. And with the software that we do, we talked about what kind of automation we have. It's all the basic stuff that you'd imagine like the discovery, the diagnostics, all the things that are manual in an Ethernet world we provide automated in a storage environment. >> What about some of the speeds and feeds? We've got so many different flavors of Ethernet now. I remember it took a decade for 10-gig to go from standards to most customer doing now. It wasn't just 40 and 100, but we've got 25 and 50 in there. So all of them, are there interoperability concerns? Any things that you want to say, yes this, or not ready for that? >> I'll say that the market has diverged on many different speeds and feeds. So we do support all of them in the technology. Even from a storage perspective, some of our platforms support 25 gig, some will support 40 gig. So with a solution, we can do one, we can do 10, 25, 40, 50, 100. What's nice is it gives you, regardless of what technology you're using you have the capability to use the technology. >> Kevin, I want to give you the opportunity. What are you hearing from the customers these days? What are the pain points? It used to be some of those speeds and feeds. Wait around, when can I do the upgrade? It's something that's a massive thing that we have to undertake from the backbone all the way through. So are we moving faster? I know we all talk, it's agility and speed, but how about the network? Is it keeping up? >> Yeah, I think we are keeping up. The thing we hear from customers is about efficiency of using their platform. So whether it's the server or the storage. And the network they don't want to be in the way. So you don't want to have stranded assets with an NVMe drive stuck inside of a server that's run at 10% and you've got another unit that's at 100% and needs more. And really that's what this disk aggregation and software-defined storage is all about is taking advantage and getting the most out of the infrastructure that you've invested in. One NVMe drive can saturate a 25-gig link. So we have people that are saying give me more bandwidth, give me more bandwidth. So we can saturate with 24 drives, 600-gig links. The bandwidth is incredible, and we're able to deliver that with zero packet loss technologies. So really that's what people are asking for. There's more data being generated and processed and analyzed to do efficient business models, new business models. And they don't want to worry about the network. They want it to configure itself automatically, and just work and not be the bottleneck. And we can do that. >> Marty, can you up-level for us a little bit here? When I think about HPE, it comes pre-configured, I know. That's what I've known HPE for. Of course HP for most of my career. Even back in some of the earliest jobs, it's like well, rack comes fully configured. Everything's in it. When I look at this announcement, HPE, server, storage, network, some of your pieces. What's important about this? How does this fit in to the overall picture? >> Customers are used to having that service level from us. Delivering those kind of solutions. And this is no different. We saw a lot of challenges with all these different types of networks. The network being the challenge with these new types of storage technologies. So having these solutions brought to you in the way that we've done with the primary storage array I think is going to make customers pretty happy about it. >> Kevin, want to give me the final word? What should we look for in this announcement? Any last things that we haven't covered? And what should we look for for the rest of 2017? >> I think as Marty said, this is a beginning. We have a strong relationship with HPE on the adapter side, on the cables, on the switches. Also on the synergy platform that we've done the switch for that as well. So 25, 50, 100-gig is here today. With shipping we're really saying 25 is the new 10. Because this faster storage needs faster networks and we're here to deliver. I think, pay attention, we're going to do some new things. There's lots of innovation coming. >> Kevin Deierling, Marty Lans, thanks so much for bringing us the update. And thank you for watching theCUBE. I'm Stu Miniman. (light music)

(upbeat guitar music) >> Announcer: Live from Los Angeles, it's theCUBE. Covering Open Source Summit, North America, 2017. Brought to you by the Linux Foundation, and Red Hat. >> Okay, welcome back, everyone, live here in LA for theCUBE's exclusive coverage of the Linux Foundation's Open Source Summit North America. I'm John Furrier with Stu Minimam. Our next guest is Aaron Welch who's the Co-founder and Head of Product at Packet. Welcome to theCUBE. >> Thank you. >> Innovation's booming, you're a product guy, so we'll have that product-founder perspective of the collision between open source, accelerating at a massive scale, not just in the classic sense of all the normal projects that are getting more and more derivative projects, but new projects. You get the hyperledger, you got IOT, you got a massive amount of collision going on between software and your world is about hosting all that, and making sure that it's on premise support with low latency at a multi-cloud architectures, so there's an architectural battle happening while open source is massively accelerating. >> Yeah. >> What's your take and reaction to all that? >> Yeah, it's pretty interesting, and I think especially with the advent of containers on the scale that we're now currently seeing them. Obviously, that's a technology that has been around for quite a while, but I think Docker finally fixed the user experience side of that and made it comfortable for developers to deploy on. And so now all of a sudden you have a sort of portability on the application level that the cloud always sort of promised, but didn't ever really deliver. You never really ran a AWS instance image on GCE, for example. You never really had that real portability, especially across clouds, or across facilities. But now with the advent of containers, both your development pipeline and your CICD pipeline, once you've obviously made the investment to get that all running properly, is so much more accelerated, and so much more isolated from, and doesn't rely so much on the traditional infrastructure gatekeepers. So I think the development cycle is accelerating in that regard, but also has enabled people to get... come full-circle, and now you have the ability to deploy your workload on specialized hardware, and target that, specifically. So we're going from a very abstracted cloud environment, where it's a certain amount of RAM and CPU, you don't even necessarily know your clock speed, to "I want to push my SSL offload to my network card" and people are able to do that. So that's an interesting thing over the last, I would say, three or four years. >> So, Aaron, I want you to take us back to the founding of Packet. >> Aaron: Sure. >> What was, why was it going, >> Why would we start >> we look at, >> A cloud company technology is changing so fast, we're talking about containers, heck, you're in New York City, we're probably going to be there. Serverless Conference is going to be there. Amazon's pushing the next generation. There's always the new, new, new, new thing, and there's companies that come out with the new, but the big guys are also jumping all over it. So where do you guys fit? What was the impotence for the start? >> Yeah, absolutely. Well, it's an interesting time. Most of the people when you're starting a company were like, "Are you completely out of your minds? Why would you start... That game has been won, you know, the cloud game."

(lively techno music) >> Hello, everyone, I'm John Furrier with theCUBE. We are here in Palo Alto to showcase a brand new relationship and technology partnership and technology showcase. We're here with Niel Viljoen, who's the CEO of Netronome. Did I get that right? (Niel mumbles) Almost think that I will let you say it, and Nick McKeown, who's Chief Scientist and Chairman and the co-founder Barefoot Networks. Guys, welcome to the conversation. Obviously, a lot going on in the industry. We're seeing massive change in the industry. Certainly, digital transmissions, the buzzword the analysts all use, but, really, what that means is the entire end-to-end digital space, with networks all the way to the applications are completely transforming. Network transformation is not just moving packets around, it's wireless, it's content, it's everything in between that makes it all work. So let's talk about that, and let's talk about your companies. Niel, talk about your company, what you guys do, Netronome and Nick, same for you, for Barefoot. Start with you guys. >> So as Netronome, our core focus lies around SmartNICs. What we mean by that, these are elements that go into the network servers, which in this sort of cloud and NFV world, gets used for a lot of network services, and that's our area of focus. >> Barefoot is trying to make switches that were previously fixed function, turning them into something that those who own and operate networks can program them for themselves to customize them or add new features or protocols that they need to support. >> And Barefoot, you're walking in the park, you don't want to step in any glass, and get a cut, and I like that, love the name of the company, but brings out the real issue of getting this I/O world if there were NICs, it throws back the old school mindset of just network cards and servers, but if you take that out on the Internet now, that is the I/O channel engine, real time, it's certainly a big part of the edge device, whether that's a human or device, IoT to mobile, and then moving it across the network, and by the way, there's multiple networks, so is this kind of where you guys are showcasing your capabilities? >> So, fundamentally, you need both sides of the line, if I could put it that way, so we, on the server side, and specifically, also giving visibility between virtual machines to virtual machines, also called VNFs to VNFs in a service chaining mechanism, which has what a lot of the NFV customers are deploying today. >> Really, as the entire infrastructure upon which these services are delivered, as that moves into software, and more of it is created by those who own and operate these services for themselves, they either create it, commission it, buy it, download it, and then modify it to best meet their needs. That's true whether it's in the network interface portion, whether it's in the switch, and they've seen it happen in the control plane, and now it's moving down so that they can define all the way down to how packets are processed in the NIC and in the switches, and when they do that, they can then add in their ability to see what's going on in ways that they've never been able to do before, so we really think of ourselves as providing that programmability and that flexibility down, all the way to the way that the packets are processed. >> And what's the impact, Nick, talk about the impact then take us through like an example. You guys are showcasing your capabilities to the world, and so what's the impact and give us an example of what the benefit would be. I mean, what goes on like this instrumentation, certainly, everyone wants to instrument everything. >> Niel: Yes. >> Nick: Yeah. >> But what's the practical benefit. I mean who wins from this and what's the real impact? >> Well, you know, in days gone by, if you're a service provider providing services to your customers, then you would typically do this out of vertically integrated pieces of equipment that you get from equipment vendors. It's closed, it's proprietary, they have their own sort of NetFlow, sFlow, whatever the mechanism that they have for measuring what's going on, and you had to learn to live with the constraints of what they had. As this all gets kind of disaggregated and broken apart, and that the owner of the infrastructure gets to define the behavior in software, they can now chain together the modules and the pieces that they need in order to deliver the service. That's great, but now they've lost that proprietary measurement, so now they need to introduce the measurement that they can get greater visibility. This actually has created a tremendous opportunity and this is what we're demonstrating, is if you can come up with a uniform way of doing this, so that you can see, for example, the path that every packet takes, the delay that it encounters along the way, the rules that it encounters that determines the path that it gets, if it encounters congestion, who else contributed to that congestion, so we know who to go blame, then by giving them that flexibility, they can go and debug systems much more quickly, and change them and modify them. >> It's interesting, it's almost like the aspirin, right? You need, the headache now is, I have good proprietary technology for point measurement and solutions, but yet I need to manage multiple components. >> I think there's an add-on to what Nick said, which is the whole key point here which is the programmability, because there's data, and then there's information. Gathering lots and lots of telemetry data is easy. (John chuckles) The problem is you need to have it at all points, which is Nick's key point, but the programmability allows the DevOps person, in other words, the operational people within the cloud or carrier infrastructure, to actually write code that identifies and isolates the data, the information rather than the data that they need. >> So is this customer-based for you guys, the carriers, the service providers, who's your target audience? >> Yep, I think it's service providers who are applying the NFV technologies, in other words, the cloud-like technologies. I always say the real big story here is the cloud technologies rather than just the cloud. >> Yeah, yeah. >> And how that's-- >> And same for you guys, you guys have this, this joint, same target customer. >> Yeah, I don't think there's any disagreement. >> Okay. (laughs) Well, I want to get drilling to the whole aspirin analogy 'cause it's of the things that you brought up with the programmability because NFV has been that, you know, saving grace, it's been the Holy Grail for how many years now, and you're starting to see the tides shifting now towards where NFV is not a silver bullet, so to speak, but it is actually accelerating some of the change, and I always like to ask people, "Hey, are you an aspirin or you a vitamin?" One guest told me, "I'm a steroid. "We make things grow faster." I'm like, "Okay," but in a way, the aspirin solves a problem, like immediate headaches, so it sounds like a lot of the things that you mentioned. That's an immediate benefit right there on the instrumentation, in an open way, multi-component, multi-vendor kind of, benefits of proprietary but open, but the point about programmability gives a lot of headroom around kind of that vitamin, that steroid piece where it's going to allow for automation, which brings an interesting thing, that's customizable automation, meaning, you can apply software policy to it. Is that kind of like, can you tease that out, is that an area that you guys talking about? >> I think the first thing that we should mention is probably the new language called P4. I think Nick will be too modest to state that but I think Nick has been a key player in, along with his team and many other people, in the definition and the creation of this language, which allows the programmability of all these elements. >> Yeah, just drill down, I mean, toot your own horn here, let's get into it because what is it and what's the benefit and what is the real value, what's the upshot of P4? >> Yeah, the way that hardware that processes packets, whether it's in network interface cards, or in switching, the way that that's been defined in the past, has been by chip designers. At the time that they defined the behavior, they're writing Verilog or VHDL, and as we know, people that design chips, don't operate big networks, so they really know what capabilities to put in-- >> They're good at logic in a vacuum but not necessarily in the real world, right? Is that what you (laughs). >> So what we-- >> Not to insult chip designers, they're great, right? >> So what we've all wanted to do for some time is to come up with a uniform language, a domain-specific language that allows you to define how packets will be processed in interfaces, in switches, in hypervisor switches inside the virtual machine environments, in a uniform way so that someone who's proficient in that language can then describe a behavior that can then operate in different paths of the chained services, so that they can get the same behavior, a uniform behavior, so that they can see the network-wide, the service-wide behavior in a uniform way. The P4 language is merely a way to describe that behavior, and then both Netronome and Barefoot, we each have our own compilers for compiling that down to the specific processing element that operates in the interfaces and in the switches. >> So you're bridging the chip layer with some sort of abstraction layer to give people the ability to do policy programming, so all the heavy lifting stuff in the old network days was configuration management, I mean all the, I mean that was like hard stuff and then, now you got dynamic networks. It even gets harder. Is this kind of where the problem goes away? And this is where automation. >> Exactly, and the key point is the programmability versus configurability. >> John: Yeah. >> In a configurable environment, you're always trying to pre-guess what your customer's going to try to look at. >> (chuckles) Guessing's not good in the networking area. That's not good for five nines. >> In the new world that we're in now, the customer actually wants to define exactly what the information is they want to extract-- >> John: I wanted to get-- >> Which is your whole question around the rules and-- >> So let me see if I can connect the dots here, just kind of connect this for, and so, in the showcase, you guys are going to show this programmability, this kind of efficiency at the layer of bringing instrumentation then using that information, and/or data depending on how it's sliced and diced via the policy and programmability, but this becomes cloud-like, right? So when you start moving, thinking about cloud where service providers are under a lot of pressure to go cloud because Over-The-Top right now is booming, you're seeing a huge content and application market that's super ripe for kind of the, these kinds of services. They need that ability to have the infrastructure be like software, so infrastructure is code, is the DevOps term that we talk about in our DevOps world, but that has been more data-centered kind of language, with developers. Is it going the same trajectory in the service provider world because you have networks, I mean they're bigger, higher scale. What are some of those DevOps dynamics in your world? Can you talk about that and share some color on that? >> I mean, the way in which large service providers are starting to deliver those services is out of something that looks very much like the cloud platform. In fact, it could in fact be exactly the same technology. The same servers, the same switches, same operating systems, a lot of the same techniques. The problem they're trying to solve is slightly different. They're chaining together the means to process a sequence of operations. A little bit like, though the cloud operators are moving towards microservices that get chained together, so there are a lot of similarities here and the problems they face are very similar, but think about the hell that this potentially creates for them. It means that we're giving them so much rope to hang themselves because everything is now got to be put together in a way that's coming from different sources, written and authored by different people with different intent, or from different places across the Internet, and so, being able to see and observe exactly how this is working is even more critical than-- >> So I love that rope to hang yourself analogy because a lot of people will end up breaking stuff as Mark Zuckerberg's famous quote is, "Move fast, break stuff," and then by the way, when they 100 million users and moved, slogan went for, "Move fast, be reliable," so he got on the five nines bandwagon pretty quick, but it's more than just the instrumentation. The key that you're talking about here is that they have to run those networks in really high reliability environments. >> Nick: Correct. >> And so that begs the challenge of, okay, it's not just easy as throwing a docker container at something. I mean that's what people are doing now, like hey, I'm going to just use microservices, that's the answer. They still got stuff under the hood, but underneath microservices. You have orchestration challenges and this kind of looks and feels like the old configuration management problems but moved up the stack, so is that a concern in your market as well? >> So I think that's a very, very good point that you make because the carriers, as you say, tend to be more dependent, almost, on absolute reliability, and very importantly, performance, but in other words, they need to know that this is going to be 100 gigs because that's what they've signed up the SLA with their customer for. (John chuckles) It's not going to be almost 100 gigs 'cause then they're going to end up paying a lot of penalties. >> Yeah, they can't afford breakage. They're OpsDev, not DevOps. Which comes first in their world? >> Yes, so the critical point here is just that this is where the demo that we're doing which shows the ability to capture all this information at line rate, at very high speeds in the switches. (mumbles) >> So let's about this demo you're doing, this showcase that you guys are providing and demonstrating to the marketplace, what's the pitch, I mean what is it, what's the essence of the insight of this demo, what's it proving? >> So I think that the, it's good to think about a scenario in which you would need this, and then this leads into what the demo would be. Very common in an environment like the VNF kind of environment, where something goes wrong, they're trying to figure out very quickly, who's to blame, which part of the infrastructure was the problem? Could it be congestion, could it be a misconfiguration? (John laughs) >> Niel: Who's flow-- >> Everyone pointing finger at the other guy. >> Nick: The typical way-- >> Two days later, what happened, really? >> Typical way that they do this, is they'll bring the people that are responsible for the compute, the networking, and the storage quickly into one room, and say, "Go figure it out." The people that are doing the compute, they'll be modifying and changing and customizing, running experiments, isolating the problem. So are the people that are doing storage. They can program their environment. In the past, the networking people had ping and traceroute. That's the same tools that they had 20 years ago. (John chuckles) What we're doing is changing that by introducing the means where they can program and configure, run different experiments, run different probes, so that they can look and see the things that they need to see, and in the demo in particular, you'll be able to see the packets coming in through a switch, through a NIC, through a couple of VMs, back out through a switch, and then you can look at that packet afterwards, and you can ask questions of the packet itself, something you've never been able to-- >> It's the ultimate debugger. Basically, it's the ultimate debugger. >> Nick: That's right. Go to the packet, say-- >> Niel: Programmable debugger. >> "Which path did you take? "How long did you wait at each NIC, "at each VM, at each switch port as you went through? "What are the rules that you followed "that led you to be here, and if you encountered "some congestion, whose fault was it? "Who did you share that queue with?" so we can go back and apportion the blame-- >> So you get a multiple dimension of path information coming in, not just the standard stovepiped tools-- >> Nick: That's right. >> And then, everyone compares logs and then there's all these holes in it, people don't know what the hell happened. >> And through the programmability, you can isolate the piece of the information-- >> So the experimentation agile is where I think, is that what you're getting at? You can say, you can really get down and dirty into a duplication environment and also run these really fast experiments versus kind of in theory or in-- >> Exactly, which is what, as Nick said, is exactly what people on the server side and on the storage side have been able to do in the past. >> Okay so for people watching that are kind of getting into this and people who aren't, just give me in order maybe through of the impact and the consequences of not taking this approach, vis-a-vis the available, today's available techniques. >> If you wanted to try and figure out who it was that you were sharing a queue with inside an interface or inside a switch, you have no way to do that today, right? No means to do that, and so if you wanted to be able to say it's that aggressive flow over there, that malfunction in service over there, you've got no means to do it. As a consequence, the networking people always get the blame because they can't show that it wasn't them. But if you can say, I can see, in this queue, there were four flows going through or 4,000 flows, and one of them was really badly behaved, and it was that one over there and I can tell you exactly why its packets were ending up here, then you can immediately go in and shut that one down. They have no way that they go and randomly shut-- >> Can I get this for my family, I need this for my household. I mean, I'm going to use this for my kids. I mean I know exactly the bad behavior, I need to prove it. No, but this is what the point is, is this is fast. I mean you're talking speed, too, as another aspect-- >> Niel: It's all about the-- >> What's the speed lag on approach versus taking the old, current approach versus this joint approach you guys are taking? What's the, give me an estimate on just ballpark numbers-- >> Well there's two aspects to the speed. One is the speed at which it's operating, so this is going to be in the demo, it's running at 40 gigabits per seconds, but this can easily run, for example, in the Barefoot switch, it'll run at 6 terabits per second. The interesting thing here is that in this entire environment, this measurement capability does not generate a single extra packet. All of it is self-contained in the packets that are already flowing. >> So there's no latency issues on running this in production. >> If you wanted then change the behavior, you needed to go and modify what was happening in the NIC, modify what was happening in the switch, you can do that in minutes. So that you can say-- >> Now the time it takes for a user now to do this, let's go to that time series. What does that look like? So current method is get everyone in a room, do these things, are we talking, you know. >> I think that today, it's just simply not possible. >> Not possible. >> So it's, yes, new capability. >> I think is the key issue. >> So this is a new capability. >> This is a new capability and exactly as Nick said, it's getting the network to the same level of ability that you always had inside the-- >> So I got to ask you guys, as founders of your companies because this is one of those things that's a great success story, entrepreneurs, you got, it's not just a better mousetrap, it's revolutionary in the sense that no one's ever had the capability before, so when you go to events like Mobile World Congress, you're out in the field, are you shaking people like, "You need me! "I need to cut the line and tell you what's going on." I mean, you must have a sense of urgency that, is it resonating with the folks you're talking to? I mean, what are some of the conversations you're having with folks? They must be pretty excited. Can you share any anecdotal stories? >> Well, yup, I mean we're finding, across the industry, not only in the service providers, the data center companies, Wall Street, the OEM box vendors, everybody is saying, "I need," and have been saying for a long time, "I need the ability to probe into the behavior "of individual packets, and I need whoever is owning "and operating the network to be able to customize "and change that." They've never been able to do that. The name of the technique that we use is called In-band Network Telemetry or INT, and everybody is asking for it now. Actually, whether it's with the two of us, or whether they're asking for it more generally, this is, this is-- >> Game changer. >> You'll see this everywhere. >> John: It's a game changer, right? >> That's right. >> Great, all right, awesome. Well, final question is, is that, what's the business benefits for them because I can imagine you get this nailed down with the proper, the ability to test new apps because obviously, we're in a Wild West environment, tsunami of apps coming, there's always going to be some tripwires in new apps, certainly with microservices and APIs. >> I think the general issues that we're addressing here is absolutely crucial to the successful rollout of NFV infrastructures. In other words, the ability to rapidly change, monitor, and adapt is critical. It goes wider than just this particular demo, but I think-- >> It's all apps on the service provider. >> The ability to handle all the VNFs-- >> Well, in the old days, it was simply network spikes, tons of traffic, I mean, now you have, apps could throw off anomalies anywhere, right? You'd have no idea what the downstream triggers could be. >> And that's the whole notion of the programmable network, which is critical. >> Well guys, any information where people can get some more information on this awesome opportunity? You guys' sites, want to share quick web addresses and places people get whitepapers or information? >> For the general P4 movement, there's P4.org. P, the number four, .org. Nice and easy. They'll find lots of information about the programmability that's possible by programming the, the forwarding being what both of us are doing. In-band Network Telemetry, you'll find descriptions there, P4 programs, and whitepapers describing that, and of course, on the two company websites, Netronome and Barefoot. >> Right. Nick and Niel, thanks for spending some time sharing the insights and congratulations. We'll keep an eye for it, and we'll be talking to you soon. >> Thank you. >> Thank you very much. >> This is theCUBE here in Palo Alto. I'm John Furrier, thanks for watching. (lively techno music)