>>Hey, welcome to the Cubes coverage of Red Hat Summit 2021, the virtual experience, I'm lisa martin, I have two guests joining me. One is a cube alum kamal Shah is back, he's now the VP of cloud platforms at Brent had come on, it's great to have you back on the program. You're in a new role, we're going to talk about that. Thank you. And Kirsten newcomer is here as well. She's the Director of cloud and Death stickups strategy at Red Hat, Kirsten, Welcome and thank you for bringing the red hat vibe to the segment. >>Absolutely, very happy to be here. >>So looking forward to this conversation that we're going to be having in the next 20 minutes or so. We're gonna be talking about the last time come on, you were on, you were the ceo of stack rocks In January of 2021. The announcement that red hat plans to acquire stack rocks, it wouldn't be talking all about that. But I'd like to start with Kirsten, give us your perspective from red hats perspective, why is red hat a good fit for stack rocks? >>You know, there are so many reasons first of all as as you know, right? Red hat has been working with product Izing kubernetes since kubernetes one dato. Right, so so open shift three dato shipped with kubernetes one dot Oh, so we've been working with kubernetes for a long time, stack rocks embraces kind of is kubernetes native security embraces the declarative nature of kubernetes and brings that to security. Red hats, Custer's red hat enterprise customers, we have a great set across different verticals that are very security conscious and and during my five years at red hat, that's where I spend the majority of my time is talking with our customers about container and kubernetes security. And while there's a great deal of security built in to open shift as it goes to market out of the box, customers need the additional capabilities that stack rock springs. Historically, we've met those needs with our security partners. We have a great ecosystem of security partners. And with the stack rocks acquisition, we're now in a position to offer additional choice. Right. If a customer wants those capabilities from Red hat tightly integrated with open shift, we'll have those available and we continue to support and work with our broad ecosystem of security partners. >>Excellent customers always want choice. Come on. Give me your perspective. You were at the helm the ceo of stack rocks as you were last time you were on the cube. Talk to me about the redhead acquisition from your seat. >>Yeah. So as as Kirsten mentioned, we were partners of red hat. You're part of the red hat partner ecosystem. And uh, what we found is that was both a great strategic fit and a great cultural fit between our two companies. Right? And so the discussions that we had were how do we go and quickly enable our customers to accelerate their digital transformation initiatives to move workloads to the cloud, to containerized them, to manage them through kubernetes and make sure that we seamlessly addressed their security concerns. Right? Because it continues to be the number one concern for large enterprises and medium sized enterprises and frankly any enterprise that uh, you know, uh, working out today. So, so that was kind of the impetus behind it. And I must say that so far the the acquisition has been going on very smoothly. So we had two months in roughly and everybody and has been very welcoming, very collaborative, very supportive. And we are already working hand in hand to to integrate our companies and to make sure that we are working closely together to make our customers successful. >>Excellent. We're gonna talk about that integration in a second. But I can imagine challenging going through an acquisition during a global pandemic. Um but that is one of the things that I think lends itself to the cultural alignment. Kamal that you talked about, Kirsten. I want to get your perspective. We know we talk about corporate culture and corporate culture has changed a lot in the last year with everybody or so many of us being remote. Talk to me about kind of the core values that red hat and stack rocks share >>actually, you know, that's been one of the great joys doing during the acquisition process in particular, Kamal and and ali shared kind of their key values and how they um how they talked to talk with their team And some of the overlap was just so resonated so much for all of us. In particular the sense of transparency, uh, that the, that the team the stack rocks executive team brings and approaches. That's a that's a clear value for red hat um strongly maintained. Uh, that was one of the key things the interest in um uh, containers and kubernetes. Right. So the technology alignment was very clear. We probably wouldn't have proceeded without that. But again, um and I think the investment in people and the independence and the and the strong drive of the individuals and supporting the individuals as they contribute to the offering so that it really creates that sense of community um and collaboration that is key. Uh and and it's just really strong overlap in in cultural values and we so appreciated that >>community and collaboration couldn't be more important these days. And ultimately the winner is the customers. So let's dig in. Let's talk about what stack rocks brings to open shift Kirsten take it away >>man. So as I said earlier, um so I think we we really believe in continuous security at red hat and in defense and depth. And so when we look at an enterprise kubernetes distribution that involves security at the real core os layer security and kubernetes adding the things into the distribution, making sure they're there by default, that any distribution needs to be secured to be hardened, auditing, logging, identity, access management, just a wealth of things. And Red hat has historically focused on infrastructure and platform security, building those capabilities into what we bring to market stack rocks enhances what we already have and really adds workload protection, which is really when it comes down to it. Especially if you're looking at hybrid cloud, multi cloud, how you secure, not just the platform, but how you secure your workloads changes. And we're moving from a world where, you know, you're deploying anti virus or malware scanners on your VMS and your host operating system to a world where those work clothes may be very short lived. And if they aren't secured from the get go, you miss your opportunity to secure them right? You can't rely on, you know, you do need controls in the infrastructure but they need to be kubernetes native controls and you need to shift that security left. Right? You never patch a running container. You always have to rebuild and redeploy if you patch the running container the next time that container images deployed, you've missed, you've lost that patch. And so the whole ethos the whole shift left. The Deb sec ops capabilities that stack rock springs really adds such value. Right? You can't just do DEF SEc or set cops. You need to do a full infinity loop to really have def SEc ops and stack rocks. I'm gonna let Kamal tell you about it, but they have so many capabilities that that really drive that shift left and enable that closed loop. We're just so excited that they're part of our offerings. >>So can you take us through that? How does stack rocks facilitate the shift left? >>Yeah, absolutely. So stack rocks, which we we announced at summit is now being rebranded as red hat. Advanced cluster security was really purpose built to help our customers address the use cases across the entire application lifecycle. Right? So from bill to deploy to run time. So this is the infinite loop that Kirsten mentioned earlier and one of our foundations was to be kubernetes native to ensure that security is really built into the application is supposed to bolt it on. So specifically, we help our customers shift left by securing the supply chain and we're making sure that we identifying vulnerabilities early during the build process before they make it to a production environment. We helped them secure the infrastructure by preventing miS configurations again early in the process because as we all know, MIS configurations often lead to breaches at at runtime. Right? We help them address uh compliance requirements by ensuring that we can check for CS benchmarks are regulatory requirements around the C I P C I, hip hop and this and and that's uh you know, just focusing on shift left, doesn't really mean that you ignore the right side or ignore the controls you need uh when your applications are running in production. So we help them secure that at runtime by identifying preventing breaches the threat detection, prevention and incident response. >>That built in security is you both mentioned that built in versus bolt on Kirsten? Talk to me about that, that as really kind of a door opener. We talked a lot about security issues, especially in the last year. I don't know how many times we've talked about miS configurations leading to breaches that we've seen so many security challenges present in the last year. We talked to me a little bit Kirsten about >>what >>customers appetites are for going. All right now, I've got cloud native security, I'm going to be able to, I'm going to feel more comfortable with rolling out production deployments. >>It's, it's a great place to go. So there are a number of elements to think about. And if I could, I could, I could start with by building on the example that Kamal said, Right, So when we think about um I need to build security into my pipeline so that when I deliver my containerized workloads, they're secure. What if I miss a step or what if a new vulnerability is discovered after the fact? Right. So one of the things that stack rocks or redhead a CS offers is it has built in policy checks to see whether a container or running image has something like a package manager in it. Well, a package manager can be used to load software that is not delivered with the container. And so the idea of ensuring that you are including workload, built in workload, protect locks with policies that are written for you. So you can focus on building your applications. You don't necessarily have to learn everything there is to know about the new attack vectors that are really just it it's new packaging, it's new technology. It's not so much there are some new attack vectors, but mostly it's a new way of delivering and running your applications. That requires some changes to how you implement your security policies. And so ensuring that you have the tools and the technology that you're running on have those capabilities built in. So that when we have conversations with our security conscious customers, we can talk with them about the attack vectors they care about. We can illustrate how we are addressing those particular concerns. Right? One of them being malware in a container, we can look for stack. Rocks can look for a package manager that could be used to pull in, you know, code that could be exploited and you can stop a running container. Um, we can do deeper data collection with stack rocks. Again, one of the challenges when you're looking at moving your security capabilities from a traditional application environment is containers come and go all the time. In a kubernetes cluster nodes, your servers can come and go in a cloud native kubernetes cluster, right? If you're running on on cloud public cloud infrastructure, um, those things are the nodes are ephemeral to, they're designed to be shut down and brought back up. So you've got a lot more data that you need to collect and that you need to analyze and you need to correlate the information between these. Right? I no longer have one application stack running on one or more VMS, it's just things are things are moving fast so you want the right type of data collection and the right correlation to have good visibility into your environment. >>And if I can just build on that a little bit. The whole idea here is that these policies really serve as god rails right for the developers. So the it allows developers to move quickly to accelerate the speed of development without having to worry about hundreds of potential security issues because there are guardrails that will notify that with concrete recommendations early in the process. And the analogy I often use is that you know the reason we have breaks in our cars, it's not to slow us down but to allow us to go faster because we know we can slow down when we need to write. So similarly these policies are really it's really designed to accelerate the speed of development and accelerate digital transformation initiatives that our customers are embarking on >>and come on. I want to stick with you on the digital transformation front. We've talked so much about how accelerated that has been in the last year with everything going on in such a dynamic market. Talk to me Kamal about some of the feedback that you've gotten from stack rocks customers about the acquisition and how it is that maybe that facilitator of the many pivots that businesses have had to do in the last year to go from survival mode to thriving business. >>Yeah. Yes, absolutely. The feedback from all of our customers bar none has been very very positive. So it's been it's allowed us to invest more in the business and you know, we publicly stated that we are going to invest more in adding more capabilities. We are more than doubling the size of our teams as an example. And really working hand in hand with our uh the broader team at Red had to uh further accelerate the speed of development and digital transformation initiatives. So it's been extremely positive because we're adding more resources, We're investing more. We're accelerating the product roadmap uh based on uh compared to what we could do as a, as a start up as you can imagine. And and the feedback has been nothing but positive. So that's kind of where we are today. And what we're doing with the summit is rolling out a new bundle called open shift uh, Open shift platform plus, which includes not just Red hat A CS which used to be Stock rocks, but also red hat open shift hybrid cloud platform as well as Red hat advanced uh container cluster management, ACM capabilities as well as create the container registry. So we're making it easier for our customers to get all the capabilities that they need to for the drive digital transformation initiatives to get. It goes back to this whole customer centric city team that red hat has, that was also core value of stack rocks and and the winner and all of this, we believe ultimately is our, our our customers because that's where we exist to serve them, >>right. And I really like that if I could chime in kind of on top of that a little bit. Um so, so I think that one of the things we've seen with the pandemic is more of the red Hat customers are accelerating their move to public cloud and away from on premises data centers. Uh and and you know, that's just part partly because of so many people working remotely. Um it just has really pushed things. And so with Hybrid cloud becoming even more key to our joint customer base and by hybrid cloud, I mean that they have some environments that are on premises as they're making this transition. Some of those environments may stay that footprint may stay on premises, but it might be smaller, they may not have settled on a single public cloud. They could, in fact, they often are picking a public cloud based on where their development focuses. Google is very popular for ai and ml workloads. Amazon of course is just used, you know, by pretty much everybody. Um and then Azzurri is popular with um a subset of customers as well. And so we see our customers investing in all of these environments and stack rocks red hat A CS like open shift runs in all these environments. So with open shift platform plus you get a complete solution that helps with multi cluster management with a C. M with security across all of these environments, right? You can take one approach to how you secure your cluster, how you secure your workloads, how you manage configurations, You get one approach no matter where you're running your containers and kubernetes platform when you're doing this with open shift platform plus. So you also get portability. If today you want to be running an amazon maybe tomorrow you need to spin up a cluster in google, you can do that if you're working with the K s or G K E, you can or a Ks, you can do that with red hat a CS as well. So we really give you everything you need to be successful in this move and we give you back to that choice word, right? We give you the opportunity to choose and to migrate at the speed that works for you. >>So that's simplicity. That streamlining. I gotta ask you the last question here in our last couple of minutes. Come on, what's the integration process been like? as we said the acquisition just a couple of months in. But talk to me about that integration process. What that's been like? >>Yeah, absolutely. So as I mentioned earlier, the process has been very smooth so far, so two months in and it's largely driven by the common set of culture and core values that exists between our two companies. And so uh you know, from a product standpoint, we've been working hand in hand because I mentioned earlier, we were partners are working hand in hand on accelerating the road map the joint roadmap that we have here uh from a go to market perspective teams are well integrated. We are going to be rolling out the rolling out the bundle and we're gonna be rolling out additional uh options for our customers. We've also publicly announced that will be open sourcing uh red hat A. C. S. Uh formerly known as Stock Rock. So stay tuned for further news and that announcement. And, and so you know, uh, again two months and everybody's been super collaborative. Super helpful, super welcoming. And the team is the well settled and we're looking forward to now focusing on our primary objective is just to make sure that our customers are successful. >>Absolutely. That customer focus is absolutely critical. But also so is the employee experience. And it sounds like we both talked about the ethos and the and the core value alignment. They're probably being pretty critical to doing an integration during a very challenging time globally. I appreciate both of you joining me on the program today, sharing what's going on stack rocks now asks the opportunities for customers to have that built in cuBA and the security. Thanks so much for your time. >>Thank you. Thank >>you for Camel shaw and Kirsten newcomer. I'm lisa martin. You're watching the cubes coverage of Red Hat Summit, The virtual experience. Mhm

>> Narrator: From Burlingame, California, it's the Cube, covering Sumo Logic Illuminate 2019. Brought to you by Sumo Logic. >> Hey welcome back everybody! Jeff Frick here with the Cube, we're at the Sumo Logic Illuminate conference, it's at the Hyatt San Francisco Airport. About 700, 800 people, full house in the keynote earlier today, all about operational process monitoring, all this crazy data is being kicked out of the Cloud and IoT and all these crazy next-gen applications. We're excited to have a very close friend of mine, CEO of a very hot company, Kamal Shah, the CEO of StackRox. Kamal, great to see you! >> Thank you, and great to be here, Jeff! >> Absolutely! So for folks that aren't familiar with StackRox, give us the overview. >> Sure, so in a nutshell, we do Kubernetes Security, and so as we've heard all day today, enterprises are deploying microservices, containers, Kubernetes, and we do security for your cloud data infrastructure. >> So how does security work for Kubernetes versus security for other things? >> Yeah, so the use cases for security, or the mission for the security team is the same, right? You got to harden your environment to prevent the bad guys from getting in. >> And, you have to make sure, despite your best efforts, if somebody does break in, then you catch them before they do any damage, right? But the how you do security has to evolve for the cloud data stack, right? It has to understand the containers are immutable affirm all infrastructure, you have to understand that it's not just about the container, but it's also about the orchestrator, and specifically Kubernetes, and it's also about making sure that you seamlessly integrate with dev ops processes, automation and workflow. So it requires a fundamentally different approach to security than traditional security tools. >> So you know, we talk a lot about the increasing attack area that's offered by IoT, right? And increasing attack area that's offered by all those API's and all these interconnected applications, but I've never heard anyone really talk about containers or orchestration as kind of a new attack surface. Did we just stop paying attention? Is that something you're seeing happen? >> Yeah it's something that is starting to emerge, and we've seen some high-profile breachers at a large next generation electric car company, and a large shopping site where misconfigurations led to security breaches in the Kubernetes' environment, and Kubernetes' ecosystem also did a Cube security audit, and so I think we're going to start to hear a lot more, because there's more and more applications are being deployed in production. It's creating a new attack area, and as the old saying goes, the predators go where there's food in the system. >> And so if you're not proactive about it, I think it's going to really hurt as you deploy containers in Kubernetes. >> Right, so we hear over and over and over again about breaches because people misconfigure stuff. That just seems to happen, whether it's a database or this, that, and the other. And I think we can pretty much safely assume everyone's going to get breached if they haven't got breached already, 'cause we hear about it all the time. How do you catch them fast, limit the damage and try not to have too much vulnerabilities? >> Exactly, so the use cases for what we do at Kubernetes are the same. Right? Its vulnerability management, it's configuration management, and we just did a study around the state of container in Kubernetes security and misconfigeration was the number one concern. Because the reality is that Kubernetes, there are a lot of knobs. And each knob has multiple options, so if you're not careful you can really misconfigure your environment and make it so much easier for attackers. >> Right, right. >> And it's precisely what happened at the two examples I sighted earlier. So a misconfigerations is important, runtime security is important, and also compliance. Let's not forget about compliance, right. You have to make sure that you meet your PCI, HIPAA, NIST, and CIS benchmark standards for this cloud native stock. >> So what we're seeing is that these are all becoming very, very important and as a result, it's increasing awareness as Kubernetes gets more prominent. >> Right, and then they are creating and tearing down hundreds, thousands, millions of these things at a nidicolous pace. >> I mean exactly. Kubernetes came out of Google, they open sourced it, and it's really what allows you to deploy, manage, containers at scale. Apparently, they manage hundreds of millions of container a day using Kubernetes, it's incredible. >> Jeff: Oh yeah, I saw a statistic that Google launches 4 billion containers per week. That was from a presentation, actually from a 451 analyst from like 2 years ago. So one can only imagine the scale. >> We are also seeing not quite 4 billion containers per week, but we are seeing thousands, and tens of thousands of containers at scale at companies everywhere. They are all deployed in production, and now they are waking up to security. The good news here is that they are waiting for breaches to happen before they solve the problem. There's still a lack of awareness, and what Sumo Logic has done today with the announcement around continued intelligence for Kubernetes just increases the awareness around, hey we have to solve observability, which is logs, metrics, and tracing, which is what Sumo does, and security for your cloud native infrastructures. >> Yeah, I mean the automation is so important, right? You can't do any of this stuff with this exponential growth of data, exponential growth of pushes, of new code releases. There's so many pieces in this, so automation is a huge piece of the puzzle. >> Automation is paramount and with this new infrastructure there aren't enough security people to solve this. So security has to become everybody's responsibility. And the only way we are going to solve this is to automate it. It also has to integrate with your DebOps processes and automation and work flows. If you don't, then the DebOps body is going to reject the security organ, right? So it has to be seamless in the way you deploy it. >> It's interesting you say that because we go to RSA, forty thousand people, more vendor than you can count, it bulges Moscone to the absolute edges. Everyone says over and over that security has to be baked in the entire process from beginning to end, it's not a bolt on and can never be successful as a bolt on. So it surprises me to hear you say that still a lot of people are kind of behind the curve. >> Well I mean if you think about I, even though they say that, right? In a traditional model of the application you go to spend 6 months building it and then you can go spend a couple of weeks or month hardening and putting security around it. But when you are launching applications every 6 hours, you can spend 6 days addressing security, so it has to be built in. And speaking of RSA, if you recall, last year the big talk at RSA was around AI, right. Everything was AI driven security. My prediction, my bold prediction for this RSA is it's going to be all around Kubernetes security. >> Yeah, well it's applied AI. Applied AI for Kubernetes. >> Exactly. >> And that's what you need. I always feel for the SISO just walking the floor at RSA going, "Where do I begin? I mean where do I spend my money, how do I prioritize?" It's kind of like an insurance problem. You can't insure to the nth degree. You got to have a budget, but how do you deploy your assets? It's got to be super, super confusing. >> It really is. I think what your seeing is that SISO's are relying on their DEV and IT ops teams, right? They are partnering with the VP of platform, the VP of infrastructure, the VP engineering, because when you think about this new world security is really, the ownership of security is now shifting from the information's security teams to DevOps teams. So security teams still drive policy, and they still want to make sure they do the trust and verify, but the implementation of the security is now being owned by DevOps teams. So its a big cultural shift that's going on in organizations today. SISO's have to realize that it's no longer just them, but they have to partner with their DevOps counterparts to effectively address security for this cloud native stock. >> Right, so tell us a little bit about the relationship with Sumo. How do the applications work together? What's the solution look like when the 2 solutions are brought together. >> So Sumo has been a great partner. We have several joint customers. The simplest way to think about this is that Sumo does observability for Kubernetes, so that's logs, metrics, and tracing, and we do security from Kubernetes. We are the yin to their yang. What we do is we have taken all the intelligence we get from security and we feed it into the Sumo dashboard. Sumo customers get a single pane of glass, not just for the observability data, but also for their security violations, weather its for vulnerability, weathers it's for configuration or if it's for runtime threats, right? You get it all in one single place. >> Right. So I just want to get your take on kind of this rise of the momentum behind Hybrid Cloud that we've seen recently. Big announcement at Google Cloud show, with Anthos. Big announcement between VMware and Amazon. It always kind of swings back and forth. It was all in to public cloud and now there's a little bit of a pullback in Hybrid, but that's terrific for you. The fact of the matter is workload should run where they should run, they don't really care it's what's appropriate. Horses for courses, right? >> Precisely so, we see the shift from public cloud to Multi-cloud, and then from Multi-cloud to Hybrid cloud. The underlying infrastructure that makes that a reality are containers and Kubernetes, right? And that's why we've seen this tremendous momentum on Kubernetes. What we are seeing is customers that want to give their Dev teams that flexibility to pick their favorite cloud, or to do it on premises, their private clouds. But they want to make it in a single security solution that gets integrated no matter where you run your infrastructure and that's integrated back to your Sumo dashboard. So you have visibility across all Dev teams, all your application infrastructure, regardless of where they are running. There is one security standard that gets implemented. That is really, that's the future. You don't want to be beholden to a one claw provider, you want flexibility, you want choice. Kubernetes allows you to do that. >> Well and the whole thing becomes more autotomized, right, with autonomic memory, autonomic compute, autonomic store, throw that on an IoT and Edges and now you're starting to distribute all those pieces all over the place, which is going to happen. >> Kamal: It is going to happen for sure. >> All right, looking forward I can't believe we're almost through 2019, it still shocks me everyday I look at the calendar, but what are some of your priorities looking forward? What are you guys working on? What do you see coming down the pipe? >> Yes, so you touches on a couple of these. So today, is a lot of talk around Kubernete. We are seeing Kubernetes also get deployed in IoT and edge devices, we are also seeing they are being used to manage serve-less infrastructure. So we are going to continue to evolve as Kubernetes evolves. The other big trend that we are seeing in the market today is around service mesh. People talk a lot about Istio and Linkerd and using service mesh as your policy framework to drive consistent policies across applications, so that's another area where we are innovating very rapidly and that will become, I think, more and more real in enterprise deployments over 2020. >> Well, congratulations Kamal to you and the team. I think you picked a good horse to ride on, I should say ship, right, with Kubernetes. Thanks for taking a few minutes. >> No, thank you for having me. I can officially say now that I've checked off one of my professional bucket-list items, which is to be on the Cube with an old friend. So thank you for having me. >> Check that box man. All right, he's Kamal, I'm Jeff, you're watching the Cube. Were at Sumo Logic Illuminate from the Hyatt San Francisco Airport. Thanks for watching, see you next time.