(bright music)
(text whooshing and twinkling)
(crowd chatting indistinctly)
>> Hello, friends, it's theCUBE,
the leader in live tech coverage.
Lisa Martin with Dave Vellante covering day two
of Snowflake Summit 2023 from toasty Las Vegas.
I think there have had a glut of 100 degree days
the last 300 days.
I think that's changing.
I think it's pretty toasty outside.
>> I'm just excited to talk security and supercloud and AI.
>> You know, you can't not be excited
to talk about security, supercloud, and AI.
We're going to have a great conversation,
as one of our alumni is back with us.
Omer Singer, Head of Cybersecurity Strategy at Snowflake,
and Nico Popp, Chief Product Officer at Tenable.
I'm going to be talking about how customers
can really centrally centralize all vulnerability
and threat data in one place and unlock that holistic view.
Guys, welcome.
>> Good to be back on "theCUBE."
>> Yeah, we haven't seen you in a year, Omer, what's new?
We talked about the launch of the security data
workload last year,
I imagine lots of great new stuff this year?
>> I got to tell you, we've launched no new
cybersecurity products since last year,
and there's a reason for that.
We have been laser focused on the data platform level,
and we've had a slew of releases in terms
of making it faster, easier, cheaper
to collect all your security data in one place,
and customers have really been responding to that.
>> Nice, Nico, talk a little bit about, you know,
cybersecurity at its core as a data problem.
We hear leaders say that all the time,
customers are talking about that.
It's also a board level initiative, right?
We know that for sure. >> Oh yeah.
>> What are some of the changes and trends in cyber
that you've seen over the last year
that are really like, whoa?
>> Yeah, so first, thank you for having me here today.
I think there's a major trend in cyber
is the realization that, you know,
it's about cyber risk management,
and how do you manage risk?
It's a data game.
So cyber is becoming a data game, period, full stop,
which means data integration, right?
And then, you know, what do you do with the data?
You have to prioritize, right?
You have to prioritize all your security findings
across the attack surface.
I can't fix everything, what are the critical few?
You have to correlate, you have to contextualize,
you have to remediate,
so the ability to bring all the data together,
breaking the silos of cybersecurity,
that's the big trend, right?
And you see it all across cyber,
you see consolidation because of that, that's the...
Go to RSA, super fragmented market,
so platforms are emerging to consolidate cybersecurity,
and data is a primary form of consolidation.
>> Okay, so you're familiar, I'm sure,
with this Optiv chart, right?
>> Yeah, exactly, that's >> It's the galaxy.
>> Fragmentation. >> Yeah, yeah.
>> So, okay, (Nico laughing)
so I love this chart, 'cause it's just sums up
the nightmare that's, yeah. >> Something will happen.
(Nico laughing) >> So, okay, so explain
where you fit in the taxonomy
at Tenable. >> Yeah, so in cyber,
you really have two school of thought, right?
You have what I call reactive security,
it's like in medicine, right?
You're sick, you're being breached,
you're under attack, you're going to the hospital, right?
You're going to the emergency room.
I call it the EDR, right? (hosts laughing)
>> Yeah. >> But really,
there's also preventive medicine,
which we know works, right?
So Tenable, you know, we are leader
in vulnerability management,
which kind of the essence of proactive security,
and we have 50,000 customers, a lot of trust,
So we have permission to say, "Hey,
"you have weaknesses exposure across the attack surface
"beyond your on-premise, you own laptop," right?
Cloud, OT, active directory, Okta,
SaaS application, right? >> SaaS apps.
>> Supply chain.
So that's the idea behind Tenable One, powered by Snowflake,
is we can consolidate a lot of these logos,
and the platform is the data.
You know, what if, of course, all the Tenable data,
but what about other product that you have
from other vendors?
Bring that data together, prioritize better,
contextualize better, remediate better.
That is the big idea behind Tenable One
and what we call exposure management.
We believe it's a new category in cyber,
and that's all about preventive security,
make sense? >> Yeah, so yeah-
>> And I just got to say how timely this is,
because if in the kind of old days,
when all the interesting things happen on-premises,
security teams were focused on reacting,
I'd say 80% of the effort was on responding.
>> Yep. >> But in the cloud,
things happen too quickly,
and by the time you're responding,
it's oftentimes too late, the damage has been done,
and so it's kind of flipped.
Now, 80% of the effort is spent on preventing
in the first place,
but it's very much a data problem.
>> How, I was just going to say,
I understand Snowflake's cross-cloud strategy,
but actually, I don't.
I want to double-click on this, security specifically.
How do you deal with the shared responsibility model
across different clouds?
What's the communication with your
customers there? >> Yeah, I mean,
I think that's the thing with the cloud can be very secure,
but as a customer, you do have responsibility, right?
It's got to be configured well,
the services, the virtual machines that you run
in the cloud need to be patched.
That's on the customer,
and a lot of times, right? >> Manage your configuration,
your access, your privileges,
you are responsible for that, yeah.
>> Right, you're right, so- >> And especially in multicloud
individual cloud providers might have their view,
but a customer needs to have a unified view
if they have any chance of dealing with it, right?
And that's where Tenable has the ability
to identify the issues, and bring them in,
and then also use analytics in order to prioritize them,
'cause I mean, customers have thousands
and thousands of vulnerabilities, right, I mean-
>> The data is humongous. >> You help with the...
You help with the customer responsibility piece.
That's what I mean, yeah. >> Exactly, we really help
with like, generalized vulnerability management, right?
We call exposure management.
You know, should I fix that misconfiguration
on that workload?
Well, yes, because it's sitting on the internet.
That's another piece of data.
Should I fix that vulnerably on your laptop?
Yes, because you have a highly privileged user.
Should I fix that OT problem
on that host human interface, right?
And so on and so forth, so you can see
the size of the problem,
and by the way, which one do I fix first?
Which one is more critical? >> Right, so you can
prioritize. >> Yeah
>> You got to do it.
I just met this morning, the CISO of one
of our customers out of Atlanta,
flew into some, which is already fun, right?
Here's a security leader
coming out to a data >> Yeah.
>> Conference, right, it's very nice to see it,
very encouraging,
and what he shared with me is the reports
that he shows his leadership and the board
around the security posture, how things are trending,
take them a week to create,
and so once a quarter, they present it to the board,
spend a week preparing it, and guess what?
As soon as they finish preparing it, it's out of date.
Things are changing so quickly, right?
How do we enable that security leader
to have a near realtime view into what's the matter
in the environment?
Are they resolving the issues, right, before it's too late?
>> Yep, that data today is in Tenable, in active directory,
in CrowdStrike, in Snyk,
I got to get all that data, massage it, transform,
I mean, that is the silo, right, the issue,
and then I love your verb, unsilo, right?
And that's your tagline, we have the same tagline.
>> Yeah. >> You've got to unsilo
your chart, right?
You got to unsilo cyber security to raise our game.
You know, we're not going to raise our game and win that war,
or at least get better, right,
without, you know, breaking the silos, for sure.
>> To unsilo, sounds complex.
>> Mm. >> How do customers lean
on Tenable and Snowflake to help them do that?
And what's the realistic timeframe
in which that can be done so they can get a perspective
on the risks and the threats, and turn that dial down?
>> Omer: So we have a scoop for "theCUBE."
>> All right. >> Tell 'em, tell 'em.
>> Okay, well, two things, right?
This guy basically have an amazing platform, right?
All the security vendors have APIs, all of them.
You can use this API to ingest these silos
into one data cloud.
Once you have the data in there, you know,
Snowpipe and all these beautiful things, right?
You've got access to the entire stack, right?
You can SQL pipe, and you know, correlation,
you can do the ML, now the LLM, right?
We heard on the first day, everything is available there.
Even better, right?
That data can be shared.
So you may already have that data in Snowflake,
and you know, it's just one point away to be shared,
so their infrastructure remove all the plumbing
that a cybersecurity company like Tenable has to build.
I spent the last 20 years
building plumbing. (Omer laughing)
We want to focus on what we do really, really well.
We're a cyber expert.
We don't want to do plumbing.
They take all the plumbing away, so we love that, right?
We get much, much faster,
and the data is only, you know, one view away, right,
from us accessing it and adding the cyber value,
the prioritization, the contextualization.
>> And you can share that within an organization,
or outside of an organization, if you want,
>> Exactly. >> And or across clouds?
>> Absolutely.
I mean, that's one of the things that we're so excited about
from Tenable joining the data cloud
is that they have all this very important information
around what does the enterprise have to protect?
How's it going with locking it down, and all that?
And now, they're making it available,
and that's the scoop that we have for "theCUBE" today,
through data sharing, which means removing the friction.
I don't need to go out and build that plumbing,
integrate with an API, bringing it,
it's just showing up in my Snowflake,
and now, I can get to the important part,
which is analyzing it.
That's why we're so proud of the work that Tenable is doing.
We awarded them the Cybersecurity Partner of the Year award,
and it's just phenomenal work that Tenable
is doing on Snowflake.
>> What is it? >> Can I give you an example?
>> Yeah, yeah, please. >> Because like,
I think that's really telling.
You remember Log4j?
>> Yeah, yeah, who could >> December 14, right?
>> Forget Log4j? >> Everybody one,
like the entire world stopped,
starting scanning, right? (Dave chuckling)
It took weeks, month, right?
Imagine you have that data lake with all your data?
One query, I'm going to tell you where you have Log4j
in your data center.
One query, that's about a millisecond with these guys.
>> Yeah. >> Okay, now,
what if I also have the cloud security data,
and your Ory data?
You want to know where you have Log4j in your environment,
in the OT environment, (table thumping)
in your public cloud?
All the public clouds, second query.
Now, tell me where it is.
Okay, great, I haven't run a single scan.
I know now where it is, that, where the risk is.
Show me now where the critical asset, you know, are
that have Log4j.
That's the one I patch now before I go home
across my attack surface.
Simple example, game changer, all the sweat,
all the, you know, the midnight oil that happened, gone.
>> And all the stress. >> That's the power
of getting the data together. >> So, so,
that's a good example, Nico,
So what does it mean for Tenable to join the data cloud,
and how do I engage with that offering?
>> So we have a product that we call, you know,
which is our platform, we call Tenable One,
>> Sure, yeah. >> And so the data cloud
is totally transparent, right?
You're basically purchasing the ability
to do proactive preventive security
across the attack surface.
You know, one SKU, one price per asset,
you have all the technology from Tenable,
and then now, we're going to add the third party data.
You know, if you have CrowdStrike,
we'll ingest CrowdStrike,
so it's really, really simple, powered by Snowflake, right?
>> Yeah. >> And then,
but more to come.
>> Yeah, and this is- >> So wait, I don't see,
I just go onto the what, a console and engage, or...
>> This is what we talk about Snowflake
becoming the platform of choice for application builders.
In some cases, it could be a lightweight data app
that you build internally and stream it, and that's great,
but here is a substantial application
that thousands and thousands of customers rely on,
and under the hood, it runs on Snowflake,
>> Okay. >> And it runs better
than it did before,
and it has the ability to crunch the data,
have the insights. >> You do nothing.
>> Yeah. >> You know, you already
have Tenable, you have all our sensor,
the data moves automatically into Snowflake,
and then we have application to do risk management,
to do prioritization that you basically, you just log into.
>> So when you say it's transparent,
I don't even see Snowflake,
>> Yeah, yeah, yeah, exactly. >> I see Tenable?
>> Yeah. >> And then how
do I engage with Tenable?
Do I do that through the AWS console,
through Tenable directly?
>> No, so we have application, so you have a choice, right?
If you are a medium-sized company,
you can use our application.
I think what's very exciting is the largest customer,
they are building data lake on Snowflake.
Where they see a lot of the value is the data,
the enriched data that we bring with the risk scoring,
that contextualization,
>> It's all shared to them. >> So they, you know,
they have a lot of tools,
and so accessing just the data, and then with Snowflake,
the ability to access that data effortlessly,
they don't have to export and reimport in another tool.
They basically just move, you know, accessing your table
on one click, (fingers snapping)
on one permission, super powerful,
and then now, they augment all the other data
they may have around cybersecurity
instantly. >> And it's, and who
are the users?
I imagine CISO, security practitioners,
but it's probably not just for them, right?
>> So the CISO is the ultimate buyer, right?
It's the guy with the budget.
You know, we're now spawning a lot of these logos,
so what do you have, you know, you have the VM buyer, right?
You have the OT security buyer increasingly converging,
you know, with the IT/OT convergence,
you have the cloud security guys, right,
that basically, they're opening the cloud,
but they're also doing governance, and they need security,
you have the AppSec, in fact, that's the beauty, right?
CISO have an AppSec team, they have a VM team,
they have an OTSEC team, right,
and they're all doing the same thing.
They're scanning, they're ingesting, they're prioritizing,
they're all doing their thing
>> Yeah. >> In their eye
with their chain,
and you know who would take advantage of that?
The bad guys, because they know we're silo,
so we're not effective,
and they use the silos, it's called lateral movement, right?
>> Yeah. >> To break in.
>> Yeah, Patch Tuesday means Hack Wednesday.
(Omer laughing) >> Yeah, exactly.
>> Yeah, and we should also mention the compliance team.
I mean, that's a team that we see increasingly
using Snowflake.
>> Ah. >> I can't tell you how
many compliance teams are still relying on screenshots,
and hey, can you email me a screenshot of your system?
Let's do away with all that, right?
Let's have everything be data driven
so that we can automate it and free up the teams
to do what they need to do.
>> Especially 'cause the cloud is like now
the first line to defense in security,
and now, you've got the CISO,
he or she has the AppSec team
>> Yeah. >> Shifting left,
they're responsible >> Yeah.
>> More and more. >> For it, right?
You have all those roles that you just talked about,
and then you've got audit as like the last line of defense.
>> Right. >> Right, so to the extent
that they've got better data,
they can do a better job of...
>> Absolutely. >> You forgot SecOps, right?
And that's interesting.
>> Yeah, yeah, yeah. >> Even what we're doing
around preventive security will be a huge boon for SecOps.
>> Yeah. >> And that's really where
the left, preventive security, meets the right,
reactive security, and the value of Snowflake,
because imagine, right, if you are an analyst in the SOC,
you know, it's 1:00 AM, and you see
an activity on that device,
and you have to make a quick decision,
do I ignore it, or do I pass it to the more expensive guy?
You need contacts.
What's that first question?
Is that device vulnerable?
Does he have a critical vulnerability like Log4j?
Okay, does he have Quad Strike to protect me?
Great, oh, Quad Strike is not in protection mode.
Ah, that's a problem.
Third question, who does he belong to?
>> Hmm. >> Oh, he belong to
an executive.
My goodness, what does executive can access?
Salesforce customer data, you know,
or source code, maybe, you know-
>> HR data. >> So you see these question
are everything that exposure management can answer
by bringing the data together.
Now, so if you're a SecOp guy, you want that data.
So if you're building your SecOps data lake
on top of Snowflake,
you are one data sharing away (fingers snapping)
from getting all that context, all that intelligence,
that exposure intelligence at your fingertip,
and that's what we see in the partnership.
>> So you can remediate, escalate, (clearing throat)
or avoid- >> Prioritize,
prioritize your activities. >> Or avoid a false positive.
>> Yeah, yeah. >> Exactly,
critical. >> That's exciting, right?
That's why they're our Partner of the Year
for cybersecurity. (Nico laughing)
I think it really is >> I can see why.
Congratulations. >> Exciting, yeah.
>> What's next for Tenable One and Snowflake?
What's next?
Crystal ball time, Magic 8 Ball,
whatever you prefer. (Omer chuckling)
>> Look, I think we learn about more of, you know,
they're working up the stack, right?
They're bringing, you know, so a lot of application
could be data sharing, I think, is the next thing.
>> Yeah. >> There's a lot
of opportunity once we share the data.
Some of application could actually run
in the warehouse of the customer, right,
the large customers as well,
so I think your application environment is very interesting.
Customers want to use our application
and their application on top of Snowflake,
so I think that will lead probably to, we hope,
joint, go to market together,
because we're very aligned, right?
They are trying to break the silo of data,
we're trying to break the silo of data security,
and we can help build that ecosystem,
we can, you know, work, we're very complimentary,
we don't step on each other, they're not trying to be us,
>> Yeah. >> We're not trying to be them,
so I think there's a lot of, you know,
not only product technology, but joint market.
>> Yeah, and I think tackling the cybersecurity skills
shortage is so important. >> Yeah, absolutely.
>> That's when we hear announcements around generative AI
and LLM coming to the platform, right,
being supported within the data cloud.
Imagine being able to ask my vulnerability data
natural language questions?
All of a sudden, that's available to more folks
within the enterprise.
Hopefully we can do a better job
as a whole of protecting the company, so-
>> Come back at RSA.
>> Yeah. >> RSA, Black Hat,
almost three months later, >> Black Hat in August, yeah.
>> Yeah, because, >> All right.
>> You're 100% right.
I think one easy powerful use of LLM or generative AI,
explainability.
>> Mm hmm. >> People do not
understand security. (coughing)
What is that vulnerability?
Why are you rating it high?
What does it take to fix it?
Why should I fix it?
>> Dave: Yeah.
>> In plain English or French, right?
(everyone laughing) Right in front of you.
You know, we'll show things like attack path analysis.
You know, we actually use AI to do some of these things,
and they, plain English, it explained, okay,
the attacker is going to go compromise that server
that's sitting on the internet using that vulnerability,
then he's going to sniff the network.
It was like, we were blown away,
and mere mortals >> Wow.
>> Can now understand complex construct from cybersecurity.
That's a low-hanging fruit.
>> That's scary, though, there's two
sides to that reason. (Rico and Omer laughing)
>> True, true. (Dave laughing)
I like your side, I'm going to stick
with your side. >> Yeah, yeah, we're
the good side, yeah. >> Mm hmm.
>> Good side. >> Okay, okay.
>> Nico, Omar, thank you so much for coming on "theCUBE,"
explaining all that has gone on in the last year
despite having nothing to announce,
(everyone laughing)
but really, what Tenable one is enabling organizations
to achieve, that shared responsibility model,
We could, I know we could keep talking,
so you guys are going to have to come back.
>> Ah, we will. >> We will, thank you
for having us. >> All right, pleasure
to have you, thank you.
>> Thank you. >> Thank you.
>> For our guests, and for Dave Vellante, I'm Lisa Martin.
We're going to be back after a short break,
so don't go too far.
Get your cup of coffee, walk the dog,
we're going to be talking (Dave chuckling)
about the Snowflake Media Data Cloud,
and LiveRamp's data journey.
You can find all of this content from Snowflake
on theCUBE.net.
All theCUBE content is there.
Our analysis and editorial content is on siliconangle.com.
Dave and I will see you after a short break.
(bright music)