(electronic music)
>> Announcer: Live from Barcelona Spain,
it's theCUBE
covering Cisco Live 2020.
Brought to you by Cisco and its ecosystem partners.
>> Welcome back to Espania this is theCUBE
the leader in live tech coverage,
we're here in Barcelona,
at Cisco Live 2020 inside the Devnet zone.
This is day one Eric Herzog is back
to talk about cybersecurity he's the CMO
and vice president of global channels
for IBM storage, good to see you again my friend.
>> Dave, Stu, thank you very much for having us
we love being on theCUBE and you are the leaders
in IT information no one better especially for realtime.
>> Thank you very much for that so we're going to talk cyber,
very important topic it's a big tailwind for Cisco,
IBM obviously a big player in security
its on every CIO's mind.
What's your angle though in storage specifically?
>> Sure, what I think one of the key things
is that when people think security
they think keep the bad guy out
and when the bad guy gets in chase him down and catch him.
What they don't realize is sometimes it could be a day,
a week or weeks till they know the bad guy is in.
So how are you going to protect yourself
when all your valuable data is exposed like that,
and then when you do have an incident,
particularly malware or ransomware,
how do you come back to a state
where you know you have good data
and you basically don't have to pay the ransom
or in the case of malware that data is good data.
So we can help on both fronts with the things we've done
with our cyber resiliency play inside our storage portfolio.
So compliments and gives IT
and the CSO as well as the CIO,
an overall comprehensive security strategy
so that when they're in my house how am I keeping them
from somehow stealing it even though they're in the house,
that's what we can help with.
>> Okay I see where you're going here so
and by the way I've seen stats that say
it's upwards of two hundred or three hundred days
before people even realize they've been infiltrated
and then it becomes a matter of okay how do I respond,
now you've got malware, not only malware
but you've got ransomware,
and so let's talk more specifically about
how you attack that problem.
Do you help me sort of find when somethings been penetrated?
By looking at the backup corpus?
analytics? what do you guys do?
>> So we do a couple things,
so first of all we do have in our Spectrum Protect Suite,
which is our modern data protection,
it does the backup et cetera
is we can detect anomalous activity
in backup data sets, snaps and replicas.
We use AI and machine learning to understand
if that's a new occurrence so lets take an example,
the backup data set runs from 11 a.m. to 1 p.m.
at midnight you have all kinds of weirdo backup activity,
why? Because if you're malware or ransomware
you want to get to the secondary data sets first
before you attack the primary
otherwise they'll just go back to the secondary,
yeah they'll lose some time but they'll go to that.
So we can detect that and alert the backup admin
the storage admin whoever you tell us to do.
Then overtime if that process changes
and so you're always going to have certain activity
at time that previously didn't.
We learn that and stop sending alerts
and stop sending notes.
And obviously we don't say we think it's malware this
or ransomware that,
what we do is alert them to anomalous activity
as an attack could be starting.
So that's just one of the things we do,
we have much more that we do in cyber resiliency,
but in that case monitoring and detection, threat detection,
we help do by looking at secondary data sets.
>> Eric, wonder if you could bring us on sign
to the organization of your customers,
because is this something that just the storage team buys
or are you being bought in you said by the CSO
or you know some other organization
and you know want it installed
then how does this play out inside the organization?
>> Sure, so it's a hybrid strategy
so lets take for example,
we have a thing called Safeguarded Copy,
we've had it for eighteen months now in the mainframe,
wildly successful, wildly successful,
not just with the new Z but with the old Z14
and the reason is we would go in to the storage guys,
and in the Z world money was tight,
and we said what if we could help you protect against
mal or ransomware or even internal threats
we has dual access control capability
from an internal management perspective they said "really?"
And then the storage guys actually took that
to the security team and said guess what we can help you
and they said "oh my god."
and they gave money actually to the storage guys,
in other instances we approach the security side
and in fact one of the things we've done
is talked to a lot of our partners
who have a security practice a storage practice
and never thought about
thinking of them in a holistic fashion,
so from a partner perspective
it gives a more holistic solution to the end user,
they sell keep the bad guy out,
track the bad guy down and by the way did you know
that IBM's flash system will do data-at-rest encryption
with no performance penalties so you can encrypt
everything on that and there's no penalty,
it's at line speed so if they're there for a week
or two hundred days or whatever,
that data is protected because it's encrypted.
So that's more of a
the partners work in a holistic security strategy.
>> I mean IBM has a long heritage in security,
RACF all you old mainframers,
Resource Access Control Facility
was the gold standard back in the day,
and really you know set the road map
for you know best practice.
So obviously things have changed a lot,
what is best practice today are you recommending
customers set up air gaps?
certainly tooling but more tooling is a challenge for people
but how are you seeing customers combat the problem?
>> So what we do is we look at if from a storage perspective
so we have a couple things,
A we have air gaping to tape and air gaping out to clouds,
so our Spectrum Virtualize sits on-prem and off-prem
we can do air gaping with our Spectrum scale product
which are AI and big data again put it out,
IBM can all put eventually a snap
or a replica out to a cloud, gives you a logical air gap,
tape will work with anything file, block and object,
then you have a physical air gap,
so that's one aspect, the other thing of course
you had mentioned already is encrypting,
you can encrypt file block and object data,
in fact we can worm it, so make it immutable
and then encrypt a worm,
so and in fact with our object storage
because of the way we do our hashing
and the way we do our erasure encoding
and the way we hide the key,
is we basically make it almost non crackable.
So file, block and object, what we do to prevent
and then the air gaping
and the last thing to do is incidents recovery,
so they had an incident to go back to a known good copy,
so the Safeguarded Copy we can basically mount
instantaneously snaps or replicas,
they would do a ring-fence network
cause obviously they do it online with the real network
they could crash it or compromise
so you set up a ring-fence network
and you keep bringing back the snaps or replicas
and look it at right,
have the app guys come in run an app
and "oh no there's malware okay we can't use that snap"
and it's very easy to do,
we can automate the process they have to put the ring-fence
around and they can go back to as many copies
or replicas they have whether it be
the file side block or object.
So that would help in incident recovery
after they know they've had an attack,
they've cleaned it up, now you've got to make sure
that your secondary data is good data
before you restore it,
otherwise you could put the malware,
ransomware right back in to what you had.
So the recovery side, protection side on-prem
with encryption and then obviously with air gaping
protection but if you will out of house
either physical or out to cloud.
>> Eric help us connect the dots
between what your talking about
and the audience here at Cisco Live,
obviously networking people there's always
a little bit of security inside there,
so help us understand how these go together
and the reception you get from them.
>> Well again the reception is very good
because what we do is,
Cisco is looking at doing all the network security
we're a partner of theirs again allows them
or their channel partners to go in
and say here's a holistic strategy, keep the bad guy out,
okay here's what you do to track the bad guy down,
by the way here's what you do
on the network side with our Cisco gear,
here's what you can do with the storage gear so,
partner can go with a holistic strategy to the end user
right and say here's what we will do for the network,
here's what we'll do for the storage
and of course it doesn't step on each other
because you're looking at the network traffic,
where looking of course at primary storage
and secondary storage and actually
hybrid multi cloud storage as ways for them
to protect their data so it's completely
in complimentary play,
by the way the other things that IBM security division does
both to keep the bad guy out and track the bad,
are also none of these things step on each other,
it allows you to have a truly holistic strategy
cause right now network security is semi thought about,
storage security is almost never though about.
So it's like let me give you a whole strategy
that's going to work bring the data back,
help you understand it,
keep the data from being stolen, immutable copies,
if they're get there and they steal the data,
encrypted data, so all kinds of strategies
the networking guys just so it allows the end user
or certainly the CIO to go to the CSO
or to the chief legal officer
and say I've got a holistic strategy yes I'm good,
it's not an if question it's a when,
so here's what I'm doing to reduce the incidents time,
here's what I'm doing to keep the bad guy out
which is not what we do in the storage division,
here's what we do if they're in to keep the data safe
so we know if it gets stolen it can't be used.
And by the way once we clean up the malware and ransomware
we need to get you up and going as soon as possible
mister CEO or CFO now or the line of business guys,
we can do that with without having
the data being compromised or the data being bad data.
>> It's interesting to hear tape as part of the equation,
right it keeps coming back,
but it is part of the best practice,
so there's the air gap but tape kind of the last resort,
you don't want to really recover from tape,
but you know if you have tape in an offsite location,
you know if it's a lot of data it's fast to move,
because you're putting it on a truck,
it may be an RPO issue,
but are you seeing that certain industries,
financial services in particular,
maybe or certain companies are mandating that last resort?
>> So what you're seeing with tape overall,
is for IBM to renaissance, both inside the data centers,
so from that perspective think enterprise accounts,
the global fortune two thousand,
and from that perspective
it's partially about the air gaping,
it's partially I've got gobs of data,
what's the cheapest way to make sure I've got a backup copy,
okay then we're also seeing a huge take up
with hyperscalers and cloud providers.
So we have several of the top ten cloud providers
on the planet that when you buy their archive
or cold store that actually goes onto IBM tape platters,
so you have a cost angle which is independent
of the cyber resiliency side,
then you've got the cyber resiliency side,
and for us when we're talking bigger accounts,
so think enterprise up to that you know fortune two thousand
they're probably going to do different things
for different data sets,
so certain things might be snapped out to the cloud,
other data sets might go out to tape
and their are regulated industries still,
like healthcare, finance and obviously the government itself
where sometimes tape is still like mandated
and so even though it's legacy
the bottom line is they need it
and then once you get in there
between the cost angle of what they can save
and the fact that oh wait,
I thought just back to well wait,
what about malware and ransomware
and by the way a smart company
is going to use a hybrid combination,
so they'll have some stuff going out to the cloud
then they have on premises.
Again our safeguard copy on the mainframe
is actually can be on premise,
so you've got five hundred immutable snaps
that are encrypted
and then you keep going back to your final one
that didn't have the malware and ransomware,
so it's probably a combination strategy
even on the storage side which would include tape,
what we could do for file block and object on flash
we could even do it for if someones got older disk
or you know want to use second
or like IBM cloud object storage is mostly done on disk,
well guess what now that older data is encrypted
it's wormed, it's protected,
by the way we can air gap IBM cloud objects
storage out to the cloud too,
so it may well be a very comprehensive strategy
based on application workload use case
value of the data set
and obviously with things like tape and backup to the cloud
you have a secondary use case,
which is not just about the security
but I need to back up the data in case there's a fire
or me being the silicon valley guy
need to go out to tape cause
there might really be an earthquake
and as great as IBM arrays are
or any of our competitors arrays,
cause we as you know with our software support
all our competition, those arrays are going to be crushed
when the building falls down in silicon valley,
so you might need to have tape for cheap backup,
so there's a lot of different angles
that involve not just cyber resilient
but the combination of cyber resiliency
and really data reliability and data safety
that are independent of the cyber attack worry
and you can combine them cause
of they way we put this together with our technologies.
>> Yeah your talking about a comprehensive strategy,
which is very important because
this has become a board level topic and it's no longer
I'm sure it still happens in many organizations
"oh yeah check off item yeah we do that,
we do backup to whatever cloud tape" check off,
but in many organizations,
if not most certainly publicly traded organizations,
it's a board level conversation
and they really do their homework,
down to even the testing,
although testing is a little tough right,
it's time consuming and cumbersome,
but definitely thinking through
the board wants to know what happens
if okay what about this what about that
and they've experienced a lot of different permutations,
so it's again not just a check off item anymore
you can say oh yeah we comply
it's really no we need something that actually works
because we know we're going to get hacked.
>> Well that's part of the reason Safeguarded Copy
on the mainframe side has done so well,
companies that are using mainframe
it is the most mission critical workloads,
the highest transaction workloads,
so in the financial sector, in the government sector,
in some of the big giant manufacturing or retailers,
they're running mainframes and they have been for years
and they're not stopping
and so for them system uptime is an issue,
security is an issue,
so the Safeguarded Copy for us
has really been really a grand slam home run product,
to use a very US centric term,
but maybe a sixer if you like cricket
or it was a try if you like rugby,
but for all those various sports
it's been very successful because of what they use
that mainframe for and how critical that data,
so it's been very successful from that perspective.
>> They're like oh,
how about, you're obviously sharing
a lot of knowledge specific to storage,
I said before IBM's got a long heritage in security,
how do you collaborate with the other
you know security pros at IBM,
how much of that sort of filters in to storage and back out?
>> So what we do is we make sure
that they're aware of what we do,
they're looking at some new things,
that I can't disclose,
around security that would make places for people to go
and practice if you will, and do some other things.
We're going to be involved in that program
which allows people to try things out if you will
in a very secure way
and someday IBM's going to do a cross
storage will be part of its security
and some of the other divisions
but we haven't yet rolled it out,
but it's something they're working on that we'll be part of.
And then obviously there are many times in the big accounts
where you know the security division are in there
the storage guys are in there,
but the account team knows that there's both issues
and bring us together inside of a big account,
so that happens as well more if you will
from the sales side versus this official program
that we're going to be launching shortly later this year.
>> So wrap it up what's going on at Cisco Live?
What are the conversations like with customers?
What's IBM all about here?
>> So for us our big thing has been about
both our hybrid mutlicloud technology,
which allows seamless move data back and forth,
and we have a product called the Versastack,
which incorporates our award winning Flashsystems,
so we're positioned to either standalone
or with the Versastack we have a Versastack in the booth.
And then also obviously cyber resiliency,
so I just presented yesterday on hybrid multicloud
and then today I presented on cyber resiliency
and how those things work together,
and what we do as Cisco,
so it's been a very good show
and you know very successful for IBM here at Cisco Live.
>> Good to hear, well you guys are great partners
thanks for coming on theCUBE,
love the shirt as always Eric Herzog IBM thanks so much.
>> Thank you.
>> All right your welcome,
all right keep it right there everybody,
we'll be back with our next guest for Cisco Live Barcelona,
Dave Vellante with Stu Miniman for John Furrier,
we'll be right back.
(gentle electronic music)