(upbeat music)
>> Hi everybody, welcome back to Las Vegas,
this is Dave Vellante with Rob Stretchay
and you're watching theCUBE's continuous coverage
of HPE Discover 2023, we go out to the events
and extract the signal from the noise,
we've been doing that 13 plus years
around HP and now of course HPE.
Bobby Ford is here, he's the Senior Vice President
and Global Chief Security Officer
at Hewlett Packard Enterprise, Bobby it's great
to see you, thanks for coming on, first time in theCUBE.
>> It is the first time so that
means I've officially arrived-
>> Dave: Yeah.
>> Bobby: So thanks for having me.
>> You got it and I want to start,
we hadn't met until just now but I knew you
from your stage performance at Antonio's
All Hands on, I think it was April 4th-
>> It was.
>> Dave: Down at Storage Day- >> Yeah.
>> Dave: They flew the analysts down.
>> Bobby: Right.
>> What they did is they invited the analysts
into the All Hands meeting, they kicked us out
before the Q and A but it was still really cool.
(Bobby chuckles) And Bobby was the MC
and I guess you guys rotate the MCs
so you were there that day and it's a big party,
I mean it was unbelievable- >> Yeah.
>> The cultural injection.
>> It's very different and I think it speaks to the culture
that we have at HP, like we really like to have a good time
and we like each other and that's always a plus-
>> Dave: Yes. >> When you like
what you do and you like the people that you do it with.
>> Well like I said, we've been covering HP
and then HPE for 13 years and when the company
was splitting apart it was very painful
and you could just sort of see it in everybody.
At that meeting, I mean people were proud,
they were nodding- >> Bobby: Yeah.
>> They were cheering, it was very cool so-
>> Bobby: Yeah. >> Congratulations.
>> Bobby: I'm glad you were able to make it.
>> Yeah, me too, it was really eye-opening,
I hadn't been back in Houston for awhile,
anyway let's talk cloud security,
hybrid cloud security, your role,
start with your role, what do you do, do you spend time
like internal security making sure HPE's secure?
Sales guys I'm sure are dragging you out all the time.
>> Yeah, so I do a little bit of both
so I'm responsible for our enterprise cyber security,
that's how do we protect HPE, how do we protect HPE assets,
how do we protect HPE data, but I'm also responsible
for our cloud security services organization
and that's how do we protect our cloud environment
that we give access and we have customers in.
>> Around GreenLake.
>> Around GreenLake, yeah exactly, exactly, yeah.
>> Well so how do you do it, I mean what
is different about what you're trying to do
than sort of conventional security?
>> Yeah so we recently conducted a research report
with the Ponemon Institute and one of the stats
that stood out in that report to me
was something like 68 or 70% of people
are concerned, or 58% sorry, 58% of people
are concerned about security as it relates
to their cloud transformation journey
and you would think that that number is low
and it's not that the others are not concerned
about security but I think that many people
have this misperception that once you go to the cloud,
or once you go to the public cloud
that you no longer have to worry about security
and that's not the case and so what we've discovered
in the public cloud world, the private cloud,
the hybrid cloud model is that security
becomes a shared responsibility between you,
the cloud provider and then those that you have
interconnectedness with, so in my role,
back in the day I would focus only on
our internal program but now I'm having
more and more conversations with customers
because it is a shared responsibility that we have
with them as in relation to cybersecurity.
>> So I'm going to ask you to put on your internal
security hat and then talk about your sort of
external and your customer one.
As a CSO- >> Bobby: Yeah.
>> When you have, you got stuff running on prem,
you got data centers all over the place,
I presume you've got stuff going on in the clouds,
you know you're partners with all the cloud companies,
each cloud has a different, you know,
it's own shared responsibility model,
it's got its own primitives, you got to connect to those
so it's a complicated situation for a lot of CSOs.
>> Yeah.
>> How do you see that evolving and how are you
and your peers trying to reconcile
all those differences and understand
all those shared responsibility models?
Do you just say, you know what,
we're going to go mono cloud or do you say OK,
we're going to have to somehow create an abstraction
layer and simplify across those clouds?
>> I've been doing cyber for awhile
and I've, you know, I'm a technologist at heart,
and I think that as it relates to the cloud
we've gone through several iterations
and when I say we, I mean the security professionals,
we've gone through several iterations
of how we respond to the cloud
and I think our first response was cloud never,
we just didn't trust it, we wanted our data
and our assets, our infra in our environment
so it was cloud never, and then we you know
morphed into cloud maybe and so we started thinking
maybe it's not that bad, we started taking tours
of their facilities and we started having conversations
with their security people and was like maybe cloud,
and then I think we got to this point
where it was cloud only, public cloud only
and it was like you know cloud first,
cloud only, no one wants to build any type
of data center, I want to get rid of it.
I think that where we are now,
I would call it cloud when it's right,
I love in Antonio's keynote, he called it cloud smart
and I think that's where we are
and in this cloud smart world, I think that it will only
become more complex so I tell any of,
you know, the CISOs that I know,
if you're not comfortable working in complexity
you should probably get another job.
(chuckling)
>> Well I think you hit on a great point
and I think Antonio and everybody
has been talking about the edge, hybrid cloud,
how do you stretch across that, what are you seeing?
Because you must be, I mean, I was with HP
a long time ago and we had the cloud back then even
and it was, you started to look at all the different
data centers, all of the different partners
and especially where you are working
with so many different clouds, how does that complexity
play in, especially when you have edge, you have hybrid?
>> Any time you're dealing with a complex
environment, I think it's critically important
that you have a great framework.
The reason why I'm at HPE, honestly,
and I don't say this you know because HPE pays me,
they do, but that's not why I say this,
(chuckles) I think that the framework
has to be edge to cloud and if you're a security
professional, I used to call it data to cloud
but I was just, because it's not always data at the edge
but it's edge to cloud and when I say it's not always data
I mean you could sometimes have sensors
or just input output, so I think you have to think
edge to cloud and your security framework
which we wrote a white paper how security practitioners
should think about security from edge to cloud because
I think that's the only way you can tackle that complexity.
Understand that you can't secure everything.
>> Right. >> So it's
critically important that you prioritize
and that you take a balanced approach
and you look at security from the edge to the cloud.
>> So the premise that we put behind this thing
we call super cloud is the more consistent
you can make that experience, the better that experience
is going to be, the less muck you're going to
have to deal with and the safer it will be
so I'm asking you now to put on your
sort of external hat, when you think about GreenLake-
>> Bobby: Yeah. >> And your promise
to customers, how do you talk about that shared
responsibility model, what are you responsible for,
what's the customer responsible for?
>> I think it depends on the nature of the relationship
that we enter into with the customer
and they have to understand, hey, where are my workloads
and what relationship do I have, what third parties engage,
where do I have connectedness, and then who's responsible
for monitoring that connectedness?
And honestly it's a case by case basis,
I mean it's done on a case by case basis
so it's not one size fits all so what I would say
and this is to any of the CISOs that I talk to
that are customers of ours, it's important
that you have conversations, it's important
that you have conversations and that you understand
with your internal teams where you're responsible
and security is prevent, protect, respond,
where you're responsible for prevent,
where you're responsible for detect,
where you're responsible for respond
and then where HPE is responsible.
>> So I like how you described it before
like first phase was cloud no way,
and you got that from a lot of customers,
particularly in financial services
and then maybe the hey, we're all in but nobody's really
all in but the other piece is the cloud,
the definition of cloud has changed, it's expanded.
We were talking to Xavier Poisson yesterday
and he's, "I've said this before,
"the cloud is an operating model, Dave get it,"
and I'm like, "OK, I'm with you,"
so the cloud is now the first line of defense
however you want to define that cloud
so I'm interested in how the CISOs role
has changed as a result of that
so you got the cloud, now you're asking developers
to shift left and deal with it,
you've got audit in the back end,
they're kind of the last line of defense,
so how has that role evolved and evolving?
>> Like I spoke to earlier, I think that
we've come to a place where we recognize that
A, we can't secure everything,
and I think that that's really important to recognize
that you can't secure everything so then
how do I prioritize what's most important
to the organization, how do I prioritize
what's most critical to the organization?
I think B, it's evolved in that I understand,
like I said it's going to be complex
and I think that hybrid is here to stay
and so understand that hey I can't secure everything,
it's going to be complex, how do I then prioritize
in my hybrid world what's most important and then make sure
I have the right controls in place to secure it?
>> I remember years ago I was interviewing Robert Gates,
former Defense Secretary and it was at the time
when security was becoming a board level issue
and he sat on a lot of boards and he's like,
"Oh it's absolutely a board level issue
"for the ones I sit on," and since that time
we've seen it go from, you know,
just the SecOps team- >> Right.
>> Dave: The security guys- >> Yeah.
>> Dave: Folks like you who have been
in it their whole life, oh yeah,
security, that's somebody else's problem-
>> Right.
>> And it trickles up to the board,
now it's sort of trickling out throughout
the organization so my question is,
well first of all statement, bad user behavior
beats good security any day- >> Bobby: Yeah.
>> So how do you create a security-aware culture?
>> That's a phenomenal question,
thanks for asking it, um, I think that most people
today, and maybe it's just because I've been doing it
so long that I think most people are aware,
I think most people are aware of security risks,
most people have been impacted personally.
Remember, there was a time when the only time
you were concerned about, you know,
something happening, a data breach or you were concerned
about a compromise was at work
because you know you still did your banking
at the bank so the only time you were concerned
about cybersecurity was at work.
>> Dave: You were air-gapped.
>> Yeah exactly, but now that we're doing
everything online, now I've discovered
that I went from people thinking
hey security is doing too much in the company culture,
hey you're doing too much to people saying
you're not doing enough, right?
They're pushing you because again personally
they're seeing the impact of cyber attacks
and they're seeing the impact of cyber risks
so I think that the culture is actually more aware
now than it's ever been and then our responsibility
and it's something that I don't,
so no one is like watching this interview
that works at HPE, right, so I can say like-
>> Yeah, of course. (chuckling)
>> OK, and no one is listening to you-
>> We guarantee you- >> No one-
>> We're filtering on the content.
>> Cool, this is private, so no one
that works for HPE is anywhere around right?
>> Right. >> OK cool,
so I want to get us to a point where we're equipping
people to actually respond themselves
and what I mean by that is imagine if you will,
this is me being visionary, imagine if you will
you get into work super early you know,
and you work in New York and you receive
this phishing email, you know it's a phishing email, right
because you're so smart, you're brilliant
so you know it's a phishing email
but it wasn't just sent to you
it was sent to 20,000 other employees
but because you're so diligent,
you got to work super early in New York City,
imagine if you had the power to pull that email
from your fellow colleagues, how wonderful would that be?
I want us to get to that point.
Right now the way that we do security
is the employee sees it, they respond to the security team,
the security team sees it, they evaluate it,
now you've already told them it's a phishing email,
after they evaluate it, they contact the IT team,
the IT team then takes action to pull the email,
imagine if we equipped you to do that yourself.
>> Yeah, I think that's the key is that it's everybody's
responsibility- >> Exactly.
>> And it's enabling everybody and I think
we actually had a saspoly, saskatuen,
or not saskatuen- >> Dave: Saskatchewan.
>> Saskatchewan- >> Bobby: OK.
>> Polytechnic on and they talked about
how they're actually using GreenLake now
because they got hit and they got hit
by ransomware- >> Yeah.
>> And it was encrypting all of their VMs
and taking them down and actually HPE helped
bring them back but now they're actually using GreenLake-
>> OK. >> So to their point
and their Director of IT who was on here
was talking about the fact, or Vice President of IT
was talking about how that was a really important lesson-
>> Yeah. >> About how they
responded and how they used Green.
Do you see a lot of customers looking to you
and saying, well how do you use GreenLake,
how do you use this in that model?
>> Yeah absolutely, and what I think the biggest,
not the biggest benefit but one of the biggest benefits
of GreenLake is that it allows you to manage
that hybrid world from a single platform
which is phenomenal because then when you're thinking
about all right, training up new users
or onboarding new users right,
so that they can do the management as well,
you're not training them or onboarding them
onto multiple platforms but it's a single platform
so like you were saying it's a consistent experience
as it relates to management of those different workloads
or those different cloud environments.
>> So I want to unpack that vision that you just laid out
and think about cloud as I just kind of redefined it
you know, clouds everywhere, the thing about
GreenLake and this hybrid cloud,
the super cloud is it really democratizes security.
>> Bobby: Yeah. >> Because you've got
the best SecOp pros in the world worrying about
the physical security, all their responsibility-
>> Right. >> OK, check,
that example you just gave about the phishing,
when stuff goes wrong you can fix it at scale
really fast, that's that vision and then the other thing
is I presume if you make mistakes
you don't make the same mistake twice
at the back end anyway now and if you can get
the employees and the users to that level,
that scales as well- >> Bobby: Yeah.
>> That's a different world and like you said-
>> Bobby: Yeah, yeah. >> Than what we're used to.
>> Because like we say it all the time,
security is everyone's responsibility,
I say well if it's everyone's responsibility
why not empower and enable everyone?
>> How about AI?
>> What? >> How about AI?
>> What's that?
>> It's something they invented last year, last November.
>> AI, Allen Iverson?
(chuckling)
>> Practices and practice.
>> Practice. >> We talking about practice.
>> What you talking about? (chuckling)
Practice.
>> We could talk basketball, I think
it's made some big grades- >> Bobby: Yeah.
>> Excited about that. >> Rob: Yes we are.
(chuckling)
>> So have you seen evidence of the attackers
using AI or is it still too sort of hard to find?
>> Um, people love to ask security
professionals "What keeps you up at night?"
>> Dave: Yeah.
>> "What keeps you up at night?"
And when I hear that what I hear is,
"What are you most concerned about?"
And so what am I most concerned about?
I'm most concerned that the adoption
of advanced technologies by our adversaries
is outpacing ours so to answer your question,
yeah, but they've been using it long before
like they didn't just start using large language models,
they've been using it but the scary part
and what's been introduced and everyone's talking about
you know ChatGPT-4 is that now
individuals that don't understand AI
are able to use AI, that's the scary part.
That was the scary part when we went from
you know, people needing to really know
how to write code to attack you
to someone just needing to download an app,
like that's all I got to do now,
I can attack, I can download an app.
>> Script Kiddie.
>> Yeah, exactly. >> Yeah, yeah.
>> That was the scary part. >> Yeah, yeah.
>> That's what we're witnessing now
in the adversary community with the adoption of AI.
I say all of that to say that I'm a huge fan
of generative AI, like a huge.
So again no one's watching this,
like no one's listening- >> No, no.
>> No one's watching, OK cool, I haven't written
a text message, now don't tell her this,
to my mother in about three months
because whenever she texts me I cut it,
paste it into ChatGPT and is like write
a response to my mother, write to this text message
and it's so thoughtful and it's caring-
>> Rob: And loving.
>> And then I just send it right back to her.
She sent me a card the other day
saying that I was so responsive lately
and she thanks me so much and she loves me so much
and I was like you're welcome, right,
like no problem, so I'm a huge fan of it
but it's a tool- >> Rob: Right.
>> It's absolutely a tool and like any tool
it could be used for good but it can also be used for bad.
>> Yeah, it's a new level, I mean if there was ransomware
as a service, any knucklehead could be a ransomwarist
and now- >> Bobby: Exactly.
>> These phishing emails are now actually well written.
>> Rob: Very well written.
>> Absolutely, well written and more targeted
like they're well written and they're targeted.
>> Rob: Yeah.
>> All right, we got to go, Bobby you're amazing
and we'd love to have you back on Supercloud.
>> Yeah, please do, yeah, yeah.
>> Dave: July, so follow up on that.
>> Bobby: Absolutely, please do,
thanks for the conversation.
>> All right, yeah you're very welcome,
all right, Rob Stretchay and Dave Vellante,
day three, HPE Discover 2023, you're watching theCUBE,
up next the men behind the curtain,
Jim Jackson and Jason Newton will be up,
keep it right there, you don't want to miss this.
(upbeat music)