(Soft music playing)
>> Narrator: From theCUBE studios in Palo Alto in Boston,
connecting with thought leaders all around the world.
This is a CUBE Conversation.
>> Hello, this is Dave Vellante.
Welcome to this CUBE Conversation.
We're here with Scott Strickland.
Who's the executive vice president
and CIO of Wyndham Hotels & Resorts.
Scott, great to talk to CIO's,
thanks so much for coming on theCUBE.
>> Thanks for inviting me, Dave.
>> You're very welcome.
All right, let's let me, let's get into it.
You guys, Wyndham Hotels & Resorts,
obviously that industry hard hit by the COVID pandemic.
Uh, I got to say though, your executives doing a great job,
you guys just had your earnings call.
Your stock is more than doubled since the March low.
So obviously hanging in there, well-run company,
but how did the, how did you respond to the, to the,
and adapt to the COVID impact? What was your first move?
>> Our first move, um, when we looked at COVID,
we're on the sharp end of that proverbial hospitality spear.
You know, we're in an industry where
people are going to see this first
and COVID is going to be very apparent
as people stop traveling.
So the first thing we saw is actually in China,
because we're a worldwide company.
We saw obviously the impact of COVID there.
So we had a little bit of a head start
in terms of planning here in North America.
And we were already planning for possible hotel closures
and for different work environments.
The very first thing we did was actually
take our corporate staff, roughly 1400 people
off campus in a 36 hour period.
And we're really, really proud of that.
The second thing we did was,
we looked at how do we help our franchisees
as they consider possibly closing their hotels?
Or how do they react to
a much lower occupancy type environment?
>> Yeah. So, okay.
So you had like a canary in a coal mine
with visibility in China.
You didn't, you didn't wait, you acted.
I want to bring up a chart guys,
if, if you would.
Um, this is data from our data partner ETR,
and every quarter they go out and ask customers,
you you going to adopt new,
you going to spend more, that's the green,
are you flat spending?
Are you going to decrease spending,
or are you going to kind of replace the platform?
This is specific to Zscaler and you can see,
and this was taken, Scott, right at the height
of the US lockdown.
And so what impressed me is that well over half,
well, 52% of the customers that they talked to said,
they're going to spend more on Zscaler.
Now of course, part of that was the
work from home pivot the investment in security.
But I wonder Scott, if you could tell us,
what does this picture look like for Wyndham?
>> So as we were migrating off site,
we realized that we needed
a different set of security solutions for us.
We had implemented Zscaler from an end point security.
They have additional security
in terms of putting applications behind them.
So they can serve almost as a VPN
and you don't have to leverage VPN
to get to some of your apps in the future.
And we're going to be spending more with them
actually to implement that solution.
So for us, we're going to be in that box,
in that eye area there,
where we will be spending more with Zscaler
in the next six months than we did in the prior year.
>> So what,
what do you think happens with this kind of work from home?
Um, basically you saw, I just saw Twitter said,
"Hey, we're going to make it permanent."
Other companies said,
"Hey, we're going to make it through the end of the year."
What's your thinking in terms of that work from home,
you know, hybrid, how are we,
how was Wyndham going to respond going forward?
>> On a go-forward basis,
we're going to go to a hybrid model.
So what that'll mean for us is
we're going to be looking at the equivalent of shifts,
almost, so two days on,
a deep cleaning, two days on
and rotate that through so that you have
different shifts of people who necessarily
aren't, aren't interacting with each other.
We also, before we even went off site,
we were looking at a work-from-home model
and what COVID did, is it really accelerated it for us.
So when we go back into the offices,
we're going to have roughly 20% of our staff,
that's going to remain as Twitter referred to them
as "permanent work from home."
These are roles that only need to be in the office
once every two to three weeks.
And then we're going to go to that rotational schedule
for the rest of the folks for that phase one.
>> So one of the other things that our friends
at ETR looking into is sort of what CIOs are expecting,
in terms of the shape of the recovery.
People talk about a V-shape, uh, which, you know,
some people expect, but not most, most people expect some
kind of U shape recovery down for maybe
a couple of quarters and then come back
over the next several quarters.
Or an L shape down for three or more quarters.
And then very slowly coming back, you know,
maybe into the late '20, '21,
some of the harder-hit industries like airlines,
you would expect that.
What's your thinking in terms of the shape of the recovery.
>> As we look at the recovery,
we try to make it a database decision right now.
And so we work a lot with Smith Travel.
They provide most of the data
actually for the hospitality industry.
Looking at occupancy and guests preconceptions,
are they willing to come back in?
Are they willing to check into a hotel?
And what Smith is forecasting right now
is a very gradual U over the next year and a half or so.
Now that said,
we believe that we're well positioned in the industry
because as people do start to travel again,
we believe they're going to want to go to "drive-to" hotels.
And with 9,000 plus hotels worldwide,
and the top economy brands around such as Super 8 Days Inn,
those are classic drive-to hotels.
You know, you're going to go drive and visit your parents,
we haven't seen in a while.
You need to stay somewhere overnight off the highway.
You're going to check into a Days Inn,
we believe we're going to be well positioned
to capture some of the initial market share
when it does return.
>> Well, true.
I think people, I mean, people have cabin fever
and young people I think are going to be more receptive,
you know, people with a lot of disposable income.
So I think that could actually bode well,
and it'd be some upside for industries like yours.
I want to talk about, you know,
get into the security aspect, the cloud.
Um, you obviously have a CSO.
Um, We'll talk about that. You, you, you were, uh,
your CSO was a peer, uh, is that right?
How, what's your relationship to your CSO?
>> Sure. So at Wyndham hotels and resorts,
the CSO reports into me, he reports into IT.
He's a group vice president level
reporting into me as an EVP.
However, really when we think about it,
I, I treat him as a peer.
And what I love about having him in my group,
is he can be part of those technology decisions
and the development cycle from the beginning.
So what that enables us to do is
we're not coming along later
and putting security into one of our products.
He's part of the security decisions
as we develop our products.
Whether it's an application, whether it's an infrastructure,
whether it's even a new networking solution.
He's part of those decisions from the beginning,
which has been great.
And he's the type of guy actually, that
the rest of my teams want to work with.
And they want to work with his security teams
and ask them questions.
So he serves as a trusted advisor for us.
>> So that's an interesting model.
And I think it's one that's going to gain traction
because, you know, if the,
if the security team is sort of an isolated island,
you know, it's sort of all falls on them.
You've got a seat at the table.
Security, of course, as we know
is a board-level topic right now.
So let's, let's talk about your environment.
I kind of want to talk about,
you know, pre- and post-COVID, but also pre- and post-Zscaler.
So let me, let's paint a picture.
You know, a lot of organizations,
you've got the corporate headquarters,
you've got a lot of appliances.
Um, You've got, maybe got people working from home,
tunneling through and a VPN.
You got your data center somewhere,
but you've got all these cloud apps as well.
Um, So it's a changing environment.
You've got to bring your own devices.
What did you know, go back a little bit,
however much is appropriate.
What did Wyndham look like in the pre-mode?
>> So in the pre-mode we had seven global offices
scattered throughout the world.
And our main office on the Parsippany campus
was roughly 1400 people across two buildings.
We used a classic, uh, Cisco sort of infrastructure
with multiple redundant data lines brought in,
and then the heavy duty switches that didn't turn off,
loaded it into a wifi network as well.
We then had a dedicated line out to our co-location facility
and that in turn,
then served out into our public cloud,
such as an AWS or Google.
So that was our pre picture.
We were in process.
Even prior to this, we were in the process of saying,
okay, we have some of this legacy hardware in it
and the Cisco-type environment,
how do we deploy that so that it can be cloud first?
So we were halfway through a Meraki implementation
all the way from the switch level
and the wifi level so that
we could administer that remotely.
And what this has done for us is
we've actually accelerated that implementation.
Uh, the good thing about everybody being out of the office
is it's pretty easy to send one or two people in,
to complete some of that work
in the closets and get our backbone adjusted.
So what we've been doing is
we've been working at fixing that backbone,
replacing it with the Meraki switch and wifi equipment
so that we can remote administer it
from anywhere in the world,
which is, is suddenly has opened up
a whole new level of ability to follow the sun,
ability to possibly even outsource that
or leverage lower cost resources to do some of that.
They don't have to be based here in the New York,
New Jersey area.
>> So maybe the big sort of challenges that you face.
A lot of organizations will tell us,
you've got different users coming in from different apps.
They've got different security policies,
uh, different standards, you got shadow IT,
um, with, with, you know,
not really enforcing our corporate edicts.
Uh, what were some of the challenges that you faced
that maybe the objectives of bringing in Zscaler?
>> Sure. So the last part that I didn't really cover,
that it'll help play into some of these challenges
is our co-location facility.
Originally we had three data centers
and we migrated those three data centers
largely into the cloud,
into an AWS or into a SaaS-based environment.
But for some of those applications that just you can't,
we put it into a co-location facility
and then paid a third party to manage that,
so that we're out of the administration
and data center business.
So that's, that's part of that pre
so when this came along and we suddenly said,
okay, how do we lock everything down?
How do we ensure that we understand
how people are going to access this?
Um, we only had two or three applications
that had a significant user base
where we needed to invest in VPN,
where we needed to ramp up our VPN licenses
because suddenly everybody's going to be at home.
>> For example, the beautiful part is,
is what we had our, our biggest applications.
Those were already cloud-based.
So those were already being accessed by people
who just had a network connection.
And that was why originally we chose, we chose Zscaler
because we wanted our folks no matter where they were.
And the classic example,
our CSO was working there at Starbucks
and they need to access our HR, uh, SaaS-based application.
We can do that with confidence,
from a Starbucks or from a coffee shop, you know,
any coffee shop in the world,
because we know we have Zscaler installed on their end point
because we know it's going to go through
that level of scrutiny and we'll have that protection.
So even if the network is being sniffed
or there's something weird going on,
there we'll be protected.
So Zscaler has been a partner for us on that
for about a year or so.
And then I spoke earlier a little bit about us, uh,
looking at their VPN-like solution
where you put the applications behind Zscaler
so that you no longer have to go in with VPN
and double-click and get a token
from a company like RSA
or something of that nature.
You can just make it,
you know, a virtual application that
you can access via Zscaler as well.
>> And let me just understand Scott,
that would be essentially like a security cloud
that you would be putting in front of all applications
or just your private applications.
>> That's a great way to think about it, Dave.
Yes, is it would be a security cloud
that we would put in front of all of our applications.
So we have it in front of our applications
that are SaaS-based,
and then we would start putting it in front of our
applications that are based in our co-location facility.
>> So Scott, when I talk to CSOs and I ask them,
what's their number one challenge,
they'll tell me "lack of talent."
"We've got all these devices and we're running around
and we just can't find the talent."
So I'm wondering, is that a main challenge of you
and what is the business impact of this
sort of new security regime that you're putting in place?
>> So what's really worked well for us is
we've been able to recruit some of the best
and the brightest and keep them here
because we're continuing to implement
these cloud-based security tools.
So Zscaler's, one of them, we have others in our suite there,
and that's what excites security guys and gals is that
they get to play with some of the new toys
and we get to migrate from something that was legacy
to something that's brand new
and they continue to get to improve their resume.
Yes, but they also get to play with play with
the new toys and some of the shiny new objects.
Our retention rate in our security team
is unheard of in the industry.
We are single digit turnover,
voluntary turnover a year over year on our security team.
And again, these are guys and girls that could go
into the city and make more
and they purposely chosen not to
because we let them be at the front edge of, of security.
>> Well, that's, that's a pretty interesting metric.
Because a lot of times
you guys don't, like air traffic controllers,
you know, the eyes bleeding, staring at screens all day
and it's, you know, you got to, you got to win every day.
You know, the bad guys only have to win once.
But, but so, okay.
So what has been
the business impact of sort of this new approach
that you've been taking, this sort of cloud-first approach?
>> What it's allowed us to do is to look at the threats
that are actually most important.
So if you look at security, you know,
you have your traditional DDOS attacks,
you have SQL injections,
you have some of these lower-level type attacks
by automating a lot even.
And by putting it into the cloud,
we're not worried about most of that anymore.
What we can really focus on now is
the state-sponsored agencies or the criminal agencies
that are coming after us with
very, very sophisticated phishing attacks or mail.
We had some physical mail attacks recently
that are trying to penetrate us in ways
that we've never seen before.
And again, that's exciting for the security team
because they get to focus
and they get to almost think like one of these hackers
and say, okay, if they're trying to get in here,
where, where do we believe we're not protected?
How do we go on the offensive a little bit here?
We have, we have a threat-hunting organization as well.
>> And I'm actually, if you had a Mulligan,
I don't know if you golf of, if you do, hopefully.
>> I do, I do every time Dave,
>> Yeah, yeah, you know, my, my golf,
my golf club went out of business.
I got to find another one.
But, but if you had a mulligan,
what would you do over again?
What kind of advice would you give to your peers?
>> My mulligan on this would have been
to have moved faster.
When we started,
our original migration of the cloud back then
even then there was concerns about,
can the cloud be as secure as your physical data center?
And the answer there is absolutely yes.
If you've ever toured one of these Tier Ones,
you know, such as an Amazon or a Google
and you take a look at their security
versus our physical security, tear off that band-aid,
execute the migration, and wherever possible
as you do that migration, don't go a legacy-for-legacy.
Don't do a lift-and-shift.
Instead, take the opportunity to transform,
do a lift-and-transform while you're doing that.
Not a lift-and-shift.
So my mulligan would be go faster.
And if I got a bonus mulligan,
then I'd say a lift-and-transform, not lift-and-shift.
>> Yeah. That's great advice.
I mean, I tend to agree with you.
I think that the work that we've done in the research
that we've done really underscores what you've just said.
There is a shared-responsibility model,
uh, but shared responsibility is great.
Uh, when you, when you're working with a,
like you say, an Amazon or an Azure or Google.
Um, so last question is,
you know, when you look forward,
we've been so tactical early putting out fires,
but as you start to come out of this thing,
how do you see, you know,
some of the things that you're going to preserve
from the past maybe, but what does the future look like?
I mean, it's kind of ironic.
This whole thing hit at the start of a new decade.
So I think we all agree.
And maybe, maybe you do too.
Maybe you don't, I'd love your thoughts.
We're just not going to go back to 2019.
So as you start to think of the,
the midterm and the longer term,
what's your, what are your,
some of your planning, assumptions,
and some of your thinking?
>> They say, Dave, "never to waste a good crisis."
And we've learned a lot out of this crisis.
Uh, one is that we don't need
a traditional work-from-home model,
and we're going to be able to collapse
actually our, our campus down into a single building,
and then go with that shift,
uh, approach that I spoke to earlier.
If I look forward into the medium and the longer term,
what we're seeing is we're seeing that our franchisees
and our guests, things are going to change.
When you check into a hotel,
you're going to want to have that
as contact-less an experience as possible.
So how do we offer the technology
at scale to our guests and franchisees
to enable that?
That's beyond just mobile check in,
and that's beyond mobile checkout.
You know, that's keyless entry, that's mobile payments.
That's the ability to choose my room,
perhaps on my mobile device.
You know, there's, there's a whole new world.
I believe that's coming,
ordering my, my room service on my mobile device
from my room without leaving my room.
You can start to see it in this brave new world,
you know, post-, post-COVID
that we're going to be able
to leverage a lot more contact-less,
a lot less face-to-face technologies,
but still enable a good guest experience
when they're at our hotels.
>> Well, I'm excited about that because I mean,
as, as theCUBE, you know,
our businesses do go into events.
I mean, mostly because we're all in the studio now,
but we do a lot of travel.
And this notion of accelerating the digital transformation
and leaders like yourself, Scott, really driving that,
I'm excited about the new experiences.
So I really want to thank you for coming on theCUBE
and sharing with us the best practice
and, and your journey. Appreciate it.
>> Hey, thanks for reaching out, Dave. Good to be here.
>> All right. And I thank you for watching everybody.
This is Dave Vellante for theCUBE. We'll see you next time.
(soft music playing)