>> Live, from Boston, Massachusetts.
It's theCUBE.
Covering AWS re:Inforce 2019.
Brought to you by Amazon Web Services
and its ecosystem partners.
>> 'Kay, welcome back everyone.
Cube's live coverage of AWS Amazon Web Services re:Inforce
their inaugural conference around security
here in Boston, Massachusetts.
I'm John Furrier, Dave Vellante.
Dave we've been talking about blockchain,
it's been part of security but no mention of it here.
Amazon announced a blockchain intention
but it was more of a service model,
less of a pure play infrastructure
or kind of a new game changer.
So we thought we would get our friends
to come on theCUBE and tell us about it.
Val Bercovici, CEO and founder of PencilDATA.
CUBE alumni, formerly of NetApp,
among other great companies.
And Ed Yu founder and CEO of StrongSalt.
Welcome to theCUBE.
Tell us, why aren't we talking about blockchain
at a security conference on cloud computing,
where we got all these resources.
Different paradigms, decentralized, what's your take?
>> So for me, having been in this world
for about 18, 24 months now,
friction is one of the main reasons we're not seeing
enterprise blockchain discussed here.
In fact, at re:Invent about six months ago,
Andy Jassy mentioned that we finally understood AWS,
the enterprise blockchain opportunity,
and it was the integrity value minus the complexity.
And they even announced a specific product,
pre-announces as it turns out, >> Yeah.
>> Called, too well, the (murmurs) Quantum Ledger database.
Should be available, maybe by (background noise drowns
out other sounds) this year but it focuses specifically,
database interface, on the cryptographic verifiability
of transactions minus the complexity of smart contracts,
wallets and protocol maintenance and so forth
and coincidentally or not so coincidentally
that's what PencilDATA does with our
(background noise drowns out other sounds) and services.
We are the ledger part of the Quantum Ledger database,
(background noise drowns out other sounds).
We can apply that cryptographic verifiability to anything
that's (background noise drowns out other sounds).
So relational database, the document database and supreme--
>> Are you partnered with Amazon?
>> We are hosted on Amazon, we don't have
the fuller partnership yet-- >> Okay,
that's always the first way to start.
>> I know, market place >> (laughs) Be on.
>> is something worth targeting, many market places,
GET cloud, main, AWS, you know?
>> What are you-- >> And you have announced two
sort of versions, right?
One for distributing
new stations and-- >> The announced,
they announced, you know, what I call a me too offering.
To manage hyper ledger, manages Ethereum.
Everyone's had that, they're late to that game.
But that's not differentiating the game.
The innovation, well, stats and the chipping, is simplifying
it down to something like,
(background noise drowns out other sounds) without
all of that, you know, complexity about what's my
(background noise drowns out other sounds), what's my
(background noise drowns out other sounds).
These are things that enterprise's aren't up to speed on,
enough yet and may never acquire the science and like,
do I need to know what my MTU size is on my TCP IP?
Not really, from my-- >> I think Amazon
wants to be that harden topping, I thought you said,
complexity but the reality is that they're, they're,
they're world is targeting a new generation, I mean, it's
our core theme of this show, >> Yeah.
>> is the new generation of developers.
The new generation of, Dave,
think we should talk about this in our intro.
I mean, I'm hard core on this because it's just so
obvious, I just can't get 'em, you know, I'm behind myself,
that people don't figure this out quicker.
The new developers are younger and older system's people.
There's a range of ages doing it.
They're, they're seeing the agility
and it's a cultural shift, not just the age thing.
>> Yeah.
>> Ed, this, they're not here.
Right, (mumbles) the missing picture of this show
and my criticism of re:Inforce is, big gaping hole
around crypto and blockchain.
>> Absolutely, you're correct, in fact I've been
in the crypto area for like, the last three, four years.
And I actually know those people, I don't see any of them
here because cryptography is difficult, cryptocurrency is
also difficult and blockchain is very hard to, for people
to understand, how to use it.
I think that's actually the missing piece for our case.
In fact, one of the things we actually launch is StrongVault
the app, it allows you to actually see the blockchain,
at your finger tips, so you can actually see how it works.
It basically, just like what Val said, it records everything
you do, to your data, so you always have a single source
of truth and I think that's something that people should
understand here.
>> Dave I want to get your thoughts on this because you made
a comment about security native being the theme here.
And security native, implying that devops, what they did
for configuration, hardening the infrastructure's code,
you have to consider,
this token economics business model side of it,
with the applications, a decentralized application is still
an application, okay, blockchain is still an infrastructure
dynamic, there's software involved.
I mean, we're talking about the same thing, is there a lost
in translation, in your opinion?
>> Well, yeah, I think that, you know, to your point Val,
if you can abstract that complexity away
but the fundamentals of cryptography
and software engineering and game theory, coming together
is what's always just fascinated me about this space.
And, and so you're right, I think, certainly enterprise
customers don't want to, you know, they hear crypto, they go
"oh no" >> Yeah.
>> Although it's interesting, you know, I was just at
a conference at IBM yesterday; they talk a lot about
blockchain, they don't talk about crypto.
>> Yeah.
>> To me they go together.
But of course IBM, they don't like to talk a lot
about job loss and automation. >> Yeah, yeah.
>> But, the reality is, it's there
and it's, has a lot of momentum, which is why you started
the company around this.
>> Yeah, we're actually seeing it all over right now
and again, our thing is around reducing, if not eliminating
the friction towards adopting blockchain.
So less is more in our case, we're explicitly choosing
not to do crypto wallets or currency transactions.
It's that Andy Jassy observation, the integrity value,
the core integrity value for financial reconciliation.
For detecting supply chain counter fitting,
for tracking assets and inventory
across two-two distribution.
Unifying multiple source, you know,
systems of record into a shared state.
Those are the kinds of, >> Right
>> applications we're seeing.
(background noise drowns out other sounds)
>> It adds to agriculture and, you know, there's so many
different use cases, obviously >> Yeah, right.
>> So-- >> Yeah and Amazon likes
to use that word, well words, of raise the bar which is
you know, more functionality but the other phrase is
undifferentiated heavy lifting.
There's a lot of details involved in some of those
complexities that you're >> Exactly.
>> talking about, that can be automated away.
That's goodness but you still >> Yeah.
>> have the security problem of mutability which is the
beautiful thing about the blockchain.
>> Actually a lot of times people, I actually forgot
to mention that one thing that blockchain allows you to do,
that's actually different from before, was actually privacy.
It's actually not just security; it's also privacy
which actually is getting bigger and bigger, as we know.
It's something that people feel very strongly about
'cause it's something they feel personal about and that's
something that in fact, token economics encourages a lot
things that enables privacy.
that was not able to do it before.
>> Well look at Facebook.
>> And I mean-- >> Exactly.
(Ed laughs) >> What do you guys
think about the Facebook--
>> I'm one of the few, you know, I'm a public Facebook critic
I think they've done atrocious job on the privacy front so
far and protecting our data.
On the other hand if, you know,
it's kind of like the Muller report.
If you actually read Facebook's white paper, it's a,
and it's an, not launch, it's an announcement.
>> Right. >> It's a technical
announcement, it's so well written, designed so far
and it's, Facebook doesn't completely control it.
They do have a vision for programmability.
They're evolving it from being a permissions to ultimately
a permission less system.
So, on paper I like what read and I think it will start
to, you know, popularize and democratize the notion of
crypto amongst broader population.
I'm going to take a much more wait
and see approach and just, >> Well, I'm--
>> you know, >> First of all,
>> (mumbles) >> I love, always loved
Facebook; I think they've done an atrocious job
but I'm addicted. (laughing)
I have all my stuff on there.
Centralized, they're bringing, they're bringing an eduction.
Bitcoin is up for a reason, they're bringing the masses.
They're showing that this is real market.
This is kind of like when the web was still viewed as kiddy,
you know, playground for technologists 'cause AOL
was so slow and that was kind of, for dummies and then you
had the Web, World Wide Web.
So when that hit, that same arguments went down, right?
This is been a crypto thing, it's been on for years.
But with Facebook coming in, it really legitimizes that
wow, if you bring two billion people to the party,
>> Exactly!
>> a lot of good can happen. >> and I'm excited about it too
>> Now, the critics of Facebook, is they basically copied
Hashgraph, kind of model. >> Yeah.
>> And there's no way they're going to get it through
because they world's not going to let Facebook run commerce
and currency (laughs); It's like they don't do it well
anyway and so I think >> Yeah.
>> it's going to be a game changing, market making move.
I think they'll have play in there but I don't,
I think Facebook's not going to have a global
currency. >> Well it says a lot that you
can get a hundred companies to put up 10 million
each, right? >> The (mumbles) is,
>> I mean (laughs) >> yeah, already the first
accomplishment. >> They don't need anymore
money, we need the money. >> You know, but the
>> Give it to us. >> but still the power, yeah
right, the power of that eco-system.
To me ... >> Yeah.
>> I was, I'm a big fan of this because I think
it gives credibility, so many companies
get interested in it and, you know, I'm not sure exactly
what's going to come out of it.
It's interesting that, you know, Bitcoin's up and everybody
says "oh, sell your Bitcoin!"
No, this is premature, so-- >> No.
>> Well, I think open is going to always win.
If you look at, even though the Web is kind of one example,
of kind of, the maturity argument.
I think the real analog, for me, at least my generation.
Val you probably relate to this, Dave you as well.
Ed, maybe, you know,
might not have been born yet but (mumbles).
You know? (chuckling)
TCP IP came after SNA, which IBM
own the protocols to that. >> That's right.
>> DECnet was the largest network at that time too.
>> Not bad for small businesses >> Both proprietary
>> Yeah >> both, well, they alway land,
all three proprietary network operating systems.
So, proprietary (mumbles) decimated by TCP IP.
So to me, I think, even if Facebook does go in there
they, will recognize it unless they stay open and I think
open will always win and I think this is the beginning
of the death of the closed platform.
>> of crouse. >> Yeah, I think they're
forced to, I think they have to open that up
because if they don't open up, people won't trust them
and people won't use them and then for blockchain,
if you don't have a community behind it,
there will be nothing.
>> Well, so the thing about the crypto spring, (mumbles)
the crypto winter but to your point, TCP IP, HTTP, DNS, SMTP
those were government funded
or academic funded protocols >> Yeah
>> and people stopped spending money on 'em and then the big
internet companies just co-opted, you know what I mean,
that's what Gmail's is built on.
So, >> Well I've always said
>> But let me finish the >> Facebook--
>> thought, is all this crypto money that came in
drove innovation. >> Yeah, yeah.
>> So you're seeing, you know, this new internet emerge,
and I think it's real.
I think people, you know, sort of over look a lot of the
innovation that's coming.
>> I've always said, to Dave, that Facebook is what the
Web would have looked like if Tim Berners-Lee to venture
financing because what they >> Yeah, yeah.
>> had at the time was a browser and way that was standard
websites for self-service information.
They kept it open and it thrived.
Facebook became basically the Webs version of AOL,
and LinkedIn does the same, Twitter has open but they have
developer opportunity (laughs) so.
Yeah, so I think Twitter is the only company, in my opinion,
that does a good job, opening up their data.
Now they charge you for it, to get their earnings up
but we still have it and crypto is the only community
that's entire ethos is based upon openness.
>> Yeah. >> And community,
you mentioned community. >> Yes.
>> That is a keyword.
>> And traditional media will, of course, focus on, you know,
the bad stuff that happens but, you know, those of us in the
business, who pay attention to it,
see there's a lot of goodness too, there's
a lot of mission driven >> Right
>> A lot of openness and it's a model for innovation.
What do you guys think about the narrative now,
to break up Big Tech?
You know, you're hearing Facebook, Amazon, Google coming
under fire, what are your thoughts on that?
>> So I wrote a blog, maybe it was a head
of it's time, about 18 months ago.
It was coincided with Ginni Rometty at Davos in 2018,
not 2019, talking about data responsibility.
The reason we're having this conversation is that the
tech industry by and large, and especially the FAANG stock
or whatever we're calling them now, have been irresponsible
with our data, the backlash is palpable in Europe.
It's law in Europe.
The backlash, we knew was going to
start at the state level here.
There's already ahead of my personal schedule.
Federal discussions, FDC, DOJ as of a couple weeks ago.
So it's inevitable that this
sort of tech reckoning is coming in.
More responsibility is going to have to be demonstrated
by all the custodians of our data and that's why
we're positioning change Chainkit as a chain of custody,
as a service, to demonstrate to your regulator,
your customers, your partners, suppliers.
You know, transparency, irrefutable transparency, using
blockchain for how you're handling data.
You know, if you don't have that transparency and you can't
prove it, we're back to the same old discussions.
We're back to, you know, uninformed old legislators
making, you know, internet is tubes type regulation and law.
>> So you're here, and DOJ, you can argue that they were,
maybe, too slow to respond to Microsoft back in the 90's.
I'm not sure breaking up Big Tech is the right thing
'cause I think it's almost like AT&T.
The little techs will become
Big Techs again. >> Yeah, right.
>> But they should not be breaking the law.
>> I think there's a,
the reason why, there's actually a limitation of
what is possible in technology 'cause they understand
and also Facebook understands as well, is that it's
actually very hard to have data that's owned by customers
but you are the one who's actually keeping track everything
and you are the one who uses the data, right?
It's like a no win 'cause like if you think about encryption
or cryptography, yes you can make data encrypted, that way
the customer has the key, they control it but then Facebook
can't offer the services so now you have a (mumbles)
thinking, well if there's no technological
way of doing this, what can you do, in the legal perspective
on a, you know, on a law perspective, how do you make it
so that the customer actually own the data?
We actually think that is a perfect reason why you
have to actually, (mumbles), should be built on our
platform because we actually allow them to have the data
that's encrypted and still be able to do operations on the
data, if the customer give them the permission to do so.
And think that's the perfect way to go forward and I think
blockchain is the fundamental thing that's bringing
everybody together in a ways that
actually benefits everyone else.
>> Ed, take a minute to explain StrongSalt, your project.
What's it about, what's the mission?
Where you at-- >> So we see StrongSalt
as actually privacy first.
We literally are building a platform with developers,
including Facebook, LinkedIn, Salesforce can actually build
on top of platform, right?
So what happens when you do this,
is that they actually give the data governance to to the
customers; the customers actually own the data
but because of cryptography they actually can offer services
to the customers, when the customer allow them to do so.
For example, we have something called searchable encryption,
allows you to encrypt the data and still give the search,
it operate on the data without decrypting the data first.
By giving this power to developers and also to community,
then you can have apps that you currently use but they not
hard to use, they're frictionless and still offer the same
service that Facebook or Salesforce offers the service.
>> So yo an do some discovery on it?
>> You can do things.
>> You can do some programmability
around data? >> Exactly.
Even though the data is encrypted
but customer owns data. >> Got it.
>> So the customer has to give them
permission to do so, right?
And we actually, in fact, launched the first app that,
actually, I told you it's called StrongVault.
You can download it on iOS or Android and you can
actually see the blockchain (mumbles).
Literally you can see the blockchain in a fingerprint.
I mean finger tip to see what happens to your data.
You see everything that happens, when you share a file
or you open a file, something like this.
>> Now congratulations, Val give a quick plug
for your project, Chainkit,
I can see the new branding there, like it.
PencilDATA, where are you on your project?
>> So after nine months of hard selling, we're finding out
what customers are actually paying for right now.
In our case, it's hardening their apps, their data
and their logs and wrapping
a chain of custody around those things.
(mumbles) at a security conference like this is actually
quite existential, when you think about it.
One of the things that the industry doesn't talk enough
about is that every attack that we read about in the
headlines was to (mumbles), so the attackers
some how hacked your web server,
managed to get administrative credentials and networker
domain administrative credentials, and here's what
professional attackers do, once they have God-like
authority on your network, they identify all the installed
security solutions and they make
themselves invisible because they can.
After that they operate with impunity, our technology
the security use case that we're seeing a lot of traction
is we can detect that.
We're applying blockchain, we're agnostic, so bring
your own blockchain in our case
>> Yep
>> but we're able to-- >> Is Chainkit a product?
Is it a development environment?
>> It's a global available service.
>> Host service. >> Hosted on AWS, restful API's
and fundamentally, we're enabling developers to harden their
apps, to wrap a chain of custody around key data or logs
in their apps, so that when the attackers
attempt to leverage at administrative authority
and tamper with logs, tamper
with estates-- >> So it's a service,
not a software tech-- >> It's a developer oriented
service. >> But this is one of the
biggest problems, challenges in security today.
You see the stat, after you get infiltrated, it takes 250
or 300 days to even detect and I have not
heard that number shirk.
I've heard people aspire to
that number shrinking, this solves the
problem. >> We can get it down to real
time, real tip of the spear
on any attack. >> I mean that's huge.
>> Yeah. >> Yeah.
I mean. >> So that's what we're excited
do here, we're excited to talk about on of the dirty secrets
of the security industry is that it shouldn't take a year to
detect an advanced attack.
(laughing) >> Guys thanks so much
for coming on to theCUBE and sharing your insight.
Congratulations on your project Ed, Val great to see you.
>> Likewise
and thanks to SPJ for having >> Yeah thanks.
>> us on here and we're looking forward to coming back and we
appropriate the opportunity. >> Yeah, absolutely,
thanks for SPJ. >> thanks you guys.
>> And thanks for you guys. >> TheCUBE is always
paying it forward, of course, really the most important
conversation in security is going to
be a blockchain type of implementation.
This is a reality, that's coming very soon but we're here
at AWS re:Inforce talking about the first conference
with Amazon Web Sources
dedicating to site (mumbles), CIOs around security.
I'm John (mumbles) Dave, stay close
for more coverage after this short break.
(techno music)
>> My name is Dave.