(upbeat pop music)
>> Announcer: From our studios
in the heart of Silicon Valley, Palo Alto, California,
this is a Cube Conversation.
>> Hello everyone, welcome to this special Cube Conversation,
here at the Palo Alto Cube studios.
I'm John Furrier, host of theCUBE.
We're here with Moritz Mann,
who is the head of the Product Management team
at Open Systems AG.
Great to see you again, thanks for coming in.
>> Hey John, thanks for having me.
>> So, last time we spoke, you had your event in Las Vegas.
You guys are launching,
you have a new headquarters here in Silicon Valley,
opened up this past Spring.
Congratulations.
>> Thank you.
Yeah, it's a great venue to start in,
and we set foot on the Silicon Valley grounds,
to make our way to--
>> I know you've been super busy,
with the new building, and rolling out
and expanding heavily here in the Valley,
but you guys are in the hottest area that we're covering,
security, cloud security, on-premise security,
the combination of both.
It has been the number one conversation, pretty much,
in the cloud world right now.
Obviously, besides the normal cloud, native cloud IT,
hybrid versus multi-cloud.
Obviously that continues to be the discussion.
I think there's no more debate
around multi-cloud and hybrid.
Public cloud is great,
people are going to still keep their enterprises.
But the security equation still is changing,
there's new requirements.
What's the latest that you guys are seeing
with respect to security?
>> John, what we see is actually that cloud adoption
happens at different speeds.
So, you have usually the infrastructure
of the service adoption would happen
in a quite controlled way, because there's a lift and shift.
You have your old data center,
you take it and you transfer it into Azure or AWS or GCP.
But then there's also uncontrolled adoption,
which is in the SaaS space.
And I think this is where a lot of data risk occurs,
especially in the wake of GDPR.
And where we see that this adoption happens
more in a sometimes-controlled,
but sometimes in a very uncontrolled way.
>> Explain the uncontrolled and controlled expansion
of how security in multi-cloud and cloud is going.
Because this is interesting,
controlled means there's plans to do stuff,
uncontrolled means it's just by other forces.
Explain uncontrolled versus controlled, specifically.
>> So, controlled specifically means
the IT team has a project plan,
and they take servers and workloads
and move them in a controlled fashion,
or in a dedicated project, to the cloud.
But what happened in the business world and business IT,
is actually that users share content at any time,
with any device, in all locations.
So, this is called the mobile enterprise,
and the cloud-first enterprise.
It means that the classical security perimeter
and the controls in that are bypassed, actually,
by the path of least resistance,
or the shortest path available.
>> And this is the classic case,
people use Dropbox for some personal things, or at home.
They're at work, API-based software.
That's what you're getting at, the uncontrolled way.
>> Exactly, yeah.
And the issue with this is that the data
that has been contained in perimeters,
where you know, as it sees, or where your data is.
This has been deployed to many edge devices,
to many mobile devices.
And it gets shared in an uncontrolled way.
>> Well, I've got a couple of talk tracks,
and I'd like to drill down on that,
because this is the trend we're seeing,
APIs dominating,
the perimeter on the infrastructure has gone away.
And it's only getting bigger and larger.
You've got IoT and IoT Edge.
And the networks are controlled,
and also owned by different people.
So the packets are moving, it's crazy.
That's the reality.
First talk track is, the security challenge.
What is the security challenge,
and how does a customer figure out what to do
from an architectural standpoint,
when they're dealing with hybrid and multi-cloud?
>> So, first of all,
we see enterprises trying to rethink
their infrastructure-centric view of the architecture.
So, the architecture that had been built around data centers
needs to become hybrid and multi-cloud aware.
So that means they need to define a new way of a perimeter,
which is in-cloud,
but also covering the old legacy hybrid data center setup,
which has the data still in the old data center.
And at the same time, they need to open up
and become a cloud themselves, so to say,
but still draw a perimeter around their data
and their users, and their applications,
and not so much any more around the physical infrastructure.
>> So, changing their view of what a security product is?
Is that really what you're getting at?
>> Yes, so the issues with the product point solution
was that they fixed a certain part of a tactile issue.
So, if you take a firewall in itself,
a firewall back then was like an entry door
to a big building,
and you could decide who comes out and who goes in.
Now, the walls of that building are vanishing,
or are more morphic,
and you need to come up with a more integrated concept.
So, having these stacked appliances,
and stacked security solutions,
trying to work together and chain them,
doesn't work any more.
So, we think and we see that--
>> Why is that?
Why doesn't it work?
>> Because in the end it's harder to operate them.
Each of those point solutions have their own end of life,
they have their own lifecycle.
They have their own APIs, they have their own TCO.
All that needs to be covered.
And then there's the human aspect,
where you have the knowledge pools
around those technologies.
So, as an enterprise, you have to continuously keep
the various security experts to maintain
continuously depreciating assets running, right?
>> And they weren't built for tying into
an holistic dashboard or platform.
>> Exactly.
What we see is that enterprises
now realize we have data centers,
and it's now an accepted reality
that you can abstract it with the cloud.
So, you don't own your own servers and buildings any more.
You have a OPEX model to subscribe to cloud services.
And we think that this has to happen to security, too.
So, a shift from CAPEX to OPEX.
And the same way also for operational matters.
>> Security as a service is a great business model.
I want to ask you, on that front,
you mentioned mobile users.
How do you secure the mobile users
when they use cloud collaboration?
Because this is really what users expect, and they want.
How do you secure it?
>> So, we secure it by actually monitoring the data
where it gravitates.
And this is usually in the cloud.
We enforce the data that is in transit
through proxies and gateways towards the cloud,
from the endpoint devices,
but also then looking via APIs in the cloud themselves,
to look for threats, data leakage,
and also certain sandbox activities that happen there.
>> Right, the next talk track I want to get into
is the expansion to hybrid and multi-cloud.
Something that you guys do
from a product standpoint solution for your customers,
but in general, this is an industry conversation as well.
How do you look at this from a software standpoint?
Because, we're heard Pat Gelsinger at VMware
talk about software-defined data centers, SDN,
everything is now software-based.
You talk about the perimeter goes away.
You guys kind of bringing up a different approach,
as a software perimeter.
What is the challenge for expanding
to multi-cloud and hybrid cloud?
>> So, the challenge for an enterprise
and customers we talk to,
is that they have to run their old business,
Gartner once called it bi-modal business,
and it's still adopting not one cloud,
but we see in our surveys,
and this is also what market research confirms,
is that customers end up with two to three cloud vendors.
So there will be one or two platforms that will be
primary to the majority of their applications
and data gravity.
But they will end up, and become much more flexible
with running AWS, their old data center,
but also GCP and Azure, or Alibaba cloud,
even side by side, right?
To cover the different speeds their own enterprise runs at.
>> So, I've got to ask you about cloud native,
because one of the things you're bringing up,
that just jumps in my head,
I got to ask.
Because this is what I see as a potential challenge,
it might be recurring challenges.
When you have Kubernetes growing at such a rapid rate,
you see the level of services coming online
at a much higher rate.
So, mobile users are using the Dropboxes, the boxes,
and they're using all these API services.
But those are apps.
There's hundreds and thousands of micro-services
being stood up and torn down in there.
You guys are taking, I think,
an approach of putting software perimeters
around these kinds of things.
But they get turned on and off,
how do you know what's clean, because--
It's all done automatically,
so this is becoming a challenge.
Is this what you guys mean when you say software perimeter?
That you can just put security around things at any time?
Explain this technique, because this is a big deal.
>> So, if you talk about the service mesh,
so really meshing cloud and native functions,
I think it's still in the phase
where it's, I would say, chaotic.
When you have specific projects
that are being ramped up, and ramped down.
So we draw a perimeter in that specific context.
Let's say you're ramping up a lot of cloud function in AWS,
we can build a perimeter around this kind of containment,
and look especially for threats in the activity logs
of the different Kubernetes containers.
But from a design perspective,
we need to think ahead of the future.
Because if you look at Microsoft, and AWS strategy,
those containers will eventually move also back to the edge.
So, we're preparing to support those models
and also bring these functions closer,
back again to the edge.
And we call that, not any longer the WAN edge,
but it will become a cloud edge, actually.
So it's not an extension of the LAN that comes to the data,
it's actually the data and applications coming
back to the user, and much closer.
>> Yeah, in that case, you can define
the on-premise environment as a edge, big edge,
because this is all about moving workloads and data around.
This is what the new normal is.
So, I've got to ask you the next question, which is,
okay, if that's true, that means that Kubernetes
becomes a critical part of all this, and containers.
How do you guys play with that, at all?
>> So we play with this by actually looking at data
coming from that.
At the moment, we are looking at this
from a data transit perspective.
But we will further integrate into their APIs,
and actually become part of the CICD process
that will then actually become a security function
in the approval and rolling out to a certain service mesh.
And we can say, "Well, this is safe, or this is unsafe."
This is, I think, the eventual goal, to get there.
But for now, it's really about tracking the logs
of each of those containers,
and actually having a perimeter,
and segmentation around the service mesh, cloud, so to say.
>> I think you guys have got a good thing going on
when you talk about this new concept
of software-defined perimeters.
You can almost map that to anything.
Everything has its own little perimeter.
Workload could be moving around still,
but it needs to be secure.
So, I've got to ask you, on the next talk track,
because this leads into hybrid cloud.
This is the hottest topic.
Hybrid cloud, to me, is the same as multi-cloud.
They're kind of together, a little bit different,
but hybrid cloud means you're operating
both on-premises and in the cloud.
This is becoming a challenge.
Most CISOs, Chief Information and Security Officers,
don't want to fork their teams,
and have multiple people coding different stacks.
They don't want the vendor lock in.
And so you're seeing a lot of people
pulling back on premises, building their own stacks,
deploying in the cloud, and having a seamless operation.
What is your definition of hybrid?
Where do you see hybrid going,
and how important is it to have a hybrid strategy?
>> I think the key success factors of a hybrid strategy
is that standardization is a big topic.
So we think that a service platform, to secure that,
like the SD-WAN service platform that we built,
it needs to be standardized on an operational level,
but also from a baseline security and detection level.
And this means that if you
run and create your own workloads on-premise,
you need to have the same security,
and standard security and deployment standard for the cloud.
And have this seamless security perimeter,
and level of security,
no matter where these deployments are.
And the second factor of this,
is how do you ensure a secure data transfer
between those different workloads?
And this is where SD-WAN comes into play,
which acts as a fabric together with a WAN backbone,
where we connect all those pieces together,
in a secure fashion.
>> Moritz, great to have you on theCUBE,
and sharing your insight on the industry.
Let's get into your company, Open Systems.
You guys provide an integrated solution for DevOps
and secure servers and security platforms.
Take a minute to talk about the innovations
that you guys are doing,
because you guys talk a lot about CASB,
you talk a lot about integrated SD-WAN.
But first, define what CASB is for the audience
that doesn't know what CASB is.
It's an acronym, C-A-S-B.
It's kicked around all in the security conversations.
If you're new to security,
it's an acronym that you should pay attention to.
So, define CASB, and talk about your solution.
>> So, CASB.
The abbreviation means Cloud Access Security Broker.
It's actually becoming this centralized orchestrator
that allows and defines access based on a trust level.
First of all, it's between networks, saying,
I have a mobile workforce accessing SaaS or IS applications,
CASB is in the middle to provide security and visibility
about, where is my data moving?
Where do I have exposure of GDPR compliance
or PCI or HIPAA risks?
And where is it exposed to?
Which is a big deal.
And it's kind of the lowest level to start with.
But then it goes further.
We can use the CASB to actually pull in data
that is about IS workloads,
to identify data that's been at rest and stored.
So, are there any incidentally shared data artifacts
that are actually critical to the business?
And are they shared with external resources?
And then going one step further,
where we then have a complete zero-trust access model,
where we say we know exactly who
can talk to which application at any time,
and give access to.
But as with everything,
this needs to be embedded in an evolution--
>> And the benefit ultimately goes to the SaaS applications,
to have security built in.
>> That's the first thing you need to tackle, nowadays.
Get your SaaS, cloud security or policy enforced,
but without disrupting service and business.
And to actually empower business,
and not to block and keep out the business--
>> I mean, it's the classic application developer challenge,
which is, they love to code,
they love to build applications.
And what cloud did with DevOps
was abstracted away the infrastructure,
so that they didn't have to do all those configurations,
just to write apps.
You guys are enabling that for security.
>> Exactly, yeah.
So, coming back to this multi-pronged product cloud
which is not keeping up anymore with the current reality
and needs of a business,
so we took the approach and compared DevOps
with a great service platform.
We have engineers building the platform,
this integrated security service platform,
which provides SD-WAN, managed detection response,
and CASB services, under one platform,
which is tightly integrated.
But in the customer focus, we provide them an OPEX model,
which is very predictable,
very transparent in their security posture.
Make that a scalable platform
to operate and expand their business on.
>> And that's great, congratulations.
I want to go back more for the final point here,
to round up the interview.
For the IT folks watching,
or the folks who have to implement multi-cloud
and hybrid cloud, they're sitting there...
It could be a cloud architect,
it could be an IT operations or an IT pro.
They think multi-cloud and hybrid cloud,
this is the environment they have to get their arms around.
What should they be thinking about
around multi-cloud and hybrid cloud?
Is it real?
What's the reality now?
What should they be considering for evaluation?
What are some of the key things
that should be on their mind,
when they're dealing with hybrid cloud,
and all the opportunity around it?
>> I think there are four key pieces.
One is, they have to start to think strategic.
So, what is a platform and a partner that helps them
to plan ahead for the next three to five years,
in a way that they can really focus
on what their business needs are.
This is the scalability aspect.
Secondly, it's do I have a network and security architecture
that allows me to grow confidently
and go down different venues to actually adopt multi-clouds,
without worrying about the security implications
behind it too much, and to implement that.
And third is, have this baseline,
and this standardized security posture
around wherever the data is moving.
Being mobiles, being SaaS, or being on-premise,
and in-cloud workloads.
The fourth piece is, again,
really thinking of, "Where do I spend most of my time?
Where do I create value?"
By defining this framework, it really can create a benefit
and value for the enterprise.
Because if you do it not right,
you will end up with an architecture
that will break the business and not accelerate it.
>> Moritz Mann, Head of Product at Open Systems,
here inside theCUBE studios.
Great job, you must love your job, you've got the keys..
Lot of pressure, security. >> Of course.
>> Being a Head of Product for a security company
is a lot of pressure.
Before we wrap up, just give a quick plug for the company.
Are you guys hiring?
You've got a new office space here in Redwood City,
it looks beautiful.
Share a quick plug for the company.
>> Yeah, so Open Systems is a great company to work with.
We are expanding in the US, and also EMEA,
with all the workforce.
So, we are hiring.
Go on our web site, we have a lot of open positions,
exciting challenges, in a growth-oriented workspace.
And, as you said, security at the moment
is one of the hottest areas to be in,
especially with all the fundamental changes
happening in the enterprise and architecture IT landscape.
>> And cloud security, specifically, not just endpoint,
the normal stuff that people are used to.
Cloud security is hot as hot could be right now.
Moritz, thanks for coming on theCUBE today.
>> Thanks, John. >> Thanks for the insights.
>> I'm John Furrier for theCUBE.
We're here at Palo Alto with Moritz Mann,
who is the Head of Product Management for Open Systems.
Thanks for watching.
(upbeat pop music)