(upbeat music)
>> Hello, and welcome to this Cube Conversation
kicking off 2022, I'm John Furrier, your host of theCUBE.
We're with Loris Degioanni, Chief Technology Officer
and founder of Sysdig.
A company that's in the pioneering
cloud native and cloud native security,
open source, big part of the CNCF, CUBECon coverage.
Of course, we know them as of that environment
as well as DockerCon which we've covered many times.
Sysdig is a very successful company.
Loris, welcome to theCUBE Conversation.
>> Thank you and thanks for having me.
>> Well, we know a lot about you,
but a lot of folks are learning about you guys
with your success.
Congratulations on the funding
and the validation of your product, which is not a surprise.
We've been saying on theCUBE
open source has been powering innovation for some time
and getting stronger, faster.
The predictions in the Linux Foundation
about this open source contributions
continue to be blown away by their projections
and more and more is coming.
A new generation is upon us.
Cloud Native, Edge, Kubernetes.
All of these things are powering
a modern application environment which is changing business.
And under the covers, you guys are a big part of it.
So take us through who Sysdig is,
what you guys do for the folks out there
and let's get into it.
Obviously open source is a big part of it.
Take us through who is Sysdig and what do you guys do.
>> Yeah, Sysdig helps you run your software in the cloud
in a way that is secure and confidently.
We have a security solution that covers containers,
cloud and Kubernetes.
And we cover you in the life cycle of modern application.
So the Sysdig security platform helps you secure application
in a way that ranges from like shift left in CSD
and finding vulnerabilities in your CSD pipeline
to run time security that is very important in the cloud
in particular with orchestrated infrastructures
like the ones that are run by Kubernetes.
And then of course, everything that has to do
with the forensics, threat-hunting and so on.
And the world is changing, security is changing,
and Sysdig is one of the startups,
one of the companies that is at the forefront
of true modern cloud native security.
>> So I got to ask you.
Were you sitting in your backyard one day thinking,
hey, I'm going to start a company?
How did this all come together?
I mean, the originator story,
because we saw open source,
we saw even more before CNCF was formed,
you saw what cloud was doing.
Again, we saw OpenStack and all these other things
happening around technology.
What was the driver behind the founding of Sysdig,
and then how did that progress?
Because again, there's an open source component here
I want to get into.
>> Yeah, and it's interesting that you say backyard
because actually Sysdig was actually
started in my backyard.
Just outside of here.
So the backyard metaphor is very, very fitting here.
And in a general way,
let's say I come from a background
in open source for a very long time.
Sysdig is my second company.
My first company was called Case Technologies.
It was the company behind an open source network analyzer
called Wireshark, which is widely used by millions
and millions of people around the world
to do network troubleshooting and network analysis.
And when we were doing network packets, we were using
like the network devices to collect information.
The data that is being transferred on the network
has some very nice properties, it's rich.
It's very deep.
When you can see and decode what's happening on the network,
you can understand what applications are doing,
what the users are doing.
I used to say, packets never lie, right?
Because you could connect to the router
and collect this data and they have a very good picture
without any two instrument libraries to link,
to install stuff and so on.
And all of a sudden, we're moving to the cloud
and the router that was like the vintage point
for this beautiful way of doing security
and visibility disappears.
And you're renting instances that are floating
in the Amazon cloud.
And when the world changed that way from one point of view,
I was sure that what we're doing before was useful
and was powerful for the users.
But I was also sure, okay, the world is going to change.
The retrofitted solutions are not going to work.
We can take our product,
but then we have the innovator dilemma.
We have a product
that we cannot completely radically change.
So I decided let's start from scratch.
Let's start Sysdig.
Let's try to understand actually what this cloud is going,
where containers are going.
There's this new Kubernetes thing
that everybody's talking about.
What does it mean to offer deep, rich, but at the same time
lightweight and easy to deploy security and visibility
for this kind of new way of writing software
and that's how Sysdig was born.
>> So if I remember correctly back in that timeframe,
that couple you said you found a millions people
using that application.
If I remember correctly,
that was software network monitoring.
Is that true?
Is that open source at that time?
Was that an open project or was that?
>> Yeah, like Wireshark is a network analyzer
and the software that we're doing was heavily
open source oriented and was mostly software
and there were also potentially appliances
because this was data center more kind of stuff.
>> That was before cloud even came here.
So again, defined data center software
and defined clouds happening.
So again, good segue into kind of where security,
you mentioned footprints, you can track people with packets.
So to your point, is this the tie into security, tell us
how this fits in with open source and security
with the software piece?
>> Yeah, what Sysdig did essentially,
the idea was let's learn from our prior life.
I always say that every new wave of technology
is built on the shoulders of the previous one.
And you'd never reinvent anything.
You just apply it and evolve it.
And the same thing we did with Sysdig.
So we learned what was working with our previous approaches
that were based on observing the applications behavior
by looking essentially at network traffic,
but we adapted it to modern infrastructures.
And open source was our mantra before with Wireshark
and became our mantra with Sysdig.
Sysdig, the company name comes from the open source tool
that we released was the first thing that we released
in our company.
And then few years later with Falco,
which now is the premier open source project
that was created by Sysdig and is now part of the CNCF,
it's an incubating project.
And it's essentially the runtime security tool
for containers, Kubernetes, and cloud.
>> Take us through that Falco,
because I think this is an important distinction
on your success trajectory because CNCF has a nice playbook
where companies can contribute to the CNCF at the same time,
that creates an open environment for all,
and then have a business model tied to it.
This is kind of a new, not new,
but this is a successful way to be open source
and have a commercial opportunity.
>> Yeah, and very much
a substantial portion of our commercial product
is let's say an extension of Falco.
But let's say our approach was like,
let's first produce something that is truly useful
for the community and fits in the proper way
with the ecosystem, with the rest of the ecosystem.
Nowadays in every field security as well,
you don't build any more a single solution.
You build something that needs to fit very well
in the stack.
Kubernetes, Prometers, network meshes and DCO
and this kind of stuff, these all fit together.
So Falco, which is the runtime security component
needs to fit as well.
So initially our focus was like, okay,
we need to fill the gap of runtime security for containers,
for Kubernetes, and also for cloud.
But we need to do that in a way that is community first
and data really helps, but also engages and takes advantage
of the users, of the broader community.
At that point, going to the CNCF and telling the CNCF,
hey, look, we developed these,
are you interested in partnering with us
and being essentially the organization behind this project,
was very natural.
And that's what we did in 2016, sorry, 2018.
2016 is when Falco started, 2018.
And at that point, you know, it's a great partnership
because the CNCF is really a great home
for all of these projects and really makes it possible
for the users to trust a project
in a way that they know that even if the commercial banker,
even if the original creators, even if the team
rotates and changes and evolves,
the end users can still use this project, trust this project
and know that it's community driven.
And it's been a great journey for us.
>> How would you describe what Falco is
and what are the key use cases?
>> Yeah, Falco is, I compare it to the security camera
for your containers, your house
and your cloud infrastructure.
So the same way that the security camera allows you
to observe maybe what's happening in your home,
even if you have a lock,
is still useful to have a security camera, right?
To understand when something breaks in what they're doing,
when they do it, get an alarm when something better happens.
Similarly, in software infrastructures,
you can still have your lock, your firewall and so on,
but then you use a security camera like Falco
that is able to observe every single container,
every single process, every single machine,
every single network connection and so on.
Keep an eye on it and then it has
sort of a points-based system that includes
a bunch of policies that come essentially pre-packaged
that allow the users to detect when something dangerous
or suspicious happens in the infrastructure.
For example, I don't know somebody is spawning or sharing
their radius container.
Or somebody is logging in AWS
without multi-factor authentication.
Falco keeps a constant eye and lets you know,
it gives you an alert when something like that happens.
>> You know what I love about what you guys do
and kind of highlights what we've been saying on theCUBE
for many, many years is that the networking concepts
of the older generations have been moving up the stack
with cloud because you got rule engines, policy automation,
all these things are now part of connected systems.
So if you have the cloud,
which is essentially a distributed computing,
you have more networks, more connections.
And so the networking paradigms of packets
can be moved over to software,
well, software maintenance, if you will,
or anything, any middleware, whatever you want to call it.
I mean, this is kind of a new paradigm.
So, what's your reaction to that?
I want to get your take on this
because this is kind of really happening.
>> Yeah, and you are absolutely right.
And what us as a Falco community
or as Sysdig as a company is exactly that.
We're taking the concepts that were maybe at the base
of the previous generation of the data center
in terms of policies, in terms of one clause
and we're sort of elevating them to what modern cloud is.
To give you an example, I don't know if you remember,
but a Falco was inspired by a tool called Snort
and the company also was Sysfire.
Snort used to listen on the network,
constantly observe the network traffic
and the deploy policies to tell you, okay,
somebody uploaded a file from China
and this file contains a malware.
Now we do this, but we're able to see inside containers.
We have cloud context.
We understand the regions.
We understand Kubernetes namespace
and all these kinds of stuff.
So we're able to put so much more context
and be so much closer to the user,
but the concepts are the same.
We're just, as I was saying,
sitting on the shoulders of people before us
that invented this and we're modernizing them.
>> Well, this is what refactoring is all about.
This is the benefit of the cloud.
I think, this is why a lot of the cloud native success
is happening because companies are realizing
that they can actually not just re platform in the cloud,
but actually refactor their business, completely different.
Using other paradigms and not necessarily rip and replace
or just cut and paste.
They can take concepts and codify them in their workloads,
not necessarily general purpose.
So again, key cloud concept and only going to get stronger
with the edge developing.
So again, more and more complexity, connected complexity.
>> Yeah, complexity that more and more you manage
through automation, right?
Which is another key concept in the cloud.
So we are able as a market, as a community to have
and manage more and more complex infrastructures
because we have tools that are able to automate,
to take care of stuff for us, to potentially remediate,
which is another big theme in modern security for us
and so on.
And of course, again, companies like Sysdig,
try to really read these in the plight, in a proper way
that can be the most possible useful.
>> And hackers love complexity, right?
And love chaos.
And so unless you tame that with really good software,
this is the key challenge.
>> You need to manage chaos
and you need good software to help you manage chaos.
>> All right, final question for you.
How is Sysdig and the Falco community working with AWS?
>> Yeah, in a number of ways.
One of the beauties, as I was telling before
of essentially being built
on an open source project like Falco
is that you can really work together with cloud providers
like AWS with mutual advantage.
For example, AWS and team members at Amazon
have done many contributions to Falco
and the Sysdig system and integrations and so on.
We partnered as Falco community and Sysdig with AWS
to offer proper support for Falco
versus the products on Fargate,
which is, managed containers are the future,
are very powerful.
Everybody wants to go there,
but then you need to make sure that you are covered,
you have security from the point of view of severability
and so on.
Sysdig and AWS work together on doing
a P trace based implementation, this is a technical thing,
but essentially it means that a tool like Falco
can give you invitations,
can be the security camera for Fargate as well.
And in general way, Amazon is a great partner for us
on a daily basis as a community and as a company.
>> Loris, you've got a great company there.
And again, it was great to see you guys grow
from the beginning and the wave is here.
As they say, in California,
you guys are riding the right wave.
And I think it's just the beginning.
I think you're going to see more and more security
be programmable, built in, automated, under the covers,
invisible, but working.
And I think the same is going to be true for data
and other things.
So a lot more to do.
And again, it's distributed computing.
We've seen this movie before, but not in this environment.
So new tools are coming and you guys are a big part of it.
Thank you so much for coming on theCUBE
and sharing what you guys are doing
and the technology behind Sysdig.
Thanks for coming on.
>> Thank you very much
and thank you for the great conversation.
>> Okay, this is theCUBE I'm John Furrier your host
for Cube conversations
with Sysdig's Loris Degioanni, CTO of Sysdig.
Thanks for watching.
(gentle music)