>> Narrator: Live from Barcelona, Spain.
It's theCUBE.
Covering Cisco Live 2020.
Brought to you by Cisco and its ecosystem partners.
>> Welcome back.
Over 17,000 in attendance here for Cisco Live 2020
in Barcelona.
I'm Stu Miniman.
My co-host is Dave Vellante,
and to help us to dig into, of course, one of the most
important topic of the day.
Of course, that's security.
We're thrilled to have back a distinguished engineer
from Cisco, one of our CUBE alumni, TK Keanini.
TK, thanks so much for joining us.
>> Dave: How ya doing man? >> Good, good, good.
Thanks for having me.
>> All right, so TK it's 2020, it's a new decade,
we know the bad actors are still out there.
The question always is it used to be how do you keep ahead
of them, then I've hear Dave say many times,
well it's not when, it's not if it's when.
You probably already have been compromised before,
so give us the latest, so what you're seeing out there,
what you're talking to customers about
in this important space.
>> Yeah, it's kind of an innovation spiral, you know.
We innovate, we make it harder for them,
and then they innovate, they make it harder for us.
And round and round we go.
That's been going on for many years.
I think the most significant changes that have happened
recently have to deal with not essentially their objectives,
but how they go about their objectives.
And defender's topologies have changed greatly.
Instead of just your standard enterprise,
you now have hybrid multicloud and all these
new technologies.
So while all that innovation happens,
they get a little clever and they find weaknesses
and round and round we go.
>> So we talked a lot about the sort of changing profile
of the threat actors.
Gone from hacktivists to criminals now.
It's a huge business and nation states even.
What's that profile look like today,
and how has that changed over the last decade or so?
>> You know, that's pretty much stayed the same.
Bad guys are bad guys at some point in time.
Just how they go about their business,
their techniques.
They're having to, like I said, innovate around.
We make it harder for them.
On Monday we're safe, on Tuesday we're not.
And then on Wednesday it switches again.
>> So we've talked about kind of this multicloud environment.
When we talk to customers, it's like well I want
the developer to be able to build their application
and not really have to think too much underneath it.
That has to have some unique challenges.
We know security, we knew long ago,
well I just go to the cloud, it doesn't mean they take
care of it.
Some things are there, some things they're going to remind
you now, you need to make sure you set certain things
otherwise you could be there.
But how do we make sure that security is baked in
everywhere and as a practice that everybody's doing?
>> Well, I mean, again, some of the practices hold true
no matter what the environment.
I think the big thing with cloud native is,
back in the day when you looked at an old legacy
data center, you were part sort of administrator,
you were part detective.
Most of the people don't even know what's running
on there.
That's not true in cloud native environments.
Some YAML file, some declaration, it says exactly
what production should look like, right?
And then the machines instantiate production,
so you're doing things at machine scale
forces the human scale people to be explicit.
And for me, that's a breath of fresh air.
'Cause once you're explicit, then you take the mystery
out of what you're protecting.
>> How about in terms of how you detect threats.
Phishing for credentials has become a huge deal.
Not just kicking down the door or smashing a window,
using your own credentials to get inside of your networks.
How has that affected the way in which you detect?
>> Yeah, it's a big deal.
A lot of great technology has a dual use.
And what I mean by that is,
network cryptology, that whole crypto on the network
has made us safer for us to compute
over insecure networks.
And unfortunately it works just as well for the bad guys.
So all of their malicious activity is now private too.
For us, we just have to invent new ways of detecting.
Direct inspection, for instance, I think is a thing
of the past.
We just can't depend on it any more.
We have to have tools of inference.
And not only that, it's gave rise in a lot of innovation
on behavioral science.
And as you say, it's not that the attacker
is breaking into your network any more.
They're logging in.
Okay, what do you do then, right?
Alice's account, it's not going to set off the triggers.
So you have to say when did Alice
start to behave differently?
She's working in accounting.
Why is she playing around with the source code repository?
That's a different thing, right?
>> Automation is such a big trend.
How do we make sure that automation doesn't leave us
more vulnerable to security because we need to be able
to automate, we've gone beyond human scale for most
of these configuration.
>> That's exactly right.
And how do we, I always say just, with security automation,
in particular, just because you can automate something
doesn't mean you should.
And you really have to go back and have practices.
You could argue that this thing
is just a machine scale automation.
You could do math on a legal pad, or you can use a
computer to do it, right?
So apply that to production.
If you mechanize something, like order entry
or whatever, you're automating part of your business.
Use threat modeling.
Use the standard threat modeling, like you would your code.
The network is code now.
And storage is code.
And everything is code.
Test, automate your testing.
Do your threat modeling.
Do all that stuff.
Please do not automate for your attacker.
>> The matrix is here.
I want to go back to the Alice problem.
Because you were talking about before you have to use
inference, so Alice is in the network.
And you're observing her moves every day.
And then okay something anomalous occurs,
maybe she's doing something that normally she wouldn't do.
So you've got to have her profile and her actions
sort of observed, documented, stored.
The data's got to be there.
And at the same time, you want to make sure,
it's always that balance of putting handcuffs
on people versus allowing them to do their job
and be productive.
At the same time as well, you don't want to let the
bad guys know that you know that Alice is doing
something that she shouldn't be doing
because it's actually not Alice.
So all that complexity, how are you dealing with it?
What's the data model look like?
>> Doing it, machines help, let's say that.
Machines can help us.
You know, you and I, we have only so many sense organs.
And the cognitive brain can only store so much state.
Machines really help us extend that.
And so looking at not three dimensions of change,
but 7,000 dimensions of change.
Something in the machine is going to say,
there's an outlier here that's interesting.
And you can get another machine to say,
that's interesting maybe I should focus on that.
You build these analytical pipelines
so that at the end of it,
they may argue with each other all the way to the end,
but at the end you have a very high fidelity indicator
that might be at the protocol level.
It might be at the behavior level.
It might be seven days back or 30 days back.
All these temporal and spatial dimensions,
it's really cheap to do it with a machine.
>> And if we could stay on that for a second,
so I'm trying to understand.
I know that's a high level example,
but is it best practice to have the machine
take action, or is it an augmentation?
And I know it depends on the use case,
but how is that sort of playing out?
>> Again, you have to do all this safely.
A lot of things that machines do,
don't return back to human scale.
It's the stuff that returns back to human scale
that humans understand that is useful.
So, for instance, if machines find out all these types
of assertions, even in medical.
Right now you've got so much telemetry going into
the medical field.
Say the machine tells you have three weeks to live.
You better explain how you came about that assertion.
It's the same with security.
If I'm going to say, look we're going to quarantine
your machine or we're going to reimage this machine,
I'm not like picking movies for you
or the next song you might want to listen to.
This is high stakes.
And so when you do things like that,
your analytics needs to have what is called entailment.
You have to explain what it is,
how you got to that assertion.
That's become incredibly important
in how we measure our effectiveness
in doing analytics for security.
>> That's interesting because you're using a lot
of machine intelligence to do this and a lot of AI
is black box.
So you're saying you cannot endure that black box
problem in security.
>> Yeah, that black box is very dangerous.
I personally feel that things should be open sourced.
This type of technology, it's so advanced
that the developer needs to understand it,
the tester needs to understand it.
Certainly the customer needs to understand it.
You need to publish papers and be very, very transparent
with this domain.
Because if it is in fact black box and it's given
the authority to automate something,
like shut down the power or do things like that,
that's when things really start to get dangerous.
>> TK, give us the latest on Stealthwatch there.
Cisco's positioning when it comes to everything
we've been talking about here.
>> You know Stealthwatch, again, has been in market
for quite some time.
It's actually been in market since 2001.
And when I look back and see how much has changed,
how we've had to keep up with the market.
And, again, it's not just the algorithms we write
for detection, it's the environments have changed.
When did multicloud happen?
So operating, again, it's not that Stealthwatch wants
to go there, customers are going there.
And they want the Stealthwatch function across
their digital business.
And so we've had to make advancements
on the changing topology.
We've had to make advancements because of things like
dark data.
You know, the network's opaque now.
We have to have a lot of inference.
So we've just kept up and stayed ahead of it.
>> We've been spending a lot of time talking
to developer communities,
and there's a lot of open source tooling out there
that's helping enable developers,
specifically in the security space.
You were talking about open source earlier.
How does what you've been doing with Stealthwatch
intersect with that?
>> Yeah, that's always interesting too because there's
been sort of a shift in, let's call them the cool kids.
The cool kids, they want everything as code.
So it's not about what's on glass or a single pane
of glass any more.
It's what's Stealthwatch's code?
What's your router as code?
Look at DevNet, right?
DevNet is basically Cisco as code.
And it's beautiful because that is infrastructure as code.
That is the future and so all of the products,
not just Stealthwatch, have beautiful APIs.
And that's really exciting.
>> Well, I've been saying for a while now,
and Stu I think you agree,
that is a big differentiator for Cisco.
I think you're one of the few, if not the only
large established player in the enterprise
that has figured out that sort of infrastructure
as code play.
Others have tried and are sort of getting there,
but sort of start, stop.
You use a term that is really cool.
It's like living off the land.
Pair of grills, like the guy who lives off the land.
And threat actors are doing that now.
They're using your own installed software
and tooling to hack you and steal from you.
How are you dealing with that problem?
>> Yeah, it's a tough one.
And, like I said, much respect.
The adversary is talented.
And they're patient, they're well funded.
That's where it starts.
And so why bring an interpreter to a host
when there's already one there?
Why write all this complicated software distribution
when I can just use yours?
And so that's where the game starts.
And the most advanced threats aren't leaving footprints
because the footprints are already there.
They'll get on a machine and behaviorally
they'll check the cache to see what's hot.
And what's hot in the cache means that behaviorally
it's a path they can go.
They're not cutting a new trail most of the time.
So living off the land is not only the tools
that they're using, the automation, your automation
they're using against you, but it's also behavioral.
And so that makes it harder.
Is it impossible?
No.
Can we make it harder for them?
Yes.
So, yeah, look I'm having fun,
and I've been doing this for over 25 years.
Every week it's something new.
>> Well, it's a hard problem you're attacking.
Robert Herjavec, who came in theCUBE sort of opened my eyes.
You think about what are securing?
We're securing everything.
Critical infrastructure, essentially it's securing
the entire global economy.
And he said something that really struck me.
He said it's an $86 trillion economy.
We spend .014% on securing that economy.
And it's nothing.
Now, of course, he's an entrepreneur,
and he's pimping for his business.
But it's true.
We are barely scratching the surface of this problem.
>> Yeah, and it's changing.
I mean, it's changing.
Could it be better?
Yes.
>> It is changing.
There's board awareness.
>> 20 years ago, they invite me to a dinner party,
you know, what does your husband do?
I'd say cyber security is something they'd roll their eyes
and change the subject.
Now they ask me the same questions,
like oh you know my computer's running really slow.
These are not, this is everyone now.
>> Or I'm worried about a life hack.
Or how do I protect myself?
Or what about these companies?
Do I trust the bank?
Those are the kinds of dinner table conversations.
>> Every party.
So now I just make something up.
I don't do cyber security.
I'm just a tour agent or something.
>> You've been in this business forever.
I can't remember, have I ever asked you
the super hero question?
>> What is that?
>> Who's your favorite super hero?
>> Ew, that's a tough one.
>> Cause all the security guys I know,
they always dreamed about saving the world.
>> Is that right?
I don't know, I just like...
>> You're not a super hero guy. >> No, no.
>> TK's a video game maker now.
>> Well, you're my super hero.
I love what you do.
I think you are a great asset for Cisco
and Cisco's customers.
We really appreciate you coming on.
>> Thanks. >> TK, give us a final word.
If people want to find out more about what Cisco's doing,
read more of what you're working on,
what's some of the best resources for them to go to?
>> Just drop by the web pages.
Everything's published out there.
Like I said, even for the super nerdy,
we publish all our security analytics papers.
I think we're over 50 papers published in the last 12 years.
>> Well, TK thank you so much.
Always a pleasure to catch up with you and safe travels.
>> Thank you so much.
>> For Dave Vellante, I'm Stu Miniman.
John Furrier's also in the house.
We will be back with lots more coverage here
from Cisco Live 2020 in Barcelona.
Thanks for watching theCUBE.
(upbeat music)