>> Announcer: Live from Atlanta, Georgia, it's theCUBE
covering AnsibleFest 2019.
Brought to you by RedHat.
>> Okay, welcome back everyone,
it's the live CUBE coverage for two days here
in Atlanta, Georgia for AnsibleFest.
I'm John Furrier.
My cohost Stu Miniman of the CUBE.
Ted Julian, Vice President, Product Management,
formerly the CEO of Resilient, now part of an IBM company.
Back to doing VP of Product Management again.
(chuckling)
Your wheelhouse!
Welcome back to theCUBE, good to see you.
>> It's a pleasure to be here, thanks.
>> So obviously, product management, holistic thinking
is the big discussion here.
The thing that's coming out of this event is,
configuration management, a siloed point activity,
>> Ted: Yeah. >> Now more of a platform.
You're seeing more of a systems architecture thinking
going into some of these platform discussions.
Security certainly has been there, they're here now,
lot of pressure.
Got to have things built in with security.
But maintaining the onslaught of threats
and landscape changes going on, that's what you do.
>> Ted: It's rough out there, yeah.
>> What's going on, what are the key trends
that customers should be aware of
when thinking about configurations,
because automation can help?
Maybe all use cases? But...
>> We need to do something,
'cause customers definitely need help.
The alerts that they're dealing with, in both
in the volume and the severity,
is like nothing we've ever seen before.
At the same time, we were talking about earlier, right?
The regulatory impact.
Also a really big difference just in the last
two or three years.
Huge skills gap shortage also a critical problem.
People can't find enough people to do this work.
Very difficult to keep.
So, clearly we need to do something different,
and there's no doubt that orchestration and automation,
and configuration management as a component of that,
we've barely scratched the surface of the potential there
to help solve some of these problems.
>> Obviously open source is helping,
a lot of people now seeing the light.
First it was cloud, the skeptics said there's no security
in cloud, now there is.
Open source, security's there.
But still, proprietary systems have security,
but there may or may not be talent, to your point.
So automation is an opportunity.
How are companies dealing with the mishmash,
or the multi-platformed solutions that are out there?
>> You're right to ask the question,
it is driving the problem in a big way.
Years ago we tried this security automation within security,
like in the early days of firewalls and the Web
and stuff like that, and it didn't go well.
Unintended consequences.
But two things have changed.
The environment's changed, which has raised the stakes
for the need to be able to do this stuff
to a whole different level.
But at the same time, the technology's matured enormously,
there's been multiple platform shifts since then.
And so, security teams are both kind of desperate
for a better solution, but also have better options now
than they had before.
And so it's for this reason that we're starting to see
people adopt orchestration and automation now
in a way that we didn't see the last time around.
>> But the thing we're hearing here is that,
people are trying to automate the same things.
And some of these holes in the infrastructure,
whether it's an S3 bucket, this is basic stuff.
This is not rocket science. >> Yeah.
>> So in these known use cases, this makes total sense
that a playbook or automation could help fill those holes.
>> We talk about it as a journey, you know?
And I don't think any two organizations' journey
is the same, nor does it really even need to be the same.
So we've seen some customers, for example,
take the approach of, what's a high volume type of incident
that we deal with?
And if we could apply orchestration and automation,
then we're going to get great ROI, right?
We see 4,000 phishing attacks every month, or what have you.
And that's certainly one way to do it.
But there's other times where they say--
>> John: Each one though. (laughs)
>> That's true too.
And to that point, there's other people that are like,
you know, gathering forensics on an endpoint right now,
incredibly manual process,
we need to be able to do that globally.
Do we do it every day? No, we don't.
But, if we could automate that,
and get those results back in more like a couple hours,
as opposed to two days, 'cause the guy we need
in Sweden is out of the office or whatever?
That could mean the difference
between a low-level incident we're able to contain
and something that goes global.
And so that's the use case we want to chase.
So I don't think there's a right or a wrong answer.
>> John: Kind of depends on the environment.
>> A whole host of factors, yeah.
>> But this is the whole point about security,
there's no general purpose software anymore.
You have to really make it custom,
because every environment's custom--
>> It's totally different.
I mean, gosh, you guys are at RSA, right?
It's nuts.
There's thousands of vendors.
There's hundreds of vendors that are really products.
They're not the features, you know?
They're masquerading as products that are masquerading
as companies, but there's a reason why that's been the case.
And it's because the risk is so high.
>> The desperation too.
>> Yes, exactly.
Good word choice, yeah.
>> One of the things that reminded me of security
is this morning hearing about J.P. Morgan
going through their transformation
from the ticketing system to, wait to make a change.
>> Ted: What a great case study.
>> To, I need to be able to automate things.
So, we know that response time is so critically important
in the security area, so tell us how that meshes together
from security and automation to be able to response,
and whether it be patching or responding to an attack.
>> There's huge opportunity gains there,
and we've seen customers do some really remarkable things
that start with what you're discussing, which is,
if we could automate that phishing process to a degree,
and we have 4,000 of those a month,
and we're able to maybe shrink our response time
by 80-some or more percent, which is what we've seen,
that's a lot of savings right there.
And the meat and potatoes there is,
you already have a phishing alias, probably,
that employees report those phishing attacks to.
Well, what if we just monitored that.
We strip those emails, stripped out the attachments,
and we could automate all the manual grunt work
that an analyst would otherwise do, right?
Is there an executable?
Is that executable a known bad?
What command and control servers does it talk to?
Are those known bads?
Those are 10 tabs that an analyst could have open
in their browser.
If we can automate all of that,
so when they go into the case,
it's all just sitting there for them.
Huge time savings.
>> Yeah, it's a great proof point
of the people plus machines.
How do you make sure that the people that,
when they get the information,
they're not having to do too much grunt work.
They get to really focus on the things where their expertise
and skillsets are needed, as opposed to just buried.
>> You nailed it.
I mean, automation is a great role to play,
but it really it a subset of orchestration,
it's when you can bring those two things together,
and really fuse the people, process, and technology,
via orchestration, that's when you get
really game-changing improvements.
>> Ted, talk about the relationship between you guys,
Resilient, and Ansible?
Where's the fit?
What are you guys doing together?
Why are you here?
Give a quick plug for what you're working on.
>> Yeah, absolutely.
So, just by working with customers we discovered
that there was this growing groundswell of Ansible use
within our customer base.
It was largely in IT.
Whereas at IBM Resilient we're selling mainly into security.
And once we uncovered that we're like, "oh my gosh,
"there's all these integrations that already exist,
"they're already using them for IT use cases
"on that side of the house.
"But a lot of the same work needs to be done
"as part of a security workflow."
And so we built our integration where literally,
you install that integration into Resilient,
and we have a visual workflow editor,
where you can define a sophisticated workflow,
and once that integration is in place,
all of your Ansible integrations are there for you.
You drag and drop them onto your workflow.
You can string them all together,
it's really, really powerful stuff.
>> You know, it's interesting, Stu and I,
Dave, and a variety of other CUBE hosts,
we go to hundreds of events, we see every conference.
Everyone's going for the control plane layer.
"I want to control the data."
It's aspirational, but you can't just say it,
you got to earn it.
What's happening here is interesting,
this configuration management little sector is growing up,
because they control the plumbing.
They control the hardware, the piece parts.
So the operating system.
So the abstraction layer provides great value
as it moves up the stack.
>> Ted: No doubt.
>> And this is where the impact is,
and you guys are seeing it,
so this dependency between, or the interdependency between,
software glue that ties the core underpinnings together,
whether it's observability, data,
it's not a silo, just contexts which
they're integrating together.
This is a collision course. >> Yeah.
>> What's the impact going to be here?
What's your thesis on this?
>> That's why there is such great synergy,
is because we're sort of the domain experts
on the security point of view.
And our ability to leverage that automation set of functions
that Ansible provides,
into this framework where you can define that workflow
and all the rest that's specific to some security use cases,
is just very, very complementary to one another.
>> This is a new kind of a 2.0 kind of infrastructure dynamic
where this enables programmability,
because if these are the control switches on the gear
and the equipment and the network routes...
>> Yeah, and where things get really interesting
is when you do that in the context of a workflow
and a case management system,
which is part of what we provide,
then you get a lot of really valuable metrics
that are otherwise lost if you're purely just
in a point-to-point, tool-to-tool automation realm.
And that allows you to look at organizational improvements.
Because you're able to marry, well, first of all,
you can do things like better understand what kind of value
those IT controls are providing you and the automation
that you're able to deliver.
But you can relate that to your people
and your process as well.
And so you can see for example, that,
well, we have two teams,
one's in the day shift, one's in the night shift.
They have access to the same tool sets,
but one's more effective than the other.
First of all, you know that.
But then having known that, you can now drill into that,
and figure out, okay, why is the day shift better
than the night shift?
And you can say,
"oh, well, they're doing things a little bit differently
"maybe with how they're orchestrating,
"than this other team is."
Or maybe they're not orchestrating at all.
And now you are able to knowledge-share
and improve that process
to drive that continuous improvement.
>> So this operational efficiency comes from breaking down
these siloed-- >> Exactly right.
>> Mentality datasets or staff.
>> Yeah, and pairing that with not just, as I said,
the IT automation aspect, we can now do that 80% faster.
But what about the people and the process aspect?
We need to bring that into the mix as well.
You get that next layer of insight,
which allows you to tap into another layer of productivity.
>> So this is an alignment issue.
This brings back the core cultural shift of DevOps.
This is the beginning of what
operationalizing DevOps looks like.
>> Yes. Yeah, and that's...
>> The people are working together.
>> That's really, really well put.
It gets back to how this question got started,
which is, what is the synergy?
And to me, the synergy really is that you have these siloed,
all too often, siloed functions of IT operations
and security operations.
And this integration between Resilient and Ansible
is the glue that starts to pull those two things together
to unlock everything we just talked about.
>> Awesome. wow, that's great.
>> Research has shown that DevOps embracing,
delivering and shipping code more frequently,
actually can improve security,
not we have to go through this separate process
and slow everything down.
What does that end state organization look like?
>> That's a huge transformation,
and it's something that in the security field
we've been struggling with for the longest time.
Because when we were in kind of a waterfall mode
of sort of doing things, your timeframe of,
uncovering a security issue, addressing it in code,
code getting deployed, to a meaningful enough fashion,
and over a long enough time to get a benefit,
that could be years, right?
But now that we're in this model,
that can be so much, much more quickly obtained.
And obviously not only other great general ROI improvements
that come from that,
but your ability to shrink the threat window,
as a result of this as well, is huge,
and that is crucial, because all the same things
that us, the good guys, are doing,
to be able to automate our defenses,
the bad guys are doing the same thing,
in terms of how they're automating their attacks.
And so we really have to, we have no choice.
>> Ted, you were acquired by IBM.
>> Yes.
>> IBM made a quite sizeable acquisition with RedHat.
>> (laughs) Little bit bigger. >> Tell us what you see,
IBM with Ansible, how that should play out.
>> There is just enormous potential.
Ansible is a big, big piece of it, without a doubt.
I think we're just scratching the tip of the iceberg
for the benefits there, just from Resilient's point of view.
And we're going to have to stay in touch,
because we have some really interesting things
coming down the pike in terms of next gen platforms
and the role that Ansible can play in those too,
and how those stretch across the security portfolio
within IBM more broadly, and then even beyond that.
>> We want to keep in touch.
We certainly have initiated CUBE coverage this year
on security, cyber.
A little bit going broader than the enterprise,
looking at the edge.
You talk about the perimeter
being just disabled by this new service area,
just takes one penetration.
>> Yep.
>> Lightbulb IP address.
So, again, organizing and configuring
these policy-based systems
sounds like a configuration problem.
>> Yep, it is.
>> This is where the software's going to do it.
Ted, thanks for coming on and sharing the insights.
Any other updates on your front?
What are you most interested in?
Give us a quick update on what you're working on.
>> We're just getting started with the Ansible stuff,
so that's particularly notable here.
But also, modernizing our portfolio,
and that really gets to the whole OpenShift side
of the equation, and the RedHat acquisition as well.
Not ready to announce anything yet,
but some interesting things going on there
that kind of pull this all together,
and that serve as just one part of the foundation
for the marriage between RedHat and IBM,
and the value it can bring to customers.
>> John: Any sneak peek at all?
On the new direction?
>> Sorry, can't do that today.
Another time though, for sure.
>> Loose lips sink ships!
Don't do it!
Love to know.
>> Can't blame you for asking. (laughs)
>> I've got a feeling it has to do with automation.
And AI somewhere in there.
Ted, thanks for sharing your insights.
>> It was a pleasure. >> It's always great
to see you.
CUBE coverage here at AnsibleFest.
I'm John Furrier, Stu Miniman.
Breaking out all the action as this new automation feeds AI,
it's going to change the stack game
as data's moving up the stack.
This is theCUBE bringing you all the data.
We'll be back after this short break.
(rhythmic music)