>> Narrator: From San Francisco
It's theCube.
Covering RSA Conference 2020, San Francisco
Brought to you by SiliconANGLE Media.
>> Welcome back to RSA for CUBE coverage
here at RSA Conference in Moscone,
I'm John Furrier with theCube.
Our next guest is Sekhar Sarukkai,
who's with the McAfee, and he's a technical fellow,
formerly chief scientist and co-founder
of Sky High Networks, which was acquired by McAfee.
Really pioneering what we're seeing as cloud,
as the driver of the screen paradigm.
Sekhar, thanks for coming on theCube.
>> John, thank you so much for having me here.
>> I know we don't have a lot of time,
so we'll just jump right in.
Cloud is changing the game.
You guys saw this wave early at Sky High.
>> Yup.
>> So, how is it rendered itself today?
We're seeing the signals out there,
(mutters) the network's earnings were down this week
because they're on-premise,
they're busy shifting to the cloud.
We think they'll do well, but it's obviously impacting.
>> Yup.
>> Everyone's got to shift, including their customers.
What's going on?
>> Yeah, this is amazing.
Last year, I think about a few months back,
we did a survey of large enterprises,
and for the first time we found that the majority
of the CIO's and the CSO's felt
that cloud was more secure than on-prem.
That's a big deal.
I mean, I've never seen that before.
I didn't expect it to be this quick,
but that actually manifested itself
and enterprises are ready to be cloud first,
are very cloud friendly.
And that's significantly different from when we started
Sky High, and even a couple of years ago.
And because of that, how you secure the data,
how you secure who can extract, the kind of threats,
need to be looked at with a different lens.
I mean, you've seen breaches happen every week,
if you look back over the last year.
And a lot of those are cloud native threats.
These are not malware based breaches of data,
which is what you would think of
when you traditionally look at...
>> John: Are they micro services breaches?
>> No, these are cloud breaches because cloud has...
It's good right?
>> John: Yeah.
>> It's got transparency, it's got API's.
So whatever API's you use, bad hacker could use it as well.
The way they land, ex-filtrate, and expand
in the cloud footprint, is very different
from how traditional malware attacks happen
within the enterprise network.
And so we've been looking at cloud native threats
and what it means to even secure data in the cloud,
which is very different from securing data
in your enterprise.
For example, I may run a DLP on my laptop
to check what kind of sensitivities are out there.
But in the cloud you don't do that, right?
Because the data is cloud native.
In our analysis we've seen that 50% of traffic
is cloud to cloud.
So it bypasses your traditional enterprise network,
it bypasses the devices.
And so, when you talk of data protection,
you need to look at new ways of understanding cloud
and integrating into it.
>> Yeah, it's interesting, I've talked to many CSO's
who've been cloud native and more in the cloud,
and they say they're worst day in the cloud with security,
is better than any day they've had on-premise.
In other words there's actually more security in the cloud.
But then, when they start getting into hybrid,
and now what we see is multicloud,
it's that third wave coming,
you start to look at on-premise to cloud, cloud to cloud,
you have a network component, becomes a big part of it.
>> Yeah.
>> Could you share your vision
on how the network needs to evolve,
cause Amazon an Azure, they've got their own networks.
>> Sure, sure, sure.
>> It's also not on-premise either,
so if I want to rent a route from here to here...
What's the network impact?
>> I don't think network based security controls
are going away.
And if you look at what McAfee announce just today,
there's, what we call, the unified cloud edge.
We acknowledge the security in depth at the end point,
at the cloud, and in the network.
So we are the first product, really,
to integrate the policies and visibility
into data flow between the clouds,
to and from the cloud, and in the device.
In that model you have a network components
of user's secure web gateway, which is cloud hosted.
Interestingly you'll see that a lot of security tools
are also becoming cloud native.
And so that's what we've leveraged.
Our cloud native, cloud security platform,
our cloud native SWD web gateway,
as well as EDR and endpoint protection from the cloud.
>> Let me ask you a question as the chief scientist
guru that you are.
The security posture of companies certainly has changed
with the cloud.
How would you describe the current posture from a customer
with respect to the cloud in a good way.
What do they need to be thinking about?
>> Actually, Gardener said it very well.
In fact, last year the had a MQ
in which they actually said that 99%
of your data breaches in the cloud,
is going to be because of customer fault.
And it may be the most trivial things,
but those are the ones that get to you, right?
And it turns out that while cloud is easy
and quick to adopt, it's very easy to miss-configure stuff.
>> John: So human error?
>> Yeah, completely.
I kid you not, majority of the issues
are failure to understand your shared responsibility model.
>> It's hard to call something a breach
when the door is wide open.
They're just walking through.
That's not really a breach, the door's open.
They walk through.
I mean, that's what you're talking about here.
>> Yeah, exactly.
It's the responsibility of the customers
to configure it appropriately,
and I think that'll take care
of the lowest hanging fruit for them.
And then as they wall their workload
moving into the cloud,
they need to think about hybrid
and not get into the trap of creating silo's.
It's a classic example.
Security vendors regretted building a ton of products
and companies around it.
There's container security, there's VM security,
there's cloud security,
but at the end of the day the customer
is moving the workload, an application into cloud.
They need a consistent way to ensure
the configurations are right, the data is secure
and there's no threats to it.
We need to make that model of simplicity,
of consistency across all of these kind of products.
>> It's clear that McAfee is transforming
their business to cloud.
You guys have been a big part of that, congratulations.
>> Thank you.
>> How would you describe McAfee's current situation
with respect to the cloud growth,
now the on-premise cloud hybrid integration,
and multicloud coming.
Because you now have this entire systems architecture
aka cloud, multicloud hybrid, a public.
>> Right.
>> All these need to work together.
>> I think McAfee is very well positioned in that.
Honestly when we joined McAfee,
McAfee's strength was in the end point,
and actually they had a very good business
in the server end point as well, with the CWS product.
When we came in with the cloud native approach where...
That product was selling very well
for the private data center, on-prem.
What we were able to do is add a cloud security story,
but also be the catalyst for M-Vision.
M-Vision is really this broad umbrella
within McAfee for doing, not really cloud security,
but EDR, insights, products which can run
in the cloud at scale, in a multi (mumbling) manner.
>> If you can create a data driven approach
to make that human personalization work
so they don't forget to secure that S3 bucket.
>> Exactly.
Which is the bigger problem, right?
>> It's kind of like when you get out your car,
it's like you left your keys in.
There's a new level of personalization coming from the data.
>> Sekhar: That's right.
>> You see that as so?
>> We do clearly.
What we see with customers is that going back
to the shared responsibility model,
it's almost like you rent a car,
the renter has some responsibilities.
The rental agency and the car manufacturer
have responsibilities.
All of us have an understanding
of what those responsibilities are.
>> I was just talking to another guest.
We were saying, "Hey, the robots use the data
to tell the human not to screw up."
>> (laughing)
>> You know, you're flying on a plane,
you got to go secure your door...
It's about really minding the environment
you're working with, and not forgetting anything.
>> And doing it in real time.
Because configurations change in the CICD pipelines
in real time, right, and being able to catch that.
What we've done as part of McAfee over the last year,
is do something which you call shift left.
Which is really before an application is born,
to make it secure.
And it's possible in the cloud
because it's very transparent.
And infrastructure is code.
So as the code gets checked in,
we can validate it...
>> Well I'm glad you're at that point.
Real quick, I know you got to go.
DevOps have been a real influence
on a lot of infrastructure's code.
But now you have SecOps, DevSecOps,
so it's all kind of the same melting pot
of agility, iteration, real time.
What's your security version of DevOps?
>> Yeah, it is that.
It is basically rather than playing WackAMole
after the fact, going and looking
at configuration failures, or DLT, or whatever, push it.
And it actually helps the security team
because they don't have bandwidth.
They want to be able to pull up developers.
There's literally 100 x more developers
than security folks.
And so, being able to integrate it into the tooling
for continuous integration deployment,
is something we've done.
It's a huge win for customers.
>> Well, Sekhar, thanks for sharing the insight.
We'll be the M Power event coming up,
we'll do more interviews there.
>> Sure.
>> And do a deep dive.
But real quick, what are you working on right now
that's exciting, that's getting you motivated,
that puts a little spring in your step.
What's happening?
>> Oh, there is a huge issue on cloud native threats
and how we use MITRE, and other frameworks,
to make the Soc teams not get loss in all the noise.
You'll see a lot of that work from us,
but there's a lot of exciting work.
>> John: Lot of innovation coming out of that?
>> A lot of innovation.
>> Software driven, obviously.
>> Cloud driven, more so.
>> Cloud native.
We'll get back and talk more
about some of the cloud native nuances
around Cooper and Eddy's service mesh state...
A lot of action.
A lot of potential opportunities but also challenges.
Very good.
Thank you for coming on theCube, appreciate it.
>> Thank you, John.
>> I'm John Furrier with theCube,
we're here on the ground at RSA Conference.
We'll be right back, thanks for watching.