Transcript 0:00 [on-hold music] Every customer that we speak to about transforming to public cloud, hybrid cloud, you know, whatever, we advise them that the first thing you need to do is take a step back from the technology and look at your business. 0:15 So what is it that your business actually wants to achieve by going to the public cloud? Is it about experience? Is it about being able to do something faster? Is it about being able to save money? 0:26 You know, these are all very valid reasons, but unless you understand exactly what the business is trying to achieve by moving to cloud, you can't build your cloud strategy. 0:38 [on-hold music] Welcome to The Peggy Smedley Show, the podcasting voice of IoT and digital transformation, with your host, Peggy Smedley. 0:59 Hello, listeners, and welcome back to The Peggy Smedley Show. As always, I'm your host, Peggy Smedley. My first guest is a technologist with extensive hands-on experience. 1:09 He has more than twenty years of industry knowledge in technical and broad level customer presentations, advising customers on network security and management solutions, and providing training for customers, sales, and pre-sales. 1:24 He has eight years of experience in team management and is committed to technology evangelists. 1:30 His specialties include cloud security, network security, intrusion prevention, vulnerability management, encryption threat landscape, security intelligence, and secure digital transformation. 1:43 Please welcome Simon Leach, Senior Advisor, Security and Risk Management for HPE Pointnext Services. Simon, welcome to the show. Thank you, Peggy, for the, uh, warm welcome. 1:56 Well, Simon, you've got a very impressive background, so that's why I'm gonna get right to it and ask you really to talk about, you know, we see Gartner throwing out a lot of projections about where the market for cloud is, but nobody knows this better than you do about talking about the cloud experience. 2:14 Help us understand what that means when we think about security and what we need to do today. Okay. 2:20 So there's definitely been a growth in public cloud services, and, you know, we only need to look at Gartner's statistics, as you said, to, to see how prolific that growth has been over the last couple of years. 2:31 But I think one interesting thing that I've taken away specifically from the latest figures from Gartner this year is that that growth is actually starting to slow down a little bit. 2:40 And I think there's a couple of reasons for that. 2:43 The first one, yeah, it could be influenced, of course, by COVID, by the pandemic, as everything has been this year, and, and organizations are taking a little bit of a step back. 2:52 But I actually think that what's happening is that we're starting to reach a little bit of a plateau as organizations that adopted cloud early on have moved the most easy parts of their business to the cloud, and they're now taking a bit of a step back, and they're looking at the costs, and they're looking to see how much it's really costing their organization, and they're starting to think more about a cloud experience. 3:15 And one of the great things about public cloud is that it's really given the on-premise vendors a reason to innovate and to think a little bit more about, like, how they can actually bring that public cloud experience back on premise. 3:32 So now it's not about where is my data sitting, it's about how easy is it for me to use my data and for me to use my applications. 3:40 Because to the end user, you know, I don't really care if the application I'm using is in the public cloud or if it's in an on-premise data center, as long as it does what I expect it to do. 3:50 And that's really what you start to see is that there's now a little bit more sort of, you know, transparency into I don't necessarily use the public cloud or use the private cloud, I just use the application. 4:00 And that's, uh, that's really where I think, uh, you know, this cloud experience is coming from. When we talk about on-premise, everybody has this idea now, things are changing. 4:09 When we think about what does that mean, describe to us why it's important to have on-premise. What, what are you getting from that? So I think that depends a little bit on the industry you're looking at. 4:20 And there, there are examples in, in, in different, uh, contexts there. But take, for example, the, the financial industry. 4:27 So the reason that they were maybe a little bit slower to move to the public cloud is, and firstly, that they had a huge amount of technical debt internally. 4:37 So they had masses of infrastructure that had been built over a long period of time that they required in order to deliver their services to their customers, so the banking services. 4:46 And then secondly, there was also a concern around the security of a public cloud. 4:52 So again, a bank being very security conscious, they felt they were in a position that they're doing things very well, and they wanted to, to take advantage of, again, the best practices they'd built over a long period of time. 5:04 So that has led customers to s- to keep things in an on-premise environment for, for a long period of time. 5:11 But what we've seen happening over the past couple of years is that the, the public clouds are becoming, you know, a lot more mature, and of course, they have to be very secure. 5:21 So we still see that security is the number one reason that people don't want to move to a public cloud. 5:26 But if you think about it logically, and, you know, I often when I speak to customers, I, I ask them, I say, "Well, okay, how, how large is your internal security team?" 5:33 And, you know, depending on the size of the company, it might be ten people, it might be fifty people, it might be five hundred people. 5:39 And then I say, "Okay, well, how large do you think the security teams are at, you know, AWS or Azure?" 5:44 And, you know, I don't know the answer to that, but it's a massive number, because if you think about it, these public cloud vendors, if they don't do security right, then they're gonna lose customers. 5:54 They're gonna see a huge attrition rate. You know, if there was ever a major cloud security incident to hit a c- a, a large public cloud provider, you know, you would very quickly see people walking away from them. 6:07 So really, the public cloud has to be secure by default. If it's not, people wouldn't use it. 6:14 But what's more important is how you use that public cloud.And there's a, a saying I often use with customers, which is whilst you can outsource your operations, you cannot outsource your organizational risk. 6:26 So organizations that put things in the public cloud, they really need to understand the risk that is involved in doing that and make sure they address that risk using the appropriate security controls. 6:37 Because the public cloud can be perfectly secure as long as you use it correctly, but if you don't use it correctly, that's where the problems are gonna start. 6:45 So you're really describing, Simon, what needs to happen when we talk about on-premise, and they think about that experience, and they think about the public cloud. Help us understand where we have to be. 6:55 Are we experiencing that same thing when we talk about the opportunities of a hybrid cloud to offer various industries? You just said financial services. 7:04 When we think about manufacturing, when we think about retail, when we think about all of these things, is this what we're talking about right now, this virtualized data that we talk about? 7:14 Is this what we have to think about? Yeah. So it's about the user experience a lot of time. 7:20 And by user, I don't just mean the end user that sits behind the keyboard, it's also the people that are creating the applications and building the infrastructure and, and building the business services that are getting consumed. 7:31 And one of the big advantages around public cloud is that it's enabled a lot of, uh, processes around standardization and around instrumentation and around, uh, automation of the, the infrastructure and the use cases. 7:47 And what we've seen happening, you know, more recently is that as some of the on-premise vendors and also the public cloud vendors, you know, if you think about something like, uh, Amazon Outposts, for example, or, um, you know, Microsoft Azure, um, Hub, yeah, a-as they start to bring that experience back onto premise, it's about delivering that cloud-like experience inside the customer data center. 8:10 And at HPE, that's also one of the things that we've been doing a lot of development and research around, um, over the past two years or so. 8:18 You know, as we move everything that we offer to our customers into an as a service model, that also means that we need to be able to deliver this on-premise cloud experience, uh, to our customers. 8:29 So we've, we've started to develop platforms. 8:31 For example, GreenLake Central is, is one of these, which does give the customer in an on-premise environment the same sort of tools that they would have in a public cloud environment to allow them to automate their internal hybrid IT data center. 8:47 You talk about GreenLake, which is so important because when you think about things that give you transparency, visibility, you know, companies need that to make real-time decisions, to really be able to understand things. 8:59 When we talk about barriers, are there barriers that they have to think about? Because now when we think about exponential growth, when we think about... 9:07 You, you talked about Azure, you talked about cloud native integration, things like that. 9:11 Are those all the things when we look at security right now and we look at the types of things, data centers to the edge, to the cloud, you're putting all these kind of things that you have to worry about, is this the pressure that comes into understanding, you know, there's a lot of bad guys out there, and you really have to be able to understand what you're looking at when you look at the cloud and where you're looking at on-prem? 9:35 These are a lot of things all that come together that you just said, and now you have to be able to look at what you're doing to be able to understand your enterprise. 9:45 And now we're all disconnected because we're all working from different locations. 9:49 Yeah, that's certainly true, but I think the security challenges don't necessarily change, whether you're talking about working from home or you're talking about public cloud or you're talking about on-premise. 10:02 The thing that does change is the perimeter. So we-we-we've seen this with, you know, the recent, uh, surge in working from home, is that the, the enterprise perimeter is starting to dissolve. 10:12 And whereas previously, you know, I was able to sit behind my, my internal, uh, security operations center and monitor everybody within the, the, the boundaries of my corporate firewall because that's where everybody sat. 10:24 Now there's almost nobody within that corporate firewall boundary. They're all outside. 10:28 They're all connecting into my office, whether it's via a VPN connection or whether it's via applications that we've, we've migrated to the public cloud or where-wherever. 10:38 So I end up with lots and lots of different sources of security data that I somehow need to bring together so that I can analyze them. 10:47 As you say, you know, data is king from, from that, that perspective, um, to enable me to, to take the right security decisions. 10:55 So what we see a lot at the moment is customers starting to really look towards, you know, new forms of security architecture, you know, zero trust architecture, which really gets away from this idea of a crunchy shell around your organization and really starts to think about, you know, moving the boundary closer to the data or closer to the application. 11:17 Public cloud really becomes a great use case for zero trust, um, from a, um, perspective. That's a really important point. 11:25 Go into more detail on that because right now when you talk about zero trust and you talk about what we need to do, how do businesses detect and respond to cloud security threats? 11:35 Because I think they have to be increasing, or at least right now we think it's a problem. We always have to think about that. Yeah. 11:42 So the detection and response in the public cloud is, yeah, is, is definitely important. 11:46 And, and that was one of the mistakes that I think a lot of companies made early on, is that they treated the detection capabilities in the public cloud separately from the detection capabilities they had internally. 12:00 So for example, they would have a, they would have a nice SIEM tool internally to collect security alerts, and they'd have a team of people that were looking at those security alerts and identifying internal, uh, threats. 12:11 And then there'd be a, a second set of tools that are somewhere in the public cloud that are storing logs from all of the public cloud applications-And whilst it would identify threats in the public cloud, there was no real correlation between those two instances. 12:25 So, you know, definitely the tools that are in the public cloud are very good at monitoring public cloud security threats. 12:32 But you need to make sure that you can integrate those into your on-premise data center as well, because there can very often be security threats and security situations that migrate themselves across, you know, public cloud and on-premise data centers, and you need to be able to get those two, two things correlated together. 12:52 And especially when you think about that in the concept of a, of a multi-cloud experience where parts of your business may be in AWS and other parts may be in the Google Cloud platform, for example, you still-- in that situation, you definitely need to have this overarching security operation capability that allows you to monitor, um, you know, everything that's happening in that environment. 13:12 Isn't that where you have greater risks? I mean, that's why you have to have this overarching because that's where we go back to your people comment that you made earlier. 13:20 Because if you don't have it, that's where you can have really a bigger problem because you're looking at things that are remote, and you're kinda looking at what's, what's the fallback then if you're not really having the answers to that because you have so many things going on, and how do you look the right information to make the right decisions that are there? 13:41 Yeah, definitely. And, and this, this is one of the problems of, you know, people going out and buying cloud services on a credit card, right? 13:47 [laughs] Because if that happens outside of the IT organization, then the IT organization and specifically the security team don't know anything about it. 13:56 So the only way you can get that really good visibility into what's happening in your environment is to know everything about your environment. 14:04 Um, and yeah, that's, that's one of the, the things, you know, public cloud and software as a service is, is certainly getting a lot better at giving you the ability to view logs and view data that you need to make security decisions, but it comes back to visibility. 14:19 You know, if, if I don't know that somebody has, has used, you know, shadow IT, has gone out and bought cloud on their credit card because it was easier, I'm not gonna be able to report on it. 14:29 So then you're just describing how can businesses identify these risks, these impacts in order to make the most out of their security because you're describing things that sometimes it's, it's hard. 14:39 They're, they're making quick decisions because they have to, because they're nervous about the threats, but they've, they've, they've got to address them quickly. Yeah. Yeah, definitely. 14:51 And, you know, a, a lot of that happens or a lot of that drives, you know, a good cloud security strategy. 14:58 So, you know, every customer that we speak to about transforming to public cloud, hybrid cloud, you know, whatever, we advise them that the first thing you need to do is take a step back from the technology and look at your business. 15:12 So what is it that your business actually wants to achieve by going to the public cloud? Is it about experience? Is it about being able to do something faster? Is it about being able to save money? 15:24 You know, these are all very valid reasons, but unless you understand exactly what the business is trying to achieve by moving to cloud, you can't build your cloud strategy. 15:33 And that also means you can't b-build your cloud security strategy. So we'll often recommend our customers, you know, start by doing an assessment of your current state. So what is it your business does today? 15:44 What do they do well? What do they do badly? What do they do well and badly from a security perspective? 15:49 And then determine what is the end state, what is the goal that you want to get to, what's your future state of operations actually going to look like? 15:56 And only then can you perform a gap analysis to understand what it is that's missing. And the cloud itself, and cloud security specifically, it doesn't need to be an obstacle. It actually offers you a way to transform. 16:08 Because once you understand what the gap is between where you are now and where you want to be in the future, only then can you start to build. 16:15 And you know what's working well for you today and what's not working well, and then you can use this cloud transformation as the opportunity to introduce new measures, new controls, new strategy items that help you address that debt you have currently. 16:30 So Simon, I guess here's the tricky part. I'm gonna go back to the people because I always think in security, you've gotta have the right people. I think in everything you have to have the right people. 16:39 It's people, technology, systems, right? In all of this. But you just said- Right... you go back to the assessment, the end state. You've gotta look at the, the gap analysis, and then you can transform from that. 16:49 That, that's exactly what you said, right? I think that's what I understood. 16:53 But now if you don't really have the right people to give you that insight, how can an organization, an enterprise do any of that when we're changing so fast, they don't even know what the end's gonna be? 17:05 They think they do, but they, they're still struggling with that. And plus, we have COVID right now, and you just said at the beginning of our conversation, we were growing, I think it was twenty percent a year ago. 17:17 We're slowing down, so companies are going, "We think we were doing this." Cities are shutting down. Um, I'm throwing a lot at you, I know. 17:24 How do we really put all this in perspective when organizations are going, "We think we wanna go here"? The people are confused about where we go. 17:34 How do you take a deep breath and say, "This is where we wanna do to be able to do that gap analysis," and the nefarious characters are constantly pushing at you to break in the back door, to, to steal whatever data you have? 17:47 Exactly. And that's a lot about your staff, right? So it's making sure that you pay attention to the peoples in your team. 17:54 And I think one of the things we've seen is that there is definitely a shortage of qualified engineers at the moment, right? 18:01 And that's irrespective of if you're talking about cybersecurity or if you're talking about cloud adoption, you know, there, there is a shortage of skilled resources there. 18:10 Uh, it doesn't help at the moment because people are nervous about changing roles or changing jobs because of the current situation as well, so it's hard to get people on board. 18:19 And, you know, I, I've seen research that suggests that the lack of engineers is gonna slow cloud projects this year. 18:25 So it's important that organizations can address that quickly and that they make sure that they've got the appropriate education and training programs in place.And that they invest in that training. 18:36 We've seen, you know, a lot of situations and, and th-this is the same, you know, all over for IT, right? 18:41 There's a lot of experience in older technologies, but it's important that as those older top technologies start to sunset, that you reuse those resources and make sure that they maintain their level of knowledge and their level of-- their, their skillset so that they can move to the next big thing in technology. 18:58 And unfortunately, a lot of organizations haven't made that jump because they weren't sure about how, you know, how quickly public cloud would, uh, would come upon us, and then the people aren't there. 19:08 So you need to then, you know, hire in contractors, work with third parties, work with consultancy organizations to make sure that you have those skillsets available to you. 19:16 I'm a believer that you have to have somewhat of a hybrid solution, because I think you have to build and deploy and then do, because we're looking at all edge computing, we're looking at cloud, I, I believe the hybrid is the way to go until you really understand where you're going. 19:32 If you look at it- Yeah. -someone like yourself, do you believe that's the way to go? I just think that businesses go too fast. Too fast, too furious, they fail. Yes. 19:39 They have to kind of look at their businesses and do that. Is, is that your belief as well? Yeah. 19:44 So I think, um, our CEO back in our-- at our Discover Virtual Experience, Antonio Neri, he said in July that more than seventy percent of enterprise apps and data still operate outside of public clouds. 19:57 So it's-- we're definitely in this hybrid model, and we're gonna remain in this hybrid model for, for quite some time. So it is important to take a sort of cloud everywhere mentality, right? 20:09 Most people are still sort of dreaming of this, this day when they can, you know, move beyond their cloud-first thinking, and instead they want to just understand how this will all fit together, so they have this cloud everywhere experience across their hybrid cloud. 20:24 And, you know, that we, we will maintain or we will remain in this, this hybrid model for some time to go. 20:29 So, you know, you know, whilst I made the comment, it's important to see what the next big thing is that's coming, and you need to make sure you're enabled to be able to adapt to that. 20:37 Don't assume that it's gonna happen overnight because you will remain with your on-premise data centers for, for some time and, um, you know, especially as the cloud experience in the on-prem continues to evolve. 20:47 It's kind of interesting to hear you say that. What advice would you give businesses what they need to do right now with the cloud? You talked a little bit about that. Is there some things that they should do to keep... 20:57 Because right now, COVID has kinda turned us upside down, and we really don't know how long this is going to be, but we can't keep looking back. In order to be successful, we always gotta look forward. 21:08 So what advice would you give these companies? Look at what your business needs, I think is, is the, is, is the very high level advice. You know, don't treat technology as a silo. 21:18 Make sure that technology is very much tied into your overall business strategy. 21:22 Whether you're talking about migrating to the cloud or adopting zero trust or just cybersecurity in general, you need to make sure that whatever you decide to do is built into your overall business strategy. 21:33 A lot of the work that I, I've been doing recently is about helping organizations to adopt zero trust, for example. 21:39 And, and for that, we take this business-led approach, which goes back to this concept of doing your initial assessments, understanding current state, understanding where you want to go to, and then finding the business use cases that are gonna help you build those sort of quick wins. 21:53 And it's the same when you're talking about public clouds. 21:56 You know, you need to understand how the applications that you want to migrate to the public cloud work today, and you need to understand how they will be improved by the public cloud model, or in some cases, won't be improved and should stay in the on-premise data center. 22:10 But i-it's really about, you know, getting that good understanding of the business, where the business wants to go, what it wants to achieve with public cloud, and, and then start to talk about how the technology is gonna enable you to move forwards from that. 22:24 And then most importantly, whatever you're doing, don't forget about security. 22:28 Because if you don't take a security by design or a security built-in approach to your cloud migration, then you're gonna get hit sooner or later with, with a s- with a serious security incident, a serious security problem. 22:41 And, you know, we're, we're really seeing a lot of organizations adopting this now, but it could certainly be better for other companies because, you know, the advantage of thinking about security upfront is, first of all, a, a financial one. 22:54 You know, it costs a lot less to integrate security into a project than it does later on. And the second is you're already prepared if security incidents do happen. 23:02 You've already gone through, you know, initiatives such as secure software development life cycle to make sure the coders that you're using understand the, uh, you know, the main vulnerabilities of developing code for, for a public environment. 23:14 And you can then, uh, you can then build upon that and make sure that you've got strong, uh, initiatives in place. 23:20 Simon, are there some industries that have been better at adopting this zero trust assessment use cases that you just described than others right now or are moving forward? 23:30 Um, a lot of organizations-- So if you look at zero trust from a traditional perspective, zero trust when it was first, uh, introduced was all about zero trust networking. All right? 23:42 So it was, it was something that the networking vendors would use as, as a way of, you know, repositioning or distinguishing the way they, they dealt with security architecture from a networking perspective. 23:52 But I, I, I really think that the organizations that are doing it well today are thinking beyond simply zero trust networking, and they're thinking much more about zero trust architecture. 24:04 So that means looking at zero trust all the way through the technology stack. So, you know, start with y- with your network devices. 24:11 You know, how does the network enforce, uh, access control to people as they, as they connect devices to the network? But then think about zero trust from a device perspective, so your server. 24:22 You know, can you trust the server hardware?Has it come from a, from a, from a trusted supply chain, for example? And then you move up to your operating system. Do I trust my operating system? 24:33 And then finally you get up to your application and to the data. 24:36 And, you know, w-we recently, uh, within HPE, we made a very, uh, interesting acquisition of a, of a small startup, uh, called, uh, Scytale, um, S-C-Y-T-A-L-E, if I'm mis-mispronouncing that. 24:49 But what Scytale does is it provides a service identity approach to zero trust. 24:55 So we can now start to think about the application that's running in the public cloud, because if you think about it from public cloud perspective, you know, very often the network isn't yours, the, the, the hardware isn't yours, so the application becomes the place where you're actually going to start to enforce your, your access decisions. 25:13 And we're seeing a lot of industries now, you know, for example, healthcare is a very good example, uh, finance is another good example, where they're developing applications that are specifically cloud native, and they're really in-interested in adopting this concept of, of service identity. 25:30 And it's something we've actually contributed as well. It's part of the, the, the cloud native, uh, compute f- uh, foundation, CNCF. So there's two projects that are part of that. 25:39 One is, uh, Spiffe and one is SPIRE, and that's, that's really the foundation of, of what we've now called Project Consignio, uh, within HPE. 25:47 But really being able to start to address zero trust at an application level, uh, as well as, you know, just being something down at the network level is, is really starting to, to get a lot of interest from those early adopters who really are concerned about security at the application level as well. 26:03 Are we on track when you look at this? 26:05 I mean, do you feel positive now to say, "Look, we can help companies do what they need to do to stay positive about where they need to be in business, whether it's on-prem, their security, their hybrid clouds, getting them to accomplish what you just said." 26:21 Can we get companies and enterprises, overall organizations to move forward? As an industry, I think we're... Well, there's, there's a couple of, of given. Like, we're always gonna experience security incidents. 26:34 So as soon as we plug one hole, the bad guys will find another hole. Yeah. Um, so, so that, that certainly is always going to remain. 26:41 But what we are doing is we're getting better as an industry in being able to identify the problems that we're seeing, and we're getting better as an industry in being able to provide technologies that help those problems, and we're also getting better as a consultancy industry, specifically, in advising customers. 27:00 Because one of the advantages of working with a, you know, a third-party services organization or consultancy organization is that while something might be new for you, they've done it fifty times before. 27:11 [chuckles] So, you know, that, that breadth of experience really means that they can take some of those best practices back into your, you know, the customer's organization, and you, you really start to benefit from that multi-project experience that the third party has had. 27:24 Well, Simon, I have to tell you, this has been a great conversation. Simon Leach, Senior Advisor, Security and Risk Management at HPE Pointnext Services, thank you for your time. 27:34 Where can our listeners go to get more information about what we talked about today? Great. Well, th-thank you for your time as well. I also enjoyed the conversation. 27:42 I guess the first starting point would be https://www.hpe.com/pointnext. All right. Simon, thank you again. All right, listeners, we're out of time for this segment, but stick around, we've got more to come. 27:55 Check out our website at connectedworld.com or the show website, peggysmedleytheshow.com. But most importantly, tweet at us, @connectedwmag. All right. 28:04 This is The Peggy Smedley Show, the podcasting voice of IoT and digital transformation. And remember, with great technology comes great responsibility. We'll be right back after this commercial break.
