1
00:00:00,000 --> 00:00:02,860
Well, we're back with another Coté and Cora episode.

2
00:00:03,160 --> 00:00:09,360
This episode we had David on, and I think it was you, Cora, who came up with the idea to interview him, right?

3
00:00:09,960 --> 00:00:11,380
Oh, yeah, I love David Zenzian.

4
00:00:11,520 --> 00:00:15,820
He is the head of Tanzu Global Field CISO, that's his title.

5
00:00:16,240 --> 00:00:24,540
And, yeah, he does these quarterly updates for our whole field organization on everything security for VMware Tanzu.

6
00:00:24,540 --> 00:00:30,620
And he is, I've also, I had the opportunity to meet him personally at a conference recently.

7
00:00:30,900 --> 00:00:32,860
I think it was a KubeCon in Detroit, perhaps.

8
00:00:33,540 --> 00:00:37,300
And he is just incredibly a nice person as well.

9
00:00:37,420 --> 00:00:39,640
So, yeah, I was really excited for this.

10
00:00:40,360 --> 00:00:54,520
And because we are doing author talks, our inspiration, our hook, was a publication that he's getting ready to put out within the next, I think, two weeks on VMware Tanzu PCI best practices for containers and container organizations.

11
00:00:54,540 --> 00:00:58,400
But, yeah, he does a lot of security work.

12
00:00:58,580 --> 00:01:04,780
And the conversation we had was so fun and covered so many different topics, right?

13
00:01:04,900 --> 00:01:05,440
I don't know.

14
00:01:05,620 --> 00:01:06,320
What did you think?

15
00:01:06,380 --> 00:01:07,880
Yeah, no, I mean, I agree.

16
00:01:08,140 --> 00:01:12,860
He's a lively person for the reputation security people have.

17
00:01:13,260 --> 00:01:17,560
Very, very, as he says many times, very optimistic and engaging.

18
00:01:17,560 --> 00:01:37,080
And, you know, I, you know, as odd as it may sound, it was really fun to read the PCI paper because, you know, over the, as I kind of talk about with him, over the years, things like compliance and security always seem like this mysterious, like almost occultic practice out there that's very complicated.

19
00:01:37,080 --> 00:01:54,220
But I've always kind of known, or not always, I've recently kind of known that if you actually go and you read a lot of the compliance and security things, like the PCI spec, like it's not that it's like not important or not complicated, but it's like not a big deal.

20
00:01:54,500 --> 00:01:57,660
It's just like, here's things you should do and you should do them.

21
00:01:57,760 --> 00:02:03,480
Now, the way it's, it doesn't have academic writing, but it can have that kind of density to it.

22
00:02:03,480 --> 00:02:07,620
Like one thing I wanted to ask him that I didn't get around to is like, why are things written like this?

23
00:02:07,840 --> 00:02:15,140
Like, this seems like the style of the community to be very, to be very like, like formal and things.

24
00:02:15,240 --> 00:02:19,400
And I guess, I don't know, that's probably what you end up with when you're doing standards and things like that.

25
00:02:19,400 --> 00:02:33,220
But I think David did, in the conversation, I think, I think we figured out a lot of just like, what, as I kind of start, not start, but at some point I asked him, like, you know, you see all these surveys and security is always like a number one problem.

26
00:02:33,340 --> 00:02:35,460
And like, I don't know what that means.

27
00:02:36,240 --> 00:02:44,520
Like, what is that actually, like, are people worried about installing virus scanners or like turning off ports and configuration files?

28
00:02:44,520 --> 00:02:50,720
And I think, I think he, you know, we got a pretty good explanation of what it would mean, what it means in a cloud native world.

29
00:02:51,040 --> 00:03:01,540
Like, not even what it means, but what the security things are, and kind of how you go about thinking about what they would be for industry and region and just basic security as well.

30
00:03:02,000 --> 00:03:09,820
Yeah, I definitely have a clearer mind about everything security in the cloud space, cloud and container space specifically after talking to him.

31
00:03:10,580 --> 00:03:14,720
So I hope that everybody else gets the same benefit out of this.

32
00:03:14,840 --> 00:03:16,580
And as you said, David is incredibly engaging.

33
00:03:16,880 --> 00:03:20,260
So if nothing else, it's just fun to listen to him.

34
00:03:20,760 --> 00:03:23,120
Yeah, well, we'll jump right into it.

35
00:03:23,220 --> 00:03:28,680
And eventually, I'm sure I'll mention in the podcast here when the PCI paper comes out.

36
00:03:28,680 --> 00:03:31,760
And you can see what I mean by it being gripping, thrilling reading.

37
00:03:32,100 --> 00:03:38,240
If you've ever been told that security is an issue to have, there's some great stuff in there.

38
00:03:39,120 --> 00:03:44,200
A very, very, you can even tell there's some, there's some great tables, multiple columns, really something good to dive into.

39
00:03:44,460 --> 00:03:51,980
But he's also publishing a blog that has a little bit more of a personal note about his background, how he came up in security.

40
00:03:52,420 --> 00:03:53,600
And that's a great read.

41
00:03:54,200 --> 00:03:54,420
Yeah.

42
00:03:54,620 --> 00:03:55,060
All right.

43
00:03:55,120 --> 00:03:56,620
Well, enjoy listening.

44
00:03:56,920 --> 00:03:58,260
Why don't you introduce yourself, guest?

45
00:03:58,760 --> 00:03:59,900
So David Zenzian.

46
00:04:00,240 --> 00:04:04,020
I lead the field CISO team for Tanzu in the modern app side of VMware.

47
00:04:04,360 --> 00:04:11,220
And I get to talk security to our customers and how they change what they do to do a modern app in today's world.

48
00:04:11,420 --> 00:04:13,740
So it's a really exciting, exciting space to be in.

49
00:04:14,400 --> 00:04:14,800
Yeah.

50
00:04:14,920 --> 00:04:27,700
And, you know, and when I, when I was, when Cora and I were reading through stuff ahead of this, I was realizing delightfully that you are, you know, a lot of what you talk about and work about is scoped down to applications.

51
00:04:27,960 --> 00:04:30,160
And I was like, oh, thank God.

52
00:04:30,220 --> 00:04:31,860
Something I kind of understand.

53
00:04:32,860 --> 00:04:44,020
We, you know, we don't have the whole gigantic wide world of security, which, which, which is, is beyond my, my comprehension being, you know, I, my excuse nowadays is always, I was an application developer.

54
00:04:44,020 --> 00:04:50,020
So everything you hear bad about developers, that's me, just not, not knowing anything that happens below the screen.

55
00:04:50,920 --> 00:04:51,240
That's right.

56
00:04:52,000 --> 00:04:58,460
And don't forget when we talk about applications, though, there's also that part that you, as a developer, you probably thought about, but didn't do a lot with that.

57
00:04:58,540 --> 00:05:01,820
I think one of the big changes today is the users, you know, the consumers of the applications.

58
00:05:01,820 --> 00:05:07,980
So that, that does bring it down to the end point in the bigger, broader scale of, of things, which gets really fun in our VMware conversations.

59
00:05:08,580 --> 00:05:24,300
Yeah, it's probably like most things where like, by the time you, you have the sophistication, I guess, in the, the, to be able to bring it down to the application level, it, it implies that you have addressed that topic at all the layers that support that, I guess.

60
00:05:24,380 --> 00:05:24,580
Right.

61
00:05:24,660 --> 00:05:25,100
It's a.

62
00:05:25,420 --> 00:05:26,600
Well, there's two sides to it.

63
00:05:26,600 --> 00:05:29,360
One is you're consuming off the shelf software.

64
00:05:29,360 --> 00:05:37,460
So, so a lot of, you know, a lot of, you know, even financial firms, you're a bank and you're receiving core software that's coming to you as containers nowadays.

65
00:05:38,320 --> 00:05:50,780
Um, but if you're, if you're like a tangent team deals with, if you're actually making software, you are a fairly mature company that, that, you know, you're either a startup who has a lot of funding just to hire developers because developers, you weren't cheap probably when you're a developer, right?

66
00:05:51,100 --> 00:05:51,780
I hope not.

67
00:05:52,980 --> 00:06:01,660
So it's, it's, it's a certain mindset of people who are actually producing software and you get to the customers we work with, you know, we're talking a thousand applications, 2000 applications.

68
00:06:02,580 --> 00:06:03,660
That's, that's big scope.

69
00:06:04,600 --> 00:06:05,000
Yeah.

70
00:06:05,000 --> 00:06:09,060
And, and, and, and so speak, you know, getting right into that as, as we're doing here.

71
00:06:09,060 --> 00:06:09,240
Right.

72
00:06:09,240 --> 00:06:11,820
So, so there's, there's two scoping things we mentioned applications.

73
00:06:12,220 --> 00:06:21,780
And then you brought up the other one that like gets right into the area that I think, I think I, we are always interested in is like large organizations that have a lot going on.

74
00:06:21,780 --> 00:06:40,580
And I think their needs in the application security space, like, you know, well, I shouldn't answer the question for you, but I think there's a lot of similarities, but there's something about the scope of application security at like a gigantic global bank or, you know, a government agency that I don't know.

75
00:06:40,580 --> 00:06:46,980
Like, does it change, does it add new things or, or does it change things or is it the same?

76
00:06:47,060 --> 00:06:49,680
How, how are things different in the application security space?

77
00:06:50,040 --> 00:06:50,480
Security?

78
00:06:50,660 --> 00:06:55,120
Well, security is completely different yet the same as it was 30 years ago.

79
00:06:55,120 --> 00:07:01,400
If you look at the, you know, OWASP top 10, it's generally the same controls over the last couple of decades.

80
00:07:01,560 --> 00:07:06,680
Even when we start going into like the OWASP for APIs, it's, it's similar, you know, you're not gonna have the same channel attacks.

81
00:07:06,740 --> 00:07:09,400
It's not a GUI you're using, but similar type of attacks.

82
00:07:09,880 --> 00:07:14,120
But in a modern app world, this, the, the, everything is code.

83
00:07:14,220 --> 00:07:15,220
You know, your infrastructure is code.

84
00:07:15,220 --> 00:07:19,040
One thing that we're going to be talking about a lot more is your infrastructure building materials.

85
00:07:19,240 --> 00:07:22,140
You're maybe we'll call it an i-bomb, I think is what we're looking at as terms.

86
00:07:22,400 --> 00:07:30,340
You know, not only that, but the application building materials, the construction of all these applications is code and it changes how we approach them.

87
00:07:30,480 --> 00:07:33,400
So in the past, you know, a good example, I'll get log4j.

88
00:07:33,520 --> 00:07:35,980
It happened in our near future.

89
00:07:36,100 --> 00:07:36,920
You know, we all remember it.

90
00:07:37,300 --> 00:07:43,400
There are customers still trying to identify which of their apps have vulnerabilities to log4j and how to upgrade them and maintain them.

91
00:07:43,760 --> 00:07:51,700
And when you have a large company, if you had say 2000 applications and you had hundreds of development teams working on those, they're all doing it differently.

92
00:07:51,700 --> 00:07:59,740
If you didn't standardize five, 10 years ago, when you start coming to this next log4j, you're like, okay, you got 2000 apps, but it's all different stuff.

93
00:08:00,320 --> 00:08:05,020
And if we look at one thing where we talk about a lot of standardization, getting that common image you're starting from.

94
00:08:05,080 --> 00:08:06,520
So you have the commonality across things.

95
00:08:06,680 --> 00:08:07,880
We're even doing our own releases.

96
00:08:07,940 --> 00:08:09,940
We're trying to standardize our own builds, how it comes together.

97
00:08:10,200 --> 00:08:12,760
It makes things like a log4j easier to address.

98
00:08:13,160 --> 00:08:15,880
It makes it, you know, the image, you know how the inventory is put together.

99
00:08:15,960 --> 00:08:21,200
So you can say, okay, I'm just going to change this basic image and it applies to 20% of my applications in one swoop.

100
00:08:21,380 --> 00:08:22,780
That makes the world different.

101
00:08:23,200 --> 00:08:29,380
In fact, there's a term that people would say you want to be, you know, secure by default, you know, which means you want to have your default configurations.

102
00:08:29,820 --> 00:08:31,540
And I tend to call it like table stakes.

103
00:08:31,740 --> 00:08:38,420
And in fact, I even push vendors like VMware or Google or any of the vendors out in the world, you should have a default secure configuration.

104
00:08:38,580 --> 00:08:45,440
You should have out of the box, this is what you get secured, authentication, your logging, all those default configurations are there for you to use.

105
00:08:45,840 --> 00:08:53,800
So we can get to the business of actually securing the applications because we spent too many decades focused on just upgrading servers.

106
00:08:53,800 --> 00:08:58,700
I talked to one firm, they had so many Windows servers, it took them 18 months to upgrade them.

107
00:08:58,980 --> 00:08:59,380
Oh, wow.

108
00:08:59,620 --> 00:09:00,480
So you never upgraded.

109
00:09:00,620 --> 00:09:01,840
You just constantly going.

110
00:09:01,940 --> 00:09:06,820
So how do we, you can get to a point where you're actually having thousands of nodes and automation.

111
00:09:07,160 --> 00:09:09,840
They can upgrade in days, you know, weeks at most.

112
00:09:09,920 --> 00:09:13,720
You know, we have, we have some customers that clusters so large it takes weeks, but it should not be 18 months.

113
00:09:13,880 --> 00:09:24,720
I mean, at heart, like basic, what I hear you saying is that simply the advance to being able to define things as code, you know, actual code and the configuration and infrastructure as code.

114
00:09:24,920 --> 00:09:31,660
That in itself positions us for much easier security and upgrades, I guess, and maintenance.

115
00:09:31,880 --> 00:09:32,400
It does.

116
00:09:32,480 --> 00:09:40,760
If we get that basic table stakes done, you know, if we know our infrastructure and the applications running, the building blocks of those are just always updated.

117
00:09:41,260 --> 00:09:46,180
If you think about, you know, the ideas we came up with years ago, the three R's, you know, we're paving the environment every week.

118
00:09:46,180 --> 00:09:51,380
If you upgrade your environment now, the hard thing, you know, code to your developer, you've learned these problems that you upgrade Java.

119
00:09:51,500 --> 00:09:52,360
Sometimes you can break things.

120
00:09:52,480 --> 00:09:56,300
So we need to have that communication in someone who's running, writing Java apps.

121
00:09:56,380 --> 00:10:00,340
Someone on the team needs to be following the release notes and understand what breaks and build tests around it.

122
00:10:00,600 --> 00:10:08,100
But we need to get that table stakes of the VMs, the applications, the building blocks of your routing, all the things you build your environment with.

123
00:10:08,460 --> 00:10:09,260
They should just be up to date.

124
00:10:09,340 --> 00:10:10,520
They should just be at the latest versions.

125
00:10:10,660 --> 00:10:13,680
And if they're not, you should have an understanding of what controls you need to put around them.

126
00:10:14,240 --> 00:10:17,300
And that should just, again, table stakes, default secure, should how it be.

127
00:10:17,700 --> 00:10:20,220
Now we can focus on the real application security.

128
00:10:20,460 --> 00:10:27,320
We can focus on real risk, which is, I think, where security teams really want to focus on because applications are the gateway to the data of the business.

129
00:10:27,780 --> 00:10:34,320
And we don't want to have applications insecure because some Java library needed to be upgraded.

130
00:10:35,000 --> 00:10:35,140
Yeah.

131
00:10:35,280 --> 00:10:36,980
Well, I guess that's part of the challenge, right?

132
00:10:36,980 --> 00:10:41,860
I mean, there are certain things you can control that are going to be sort of the same, right?

133
00:10:41,860 --> 00:10:49,200
If everybody imports the same third-party library, then that third-party library, if you can make sure that's secure, everybody sort of, you know, consumes that.

134
00:10:49,640 --> 00:10:53,440
But then there is also the custom code and the education around it.

135
00:10:53,500 --> 00:10:58,560
I think you've, I mean, you've often said security is about, is it people, process?

136
00:10:59,360 --> 00:11:00,460
What's the third thing you say?

137
00:11:02,540 --> 00:11:03,260
Probably technology.

138
00:11:03,260 --> 00:11:04,260
People process technology.

139
00:11:04,260 --> 00:11:12,560
So you can cover the tech maybe, but then there's the education of the people as they write new code.

140
00:11:13,420 --> 00:11:16,140
And security has to have an arm in that as well, right?

141
00:11:16,740 --> 00:11:23,980
Well, security, the hard thing, you know, other fields have this, but security has had the problem of technology has always been tried to be the answer.

142
00:11:24,180 --> 00:11:32,260
So if you look at anything in security, like just in the S-POM vulnerability scanning space, there's, what, 40, 50 companies every few months being just, like, funded to create.

143
00:11:32,920 --> 00:11:39,020
There's an oversaturation of technology to solve the problem, when realistically, it is those people and processes.

144
00:11:39,240 --> 00:11:40,280
You know, we have policies.

145
00:11:40,960 --> 00:11:41,800
I'm guilty of this.

146
00:11:41,860 --> 00:11:45,500
I wrote policies at Wells Fargo decades ago that I'm willing to bet are still there.

147
00:11:46,080 --> 00:11:47,260
You know, it's just...

148
00:11:47,260 --> 00:11:48,100
Hopefully they were good.

149
00:11:48,400 --> 00:11:50,400
Yeah, well, it was Oracle.

150
00:11:50,560 --> 00:11:51,540
So I know Oracle is still there.

151
00:11:51,680 --> 00:11:53,720
So the question is on the version I wrote it.

152
00:11:53,820 --> 00:11:55,660
So the upgrade process part of that.

153
00:11:55,760 --> 00:11:57,040
But yeah, I think I thought it was good.

154
00:11:57,220 --> 00:11:58,180
I'm pretty happy with it.

155
00:11:58,200 --> 00:11:58,700
In fact...

156
00:11:58,700 --> 00:11:59,020
I'm sure.

157
00:11:59,100 --> 00:11:59,380
I'm sure.

158
00:11:59,440 --> 00:12:00,760
If you wrote them, I'm sure they were good.

159
00:12:01,700 --> 00:12:06,700
But it's one of those things that the policies, how do you change them with the modern tools?

160
00:12:07,080 --> 00:12:11,100
And the people themselves, the way we train security...

161
00:12:11,100 --> 00:12:23,760
I was talking earlier on the show before we started around the idea of the way we train people to be in security nowadays is either they learn on their own, they do, like, bug bounties, they do ethical hacking, they try to figure out, and they very specialize in the application or networking side.

162
00:12:24,100 --> 00:12:33,000
Or they go to college, and they might have a computer science degree with a specialty in cybersecurity, but that specialty is they're not treated the same.

163
00:12:33,180 --> 00:12:38,660
You know, when you have that CS101, you're starting to learn Java, they don't teach you, here's how you securely code Java.

164
00:12:38,780 --> 00:12:48,540
They don't teach you the mechanism, which is, to me, one of those frustrating things, because there's no developer today that's not going to work for a retailer doing PCI, healthcare, some government organization.

165
00:12:48,780 --> 00:12:52,540
No matter where you go, the code you have to write is going to need to be secure.

166
00:12:52,880 --> 00:13:03,260
And if you learn things, it's like if you learn to teach someone a language, if you're trying to teach a language, and they come back later and say, oh, well, that was wrong, let's change this in the middle, muscle memory has already been made.

167
00:13:03,420 --> 00:13:03,660
It's a hard...

168
00:13:03,660 --> 00:13:06,760
I mean, you don't generally have people who write unit tests even, right?

169
00:13:06,980 --> 00:13:09,140
There's no unit test for security.

170
00:13:10,480 --> 00:13:16,240
That's actually, I think, that the step that's happened, when we say DevSecOps, that's really what I mean is the people in process.

171
00:13:16,240 --> 00:13:22,780
You know, we're getting developers and security teams to work together, because security people see things differently.

172
00:13:23,100 --> 00:13:25,720
I'll be honest, I'm a very optimistic security person.

173
00:13:25,880 --> 00:13:30,120
I recognize the ways and attacks that happen, but I believe we're getting better at it.

174
00:13:30,200 --> 00:13:34,360
My friends are going to joke at me for saying that, but I truly believe we are getting better at it.

175
00:13:34,560 --> 00:13:43,340
But in this testing side, unit testers, you know, the common question, like when I used to do PCI audits, is that when I was going to a company, I said, okay, do you do testing?

176
00:13:43,340 --> 00:13:44,700
They're like, yes, we do testing.

177
00:13:44,800 --> 00:13:47,320
But then I have to ask the follow-up question, is it functional testing?

178
00:13:47,420 --> 00:13:51,820
Because think about when you were given a development assignment, you're like, here's the function I need to do.

179
00:13:51,880 --> 00:13:53,800
So the tests you write confirm that function.

180
00:13:54,940 --> 00:13:57,840
But it doesn't generally include security testing.

181
00:13:57,940 --> 00:14:00,840
Like if you have a login, well, did you test failed logins?

182
00:14:00,940 --> 00:14:03,740
Did you test, you know, try and make sure an account exists through password resets?

183
00:14:03,780 --> 00:14:07,780
All these little things that attackers are known to do, are we writing those tests?

184
00:14:07,920 --> 00:14:13,620
Or even better yet, what is the security community doing to provide, you know, unit tests that can be scripted?

185
00:14:13,680 --> 00:14:20,280
So if you go to OWASP, you know, what are we doing to actually make it easier for developers to add some of those basic tests in that process?

186
00:14:20,280 --> 00:14:27,160
But this is the change that security is going through now is trying to get that people and process better.

187
00:14:27,820 --> 00:14:28,820
And I've seen it work great.

188
00:14:29,100 --> 00:14:31,220
There's one bank I worked with years ago.

189
00:14:31,340 --> 00:14:40,820
I'm really, it just, it's stuck in my head so strongly because we actually got 54, 56 applications in eight weeks in the production of four different data centers.

190
00:14:41,080 --> 00:14:45,960
Because every week during that sprint, security was there saying, I need to have, okay, we're working on this one function.

191
00:14:46,080 --> 00:14:47,440
And it talks to this database.

192
00:14:47,720 --> 00:14:50,500
I need, because of our policies, this test done.

193
00:14:51,140 --> 00:14:53,020
And then the end of the week, that test was done.

194
00:14:53,080 --> 00:14:57,020
They validated that that would always in the release cycle be testing that process for us.

195
00:14:57,020 --> 00:15:00,960
They had continuously integration of other requirements and then testing in the end.

196
00:15:01,340 --> 00:15:02,940
And that's how they were able to move really fast.

197
00:15:03,300 --> 00:15:05,740
And they can continue to move fast because the tests were already written.

198
00:15:06,060 --> 00:15:09,360
So they need, you know, both sides need a little guidance in working together.

199
00:15:09,420 --> 00:15:10,740
And that's really what the change is happening.

200
00:15:10,740 --> 00:15:30,640
It sounds like a lot of sort of a combination of that shifting left of security and also breaking down that silo where security was often sort of handled by a security team with tests later in the process, separately from whatever the development, without, you know, probably without a lot of visibility and even conversation with the security team.

201
00:15:30,860 --> 00:15:33,080
Very, very, very, very little.

202
00:15:33,080 --> 00:15:35,480
In fact, it was called throwing over the wall.

203
00:15:35,720 --> 00:15:37,160
You know, you would finish your application.

204
00:15:37,300 --> 00:15:38,180
You'd throw it over the wall.

205
00:15:38,720 --> 00:15:45,260
Security, if they're lucky, would get a copy running somewhere and then do their tests on it with any knowledge, without knowledge of what's going on.

206
00:15:45,360 --> 00:15:51,380
When I was a pen tester, one of the things I approached, the way I approached this is, again, the app-centric mind point of view.

207
00:15:51,860 --> 00:15:58,840
I didn't want to, even better yet, when I was actually, when I was working at a bank trying to hire pen testers, you know, so pen testing is a really specific practice.

208
00:15:59,020 --> 00:16:00,500
There's people who do physical pen testing.

209
00:16:00,600 --> 00:16:01,120
There's application.

210
00:16:01,300 --> 00:16:01,760
There's networking.

211
00:16:01,880 --> 00:16:02,240
There's data.

212
00:16:02,420 --> 00:16:04,720
There's people, the social engineering side of pen testing.

213
00:16:05,460 --> 00:16:11,420
And when I was hiring people to come and attack the bank I was working with, I was getting each of those personas together.

214
00:16:11,700 --> 00:16:17,120
Now, what's missing when you're having the security testing is I don't want to hire somebody.

215
00:16:17,120 --> 00:16:23,120
If it can cost me $40,000 to hire a pen tester, I don't want to spend 80% of that budget to discover what I could just give them.

216
00:16:23,160 --> 00:16:24,080
Here's the application diagram.

217
00:16:24,560 --> 00:16:25,440
Here's the data flow.

218
00:16:25,560 --> 00:16:27,980
Here's the developers you have access to and understand the logic that was written.

219
00:16:28,460 --> 00:16:33,720
Let's find the real risk in the application, not those things that we already know about we're trying to validate.

220
00:16:33,980 --> 00:16:42,920
You know, a lot of security programs will hire people to validate their assumptions to justify the budget of the tools they're getting versus, again, that default secure configuration.

221
00:16:42,920 --> 00:16:45,520
We're doing the basic table stakes of upgrading everything every day.

222
00:16:45,820 --> 00:16:47,240
We know where things are at.

223
00:16:47,380 --> 00:16:49,520
We can focus on the real risk of the application.

224
00:16:49,660 --> 00:16:52,440
So when you're hiring security testers, you give them the knowledge.

225
00:16:52,580 --> 00:16:55,580
You know, there's what's called the black box and white box testing.

226
00:16:55,940 --> 00:16:56,780
I'm a white box fan.

227
00:16:56,860 --> 00:16:58,600
I want to make sure that you have all the knowledge you have.

228
00:16:59,380 --> 00:17:04,240
I'd rather spend two days in a deep dive than six weeks of you discovering what I could have shared in two days.

229
00:17:04,620 --> 00:17:07,000
It's just, to me, a waste of effort on that side.

230
00:17:08,680 --> 00:17:15,660
So if we, like, I think there's at least two groups of things that we've gone over here.

231
00:17:15,660 --> 00:17:20,840
And to take a layering approach, as we like to do around here in computer land.

232
00:17:21,920 --> 00:17:28,460
You know, like, there's, I almost want to say the stuff you're saying is, like, table stakes.

233
00:17:28,720 --> 00:17:33,040
A lot of it is, like, let's call it, like, infrastructure and platform security.

234
00:17:33,040 --> 00:17:51,300
And it's just, like, the systems that you run on and the way you have them configured, particularly when it comes to, like, networking access and how, where you get your software from and your ability to, like, upgrade it or patch it or whatever.

235
00:17:51,740 --> 00:17:55,080
Like, that's kind of, like, in this, like, table stakes platform area.

236
00:17:55,240 --> 00:18:14,620
And then there's the, like, chef's secret ingredients, which is application security, which is sort of, like, that's where it seems, like, most of the variability and just, like, unique wackadoodle stuff happens, right?

237
00:18:14,620 --> 00:18:24,720
Like, like, it takes a lot more, like, like, kind of curious, exploratory thing to figure out what's going there and also to make that layer secure.

238
00:18:24,780 --> 00:18:34,160
Because, like, you know, for example, you, I don't know if it's out yet, but you and some people have been working on, like, a PCI document for, like, our Tanzu products, right?

239
00:18:34,200 --> 00:18:41,040
And as I recall, you don't exhaustively go through everything at some point, but it's sort of, like, here's a payment card.

240
00:18:41,520 --> 00:18:42,480
What's I stand for?

241
00:18:42,480 --> 00:18:43,040
I forget.

242
00:18:43,860 --> 00:18:46,440
Oh, it's PCI, payment card, PC.

243
00:18:47,680 --> 00:18:49,280
Now you're getting me screwed up.

244
00:18:50,760 --> 00:18:51,800
Payment card industry.

245
00:18:52,460 --> 00:18:52,840
There you go.

246
00:18:53,040 --> 00:18:57,280
It's, you know, I don't know it well, but there's, like, three or four subsets of it.

247
00:18:57,300 --> 00:19:04,780
Anyways, the point being, it's a document of, like, if you want to handle credit cards and debit cards and other stuff, like, here's how you would secure your goop.

248
00:19:05,220 --> 00:19:08,660
And a lot of the things in there are, like, you know, great.

249
00:19:08,660 --> 00:19:14,160
It's, like, you should make sure you don't just randomly download container images and use them, right?

250
00:19:14,160 --> 00:19:15,600
Like, that would be cool.

251
00:19:16,020 --> 00:19:26,580
And then there's more, like, I would say difficult things to achieve, like, how you manage certificates and making sure they're trusted and the ability to rotate them and stuff like that.

252
00:19:26,580 --> 00:19:30,720
But that's sort of, like, I feel like it's straightforward.

253
00:19:30,940 --> 00:19:40,120
It's a lot more straightforward than what you're going over at the application layer, which is, like, well, did you write tests to make sure you wrote code that may or may not exist?

254
00:19:40,700 --> 00:19:41,060
Right?

255
00:19:41,140 --> 00:19:45,720
Like, you're sort of, like, certifying just stuff.

256
00:19:45,960 --> 00:19:48,560
I mean, I can't even find the words because it's so vague.

257
00:19:48,640 --> 00:19:49,380
It's just, like, I don't know.

258
00:19:49,420 --> 00:19:50,480
Did you write bad code or not?

259
00:19:50,540 --> 00:19:53,760
We kind of got to go look at the code and see what happens.

260
00:19:54,100 --> 00:19:55,680
That is the hardest part of the testing.

261
00:19:55,920 --> 00:19:58,060
So, like, PCI is a great example, as you have there.

262
00:19:58,240 --> 00:20:00,160
So, PCI has been around for a little while.

263
00:20:00,940 --> 00:20:02,540
And it goes through changes every couple years.

264
00:20:02,620 --> 00:20:06,640
So, they just had the PCI version 4 of the DSS, which that's not the document I shared with you.

265
00:20:06,920 --> 00:20:08,740
That one's actually, like, several hundred pages.

266
00:20:09,340 --> 00:20:11,960
It's in-depth, all those things you have to have in place.

267
00:20:12,020 --> 00:20:15,320
And what happens is it's confusing when you have new technologies.

268
00:20:15,320 --> 00:20:21,180
So, back a while ago, I think about 10 years ago, I have to look at the dates, but there was the virtualization.

269
00:20:22,040 --> 00:20:26,600
They created a SIG that said, okay, virtualization is new, but how does virtualization fit into PCI?

270
00:20:26,680 --> 00:20:28,060
Because PCI has all these controls.

271
00:20:28,640 --> 00:20:31,540
So, they had a white paper that came out of best practice guidance for that.

272
00:20:32,020 --> 00:20:46,900
And recently, there's a working group started, which we got myself and some of the TKG engineers and a couple other folks from inside Tanzu and VMware participated with them in the PCI SIG on the writing of, from PCI, their best practices for containers.

273
00:20:46,900 --> 00:20:47,460
It's a big word.

274
00:20:48,360 --> 00:20:51,260
PCI best practices for containers and container orchestration tools.

275
00:20:51,920 --> 00:20:52,180
Yeah.

276
00:20:52,440 --> 00:20:57,500
So, that was a big sentence to basically say, what's the best practice on this space?

277
00:20:57,620 --> 00:21:06,620
And if you look at the document, what I did is I took that document and then we applied it across Tanzu and said, okay, Tanzu, we have all these application things.

278
00:21:06,700 --> 00:21:11,760
And if you're looking at PCI, it really comes down to an application running in a card data environment, CDE.

279
00:21:12,100 --> 00:21:15,700
And it talks about the controls of the platform, the infrastructure, the applications.

280
00:21:16,140 --> 00:21:22,020
And that's really what PCI is protecting is the card data within the environments that run card applications.

281
00:21:22,700 --> 00:21:28,240
So, it fits you very well because we make applications that run in banks and retailers and places that have credit cards.

282
00:21:28,880 --> 00:21:32,460
So, one thing our customers look for is, well, PCI has its best practice.

283
00:21:32,940 --> 00:21:35,540
What's VMware's response to the best practice for your products?

284
00:21:35,900 --> 00:21:37,680
So, that's the document that will be coming out soon.

285
00:21:37,760 --> 00:21:38,940
We're in the final edits right now.

286
00:21:39,200 --> 00:21:40,700
And it's going to go through all these sections.

287
00:21:40,820 --> 00:21:46,580
And if you look at the table of contents of it, as you mentioned, it goes through authentication, your secrets, your PKI, your network security.

288
00:21:46,880 --> 00:21:58,400
But if you look at PCI, PCI goes, you know, application, you know, it goes from firewalls to your data, you know, you're basically your platform, you know, hardening security, your data encryption standards, your transmission standards.

289
00:21:58,560 --> 00:22:02,280
So, it's more, it's not containerized focus.

290
00:22:02,360 --> 00:22:11,820
Like, there's stuff that talks in this new guidance around container images and patent and runtime security and things that are not, you know, there's not an easy overlay for PCI.

291
00:22:11,900 --> 00:22:16,040
So, it's kind of guidance of, well, in this space, how does this apply to PCI?

292
00:22:16,860 --> 00:22:20,780
And then we provide our own interpretation of the tools and products we have around that space.

293
00:22:20,840 --> 00:22:23,420
Because PCI, it also is people, processing, technology.

294
00:22:23,720 --> 00:22:25,640
You know, a big piece of it is talks about policies.

295
00:22:25,760 --> 00:22:27,560
We can't provide guidance and policies.

296
00:22:27,640 --> 00:22:28,860
It's up to a customer to do that.

297
00:22:29,280 --> 00:22:34,020
But we can provide answers of, you know, if you're building applications, how do you make sure you're building it right?

298
00:22:34,060 --> 00:22:38,720
But there's a whole section of PCI called, you know, it's in section six that deals with the application security.

299
00:22:38,720 --> 00:22:40,080
And it goes into the way you write code.

300
00:22:41,000 --> 00:22:47,000
And that gets a little interesting because it's like you said, you know, we can do the table stakes.

301
00:22:47,080 --> 00:22:49,920
We can get the platform that runs it all the way up to date.

302
00:22:50,380 --> 00:22:55,740
But when you're doing application security, it really gets fishy.

303
00:22:55,960 --> 00:23:01,320
You know, it's how do you validate someone did input injection validate, you know, protection.

304
00:23:01,320 --> 00:23:20,760
So, as an example, when I'm talking to development teams and security teams around observability in the modern cloud space, you know, the looking for an attacker, you know, doing blue team stuff or actually being, you know, watching for the attackers, developers might do input validation, which is one of those tests you're doing inside of PCI or any just general best development, best practice or security.

305
00:23:21,320 --> 00:23:23,080
But what are you doing with the output of that?

306
00:23:23,080 --> 00:23:29,980
So if someone injects, you know, it submits a form and they submit a 2000 character string with that form that tries to do injection into a command line.

307
00:23:31,120 --> 00:23:32,820
Well, that's going to fail your input validation test.

308
00:23:32,900 --> 00:23:35,560
It says, I only take, you know, social security number here.

309
00:23:35,620 --> 00:23:38,120
No, it's only mean not, you know, the seven digits or whatever the digits are.

310
00:23:38,520 --> 00:23:39,860
And it says, this is an input validation error.

311
00:23:39,940 --> 00:23:41,100
Well, are you logging that?

312
00:23:41,820 --> 00:23:43,420
How do you observe that in your observability?

313
00:23:44,060 --> 00:23:51,860
And, you know, looking at the tools and trends, we do a lot of demos on our observability products, but we usually show like spikes in CPU or spikes in network.

314
00:23:52,280 --> 00:23:53,220
Well, this would also be a spike.

315
00:23:53,360 --> 00:23:56,320
You know, if you see, you know, one or two validation errors, it's okay.

316
00:23:56,520 --> 00:24:00,080
If you see 6,000 in a minute, someone's doing something.

317
00:24:00,500 --> 00:24:03,760
And generally, application attacks are very cumbersome.

318
00:24:03,760 --> 00:24:06,140
You don't just like jump into an application and say, I'm going to break it.

319
00:24:06,540 --> 00:24:09,860
Unless you have the source code and you know where it is, you've got to find it.

320
00:24:09,940 --> 00:24:11,420
And it's very noisy finding it.

321
00:24:11,460 --> 00:24:14,780
If we can just detect them before they find it, you can block most things.

322
00:24:15,380 --> 00:24:28,120
Are the tools, I mean, all of the whole industry of software on containers, because it represents and it leads to this explosion of sort of scale of data to analyze, right?

323
00:24:28,200 --> 00:24:30,560
So observability has had to advance a lot.

324
00:24:30,560 --> 00:24:46,020
Do the same observability systems that we use for managing our applications and our infrastructure, are they sufficient for being able to track and manage and audit security data at scale?

325
00:24:46,020 --> 00:24:53,520
Or is there need to create additional observability kind of, you know, systems for that?

326
00:24:53,880 --> 00:24:55,140
Yeah, we don't need to create anything new.

327
00:24:55,300 --> 00:25:07,120
I think, honestly, you know, looking at, you know, I hate to throw the names out there, but, you know, the RE operations tools, you know, if you look at those or Datadog or any of these tools, the tools are there.

328
00:25:07,280 --> 00:25:09,900
You know, security events are just that events.

329
00:25:09,900 --> 00:25:15,660
You can't have the log monitoring looking for logs, but typically even looking for logs, you're pulling out events.

330
00:25:16,280 --> 00:25:20,340
So the hard part is building the metrics of what events you're going to monitor.

331
00:25:20,500 --> 00:25:22,540
And I think that's where it comes, again, there's people and processes.

332
00:25:23,180 --> 00:25:28,540
If you're going to, at scale, if we're solving this problem for a scale, these companies have the multi-thousands applications.

333
00:25:28,960 --> 00:25:39,080
Well, one, if they have standardized images, you know, we talk about the technology using the standard platform, standard images, things that make it easy to maintain the default secure config, then they can focus on the app side.

334
00:25:39,280 --> 00:25:46,340
Well, logging, you know, if you have 2,000 development teams, you tell every one of them to log, log in failures or other errors in the app.

335
00:25:47,020 --> 00:25:49,400
How, honestly, Cody, you've worked with development teams.

336
00:25:49,560 --> 00:25:50,960
You know, Corey, you've probably worked with a couple in your life.

337
00:25:51,580 --> 00:25:54,580
How many different versions of that log file do you think you'll see?

338
00:25:54,580 --> 00:26:03,680
If you don't standardize and say, we need to have these type of events with, you know, so we're not telling the developer what to do, but there are some things I need to get in a consistent manner from the different teams.

339
00:26:03,740 --> 00:26:07,060
So we have to have some standardization that everyone abides by.

340
00:26:07,120 --> 00:26:19,120
And that's where having a common way for developers to interact with documentation, you know, again, maybe a portal for developers, you know, where you can actually have standardized documentation, standardized paths for building, you know, like the building blocks.

341
00:26:19,120 --> 00:26:25,020
If you're going to build an application, you know, that set of building blocks or accelerators that can actually say, here's how you're going to do input validation.

342
00:26:25,160 --> 00:26:25,980
Here's how you're going to do your logging.

343
00:26:26,100 --> 00:26:26,940
Here's how you're going to do your authentication.

344
00:26:27,240 --> 00:26:29,620
Here's how you're going to do data log, you know, your data connections.

345
00:26:29,820 --> 00:26:31,580
All those things are predefined.

346
00:26:31,660 --> 00:26:32,780
Again, default, secure.

347
00:26:33,380 --> 00:26:35,500
Then everyone has the same mechanism they're building from.

348
00:26:35,580 --> 00:26:37,860
And then security only needs to build one model to watch for.

349
00:26:38,280 --> 00:26:41,100
You'll need to have a different regular expression for every different development team.

350
00:26:42,400 --> 00:26:42,620
Yeah.

351
00:26:43,760 --> 00:26:44,080
Yeah.

352
00:26:44,280 --> 00:26:44,560
No, sorry.

353
00:26:44,640 --> 00:26:44,860
Go ahead.

354
00:26:44,860 --> 00:26:57,800
Oh, I was going to say, I mean, you bring up, you know, you know, there's almost this universal thing that, of course, there's exceptions, footnotes and whatnot, but like variability is not cool.

355
00:26:58,920 --> 00:26:59,320
Right.

356
00:26:59,320 --> 00:27:11,620
Like, like the, the larger the organization, the more, I don't know, some formulaic way to put it, but the larger the organization, the more benefits you're going to get from reducing variability from standardization.

357
00:27:11,620 --> 00:27:12,060
Right.

358
00:27:12,120 --> 00:27:13,680
Which is not necessarily the case.

359
00:27:13,720 --> 00:27:19,920
Like, I don't know if it's the case when you go smaller down, but like at some point, some fancy curves intersect.

360
00:27:19,920 --> 00:27:26,320
And like, once you reach a certain size of organization, like standardization wins out for whatever you're giving up for it.

361
00:27:26,320 --> 00:27:33,020
And, you know, I mean, you provide just one, you just provide you went over one thing where like, I mean, log files are a great example of that.

362
00:27:33,020 --> 00:27:48,880
We're just like, if I have, you know, it's not only like when you're going over earlier, if you're a large organization, you've developed all these applications, but then as happens in certain industries, all of a sudden you find yourself owning gigantic rivals of yours, perhaps in banking.

363
00:27:48,880 --> 00:27:53,880
Like, and then you've multiplied your portfolio by whatever.

364
00:27:53,880 --> 00:28:00,880
So you have all these acquisitions and different policies and like, so you have a huge amount of variability already.

365
00:28:00,880 --> 00:28:04,900
And just like, you could imagine 500 different ways of logging something.

366
00:28:04,900 --> 00:28:07,460
And then that's just like a hassle to put up with.

367
00:28:07,460 --> 00:28:22,280
And like, so it does seem like it's, it's, I'm, I'm, I'm spending a lot of time on this point because it's hard to like describe the value of standardization often.

368
00:28:22,280 --> 00:28:30,720
You know, how do you balance creativity because you, you don't want to stifle developer creativity, but at the same time, does a developer need to think about how they do authentication?

369
00:28:31,620 --> 00:28:33,720
Is that where their creative juices are flowing?

370
00:28:33,820 --> 00:28:35,180
If they are, then cool.

371
00:28:35,260 --> 00:28:38,100
Maybe they can work with a team, make a standard that works for more development teams.

372
00:28:38,100 --> 00:28:40,720
But how do we balance that?

373
00:28:41,160 --> 00:28:42,760
You know, we even had a problem here inside VMware.

374
00:28:42,960 --> 00:28:51,100
You know, how do we balance the need for functions and creativity and features while trying to balance the need for the everyday, just standardization patches,

375
00:28:51,940 --> 00:28:54,520
all those things that come, it's a, it's a fine line to balance.

376
00:28:54,520 --> 00:29:00,860
So you feel like you're not stifling that creativity that got you to the point that you are big enough to have the need for all the developers.

377
00:29:01,240 --> 00:29:01,640
Yeah.

378
00:29:01,820 --> 00:29:21,920
I mean, ideally the better you can solve the problem by maybe consolidating, deduplicating, having every, if, you know, if you have one law, if, I mean, it's, it's sort of this, I mean, I know you're an optimist, so you can see this future, but if you have a company and you can have one sort of API that people use for login so that they don't have to worry about it.

379
00:29:21,920 --> 00:29:29,780
Then you do free up their time for creativity in their, in their space rather than having to recreate the wheel for login.

380
00:29:29,780 --> 00:29:44,020
But as Coté's pointing out, enterprises are large and then you have acquisitions and, you know, between the ideal and practice, there's, there's, there's that gap of like, you know, can I really get everybody on using one login API?

381
00:29:44,560 --> 00:29:57,220
And if you have, even if you don't have acquisitions, which that's also a huge question, just having more than a dozen development teams and then trying to make a standard around that means someone's going to have to change what they've written.

382
00:29:57,660 --> 00:29:59,400
And how do you approach to detect that?

383
00:29:59,520 --> 00:30:01,940
You know, how do you approach, you know, who gets that debt?

384
00:30:02,020 --> 00:30:06,000
How do you, you know, how do you budget so people have time to work on making that standard?

385
00:30:06,440 --> 00:30:08,360
Because you already have existing code you got to work with.

386
00:30:08,460 --> 00:30:12,960
Now I met with a bank a few weeks ago and they had an acquisition where they're going through the same problem.

387
00:30:13,020 --> 00:30:15,800
They have, they only had 10 developers internally because they didn't do a lot of development.

388
00:30:15,900 --> 00:30:17,520
They had a lot of off the shelf banking products.

389
00:30:18,520 --> 00:30:24,780
Well, they acquired a bank that is a hundred percent container driven that, you know, has hundreds of development teams.

390
00:30:25,840 --> 00:30:28,760
So their, their whole world is changing as they're figuring that out.

391
00:30:28,800 --> 00:30:32,860
And how do they plan in advance while not causing a problem?

392
00:30:32,860 --> 00:30:39,860
Because we all know acquisitions also mean that you're going to have two years of things not integrating and the customers want to, you know, they want the integration.

393
00:30:40,240 --> 00:30:59,480
So, yeah, do you find one of the, one of the things that, that I think is true for the platform space is that as we moved from virtual machines to containers and then to container platforms, and then maybe, you know, more sophisticated container platforms built on top of Kubernetes, more comprehensive platforms.

394
00:30:59,720 --> 00:31:01,300
We saw this a lot with Cloud Foundry, right?

395
00:31:01,300 --> 00:31:08,860
We talk about platform teams that could be just, you know, two, four, six people total to support a very large enterprise.

396
00:31:09,100 --> 00:31:22,500
Are you finding that, I mean, security seems so broad in scope that, like, I wonder, do you, are you seeing that security teams are able to get smaller to support larger organizations or are we not there yet?

397
00:31:23,500 --> 00:31:29,140
I think security teams have been traditionally small to begin with, but they are segmented.

398
00:31:29,140 --> 00:31:38,600
You know, there, there's, you know, in a large organization, if you're going to have, you know, like the, the large retailers or manufacturers, you know, we already have several hundred, if not several thousand applications.

399
00:31:38,960 --> 00:31:45,000
Those, those, you're going to have your, your security operations team that just runs and watches events and, and they, that's all they do.

400
00:31:45,000 --> 00:31:49,820
But there might be segmentation of, they watch end, endpoints, like our desktops and laptops versus servers.

401
00:31:50,180 --> 00:31:52,220
It's a different skill set of what to watch for.

402
00:31:52,820 --> 00:31:56,220
There might be some, or it might be the same team, depending on how they put that together.

403
00:31:57,860 --> 00:31:59,960
Then you have your access and identity management teams.

404
00:32:00,100 --> 00:32:02,740
You know, those are generally people have processes around onboarding.

405
00:32:02,780 --> 00:32:10,720
So if you have an organization with 70, 80,000 employees, you're going to have a lot, you know, even, even we in VMware, half of our company has only been here for what, a year and a half, two years.

406
00:32:10,720 --> 00:32:13,360
And we're, we're what, 30,000 people.

407
00:32:13,500 --> 00:32:17,300
That's, that's a lot of people's accounts to change every day.

408
00:32:17,300 --> 00:32:19,040
So there's dedicated teams to that.

409
00:32:19,260 --> 00:32:29,480
There, there's dedicated architects who just work on the designing of the, so there's already been some segmentation around those different areas, but the teams aren't traditionally very big.

410
00:32:29,480 --> 00:32:36,480
I, I was working with a company out in, out West and I can see where it was, but they, they have a small security team.

411
00:32:36,640 --> 00:32:38,080
They're, they're a fairly old company.

412
00:32:38,080 --> 00:32:46,140
They've been around for a couple of decades, but they're, they're trying to figure out that scaling problem because they don't have the ability to grow.

413
00:32:46,140 --> 00:32:56,860
Cause as, as they get more and more containerized apps, there's more and more ways their team is interfacing with these teams because we have found that everyone now can scan containerized apps.

414
00:32:56,860 --> 00:32:59,200
So everybody is involved in that security story.

415
00:32:59,200 --> 00:33:14,660
So when, when security things come up and they have to have an in-depth conversation and you actually help the developer or help the platform team understand the risks of that security, what happens when you now have, you know, a thousand apps with all those conversations and they aren't standardized on common images.

416
00:33:14,660 --> 00:33:23,660
So it's a thousand different conversations, but the team was only 10 people to begin with, you know, so we have, we have a bigger scope now and the teams have still been small.

417
00:33:23,660 --> 00:33:31,860
So I don't, I don't think we're going to see any optimization of security for probably five or 10 years because I think it's driven by two things.

418
00:33:31,920 --> 00:33:36,040
One, there's a lack of people in security space that we need more security people.

419
00:33:36,900 --> 00:33:45,960
But separately there's the scope, you know, understanding application security is completely different than understanding network segmentation at its core.

420
00:33:46,080 --> 00:33:50,120
I mean, they're tied together, but we don't train this.

421
00:33:50,200 --> 00:33:51,600
So it's experience is going to be part of it.

422
00:33:51,600 --> 00:33:52,440
So you need to have more senior.

423
00:33:53,160 --> 00:33:57,880
I don't think that we're going to have the automation in place for the security side for several years.

424
00:33:58,000 --> 00:34:03,280
You know, we saw this conversation on do-it-yourself versus using pre-built platforms and having opinions around this.

425
00:34:03,720 --> 00:34:07,580
You know, we're still trying to please everybody.

426
00:34:07,940 --> 00:34:15,720
And I just don't think we're at a point where the security teams, which are already small, will see the optimization because they don't, there are no developers usually on security teams.

427
00:34:15,720 --> 00:34:17,980
You know, they can't automate these things.

428
00:34:18,060 --> 00:34:20,800
They depend upon either bringing developers in, training developers, you know.

429
00:34:21,160 --> 00:34:23,560
So there needs to be some changes.

430
00:34:23,880 --> 00:34:31,580
Like I mentioned earlier, the teams on the platform side and the application side have had two decades to get used to automation, agile, extreme, those tools.

431
00:34:32,220 --> 00:34:33,420
Security teams have had five years.

432
00:34:33,880 --> 00:34:37,120
So we're five years into that 20-year journey that developers are already at.

433
00:34:37,440 --> 00:34:41,940
And let me ask you, how often you run into development teams that are still struggling with modernizing the way they do development?

434
00:34:41,940 --> 00:34:50,300
So I think security teams were a good 10, 15 years behind the ball on that with a whole new set of tools everyone's trying to learn at the same time.

435
00:34:50,900 --> 00:34:55,340
And not enough people to help cover the current load and then work on the new one at the same time.

436
00:34:55,420 --> 00:34:57,460
So we're a couple years out.

437
00:34:58,200 --> 00:35:07,060
Yeah, you're starting to answer what I was interested in talking about next, which is to do one of my well-known statement questions.

438
00:35:07,060 --> 00:35:25,840
It seems like if we were to borrow from the DevOps world, as you were just describing, I'm summing up a little bit here or summarizing what you're saying, that what we would like to move towards is automating as much of security as possible.

439
00:35:25,840 --> 00:35:32,320
And kind of getting in that area where, you know, there's the platform security and the app security.

440
00:35:32,560 --> 00:35:48,620
And again, going back, you know, I imagine a lot of whether it's PCI or DOD, whatever, like all these different security specifications, you could, in theory, get to the point where you had like a special interest group, a SIG.

441
00:35:48,620 --> 00:35:56,280
And they were like, you know, here, like, almost literally, here's a YAML file and use that, right?

442
00:35:56,340 --> 00:35:59,400
Like, you know, of course, that's a little, maybe a little too low level.

443
00:35:59,400 --> 00:36:05,720
But sometimes, you know, it would just be like, yeah, like every time you download this version, it's going to have like a default password.

444
00:36:05,880 --> 00:36:07,160
So remove that, right?

445
00:36:07,220 --> 00:36:09,660
Like, kind of like, just automate all this stuff.

446
00:36:09,740 --> 00:36:26,340
And then there's the things that you can't like immediately, you can't automatically automate, but you can, following this idea of compromising ultimate agility by standardizing, you could say like, you know what, this is just how we're going to manage containers.

447
00:36:26,340 --> 00:36:28,140
And you have to use our registry.

448
00:36:28,720 --> 00:36:37,920
And like, maybe it's going to take three months to get a cool new feature in a project that you're using, because we're a gigantic bank, and we need to be secure, right?

449
00:36:38,020 --> 00:36:42,960
Like, and, you know, I mean, that's kind of worst case scenario, but it's sort of like, we automate all this stuff.

450
00:36:43,300 --> 00:36:55,180
And now in the, you know, in the same thing you would hear about, like, from, you know, fancy platforms as a service, like Cloud Foundry and stuff, like, we need, like, I don't know, five or eight people who manage that, right?

451
00:36:55,200 --> 00:36:56,880
Like that layer, because most of it's automated.

452
00:36:57,100 --> 00:37:07,140
And then we can shift most of our security resources to being like that ideal state you were talking about earlier, where you have the development team, and they're doing their stuff.

453
00:37:07,180 --> 00:37:12,260
And there's, like, a security person there, like, you know, leaning back in their chair, and like, have you tried this?

454
00:37:12,560 --> 00:37:14,160
Like, how about these 10 things?

455
00:37:14,220 --> 00:37:20,060
Like, if you, like, if you're making a login window, you need to try these things, and let's poke at that.

456
00:37:20,060 --> 00:37:32,480
And then, like, whenever you're at the window where, like, you are giving someone a higher security, like, rating, you're upgrading a user to an admin, we should test these things out.

457
00:37:32,560 --> 00:37:42,460
Like, you know, like, all that application layer stuff that is much more, I would assume is basically, like, artisanally crafted per code base, right?

458
00:37:42,540 --> 00:37:43,520
Like, it's hard to...

459
00:37:43,520 --> 00:37:45,640
You have some standardization on some of that stuff.

460
00:37:45,720 --> 00:37:49,160
You know, there's some things that you don't want to, again, you don't want to have everybody define how you log in.

461
00:37:49,340 --> 00:37:51,620
You want to have some basic standardization on that.

462
00:37:51,620 --> 00:38:01,320
But you mentioned that the data, you know, the password part, that actually is, there's a vulnerability in MySQL that is fixed by changing default password, that the Helm chart in the application catalog changes that password.

463
00:38:01,660 --> 00:38:08,660
So, again, that default security, not secure by default, but shipping out default security.

464
00:38:09,060 --> 00:38:19,200
To get to that point where you can have a small platform team, then make sure that the VMs that run the platform, that have the container images, that make the applications, all that is up to date.

465
00:38:19,320 --> 00:38:22,600
You don't have to think about it, you know, whatever your cycle is.

466
00:38:23,000 --> 00:38:25,220
Now, there's one exchange I'm working with out in Asia.

467
00:38:25,320 --> 00:38:26,260
They're doing it every six months.

468
00:38:26,480 --> 00:38:27,200
I keep pushing them.

469
00:38:27,220 --> 00:38:28,340
We need to at least do it monthly.

470
00:38:28,800 --> 00:38:39,740
You know, one of my favorite stories is hearing up on main stage on SpringOne a couple years ago, the idea that, you know, in big banks, you know, changes are really coordinated.

471
00:38:39,740 --> 00:38:44,720
When I was working at Wells Fargo a couple decades ago, I would work on firewall changes through the day.

472
00:38:45,240 --> 00:38:59,380
And then twice a week, we'd have a 11 p.m. to 2 a.m. call with the two engineers doing the actual changes in the firewalls, me there to make sure that they met the conformance tests, and then 40 executives to make sure their applications are still running.

473
00:39:00,380 --> 00:39:01,560
And we need to get past that.

474
00:39:01,620 --> 00:39:14,980
And what happened is, it gets to a point, if you can choose the right applications, this is key, you can make these platforms, but if the applications you put on them are not properly designed, they have no error budgets, they have no high availability, they don't allow you to actually reboot platforms.

475
00:39:15,060 --> 00:39:16,600
What happens when you upgrade your database?

476
00:39:16,700 --> 00:39:18,280
You have to reboot or migrate a database.

477
00:39:18,420 --> 00:39:24,120
You have those circuit breakers and things within what you, so the application needs to be built for these platforms.

478
00:39:24,120 --> 00:39:30,380
But if they're done right, we should just have the platform with a small team automating the entire table stakes.

479
00:39:30,960 --> 00:39:36,520
It's just, you know, we have that pre-built guardrails definition, which, you know, comes into, you know, our story.

480
00:39:36,680 --> 00:39:39,840
If we actually even look at, you know, say, ARIA guardrails, I'm not sure if you looked at that yet.

481
00:39:39,920 --> 00:39:48,760
You know, we can actually have, we actually have the idea that we could pre-define a PCI environment or a banking environment, whatever the controls you want to have.

482
00:39:48,880 --> 00:39:53,880
It just builds that environment, deploys your application service, your Cloud Foundry, your TAP, whatever it might be.

483
00:39:54,280 --> 00:39:56,640
And then from there, the applications just push automatically.

484
00:39:57,280 --> 00:39:58,020
Table stakes are done.

485
00:39:58,100 --> 00:39:59,400
You just maintain the upgrade of that.

486
00:39:59,540 --> 00:40:01,040
The controls are on or in place.

487
00:40:01,440 --> 00:40:07,380
You're using reporting on the backside of it through some sort of, you know, cloud checking tools to say, okay, all the controls are required.

488
00:40:07,680 --> 00:40:08,380
I'm auditing them.

489
00:40:08,460 --> 00:40:10,520
I can provide an audit report daily to my audit team.

490
00:40:10,860 --> 00:40:13,340
So the controls and the environment are there.

491
00:40:13,500 --> 00:40:15,100
Now we just can focus on the application.

492
00:40:15,700 --> 00:40:16,440
You know, who is using it?

493
00:40:16,460 --> 00:40:16,960
What's the consumption?

494
00:40:16,960 --> 00:40:17,680
What's the patterns?

495
00:40:17,960 --> 00:40:19,620
What's actually being attacked or not being attacked?

496
00:40:20,060 --> 00:40:25,440
We don't have to worry about, you know, did, was there a vulnerability in the library that's in the container?

497
00:40:25,580 --> 00:40:30,700
You know, the scanning of containers should not really be needed in the end because we're going to get a new container every week.

498
00:40:30,960 --> 00:40:35,420
And there are some vulnerabilities that are never going to be patched, but generally those are very low risk.

499
00:40:35,920 --> 00:40:37,120
But you still need to understand the risks to them.

500
00:40:37,120 --> 00:40:47,620
I want to get to the point where we're having the conversation on understanding those risks to those long running vulnerabilities or the risks the way you've written code and not worrying about upgrading your VM or upgrading your container.

501
00:40:47,740 --> 00:40:48,380
That should just happen.

502
00:40:48,380 --> 00:40:51,340
You know, a small team can maintain a very large environment for that.

503
00:40:51,400 --> 00:40:51,960
We don't need to.

504
00:40:52,160 --> 00:40:55,860
We need to get back past the date where we're saying, well, when's your upgrade cycle?

505
00:40:56,020 --> 00:40:57,280
It should be assumed.

506
00:40:57,420 --> 00:40:58,960
I'm upgrading regularly every day.

507
00:40:59,380 --> 00:41:01,560
How close are we to this vision?

508
00:41:02,260 --> 00:41:06,840
I think applications are the hardest part for that because a lot of applications aren't designed for that.

509
00:41:07,320 --> 00:41:12,320
But if you look at some of the most successful Cloud Foundry customers, they do upgrades in the middle of the day.

510
00:41:12,720 --> 00:41:21,860
They do it, you know, they're doing upgrades about every 7 to 10 days based upon the release of us releasing TAS every 10 to 14 days.

511
00:41:22,020 --> 00:41:25,060
So they're just consuming it as the updates come out.

512
00:41:25,620 --> 00:41:26,480
How do you see us?

513
00:41:26,600 --> 00:41:30,280
How close are we in the Kubernetes space to that same vision?

514
00:41:30,280 --> 00:41:35,120
I think we have the mechanisms for supporting platforms that upgrade like that.

515
00:41:35,380 --> 00:41:36,600
There needs to be a few tweaks.

516
00:41:36,800 --> 00:41:39,960
You know, some of the places that, you know, we might have to do some manual pipelines around it.

517
00:41:40,320 --> 00:41:52,060
But I think the platform itself, Kubernetes, the tools that are actually providing, you know, the automation of applications pushing into the Kubernetes, cluster API, you know, all the backstage stuff, all those pieces come together.

518
00:41:52,340 --> 00:41:53,980
We have automation in that space.

519
00:41:54,280 --> 00:41:57,640
It really comes down to are the Kubernetes applications being designed?

520
00:41:58,400 --> 00:42:02,340
Are they properly designed to handle an infrastructure that's continuously upgrading around it?

521
00:42:03,100 --> 00:42:04,060
And that's where it gets really interesting.

522
00:42:04,140 --> 00:42:06,720
We start thinking about, you know, the errors of Kubernetes.

523
00:42:06,720 --> 00:42:13,800
You know, people will deploy an application to a cluster or maybe an application to two clusters and then use like something like an Ivy Networks or an F5 to load balance those.

524
00:42:14,300 --> 00:42:23,940
You know, I think what we're seeing is this trend toward recognizing an application isn't just a single cluster because clusters go down either through manual maintenance or unexpected things.

525
00:42:24,480 --> 00:42:30,620
So the idea that we're having this space for applications run that's realistically a multi-cluster organization.

526
00:42:30,820 --> 00:42:34,540
If you think about the scale of any of these large applications, they're not single Kubernetes cluster anymore.

527
00:42:34,880 --> 00:42:40,500
There are many clusters tied together with meshes and ingress and egress through proxies, you know, whatever it might be.

528
00:42:40,560 --> 00:42:45,380
It's these complex things that the idea that a single cluster shouldn't be a problem.

529
00:42:45,460 --> 00:42:48,480
So, yes, I think we have the tools in place for continuous maintenance.

530
00:42:49,120 --> 00:42:51,160
The applications are the real question.

531
00:42:51,240 --> 00:42:54,300
Did you design an application that's highly available, multi-data center?

532
00:42:54,440 --> 00:42:59,200
You can actually take a data center offline, you know, like Dick's Sporting Goods did on SpringOne Day.

533
00:43:00,200 --> 00:43:03,600
They had two Cloud Foundries running, they just turned one off and it just kept running.

534
00:43:03,980 --> 00:43:05,360
Did you design the application?

535
00:43:06,000 --> 00:43:12,900
And that's the question we should be getting to is are we helping customers make applications that are ready for modern security, modern platforms?

536
00:43:13,480 --> 00:43:17,300
So we can have the default secure modern platform in Kubernetes, Cloud Foundry, whatever it is.

537
00:43:17,580 --> 00:43:18,260
That shouldn't matter.

538
00:43:18,420 --> 00:43:21,360
That should just be handled in the background by automation if possible.

539
00:43:21,880 --> 00:43:30,180
I mean, it's interesting because, like, what you're saying, like, I've heard of this idea, right, of, like, you know, if you have an application, you should code it so that it can go down, right?

540
00:43:30,260 --> 00:43:34,140
But I have not actually heard it in the context of security.

541
00:43:34,300 --> 00:43:38,400
Normally, you hear about it in terms of, like, well, if your application, you know, keep your state outside.

542
00:43:38,500 --> 00:43:45,720
So if your application needs to go down because of a glitch, usually you think about it in terms of hardware failure or network failure.

543
00:43:45,720 --> 00:43:49,120
Can your application sustain the failure of the infrastructure around it?

544
00:43:49,360 --> 00:44:00,540
But in reality, what you're saying is, is your application coded in a way that allows a security process to intentionally take down the system around you in order to patch it?

545
00:44:01,560 --> 00:44:03,360
Well, Netflix actually championed that.

546
00:44:03,480 --> 00:44:05,900
You probably have heard of chaos engineering, your chaos monkey.

547
00:44:07,140 --> 00:44:07,540
Yes.

548
00:44:08,160 --> 00:44:08,300
Yeah.

549
00:44:08,420 --> 00:44:11,960
But still chaos engineering is about what if there's a network glitch, right?

550
00:44:12,060 --> 00:44:12,400
It's not.

551
00:44:12,820 --> 00:44:13,680
It can be anything.

552
00:44:13,680 --> 00:44:17,060
Your chaos engine can be, you know, can disrupt your access to your registry.

553
00:44:17,200 --> 00:44:18,420
It can disrupt your access to a cluster.

554
00:44:18,560 --> 00:44:19,640
It can mess with service mesh.

555
00:44:20,120 --> 00:44:23,200
Anything in your clusters is fair game to turn off or on.

556
00:44:23,780 --> 00:44:24,440
Right, right, right.

557
00:44:24,440 --> 00:44:26,280
So, you know, an upgrade can simulate an upgrade.

558
00:44:26,400 --> 00:44:27,260
It can simulate an outage.

559
00:44:27,360 --> 00:44:30,380
It can simulate an attacker knocking a single microservice offline.

560
00:44:30,580 --> 00:44:34,160
So it's the approach toward making applications resilient.

561
00:44:35,380 --> 00:44:35,640
Yeah.

562
00:44:35,880 --> 00:44:41,760
So tell me, like, if this is a reasonable line of thought.

563
00:44:41,760 --> 00:44:45,740
Like, it seems like, based on what you're saying, let's see.

564
00:44:46,400 --> 00:44:56,040
You got this new architecture for applications cloud native, which also means you've got new infrastructure for, like, running containers instead of VMs or, you know, bare metal.

565
00:44:56,440 --> 00:45:03,960
That's orchestrated by something, which is likely Kubernetes, at least by interest at the moment, to orchestrate your containers running.

566
00:45:04,120 --> 00:45:11,460
And then, you know, and then, you know, next slide, you throw up the crazy CNCF, like, project chart.

567
00:45:11,660 --> 00:45:12,820
Like, all the plugins.

568
00:45:13,000 --> 00:45:26,340
Because I think another thing that, like, I come to appreciate almost on a weekly basis over the past three years is that, like, and I mean this in a good architectural design way, is that, like, Kubernetes actually doesn't do that much.

569
00:45:26,760 --> 00:45:41,980
Like, it's this little core that basically just, like, places stuff on, I'm going to really simplify it, places stuff on computers and make sure you have what you want on there and then make sure that the stuff, the little apps that you put on all the computers can talk with each other.

570
00:45:42,260 --> 00:45:44,660
And there's a little bit more that it does, but that's kind of it.

571
00:45:45,100 --> 00:45:54,600
And, like, all these things that you would assume an infrastructure as a service does for you, you pull from that slide of all the projects and all the various things to add in there.

572
00:45:54,960 --> 00:46:00,280
And then the issue there is that it's all very new and frothy and exciting.

573
00:46:00,620 --> 00:46:12,560
And so I suppose you could, you know, if I knew how to do math, you could do the, I forget which one has to be in an order, but you could do either the permutations or the combinations of all these different things.

574
00:46:12,660 --> 00:46:16,560
And it probably would be, like, well, that's impossible, right?

575
00:46:16,580 --> 00:46:19,200
Like, all the various different ways you could combine this stuff together.

576
00:46:19,340 --> 00:46:20,820
So you've got that.

577
00:46:21,040 --> 00:46:29,240
And then, you know, so that opens up the need to basically revisit how you go in and you make sure your infrastructure and platform layers are secure.

578
00:46:29,440 --> 00:46:32,260
Now, you may not have to completely redo everything.

579
00:46:32,620 --> 00:46:37,740
Like, you may not have to redo how you hand out certificates or how you store, like, secrets or passwords.

580
00:46:38,040 --> 00:46:41,340
But you at least need to go in and make sure it's still applicable.

581
00:46:41,580 --> 00:46:47,280
And if it's not applicable, you got to, like, do some new stuff for that.

582
00:46:47,800 --> 00:46:51,500
And so that is a problem, not to be all funny about it.

583
00:46:51,540 --> 00:46:58,940
But, you know, the hopeful thing that you're pointing at is, like, well, we could automate a lot of that, right?

584
00:46:58,940 --> 00:47:04,300
Like, maybe we could go in and use, like, guardrails or just modify a Helm chart.

585
00:47:04,640 --> 00:47:05,300
I mean, not just.

586
00:47:05,420 --> 00:47:12,820
But, you know, maybe we couldn't do all of the different combinations or permutations of this stuff.

587
00:47:13,060 --> 00:47:17,960
But we could say we can do 50 of them, right?

588
00:47:17,960 --> 00:47:23,120
Like, or, like, here are, you know, here's a box of opinions.

589
00:47:23,660 --> 00:47:27,280
And you can select one of eight opinions of what a platform looks like.

590
00:47:27,440 --> 00:47:43,640
And essentially, we can automate doing a baseline, like, secure, not secure enough, but, like, doing as much automation of security, like changing, making, like you're saying, making MySQL secure by default or whatever the fun phrase was.

591
00:47:43,840 --> 00:47:48,180
And then, you know, you can pick one of those, and then at least we get that platform security.

592
00:47:48,360 --> 00:47:58,300
And, like, I don't know, I'm imagining, like, maybe after you run this mega script, you generate a readme file that's, like, and here's the other stuff you got to do, right?

593
00:47:58,380 --> 00:48:06,400
Like, and now you have, like, you know, this is your pre-made meal that we've done for you, and now here's the way that you put it together.

594
00:48:06,480 --> 00:48:08,020
I mean, again, being loose about it.

595
00:48:08,180 --> 00:48:19,420
But it seems like getting to that point is, like, a major step that would take, like, you know, as you were saying, like, several years where you can actually just automate this stuff.

596
00:48:19,540 --> 00:48:26,680
And then, you know, each time you go up to the application layer, I can tell that's the more exciting part because you get very excited, right?

597
00:48:26,820 --> 00:48:29,720
But that's where there's, like, more of the creativity and stuff.

598
00:48:29,800 --> 00:48:42,000
And it's, I feel like it's very analogous to the, like, first, or, you know, the first two phases of DevOps where it was basically like that, except it was, like, the thrilling world of server configuration.

599
00:48:43,000 --> 00:48:51,320
Like, everything, and now when you say server configuration or platform configuration, the scope of that is so much more than it was just, you know, probably when you were developing, you know.

600
00:48:51,680 --> 00:48:52,040
Absolutely.

601
00:48:52,460 --> 00:48:56,760
And there's huge wins you can have with some of this, you know, certificates or credentials, you know, service bindings.

602
00:48:56,840 --> 00:49:01,340
Just a pure idea of, you know, Coté, let me just go back in your past.

603
00:49:01,380 --> 00:49:03,920
When you were developing in the past, I'm assuming you need a database.

604
00:49:04,240 --> 00:49:15,820
So, if you're an enterprise, the process you went through of having a database for your application generally involved opening a ticket, someone created a database, someone created a password, probably emailed to somebody who then emailed it over to you.

605
00:49:16,100 --> 00:49:16,440
That's right.

606
00:49:16,620 --> 00:49:18,400
You know, your application, it became a secret.

607
00:49:18,780 --> 00:49:19,760
This password's everywhere now.

608
00:49:20,260 --> 00:49:25,600
So, if we can take just the basic, again, table stakes, get those things out of the way, those things that can be automated.

609
00:49:25,680 --> 00:49:28,420
We have service bindings where you say, I'm building an application.

610
00:49:28,560 --> 00:49:30,080
I want to bind it to a database.

611
00:49:30,880 --> 00:49:32,920
And then I want that password to rotate daily.

612
00:49:33,880 --> 00:49:34,860
No one knows a password.

613
00:49:34,980 --> 00:49:35,780
It's all automated.

614
00:49:35,960 --> 00:49:37,720
There's no password or credentials to leak.

615
00:49:38,300 --> 00:49:39,460
You know, certificates are the same way.

616
00:49:39,500 --> 00:49:48,220
The idea that we can use certificates without having to have this big, huge hurdle of getting a certificate, you know, automation around majority consumption.

617
00:49:48,340 --> 00:49:49,280
Like, I've got Kubernetes clusters.

618
00:49:49,420 --> 00:49:50,560
I don't even renew certificates.

619
00:49:50,740 --> 00:49:51,740
It's all Acme.

620
00:49:51,840 --> 00:49:53,800
They just renew every three months on their own.

621
00:49:53,900 --> 00:49:55,180
I never have to think about it.

622
00:49:55,180 --> 00:50:08,540
So, taking that out of the picture means we're not spending cycles monitoring hundreds of certificates for maintaining and upgrading and having had someone dedicated to making sure we don't go offline because our SSL certificate expired.

623
00:50:08,940 --> 00:50:12,600
Or having a database password expire or somebody leave and you have to change a password.

624
00:50:12,720 --> 00:50:14,640
You're like, okay, now who knows how do we rotate these passwords?

625
00:50:15,200 --> 00:50:20,040
Taking those tables to take things out saves so much more time on those people who are trying to work around it.

626
00:50:20,100 --> 00:50:21,980
Now we can actually start focusing, as you said, on the fun stuff.

627
00:50:22,540 --> 00:50:26,500
Well, I'm a security guy, so my idea of fun stuff is probably different than the average person.

628
00:50:27,900 --> 00:50:42,780
Well, so this gets to the next thing, you know, I was interested in talking about here, which is, you know, I look at a lot of surveys and I get to do some analysis of our own state of Kubernetes survey, which is always fun.

629
00:50:42,780 --> 00:50:51,740
And, you know, with Kubernetes or with any new technology, like concerns and problems, like security is always like number one or number two, right?

630
00:50:51,860 --> 00:51:07,180
And, you know, we've kind of, we've provided a little bit of the answer here, but like it's making me realize even more that like just to see like security as a concern is sort of like, I don't know, to be a bit aggressive in it is kind of a nothing burger.

631
00:51:07,640 --> 00:51:15,900
It's just sort of like, it's like, well, yes, but what of the five, you know, not 500, but what of the many things is the concern for you?

632
00:51:15,940 --> 00:51:22,780
And I think that, like that leads to the next thing is like, I mean, I vaguely know what OWASP is, right?

633
00:51:22,900 --> 00:51:27,820
Because I remember that, that, that came about like in the kind of like early DevOps days.

634
00:51:27,920 --> 00:51:32,100
So I remember seeing that and like, is that like sufficient?

635
00:51:32,600 --> 00:51:41,640
Like, like, like, is, is, is there a list that like, let's say we're, uh, nevermind the cut, the complexity of like three giant banks that have merged together and now they got to deal with that.

636
00:51:41,740 --> 00:51:46,740
But like, let's just say we're building a banking platform, right?

637
00:51:46,860 --> 00:51:49,460
And we're, we're, we're going to build a cloud native platform.

638
00:51:49,460 --> 00:51:52,500
And then we're going to, of course, develop, uh, in Java and spring.

639
00:51:52,840 --> 00:51:59,440
And like, can I just go to like OWASP.org and like go through their things and I'm more or less cool?

640
00:51:59,560 --> 00:52:12,100
I mean, obviously, as we've mentioned many times that the application layer, you're writing code and like, that's more artful, but it's sort of like, what is the list of things that's behind that security is my number one concern?

641
00:52:12,100 --> 00:52:13,960
Is that, is that like catalog somewhere?

642
00:52:14,620 --> 00:52:16,320
Not as easily as you'd like it to be.

643
00:52:16,900 --> 00:52:21,040
Um, so at a high level, if you're, say you're in banking, well, first question is, which region are you in banking?

644
00:52:21,040 --> 00:52:29,080
Because you have Singapore monetary authority, you have the FCC, OCC, we have the FDIC, we have, you know, we have all the FCC probably for transmission.

645
00:52:29,220 --> 00:52:36,240
Anyway, uh, either way there's, there's FFIEC, which has banking and, and their testing methodologies for banking in the backend.

646
00:52:36,560 --> 00:52:40,580
If they're doing credit cards and PCI fits in and they all refer to OWASP.

647
00:52:40,820 --> 00:52:42,260
So that's, that's one piece of it.

648
00:52:42,440 --> 00:52:45,180
But when you start looking at infrastructure, there's other standards that are coming out.

649
00:52:45,280 --> 00:52:48,040
There's, there's the CIS, which is how you approach hardening.

650
00:52:48,220 --> 00:52:54,420
So if you're going to deploy MySQL or Apache, what are the common hardened methodologies for hardening the application?

651
00:52:54,660 --> 00:53:06,280
If that's going to run on a Linux container or a Windows container or a Windows VM or a Linux VM, there's a hardening standard that you'd expect to have shipped by default with those things or ways for you to tune those.

652
00:53:06,560 --> 00:53:14,060
So all of these standards are going to have, you know, you must follow industry standard hardening, which OWASP is not going to talk about hardening.

653
00:53:14,140 --> 00:53:16,500
That's the open web application security.

654
00:53:17,180 --> 00:53:19,800
So there are ties to the platform and the application security.

655
00:53:20,100 --> 00:53:28,700
Just like there's, there's an API OWASP, there's other OWASP, but then you have CIS or STIG for hardening, STIG for the federal government, CIS for the rest of the world or U.S. federal in the rest of the world.

656
00:53:28,900 --> 00:53:33,860
But then you're going to have even more on top of that, you know, how do you actually make a secure application?

657
00:53:33,860 --> 00:53:40,440
So Google recently released Salsa, and again, I'm going to probably butcher the term, it's SLSA.dev.

658
00:53:40,940 --> 00:53:43,260
And it's basically secure, it's a supply chain artifact.

659
00:53:43,520 --> 00:53:50,360
So the parts, the dependencies, the containers, the things that come out of building applications in a modern environment, what are all the security risks?

660
00:53:50,440 --> 00:53:57,100
Everything from the developer committing code to supply, you know, actually your registry, your build process, are you building things consistently?

661
00:53:57,580 --> 00:53:59,300
And can you validate and attest to that?

662
00:53:59,300 --> 00:54:08,420
So the supply chain side of building applications, then there's CNAP, which came out of Gartner and heavily influenced by Palo Alto, because they have a lot of products in the security space there.

663
00:54:08,860 --> 00:54:17,820
Looking at the cloud native application security, which includes parts of Salsa, but also your actual cloud environment, your infrastructure, the runtime security as well.

664
00:54:17,880 --> 00:54:20,260
So it talks about the bigger picture of the running application.

665
00:54:21,360 --> 00:54:28,900
Now, FFIEC and PCI may not mention Salsa or CNAP specifically, but they'll say industry standard because standards change over time.

666
00:54:29,800 --> 00:54:30,140
Right, right, right.

667
00:54:30,320 --> 00:54:34,520
So OWASP has been around for decades, but they're all going to refer to, well, what's the platform?

668
00:54:34,640 --> 00:54:35,900
What's the standard for that platform?

669
00:54:36,420 --> 00:54:38,360
What's your vendor's best practice that goes with that?

670
00:54:38,360 --> 00:54:43,900
So to do all this, you need to start off with your vendor's best practice and the industry standards for the different layers you're doing this.

671
00:54:44,000 --> 00:54:50,820
So I have one slide I share when I'm talking about this that shows multiple supply chains filtering through service message into multiple clouds.

672
00:54:50,900 --> 00:54:56,660
You can picture a modern app, that big, big circle with all the connections going between it, but it shows the supply chain on each of those.

673
00:54:56,660 --> 00:55:08,280
And you have the Salsa side of all the risks in the slide chain, but each one of those connections, each one of those places, there's a security risk providing either a risk-based approach or a tool from a security tool that provides protection.

674
00:55:08,500 --> 00:55:09,480
Is there a runtime security tool?

675
00:55:09,560 --> 00:55:10,220
Is there a service mesh?

676
00:55:10,480 --> 00:55:14,500
Like our service mesh that we have has security tools built in the mesh itself.

677
00:55:15,080 --> 00:55:25,200
So every layer of these has a risk associated to it and then generally some sort of compensating security control and or methodology or practice that goes with it.

678
00:55:25,520 --> 00:55:28,600
And if you're doing a bank, all of this is in scope for you.

679
00:55:28,820 --> 00:55:33,840
How does this impact the build versus buy question?

680
00:55:34,820 --> 00:55:41,140
Oh, well, it's the same impact because if you're buying, and I'll give this example from a financial side.

681
00:55:41,220 --> 00:55:43,620
So say you're, again, banking, you're doing a bank co-tay.

682
00:55:43,980 --> 00:55:48,080
So you're starting your bank and you decide, I'm not going to build my own core because building a core is really hard.

683
00:55:48,240 --> 00:55:52,260
And the actual getting certified, having my core certified is a big uphill battle.

684
00:55:52,320 --> 00:55:53,400
So I'm just going to buy a core.

685
00:55:53,700 --> 00:56:03,040
Now, if you're going to buy a core from Temenos or, you know, Fiserv or FIS or whoever it might be that produces cores, you might actually be asking them, well, how are you building it?

686
00:56:03,320 --> 00:56:18,480
You know, the question we're asking of, like, we as VMware, we are constantly asked, and what we and my team help with is, how are we building our software so that our customers who are receiving the out-of-the-box tools, you know, how can they validate that we've developed it securely?

687
00:56:18,880 --> 00:56:20,900
And what trust and mechanisms do we have?

688
00:56:20,940 --> 00:56:29,960
And that's where you have the federal S-bomb mandate that came out because just asking a vendor to say, trust me, I'm doing it, is generally not been good enough over history.

689
00:56:30,220 --> 00:56:38,100
So off-the-shelf software has an assumption that they're doing good, but we've gotten to a point where sometimes those assumptions are being questioned.

690
00:56:38,240 --> 00:56:45,300
So you had the federal mandate that came out and said, if you're going to work with the federal government, you need to provide a build of material so I can understand what you've built your product from.

691
00:56:45,700 --> 00:56:52,300
So I can see that you're upgrading, you're not running a version of Java that has log4j from two years ago that you've not upgraded.

692
00:56:52,780 --> 00:56:59,480
So this whole S-bomb mandate means you're going to have regular updates to the S-bomb with each new release because that's just the first step.

693
00:56:59,540 --> 00:57:02,380
Then you start having Salsa come in, which is great, you've got an S-bomb.

694
00:57:02,740 --> 00:57:06,440
How do I know you've built this consistently and securely in the process?

695
00:57:06,520 --> 00:57:08,820
So how can you as a business attest to your Salsa?

696
00:57:09,360 --> 00:57:10,380
And this is where Salsa is right now.

697
00:57:10,420 --> 00:57:16,940
As they produced a standard a few months ago, the working groups are breaking down now into how do you actually do attestations?

698
00:57:17,060 --> 00:57:18,560
How do you, can you self-attest?

699
00:57:18,640 --> 00:57:22,820
Do you need to have a third party like PCI as self-attestation or third-party attestations?

700
00:57:23,420 --> 00:57:24,640
And PCI has done it by size.

701
00:57:24,640 --> 00:57:32,780
So if you're PCI level one, meaning you've either been compromised or you're just large in the number of transactions you do, then you have to hire a QSA to do your audit.

702
00:57:33,300 --> 00:57:36,160
The question for Salsa is, we don't quantify that.

703
00:57:36,180 --> 00:57:40,300
There's no, like with PCI, they can say, you can't process credit cards unless you do what we say.

704
00:57:40,400 --> 00:57:41,880
So there's a big, big stick.

705
00:57:42,320 --> 00:57:43,960
You know, the carrot is you get your money from credit cards.

706
00:57:44,040 --> 00:57:45,400
So that works well.

707
00:57:45,460 --> 00:57:54,900
But in Salsa, it's put together by Google and VMware and Red Hat and the communities come together and say, we want to have our customers trust us better.

708
00:57:56,220 --> 00:58:02,020
And as someone who was a QSA, the reason I joined Salsa as a working group is I want to see this attestation side.

709
00:58:02,440 --> 00:58:04,060
How are we going to actually validate that?

710
00:58:04,220 --> 00:58:05,680
And this is where off-the-shelf software comes.

711
00:58:05,840 --> 00:58:10,560
You know, the idea that I'm receiving software from someone, again, that core for your bank, Coté.

712
00:58:10,920 --> 00:58:15,140
How do you know that each release followed the, you know, they're going to provide you a guide.

713
00:58:15,200 --> 00:58:18,320
We actually have our own guide when the customer asks us, here's how we develop secure software.

714
00:58:19,040 --> 00:58:21,220
And how do we actually show and attest that?

715
00:58:21,280 --> 00:58:24,580
That's coming through the S-bomb and soon the Salsa attestations that come with it.

716
00:58:24,820 --> 00:58:28,620
I expect starting to see companies having that in the coming time, in the years.

717
00:58:28,640 --> 00:58:31,360
Can you talk a little more about this concept of attestations?

718
00:58:31,360 --> 00:58:33,880
Because, so, I mean, you're talking about S-bombs, right?

719
00:58:33,940 --> 00:58:37,240
So, a secure bill of materials or a software bill of materials, right?

720
00:58:37,240 --> 00:58:41,180
Where somebody who produces software says, here, this is what's in it.

721
00:58:41,920 --> 00:58:46,940
Or, so you're really, it's sort of like a self-reported bill of materials.

722
00:58:47,200 --> 00:58:50,160
It's a bill of materials, but it doesn't tell you how you've built it.

723
00:58:50,880 --> 00:58:58,440
So, it's just a, I can get any container and I can get an inventory list of that inventory of that container and say, here's the bill of materials that made that container.

724
00:58:59,480 --> 00:59:02,960
But how do I know how you've actually, you know, layers are an OSA model.

725
00:59:03,120 --> 00:59:04,160
You've put these together.

726
00:59:04,260 --> 00:59:06,960
How do I know that the process you used to build that?

727
00:59:07,040 --> 00:59:10,940
Was that a Docker file on someone's laptop that's going to have the dependencies change from one build to the next?

728
00:59:11,320 --> 00:59:12,240
Is it a build service?

729
00:59:12,420 --> 00:59:14,800
So, how do you provide that?

730
00:59:14,800 --> 00:59:20,520
And this is where it's also coming together, trying to figure out how do we validate and report on these attestations?

731
00:59:20,620 --> 00:59:27,380
There's two sides to it is, one, if someone's going to do self-attest, you have to have some level of assumption that they're going to do it honestly.

732
00:59:28,120 --> 00:59:32,900
You know, you have to trust at some point the contracts and stuff to help validate those trust conversations.

733
00:59:33,480 --> 00:59:43,620
But I'm a big fan of, if you're a big firm, say like a VMware or Google or Microsoft, I would expect to have a third party come through, like a QSA and PCI.

734
00:59:44,460 --> 00:59:49,160
And if you're going to have this testing methodology, you say, here's how I do my builds.

735
00:59:49,240 --> 00:59:50,360
Here's how I do my code check-ins.

736
00:59:50,440 --> 00:59:54,060
Here's how I do all those things in Salsa or CNAP, whatever it comes out to.

737
00:59:54,460 --> 00:59:55,820
How do you prove that?

738
00:59:55,960 --> 00:59:57,440
So, some things can be done through code.

739
00:59:57,720 --> 01:00:02,540
You know, if, say we're building, you know, our own applications in Tanzu with TAP, which we are.

740
01:00:02,640 --> 01:00:06,040
There's a project I actually work on building our own products with our own products,

741
01:00:06,180 --> 01:00:09,960
which means we're going to have similar build methodologies, similar consistency in containers,

742
01:00:10,100 --> 01:00:13,700
similar consistency in the actual way we're actually building and releasing our software.

743
01:00:14,620 --> 01:00:18,100
And the benefits for those is that means we now have a better way of attesting this.

744
01:00:18,220 --> 01:00:22,760
So, what the TAP team is working on right now is, as Salsa is figuring out what does it mean to attest,

745
01:00:22,820 --> 01:00:25,840
so we're trying to figure out, well, how do we in our own software provide that?

746
01:00:25,860 --> 01:00:28,560
Because some of these attestations, I would expect to be digital.

747
01:00:29,040 --> 01:00:30,960
I would expect, again, this automation to come in.

748
01:00:31,360 --> 01:00:34,100
If I'm attesting for CNAP, you know, I get out of the Salsa to CNAP,

749
01:00:34,160 --> 01:00:38,120
if I have a cloud environment running my platforms, I should get a report every day

750
01:00:38,120 --> 01:00:42,380
that tells me all those controls I built, the security groups, the access controls, the secrets,

751
01:00:42,480 --> 01:00:45,760
all those things the cloud provider makes for my building my environments,

752
01:00:46,140 --> 01:00:50,240
I should be able to get a report every day that tells me all those controls are matching what I've put

753
01:00:50,240 --> 01:00:51,960
and how it matches my policies.

754
01:00:52,300 --> 01:00:55,140
So, I can then show my auditor every day over time.

755
01:00:55,380 --> 01:00:57,340
Wouldn't it be great if we had a time-based graphic log for this stuff?

756
01:00:57,420 --> 01:01:04,700
Anyway, it would be the idea that we have this attestation self-handling through automation,

757
01:01:05,060 --> 01:01:09,820
and then those things that tie it together would be a manual, either internal, professional.

758
01:01:10,040 --> 01:01:15,480
In PCI, you can get, actually be a QSA where you're trained and you actually do audits.

759
01:01:15,820 --> 01:01:17,120
There's also a PCI specialist.

760
01:01:17,280 --> 01:01:19,680
I'm sure somewhere in VMware, in one of our security teams,

761
01:01:20,040 --> 01:01:22,300
there's someone who's actually currently trained in the latest PCI

762
01:01:22,300 --> 01:01:25,940
to make sure that we as a company are following that without having to hire an auditor

763
01:01:25,940 --> 01:01:27,500
for every little question.

764
01:01:28,400 --> 01:01:31,320
Similar for Salsa or CNAP or these standards coming out,

765
01:01:31,840 --> 01:01:33,740
there's a certain attestation we should be able to give internally

766
01:01:33,740 --> 01:01:35,720
as the standards are more mature.

767
01:01:36,480 --> 01:01:39,060
But there's, how do we actually do this automated?

768
01:01:39,220 --> 01:01:41,940
How do we actually get, our first part of the conversation,

769
01:01:42,120 --> 01:01:44,020
we want to automate some of the security things.

770
01:01:44,100 --> 01:01:46,100
Well, how do we generate those automatic reports

771
01:01:46,100 --> 01:01:47,700
and put them in a way that we can say,

772
01:01:48,140 --> 01:01:49,860
not just to ourselves, but to our customers,

773
01:01:50,580 --> 01:01:51,660
how it's done?

774
01:01:51,720 --> 01:01:53,440
And this is where, you know, buy versus build.

775
01:01:53,900 --> 01:01:57,020
If you are buying your core for your bank code today,

776
01:01:57,140 --> 01:02:00,960
I would expect, I'm sure if you were doing one today after this conversation,

777
01:02:01,080 --> 01:02:04,040
you'll be expecting your core provider to not only provide an S-Bomb,

778
01:02:04,640 --> 01:02:06,100
but the details of this build process.

779
01:02:06,240 --> 01:02:10,320
How do I know that the next release I get is going to follow that build process?

780
01:02:10,380 --> 01:02:14,140
If you made changes to your build that impacts the way the software builds and runs,

781
01:02:14,500 --> 01:02:19,260
I'd want to know that because a core banking product is the center of the bank.

782
01:02:19,360 --> 01:02:21,640
That's where all, you know, that's where your money is kept.

783
01:02:21,740 --> 01:02:22,620
You know, money's all digital now.

784
01:02:22,680 --> 01:02:23,180
It's in that core.

785
01:02:23,760 --> 01:02:26,760
So I think even if you're building yourself, you have the same questions.

786
01:02:26,800 --> 01:02:28,080
How do you prove to your customers?

787
01:02:28,480 --> 01:02:30,600
In the end, that's what it's coming down to is how do people trust

788
01:02:30,600 --> 01:02:34,300
that the work you've done is the work you've intended to do?

789
01:02:35,920 --> 01:02:41,360
Right. Like you're saying, you know, when it comes to the ultimately like a testing

790
01:02:41,360 --> 01:02:46,900
that something has been done properly, I guess you go all the way back to there's a prime mover

791
01:02:46,900 --> 01:02:50,020
of just like, oh, I trust that person, right?

792
01:02:50,080 --> 01:02:56,220
And I trust that they set up all of the automated stuff that therefore generates all the like signing

793
01:02:56,220 --> 01:02:58,100
and things that like are cool.

794
01:02:58,100 --> 01:03:05,020
But you do have to trace back at some point that this is a, I was told they set up their salsa this way.

795
01:03:05,020 --> 01:03:10,620
They did just like generate all, you know, start some, some, obviously it would be a lot of work,

796
01:03:10,620 --> 01:03:15,800
but like you do have to have some sort of kernel of, of, of trust at the beginning that kicks all these things off.

797
01:03:16,000 --> 01:03:18,120
Well, there's always that, that conversation trust, but verify.

798
01:03:18,380 --> 01:03:22,160
And then going back into security, security is generally in companies driven by compliance.

799
01:03:22,220 --> 01:03:26,040
So PCI is a compliance standard, you know, so these standards come out.

800
01:03:26,040 --> 01:03:30,660
So FFIC for banking, Singapore banking authority, you know, even GDPR across Europe,

801
01:03:30,700 --> 01:03:34,200
how do you handle the data when customers ask you to delete or change it, you have access to it.

802
01:03:34,340 --> 01:03:39,800
So having these compliance regimes drive security requirements.

803
01:03:41,380 --> 01:03:45,440
But I think, again, going back to what I'm, I'm hoping that the changes we'll see in security is

804
01:03:45,440 --> 01:03:48,300
we can automate those compliance regimes.

805
01:03:48,680 --> 01:03:52,200
So we can really start focusing on the real security risks of the businesses we're running.

806
01:03:53,060 --> 01:04:03,240
So, so that, so then as, as a final topic, let's, let's talk about like something, you know, it's, it's kind of in the build by area, but is it like, like, okay.

807
01:04:03,240 --> 01:04:11,280
So both what is the current like security, like CISO, whatever culture and like the one you think should exist, right?

808
01:04:11,280 --> 01:04:14,520
Like in the same way that you're like automating this stuff would be fantastic.

809
01:04:15,200 --> 01:04:28,820
Like, you know, what, what's like the vision for the future and also the current as far as like, like, would you go to like a vendor or a cloud provider and like buy full stack bank compliance?

810
01:04:29,280 --> 01:04:48,600
Or is it, or is it like, you don't do that instead you go to like auditors who do it or you do it on your own or like, what is, what's like the current like culture of like, again, if, if I were, if, if Cora and I were building our bank, like, do we just go to like, you know, Fiserv and they just do it all?

811
01:04:48,600 --> 01:04:53,240
Or like, normally do you involve other parties or do other things?

812
01:04:53,900 --> 01:05:00,860
Well, Fiserv would want you definitely, definitely yes to just outsource and have their, their SaaS or on-prem product be the end all be all.

813
01:05:01,300 --> 01:05:17,180
Well, and, and then, and then, for example, also like, you know, as, as delightfully, I, I, I love the, the very professional sterile nature of any document about PCI compliance, but there's a great joke in, in your document, which is like, well, you know, PCI says you need to have security cameras,

814
01:05:17,340 --> 01:05:19,060
which Tanzu has nothing to do with.

815
01:05:19,760 --> 01:05:30,100
So there's like, you know, there's all this other stuff that like, I, I mean, I'm kind of blowing up my question here, but it's sort of like, what is the current method that people go about doing this stuff?

816
01:05:30,160 --> 01:05:35,340
Do they, is it single source or do you have multiple people or like, how does it work out for any of this?

817
01:05:35,440 --> 01:05:39,420
I wish there, well, there are people who can help with various things.

818
01:05:39,420 --> 01:05:46,080
So, so before I was starting the bank before Pivotal, I was actually at a private data center with my brother and we actually hosted PCI customers.

819
01:05:46,080 --> 01:05:52,060
We had all of the IT, you know, everything in PCI, except for those policies and the physical side of where their office was.

820
01:05:52,380 --> 01:05:56,760
We did, we did, we did, they gave us a copy of the, so we were their entire IT for running it.

821
01:05:56,800 --> 01:05:58,780
So you can outsource a lot of that stuff.

822
01:05:59,660 --> 01:06:07,160
There are definitely firms who would like to do as much of those pieces for you, but realistically, it, it is not a single provider to provide all of it.

823
01:06:07,160 --> 01:06:10,760
Because again, people process technology, you can outsource parts of the technology.

824
01:06:11,820 --> 01:06:13,280
Generally, you're not going to outsource all of it.

825
01:06:13,320 --> 01:06:15,060
So going back to the Fiserv banking side.

826
01:06:15,140 --> 01:06:17,000
Well, what if your bank also wants to have loans?

827
01:06:17,280 --> 01:06:24,480
You know, are you using a provider to do your, you know, know your, know your, know your question, you know, the KYC, know your customer of doing the loan application process.

828
01:06:24,560 --> 01:06:26,340
And in that process, Fiserv won't have that.

829
01:06:26,380 --> 01:06:26,960
That'd be another vendor.

830
01:06:27,060 --> 01:06:33,040
So each other business you get into will probably have other vendors in that space that are providing some tools.

831
01:06:33,320 --> 01:06:35,240
Then you, then you start looking at, well, how do I integrate them?

832
01:06:35,280 --> 01:06:36,880
How do I tie them together into one common tool?

833
01:06:36,900 --> 01:06:42,980
And that's what I think you would focus on if you're starting a bank is you'd find the best of breed for the products that you are providing.

834
01:06:43,680 --> 01:06:47,220
And those that you think you can do better, that's where you can actually make your business around.

835
01:06:47,220 --> 01:06:54,200
You're actually going to integrate these in a certain way, or maybe you're going to find out that the way you're doing, you know, loan applications is different than the rest of the world.

836
01:06:54,280 --> 01:06:54,880
You're going to change it.

837
01:06:55,100 --> 01:06:59,480
You actually make your own, know your customer product and actually sell that to other people on top of your banking.

838
01:06:59,940 --> 01:07:00,820
Maybe you'll build that yourself.

839
01:07:01,100 --> 01:07:05,120
So it really depends on what is your business and how you're going to approach it.

840
01:07:05,200 --> 01:07:08,240
And it really is an integration story of tying those together.

841
01:07:09,100 --> 01:07:09,500
Right, right.

842
01:07:09,500 --> 01:07:24,520
So, so like, like, and then as you were saying, right, you have not, not only like industry and sub industry things you need, like, like in banking, you know, you have different, different, I'm sure different things for like loans versus like trading.

843
01:07:24,520 --> 01:07:35,360
And then you also have regional, like nation specific, and then also whatever a super group of nations is like the EU, like, like you have standards from them.

844
01:07:35,360 --> 01:07:36,880
Your technology itself is different.

845
01:07:36,880 --> 01:07:47,520
You might find, you know, say, say you've got like a big bank, say you've got 2000 applications, you might find that you have 50 or 60 core base, you know, accelerator images that you want to tie together to those.

846
01:07:47,580 --> 01:07:52,500
So it's not going to be one image across all of them, it might be 50 different images, which means that different sources for those pieces.

847
01:07:52,820 --> 01:07:56,540
I was talking to one bank, actually a company that does a lot of credit card processing.

848
01:07:57,180 --> 01:08:04,900
And I said, well, how would you feel if, if all these products, because they're a big VMware customer, you know, if you had better, you know, you have the S-bombs, we can provide, you know, vulnerability details.

849
01:08:05,120 --> 01:08:08,060
Well, if we provide all this for you, would that make your life easier?

850
01:08:08,540 --> 01:08:14,580
And he said, well, except for the fact that we also have Microsoft, we also have Google, we also have, you know, it lists out the 40 other vendors you have.

851
01:08:15,320 --> 01:08:18,520
And his job as a CISO is to know the risk and security.

852
01:08:18,600 --> 01:08:28,900
So it's great we can automate a lot of the application, the platform, but he's going to run that inside of a Google and Microsoft clouds, which have their own sort of constraints on those and tools.

853
01:08:28,900 --> 01:08:35,300
So he has to manage all these different vendors that are integrated together just for the different business lines of his company.

854
01:08:35,660 --> 01:08:37,800
So it's playing all these different places.

855
01:08:37,920 --> 01:08:39,340
And again, their teams are small.

856
01:08:39,500 --> 01:08:43,880
So now we have the need of diverse skill sets of these different types of products.

857
01:08:44,180 --> 01:08:51,960
So it still is kind of a challenge, but it's a fun big picture challenge, which I think is why I feel like you're all here.

858
01:08:51,960 --> 01:09:14,100
I like the approach that your brother and you's business there kind of implies is that if you think of your stack as a bunch of layers, then what you're looking for in all of your, let's call them suppliers, your suppliers in that layer is that they basically have that stack of certifications and compliance.

859
01:09:14,100 --> 01:09:15,080
That's what you need, right?

860
01:09:15,440 --> 01:09:15,600
Yep.

861
01:09:15,600 --> 01:09:21,540
So that, you know, they go, they go to, they go to you, you and your, they go to the brother's PCI compliant managed service provider.

862
01:09:21,880 --> 01:09:28,720
And essentially, I mean, I would imagine you would say like, we have all these initialized standards in the scope of our layer.

863
01:09:28,720 --> 01:09:37,600
You look at VMware, our SaaS offerings, we have ISO 27001, we have, you know, the SOC 2 audits, we have the Cloud Security Alliance.

864
01:09:37,740 --> 01:09:42,020
There's based upon the type of business, some of them are doing FedRAMP, you know, base objectives.

865
01:09:42,240 --> 01:09:54,800
So based on the customers and the needs of those customers, again, those regulatory compliance frameworks drive certain sets of standards and audits and validations that happen that we need to provide to our customers to show that attestation.

866
01:09:54,800 --> 01:10:01,600
And I think that the application layer is the one that's the biggest focus now beyond, you know, we've had SOC 2 for a long time.

867
01:10:02,140 --> 01:10:04,840
Now we're actually going to the next depth when customers are asking for SBOM.

868
01:10:04,880 --> 01:10:10,920
In fact, I've seen several customers talking about putting in their MSAs, the requirement of VMware providing SBOMs.

869
01:10:11,280 --> 01:10:18,860
And even PCI, we've mentioned recently, version 4 came out, the vulnerability scanning inside PCI used to be, you know, addressed high-end criticals.

870
01:10:19,260 --> 01:10:28,460
Now it's not only just high-end criticals being addressed, but starting in 2024, 2025, I forgot the exact date, customers are going to have to do risk assessments on every low and medium finding, too.

871
01:10:29,040 --> 01:10:36,600
So if you've got 2,000 servers in your PCI environment and you've got to do every low and medium finding risk assessment, your team wasn't big enough to begin with.

872
01:10:36,640 --> 01:10:37,580
How are they going to handle that?

873
01:10:37,800 --> 01:10:45,220
And that's all, is that all part of, I mean, if the application is now the biggest focus, that is what Salsa is all about, right?

874
01:10:45,440 --> 01:10:45,600
I mean.

875
01:10:45,640 --> 01:10:49,320
Well, Salsa is the building blocks to make up the artifacts that you run in your clusters.

876
01:10:49,700 --> 01:10:58,240
So it provides security of the coder, the committee into the registry, the registry security, the, you know, also as well as your source code repository.

877
01:10:58,400 --> 01:11:03,500
You know, all the parts of building software and the artifacts that come around that, Salsa is looking at how you protect those.

878
01:11:04,600 --> 01:11:06,180
But it doesn't deal with the running side.

879
01:11:06,180 --> 01:11:08,020
So that's where CNAP comes in.

880
01:11:09,160 --> 01:11:14,260
And it doesn't address, Salsa was not meant to address PCI.

881
01:11:14,540 --> 01:11:16,620
It's just, it's a supply chain conversation.

882
01:11:16,880 --> 01:11:23,500
But I expect, you know, if you go through the PCI best practices document, you'll see parts of where Salsa comes in.

883
01:11:23,560 --> 01:11:29,100
Like it talks about your container orchestration tools, your registry and building process.

884
01:11:29,280 --> 01:11:31,180
You know, those are parts of Salsa on that.

885
01:11:31,860 --> 01:11:47,240
One other question is, there's been this sort of, I don't know if it's a vocabulary change or just sort of like a foe we're having, but secure software supply chains and just supply chains in general are sort of like the term of the day when you're talking about taking an app from code to production.

886
01:11:48,640 --> 01:11:57,860
Does that, is that instead of or on top of the way we have used CICD as a term for so long?

887
01:11:58,300 --> 01:12:01,340
Well, CICD is a nuanced conversation.

888
01:12:01,520 --> 01:12:11,300
So you can't have a supply chain without a CICD, but you can have CICD without the full supply chain because supply chain must take it back to its original practice.

889
01:12:11,460 --> 01:12:12,660
You know, they were building cars.

890
01:12:13,320 --> 01:12:21,200
You know, the supply chain is where you gain your chip from that's made and shipped to one place and tested and shipped to another place and put onto a PCB and tested and shipped.

891
01:12:21,420 --> 01:12:32,280
So the supply chain, in fact, there's some standards coming out around, you know, how do you actually do this, you know, the S-bomb or I-bomb or other building materials, which includes the physical side of supply chains.

892
01:12:32,280 --> 01:12:46,920
So supply chains, you know, say you're flying out of a jet and they're doing maintenance on the engine, they can tell you by the serial number on the fan blade of that jet engine where it was made and the tensile strength as it was tested to prove that that blade met the requirements as it was shipped on the supply chain.

893
01:12:46,920 --> 01:12:58,480
So supply chain is that big picture story from manufacturer to release that you can attest all the individual pieces, where they came from, how they're built, how they're tested, how they're validated to get to the final product.

894
01:12:58,600 --> 01:13:02,980
So supply chain is a bigger picture of everything it takes to make that application.

895
01:13:03,800 --> 01:13:08,000
And realistically, a supply chain, if you think of a modern app, many modern apps aren't just one service.

896
01:13:08,140 --> 01:13:12,160
You know, they're going to be 50 or 60 microservices, if not hundreds or thousands of them.

897
01:13:12,160 --> 01:13:20,020
So realistically, a supply chain is all of those, but there might be thousands of CICD pipelines that make that work.

898
01:13:20,880 --> 01:13:25,780
So supply chain is really that bigger picture story of the application in its whole and what it took to get there.

899
01:13:27,740 --> 01:13:28,700
Well, that was great.

900
01:13:28,940 --> 01:13:40,800
I think I think I have a little bit of an idea of what people are talking about when security is in a survey that it's, you know, I, I, I would say there's a lot going on, but it's not incomprehensible.

901
01:13:41,040 --> 01:13:42,500
It's just a lot.

902
01:13:43,460 --> 01:13:45,780
It's, it's, it's like knowable complexity.

903
01:13:46,400 --> 01:13:53,760
Uh, but, but, uh, it's, it's not just as simple as like making pancakes, which I guess could be difficult if, uh, if you don't have experience.

904
01:13:53,860 --> 01:13:59,620
Like anything that's complex that you break it up into parts and you, and you treat those parts and you take one part, automate it.

905
01:13:59,840 --> 01:14:07,560
But I'm going to go back to getting one of the favorite phrases I learned in my pivotal days, which I'm still using today is even these platforms and the automation that go with them.

906
01:14:07,920 --> 01:14:15,740
They are products make sure that you have a PM, a designer, you know, the security team, the whole balance team for that platform.

907
01:14:15,820 --> 01:14:20,700
And it's not just, you know, once you've built it, the engineer, the platform team runs it, but things are going to change.

908
01:14:20,700 --> 01:14:21,780
We're going to have new standards tomorrow.

909
01:14:21,880 --> 01:14:24,760
We're going to have new ways of changing, you know, Kubernetes is still maturing.

910
01:14:25,400 --> 01:14:31,400
So as these platforms change, they need to also have the same treatment to them as a supply chain and security.

911
01:14:31,640 --> 01:14:32,900
It's not a destination.

912
01:14:33,140 --> 01:14:33,780
It's a journey.

913
01:14:34,060 --> 01:14:34,380
Yes.

914
01:14:35,580 --> 01:14:36,640
Security is a journey.

915
01:14:37,320 --> 01:14:50,680
Well, on that note, if people wanted to join you on your journey through the exciting world of security, do you have, do you have any, uh, any web logs or, uh, or, or LinkedIn profiles, social media accounts that you would point them out?

916
01:14:50,680 --> 01:14:58,420
I'm going to start with LinkedIn, um, David's in, uh, in fact, I put DMZ on my thing here, but if you just search, you know, VMware DMZ, you'll probably find me.

917
01:14:59,140 --> 01:15:00,700
Um, I'm fairly easy to find.

918
01:15:00,760 --> 01:15:02,360
I've never, you know, again, be in security.

919
01:15:02,360 --> 01:15:04,040
People are like, Oh my God, we got paranoid and hide ourself.

920
01:15:04,040 --> 01:15:04,880
I'm fairly visible.

921
01:15:05,220 --> 01:15:07,040
I am on Twitter, but I don't post much.

922
01:15:07,120 --> 01:15:07,940
So I'm not gonna really share that one.

923
01:15:08,000 --> 01:15:11,860
If you find it good for you, uh, or just see me.

924
01:15:11,900 --> 01:15:14,940
I'm, I'm, I'm every year I go to, I've been going to DEF CON since DEF CON six.

925
01:15:15,020 --> 01:15:16,340
So I'm out there in the desert every year.

926
01:15:16,380 --> 01:15:16,920
I hate the desert.

927
01:15:16,920 --> 01:15:18,180
So let's make it fun and enjoyable.

928
01:15:18,180 --> 01:15:19,040
So come visit me there.

929
01:15:19,300 --> 01:15:26,160
Um, but also any, any of these security events, RSA or b-sides, or even our VMware Explorer, I, I tend to be out there talking to people.

930
01:15:26,160 --> 01:15:33,460
If you are out there, find me on LinkedIn, email me, uh, at VMware, um, and highly available, highly available.

931
01:15:33,580 --> 01:15:33,760
Yes.

932
01:15:34,020 --> 01:15:34,660
There you go.

933
01:15:34,740 --> 01:15:34,940
All right.

934
01:15:34,940 --> 01:15:35,220
Well, great.

935
01:15:35,260 --> 01:15:36,300
Well, thanks again for being on that.

936
01:15:36,400 --> 01:15:37,540
That was, that was really enjoyable.

937
01:15:37,760 --> 01:15:41,380
And as always, this has been a Tanzu talk.

938
01:15:41,460 --> 01:15:46,900
Perhaps you watch the video on our YouTube channel, or maybe, uh, you are subscribing to the podcast.

939
01:15:46,900 --> 01:15:53,140
And if you're not, if you've listened this far, you should by going to Tanzu talk.com and you can find the show notes for this episode.

940
01:15:53,200 --> 01:15:54,240
You have to hunt around for it.

941
01:15:54,240 --> 01:15:56,540
Cause I don't know how it generates the URLs for it.

942
01:15:56,840 --> 01:15:59,540
Uh, the thing that I use, but it's fine.

943
01:15:59,940 --> 01:16:01,460
Just search for Tanzu Talk.

944
01:16:01,600 --> 01:16:03,220
And with that, we'll see everyone next time.

945
01:16:03,380 --> 01:16:03,740
Bye-bye.