 Live from New York, it's theCUBE, covering AWS Summit New York 2018. Brought to you by Amazon Web Services and it's ecosystem partners. Hey, welcome back everyone. We're live here in New York City, theCUBE's exclusive coverage of AWS Amazon Web Services Summit 2018 in New York City. I'm John Furrier with my co-host Jeff Frick. We're here for all day, wall-to-wall coverage, telling the thought leaders, getting all the news out there. Next guest is Mark Ryland, director at AWS office of the CISO chief information security officer. Great to have you on theCUBE. Great to be here. Hey, thanks for coming on. You've been involved in AWS, you had a tech history going back, you know, early days of computing. Cloud is obviously taking over the data center and the enterprise, but it's had it started in startups, small growing businesses, cloud native. And now enterprises are looking for cloud native, looking for a do-over at an infrastructure level. You're in the middle of it. What are the, what's the top conversations you're hearing here at the show? What are you guys working on? Cause security is the number one problem. Scale, these are challenges. So I've been in this business quite a while. I joined AWS almost seven years ago, which, you know, like we talk, joke about like dog years, like that's like 49 years at AWS. And lots of changes since then, lots of progress. And in the early days, it was like, first of all, conversations like what's a bookseller in here doing, talking to me about IT, you know, in the early days. And I worked in public sector, so governments naturally had lots of concerns about, hey, what's this cloud thing? Is it secure? And frankly, people, the word cloud is so ambiguous that they would think about like consumer use cases like Gmail or Facebook, and they think that's cloud and this is cloud, and that doesn't sound very like safe and private. So, you know, we had to educate people on, hey, a fundamental property of our business is to give you isolation and control and visibility. If we don't give you that, then you really are never going to use this platform for anything but the most trivial applications. So from the start, we were very focused on communicating the message. And it's gotten out there now. People are really understanding that. I think not only is it out there, I think you guys at the public sector, the work you were involved in, and Amazon in general, Amazon Web Services, really took that whole security ambiguity thing off the table and put it to bed. The CIA deal a few years ago, check, a lot of good work in department of defense, so the government certainly is really stringent on security, enterprises now recognize that cloud security's not an issue like it was, they thought it was. It's changed over a certain time. In fact, to the contrary now, we hear from customers like FINRA, you've probably interviewed them. They say, look, we're more confident in our cloud-based workloads than we are in our data center workloads. Just because cloud has, it's all API-driven, software-defined, we have visibility into everything that's going on. We have the ability to automate more and more because so many things we've struggled with in the past where humans like typing on things and making mistakes and if you can automate those things and humans are always going to be back there somewhere like writing the scripts and writing the code. But now you do source reviews, you check it into a source repository, you get peer review of the code and you apply software design principles to security and that secure DevOps is really the future and it's what everyone's going to. I wanted to get into about the IoT edge. Before I get there, I want to ask you a question that I want to just get on the table on the record. Security, certainly we talked about kind of a level set but it's been called a do-over. You said before you came on camera, people get a mulligan. If a company can do security over in the cloud and do it right, and this has been a company we've had on theCUBE for many years, if you can do a do-over in security and Pat Gelsinger at VMware clearly said this years ago, it's a do-over. What is the best approach? What are you seeing as a do-over option? How are people thinking about it? How are they rolling it out? How are they managing security? The big, big change is to think about security as a essentially engineering process that involves automation. So if you, in the past, when you would configure systems and servers and switches and routers, it would be humans going in, logging in, typing things, maybe there's a runbook if things are well organized. But the problem is you're doing things in a very manual fashion. The fundamental approach we can take now is we can say, look, when I deploy this service, when I have, first of all, go back to my stand-up meetings of my DevOps team, my Agile meeting is like, there's a security guy there. There's a compliance gal there. There are people involved in the development process that are focused on security. My security tests run on that code. My penetration tests run in an automated fashion. Each step along the way before I deploy to live has security as an element. I'm not coming along later and trying to patch and shore up the perimeter of something that fundamentally wasn't built in a secure fashion. I'm building it in. And that's the big change, is to think about security as just a fundamental property of every single thing I deploy, I think about security right from the get-go. And that's the big change we're seeing in the industry right now. Now the other thing that you get now that you didn't have before is the advance in machine learning and artificial intelligence. So now you've got a whole another kind of level of automation and horsepower that you can apply to this problem that you didn't have before. And this cloud platform is emitting all kinds of incredibly useful and interesting metadata about CPU consumption, network consumption, flow logs about the interaction between systems and a network. And that goes into a data lake and now you've got this rich access to historical data, current data about what's going on in your environment and then you apply machine learning techniques. So look for anomalies, look for things that you haven't seen before, look for inefficiencies that you can improve. In fact, security is and just availability. Those are fundamentally similar properties, right? An unavailable system is equally a problem as one that's been hacked or something, right? So security was always part confidentiality, integrity and availability. Now those really emerging into this focus on, hey, keep these systems up, keep them safe and secure and the techniques and tools are there. It's a very powerful change. And I think the architectural philosophy of horizontally scalable systems allows you to have a surface area or observation space to look at the data and use AI. With that increased surface area which we're not talking about a perimeter now, we're talking about flat perimeter. I mean, non-perimeter surface area is the IoT, mobile edge or now telematics car. So as the mobility piece changes and grows and as devices become IP enabled, whether it's sensors or people or whatever, the surface area is massive. How do you secure it? How does IoT grow? How does that become a comfortable equation for a CIO or a security officer? I mean, because that's just a challenge. It is. And you have to say, on the one hand, with these dynamic environments that where deployments are common, you don't have the advanced persistent threat issue, right? You don't have code laying around for months that no one detects because you're constantly updating and improving. But on the other hand, as you say, cloud and mobile often go together because if you're going to be using internet or using public networks to get, connect from these remote devices to the cloud. And so now the perimeter is no longer the key security feature of your environment. Perimeter lists is what's happening with these mobile and IoT type applications. So now we have to focus on every communications got to be secure. We have to have device management as a security feature. We have to be able to update and patch dynamically all the things that are out in the field. We have to do key management in a reasonable way, make sure that we have the public key certificates for a secure TLS communication that those can be updated. Those are all built into our IoT platform. So IoT, in fact, when we launched IoT, we took a, at the time, controversial decision, which is we did not permit insecure connections, not any connection required TLS, you know, the secure transport layer. And so that was actually excluded a lot of small devices from ability to connect to our back end. However, we subsequently, now with free RTOS, we've added the TLS capabilities to these very tiny microcontroller type devices so they can make encrypted connections to a secure back end and we can manage those remotely as well. Mark, what are some of the tools and you guys and services you have at Amazon that would make the IoT architect get inspired? What are some of the key technologies that you guys have? Well, you know, we start with a very core concept which we call device shadows. So for each device in your environment, there's an object in the cloud that represents that device. It supports the properties and synchronizes with the device when it's online. But even when the device is offline, you can still write application code that updates the device. And next time the device connects, it will take those changed properties and merge them in with the running configuration. So you can literally write code that doesn't care about connected or disconnected state because you're programming the shadows rather than the actual devices. So that gets people excited. And then all the incoming devices, there's an analytics service that's built in, streaming analytics, ability to see what's going on with all those devices as they make changes, ability to just subscribe to different topics and have updates propagate across millions of devices in a very scalable efficient way. To deal with the spike scaling spikes, like you might have a million devices that aren't very busy one day and are super busy another day. And in a traditional environment, it's really hard to handle those peak loads. And with the IoT service, you can scale up. And then of course, as I said, security is a key property built into the service. So one of the big news items this week is Snowball. Yeah. Give us some color commentary around what's going on Snowball and what's the big story there? Snowball is a super cool platform and customers love the ability. First of all, we have these, you know, 80 or 100 terabyte devices, the loggable devices that we ship around. And I'll talk about some amazing security. We've had them on the key before. We had it in Snowball. The original Snowball. We also have Snowmobile, which is the truck that can go around. Digital Globe was our first customer to use that. And that was, that's a super cool. And as time has gone by, we've added more and more capabilities. We added, you know, first it was S3 endpoints and then it was the file server. So an NFS type of endpoint to make it easy to get data in and out of these devices. Then we added Lambda and Greengrass, which makes it programmable. So I can write Lambda code in the cloud that gets automatically deployed to the device. And then when I'm working at a disconnected or remote location, whether it's an oil field or a hospital somewhere, my code can run and respond to events on that device. Today we're actually announcing another really cool capability, which I think comes later this morning in the keynote. So tease that, but look for a really cool addition to Snowball. So that's been a big success with customers. We have these amazing use cases like University of Oregon. They take these devices, they used to have literally hundreds of hard disks they had to manage, put on a boat, go out and do a geographic exploration with the oceanography group. And they come back and there's like, literally a great video online that shows them lugging boxes of disks around and the people in the data center scratching their heads and having a bad day. And now they've got these devices, they're like, wow, we're like 10 times more efficient and we can process more data, we can do better science. And so you see these, you know, every time a boat comes in, they put a snowball on, they take one off and off they go and they do remote storage and processing. How deep is the edge go in your mind? What does the edge of the network mean to you? Gosh, I mean, the whole idea of the edge is sort of gradually disappearing. I mean, we still have perimeters, we still have firewalls. I mean, we all do that to some extent. We'll never, it won't go away completely rapidly. I mean, a Tesla's an edge. Yeah, that's for sure. I mean, a person with their phone. Edge computing, absolutely. So, kind of crazy. The devices, the smart watches that are, you know, connected to the internet. LTE on your watch, I guess. That's not uncommon now, so. And the microcontrollers, that's one of the big announcements we made at re-event last year was building, taking the free RTAS operating system and essentially bringing that into the Amazon family, providing the libraries you need to connect to our cloud back in and making that free and open source. And so now even the $3, the $1.50 microcontroller can actually talk to the cloud using a free operating system. So that's been a huge step up in terms of the breadth of the platform. So, Mark, I got to ask you a question, a personal question. I mean, if you step out and zoom out, take your AWS hat off, put your industry expert hat on. Knowing what you know now at AWS, the work you've been through at public sector now as an office of the CISO, and you go back into your best buddy, calls you and says, hey, come in, let's transform this large bank, this large insurance company, this oil and gas company. Knowing what you know at Amazon, you were deployed in to do a digital transformation. What would you do? What would be the first things you'd do? How would you lay it out? How would you attack the problem set of getting a real company that's operating at scale to transform to the cloud? What would you do? Well, the good news is we've thought about this a lot and we actually have something called the cloud transformation framework, which has steps and concepts and a workshop that enables one for the CISO. Of course you use the Amazon version. Yeah, of course. I mean, but they're generic concepts, right? Prior to getting to technology, you have to do things like application inventory, you have to do things like which of these applications is easily migratable, which of them, if I have a main frame-based application, that's not going to be my first thing workload I move, right? Because there's a lot of work you have to do. Although you can create API front-ends for those applications and people do that all the time. So yeah, application inventory, look at where is the, in my business strategy, digital transformation, where do I need to be the most agile, the most ability to move more quickly? I'm going to take that set of applications and make those my cloud priority, because if I have some, whether it's an accounting application that I don't consider part of necessary to really advance my digital strategy, then I won't move that so quickly. So. How would you talk to a customer or even investor, a lot of venture capitalists in Silicon Valley that are now getting back in the club, maybe they took a little heyatus, and you know, go back five, six years. The tech stack was pretty simple. Yeah. It's changed a lot with cloud. How would you describe the changes in the tech stack with cloud versus say a normal on-premise kind of data center architecture? I think the biggest change I'm seeing, and I'm surprised at the adoption rate is Lambda is serverless. We have a lot of enterprise customers that we thought would not be the first to adopt Lambda, but since they're doing significant application rework, they say like, why should I, you know, go to containers, for example? I can construct an application that just functions. I've got all these storage services. I've got functions that scale automatically. Lambda uptake has been tremendous. And so that I think is probably the biggest change, biggest surprise. Why does it surprise you that the uptake has been so good? Because it seems like we've been driving towards this kind of atomic compute world where the units of compute and stored networks can just continue to get smaller and smaller and smaller. And yet you said it's a surprise. I guess, you know, maybe it's me. It's my mental limitations, but I guess I thought people would say, well, that's a bridge too far. I'm going to first just, you know, make sure everything works in the cloud with my virtual machine model. Maybe I'll go to containers, which is not a big lift from VMs. But to go to Lambda is a substantial code rewrite or, you know, code refactoring. But I'm happy to see people say, you know what, the advantages are so clear. And I mean, we see applications that would take literally like $1,000 a month to run with a couple VMs and now they'll be like $50 a month with Lambda. And they'll have better peak scaling, but in the middle of the night, there won't be any functions running and you're paying $0. But you can't shut the VM down and you can't rely on autoscaling because autoscaling takes like three minutes to start the VM and what if someone comes up and wants to do that in the middle of the night? So Lambda is truly revolutionary in terms of cost performance and other things. It changes the autoscaling equation big time. Completely, yeah. I mean, the scaling happens in seconds and you can scale to thousands of functions per second and from zero in like almost no time at all. Yeah, it's interesting the VM, the virtual machine wave that hit really did a lot of great stuff. And now you're seeing Kubernetes, microservices, really that whole nother Lambda functions go in the whole nother level. Which goes to the security point we were making earlier because each of those microservices now can be a hardened endpoint talking to another hardened endpoint. And there's no lateral mobility. If I get owned on one of these little microservices, what can they do? It can call their microservices, you know? It's not like you get inside and now you're in. It's kind of the old model with applications. It kind of takes security and kind of spreads it out versus one kind of place where hackers can go. Exactly. I mean, the cloud's distributed nature actually makes it harder for hackers. Right. This technical cost. And something like Lambda, you know, there's a discovery phase when you're hacking. You get in and you look around. Okay, well, and you're in a Lambda function, you got about 30 seconds to figure out what's going on and then you're dead. You're going to get killed, so good luck. It changes a honeypot strategy big time. It's just interesting to me that so few people talk about turning off, which you just talked about the great advantage in a service environment versus a server. You actually could turn off. I said to keynote, the guy said, yeah, on the weekends, we actually turned this particular service off. Yeah. And the vendor was like, and we're happy because they're not using it and they shouldn't be paying for it. I don't think enough people talk about that. So we have one minute. I'm watching the live feed now. Looks like there's a snowball announcement. Something about an edge. Okay, you're up. Okay. Data Lake in S3. We have a Data Lake in S3 and I still don't know. Dr. Werner Vocals and Dr. Matt Wood. They had Werner on stage. Edge workloads, something about Edge workloads they're announcing it now. Switch.tv slash aws if you want to go check it out. But come back to theCUBE if you're watching now. Very exciting. Good stuff going on. Collect and pre-process remote site data, develop and test EC2 based apps in the cloud and run disconnected locations. Is that what you were getting at? The announcement is EC2 on Snowball. So you can run, you can take an AMI out of EC2, import it into your Snowball. It'll get deployed to the edge. And now you've got a full virtual machine model in addition to Lambda because there's still some code that is written for virtual machines. And so we made it really easy now to make your VMs run in the Snowball disconnected environment and update the local storage and when the device ships back. So this development and testing gets done once? In the cloud. In the cloud. It's essentially offline cloud. Exactly. It's offline cloud with EC2 now. So we had for Lambda before, now we're adding EC2, which will bring a lot of traditional codes whether it's maybe some COBOL application or an HPC app that is never going to be Lambda eyes, but you've got an investment in the existing code. Now that can run it at the edge in a disconnected way. So very exciting. Great chat on Twitch. You can export from relational to flat format and S3 using DMS, the migration service. Great stuff. It's very exciting. So our final question. And I didn't get to talk about the security, but these devices are amazing. Tell us. Okay, so first of all, you can't make a physical device literally tamper proof, but you make them tamper resistant and you make them exhibit signs of tampering. Remember, these devices are out of our physical control and out of our customers physical control for extended periods of time. They're in transit by shipping companies. So tamper evidence is really important. You want to know if someone tried to open that thing up. Secondly, that's by far not the most important thing. Everything on the device is fully encrypted. It's encrypted with multiple layers. It's encrypted with a combination of KMS cloud keys and the TPM in the device, it's private keys so that you need both keys to be present for the device to not be a brick. So, and we don't even deploy into our API the code that the manifest file you need until the shipper tells us they've delivered the device to you. So imagine I'm a hacker and I take a device in transit and I even hack your credentials and I can somehow get into your environment. There's no data there to unencrypt the device because it hasn't shown in the shipper system to be a delivered device. So, you know, it goes on and on like that, so. So the authentication only happens. They can't do anything. They can't do anything. Things turned on. UPS or FedEx informs our API that this device has been delivered to its end destination. That's when you finally, the cryptographic information needed to unlock the device that becomes available in the API to our customers. And then from there I could go on and on about the layers and layers of encryption there to use. Basically, if you unplug that device, you brick the device. Someone can open it up and they can get access to all the physical stuff. There's nothing there of interest to them because there's like triple layers of AES 256 encryption. And there's no way to spoof the origination piece. Yeah, I mean we can go into every threat vector you can, we thought of it through pretty carefully. And actually we're working on a security blog post to talk about all the cool layers of careful thought that have gone into making the snowball, which is a, your data's in transit and we don't control it and you don't control it. And so we've got to make sure that that's a very secure environment and we've done the work to do that. Well, let's make some time to follow up with more security conversations with you. Sounds good. Sounds good. Final question before I got to get this out there. Okay. What is the most exciting thing that you're working on right now? Or technology that gets you excited? Oh gosh, where do I start? It's like a kid in a candy store working at AWS if you like technology, right? So great new security features coming. I'm a networking geek. I love what we do in networking and virtual networking. We've got some amazing capabilities we're working on in that space. And better management, better governance. I mean enterprise customers want more of these high level features that are not just the powerful little Lego bricks, but also the more, what we call kits like, hey, pre-build something for me. And so we're using things like AWS organizations and some of our higher level services. We make it easier for you to manage these environments. I mean, just the improvements in our billing platform doesn't sound very exciting, but billing reports, billing insight into billing, you know, cost management, budgets. You can set budgets and see how you're doing against but all those features are important to enterprise customers. And, you know, we've got a long way to go. There's a million more things we're going to do. You got a lot of operators and developers now you got to cater to ease of use is critical. Absolutely, yeah. Mark, thanks for coming on theCUBE. Mark Ryland is the office of the CISO. He's a director at AWS. I'm John Furrier with Jeff Frick, it's theCUBE. Stay with us for more live coverage here in New York City. We'll be right back.