 Live from Boston, Massachusetts, it's theCUBE. Covering AWS Reinforce 2019. Brought to you by Amazon Web Services and its ecosystem partners. Hello everyone, welcome to theCUBE here in Boston. We're live at Amazon Web Services AWS's first inaugural security conference. It's called the Reinforce. They have Reinvent, which is the annual Amazon Web Services AWS customer event. This is kind of like an Amazon Web Services Summit meets with Reinvent, they're calling it Reinforce. This is an event that looks like it's going to be a lot like Reinvent for the security sector. I'm John Furrier, host with my co-host Dave Vellante. Dave, Reinforce, an inaugural show for Amazon Web Services AWS. But it's got a feel for Summit, a little education, but big keynotes. This is about security. This is a stake in the ground for AWS to have a dedicated conference and customer event around security. Reinforce is the name. Kind of like Reinvent, kind of get the vibe there. They're trying to go kind of independent, kind of new swim lane for a conference. Certainly there's demand. Yeah, well, two years ago when you and I were at the DC public sector, you just came off of that show recently. The head of IT at the CIA said, security in the cloud on our worst day is better than our client service systems on their best day. So this narrative of the sky is falling that you always hear from security vendors is not what Amazon is projecting. Amazon is projecting that the state of the cloud union is strong, kind of like the president every time he gives a state of the union address. So it comes down to me, John, is how do you secure massively distributed systems in the cloud? Huge challenge for people. We heard from customers today, Liberty Mutual and Capital One, their number one challenge is how to keep pace with AWS, how to keep pace with the changes. So what you're seeing is this shared security model. Amazon takes care of the infrastructure, the compute, the database, the storage, and the customer still has to worry about endpoints, their own network, the operating system, the applications. So they always talk about undifferentiated heavy lifting. You're seeing a shift toward that customer side of focus and on response. So putting more resources on response versus securing that core infrastructure. And security is changing. This is also a show about CISOs, the Chief Information Security Officer, also known as a CISO. The CISO and CIO kind of similar roles. They have to look out over massive change in the enterprise these days, digital transformation, on-premises versus cloud. Two different modes of operation. People love the on-premise in the old days, but now moving to the cloud creates a different challenge and opportunity for security. I have some thoughts, I'd love to get your thoughts on what you see as cloud security, because there's a difference. Lift and shift is easy when you talk about infrastructure. When you start getting into coding and having something be security native, there's a difference between cloud security and on-premises security. How are you seeing that play out? Well, I think the whole notion of infrastructure is code emanated because of the cloud. So I see it playing out as, you got to have security as code. So it's sort of the intersection of dev ops and sec ops. And then to your other point is, what's the right regime? Who's responsible for it? Is this a CIO? Is this a CISO? Should the CISO report to the CIO? All that other stuff. Personally, I've always felt like it should be a separate reporting structure, because otherwise, you've got the sort of cat guarding, the fox guarding the hen house. So I think that's key point number one. The other point is, bad security practices by end users will trump good security by IT. So it is really, it's a cliche, but it is truly a team sport. I think the big challenge, again, that people have is how do they keep pace with AWS? They're moving so fast. And it's not only just for customers, John, I think it's for the ecosystem as well. I can see Amazon eating away at the value created by a lot of their partners. I mean, Amazon clearly is showing their cards here. They're continuing to push the agility, raising the bar kind of philosophy. And really what's happening with AWS is that they're just, it's a continuation of their subscription model. Got Dave McCann, he's going to be coming on the QB, runs the marketplace. You're seeing now hundreds and hundreds of subscriptions in the marketplace, thousands of subscriptions coming out, huge buying philosophy there. But this notion of foundational security built in from day one is a philosophy Amazon has believed in that. And they can secure their environment and they want customers that to you pointed out as saying, look it, we'll cover our AWS, we'll be highly secure. You focus on what you do better. You can use security hub, control tower, which was announced as general availability. And they're saying to their ecosystem, look it, build on top of AWS. Because we have the best security, we are a bit more secure, but we won't try to compete with you if you use our stuff. So this has been a very interesting dynamic and the security industry is responding well to it because they want to rely on Amazon. Why recreate the wheel, use the Amazon, but they have to be free to compete on their own. That's what Amazon is saying in the private conversation I've had is that they're saying, we're not going to compete with you if you build on AWS. And you move fast. And you move fast. And you make more money. But this is why I think everybody's going after multi-cloud, because if you hear that story, like wow, I don't think I can move as fast as AWS, I can't just build on AWS. I have to have a hedge strategy. So that therein lies the multi-cloud. But John, you I think nailed it several years ago. I mean, it's cloud, right? It's data, security fits in there and it weaves in availability. Certainly privacy, you don't hear Amazon talking tons about privacy, but that's another side of the coin. These things are all intertwined. And it comes back to the data. We're going to see, for the folks watching, we're going to be seeing a lot of security on theCUBE. Security is a natural fit for what we've been covering, starting out the infrastructure with cloud, big data, AI, security, IoT are all kind of in the center there because security is looking a lot more like cloud than cloud looking like security. So security has to become more agile, shared responsibility, things like automation, reasoning. These are terms that are coming up. AI and cloud are a perfect mixture to come in and actually reshape the security landscape. Because the fact of the matter is there are way too many vendors and suppliers and service providers for customers that want to get down the lower number of suppliers and more functionality. So you're seeing the conversations from the CISOs that I've had here in the hallways and meetings I've had privately, they all tell me, Dave, that we want to reduce our suppliers down to big number down into single digits or double digits, not three digits. Hundreds to a handful. The second thing that they're telling me is multi-cloud is BS to them. That shocked me to hear top regime leaders saying multi-cloud is not something we're interested in. Because this flies in the face of what we've been reporting and we've been hearing around multi-cloud. And I asked, why is that an issue? Won't there be multiple clouds? And this person said, yeah, we use multiple clouds but I can't split my talent up, multi-talent. So it's a talent game in security and the risk for the organization is to have multiple clouds, multiple stacks, too many code bases. They're forking their talent base and that is not consistent with the security direction that they're taking from a coding native standpoint. They want to have security built in and everything so the devs can be agile and start and build stuff on top of the security. So multi-cloud great messaging and concept. You might have a few clouds, but the fact of the matter is when they start splitting the talent out like that, you dilute the overall power. But you actually did report on this. I mean, you tie back to your Jedi coverage. I mean, the DoD basically said that multi-cloud is more complex, more costly, and less secure. Now for that team that's doing Jedi, they want a single environment. The other thing I heard today, which I think is interesting, huge challenge is IoT. 75 billion connected endpoints by 2025. Okay, we always hear those big numbers but something I didn't know. 90% of IoT data is plain text in the form of HTTP plain text. So it's not encrypted. So Amazon is going hard after that. And so they're going to bring tooling to that problem. I like Amazon strategy and the edge of it says, oh, you can't bring the cloud edge but it's about building applications securely at the edge. And that's what Amazon wants to enable. I like that strategy better than what you see from companies like Dell and HP is like, hey, here's a box. We're going to chop down, throw it over and secure the edge. I don't think that top-down approach is going to be as effective as a bottom-up application developer approach to your point, building security in. Yeah, I mean, we're back to the classic digital transformation and people process technology equation where you have the organizational structure is a big conversation here as well. You mentioned which regime runs it because if you want to do DevOps, you got to develop and then put it in production. So you have two kind of splits there. You want to have more agility, you need more DevOps and you want to have that native stack built in, firm security stack. But then when you ship it to production, you got governance. So most organizations here that are the big players and in security have kind of pillars, right? Governance and risk management, operations, intelligence, data, and then full-blown engineering teams and then information security groups that are just peaked on those. And the numbers are becoming much more significant. Security is IT now. It's not some sanctioned off group. It's becoming the way. And a lot of the cutting edge technologies are coming out of the security market. So to me, I think the security industry and the idea of having a conference dedicated to security is a good one because the canary in the coal mine in this industry is coming out of security. And this is where the action is. So I see a lot of innovation. I think there's going to be a tsunami of apps that are going to be bought like services. So I think, you know, this notion of shared services with Amazon and the marketplace could be a great consumption model for enterprises. So you're going to see that dynamic. Enablement for channel and ecosystem, marketplace for customers to buy software and services. And it's really, again, a strong bottoms-up message from Amazon. It's kind of seesaw on down. It's not the corner suite that Amazon is messaging to. Although there's some messaging in there, they're basically positioning themselves as, by far, the fastest innovator, most features, most compliance, GRC, all that stuff. But really, it's hardcore deep dives on security. They're talking to security pros. It's like when you go to reinvent strong developer crowd, hardcore security, sec ops, really detailed, serious technical people, that's their bottoms-up approach. Well, Dave, let me give you my thoughts on the keynote and I want to get yours. And I want to give you a list of things that I was reporting on last night and getting all the data on kind of the key topics that are going to be covered here in this show and beyond. So first, the keynote. Love the Encrypt Anywhere message. As soon as everyone's watching, security is everyone's job. Very big theme around that notion of encryption and that you've got to take care of it. The shared responsibility model, I love that kind of message. And then automated remediation. This came up in my seesaw conversations I've had this week where remediation can be automated so they can focus the talent on threat detection and notification alerting. So threat detections moving to notifications and alerts and they want to use automation like Lambda to automate known tech problems that can just take away and not have their people work on it. So that's a huge, huge topic on the keynote. I love that. And using Lambda is a great one. Building security measures into APIs. And then mapping the cloud. I love that concept, nerdy on that. So overall, you know, typical Amazon keynote, meat and potatoes being served up in terms of the course of content. And that was an awesome, awesome piece of it. So that's my take. What's your favorite keynote? My number one takeaway is again, the customer saying our number one biggest challenge is keeping up with the pace of change and the pace of innovation. And to your point, the answer to that challenge is automation. Amazon is forcing its customers to automate so they can move faster. And Amazon knows that's its key competitive weapon. It can roll out features faster than anybody else, create that flywheel effect. If it can get its customers, you know, most vendors move at the speed of the fat middle of IT, which is really slow. Amazon interestingly is pushing its customers faster than they're used to going. So, Dave, I had a chance to have a sit-down and pull a bunch of CISOs and CIOs. So sometimes they have a CISO, sometimes it's a CIO. The role seems to be blending in as kind of one big kind of overseer of the action. And here's what I found in terms of the key themes that were on their mind. And again, this is part of our ongoing CISO interviews that we've been doing and paneling the top CISOs of the top companies. Key topics that's on their mind. Vendor lock-in, spend. They're spending a lot of cash. Being security native and kind of having that cultural philosophy of security built in so developers don't have to do it. That's very DevOps-y. Your point about security as code, big topic. That was a big one. And then kind of in the management side, service providers slash suppliers. Dealing with the legacy of the inherited supplier base of calling on them and people who want to sell them things. The value creation process wants to be tied into suppliers. That's kind of a procurement thing. Metrics. Which KPI should they be paying attention to? What's really going on? As I mentioned, threat detection versus alerts. Threat detection is kind of seems to be moving more towards alerts. So threat detection can be managed. These are kind of things they want to measure. If you just measure one thing, then you might be have a blind spot. So metrics is like, I think what keeps them up at night in terms of the topic. The cloud security model is different on premise and cloud. Integration. Integration from third parties because that's going to be a reality. Ecosystems like Amazon has a ton of suppliers that they could be buying services from. So it better integrate into a security stack. Identity management, obviously big. Automation, workforce and talent. The multi-cloud comment came out of this. Talent is the number one game. This is a really critical piece. They coming up with strategies to recruit and to retain and have the best people working on the tech stacks not working on just general architecture. And then finally, coding security. These are the top topics on the minds of the top CISOs and CIOs in the enterprise. And this is the key areas we're going to be covering. So that says to me, the concern about lock-in, the concern about spend, so they probably will have exit strategies and hedge. So probably will be multi-cloud, which is interesting. Multi-cloud, one said multi-clouds BS, but at the same time, their top of mind issues suggest that multi-cloud is going to be a key. On metrics, there's a metric out there that after you get infiltrated, it takes 256 days to identify that. I'd like to see in the cloud what that metric looks like. It does that go down. So that's something that's really interesting. As opposed to, okay, how many threats did we count, right? Or toward, you know, like you mentioned, ID management, identity management, automation. And I agree, talent is, there's a big war. Capital One said they just opened a big technical presence in Boston. A lot of talent here, a lot of talent around the world. Well, just for the record, I am not anti-multi-cloud. I was just pointing out the comments that CISO said. I think multi-cloud is going to be as realistic. But what he was pointing out is that right now multi-cloud isn't attainable in the way that they want it. They have to spend too much of their talent on code bases and stacks that aren't compatible. And integration. I personally think that you'll have multi-cloud environments for all companies, but they're going to pick one. Like for example, on the workload should define the cloud you're working on. So why would you want to just split a cloud between a workload, a workload between two clouds? Makes no sense unless it's completely automated and frictionless and is valid. But multi-cloud is a symptom of multi-vendor. You've got different teams doing different projects, different parts of the organization. And that's what it is. It's less a strategy than it is a symptom, at least at this point in time. Okay, that's the kickoff of the inaugural AWS show here in Boston. This is the live CUBE coverage here for two days. I'm General Dave Vellante. Stay with us for two days of coverage. We'll be right back.