Mitch Ashley & Lee Atchison – Securing the Cloud for Modern Apps

you Hi welcome. Thanks for stopping by we've got a really I think interesting session here. This is Lee Atchison.

My name is Mitch Ashley eilee. I met all you doing today. Very good.

Welcome to Cloud container sex summit we're gonna be talking about is the cloud secure. I remember or was this secure enough to what we want to do right? Remember when this was a a big big question, of course, everybody said no, especially if they were in security, right?

Well, we'll get to that and just a minute so myself. I am CTO with tech strong group also principal with tech strong research analyst firm and my background is both as a product Creator and the security and internet services space and running it organizations as a practitioner that kind of thing. So hopefully I come by some of this honestly with that just in technology author, you know expert on on scaling systems and a lot of other things tell us a little bit about yourself sure.

So I'm Owner of autism technology. I'm a consultant. I'm a thought leader.

I I am an author I've written several books and I've got a couple more books coming out this year or actually early next year now and I talk a lot about cloud cloud security Cloud scalability High availability a lot of those sorts of cloud modernization another big area a lot of those topics. Excellent. Well, I didn't mean to drag us too far back into the 2012 or 10 or whenever it was over, you know, nobody thought the cloud secure.

I remember with that that was a real issue. But I mean it really was yes taking your you know, your career your reputation or maybe you didn't care you went to the cloud. Anyway, he got around went around the security people.

Eventually they came on board. I don't mean it that way that seriously but it kind of seems like that's where we were but very definitely I mean the, you know, the the number of customers I talked to where they said, you know, my data is just too sensitive for the cloud. I could never put it in the cloud.

It's it's amazing. You don't hear that nearly as much anymore but it really was a a common practice. Very much.

So well, let's so let's kind of jump forward to where we are today because I think that's what our topics really about is. So where are we on the cloud being secure and doing things like Cloud native applications and you know, the world's definitely changed. It's definitely changed.

Yeah, and I think so rated. Yeah. Yeah definitely changed definitely accelerated and and you know, we'll talk a little bit about the pandemic.

I'm sure in a little bit but that has helped a lot with this is time has gone on but I think it's it's Times Gone on what's happened is a lot of people have started to realize that The cloud isn't insecure like they thought it was yeah people were afraid of the word public in public Cloud. Why would I put my data out on the internet? I'll keep in my own data center.

It's more secure if I keep it close to me, but the reality was you still have to secure your own data centers and the public Cloud was just a different type of data center that had to be secure differently. Now, who do you think is better at securing the data center you and your your your couple of people who have some security background that are working in your company and I don't want to disparage anyone in the security organization a lot of great people doing this, but you know small group for small company is a limited amount of expertise you have in order to keep the data center secure. Or do you want to trust the you know thousands of man years of experience in building?

Secure data centers in the cloud that companies like Amazon have companies like Google have or companies are Microsoft have in fact, the matter is they are Security Experts. They couldn't survive the way they've lived so far without being Security Experts. So they've had to build that expertise and they build that not only to secure their own systems, but to build tools to secure your applications.

So your applications can be secured a lot easier on a cloud and it came in your own data center because of these tools that are available. So in reality the public cloud in many respects can be considered much more secure than your own data center. I think that's particularly true for mid-sized businesses.

I always have my biggest compassion goes out to the mid-sized business who has nearly all the requirements of a large Enterprise but none the staff or resources in any of it more or less valid point really, it's just also don't world. That's true and absolutely is but also don't underestimate the the value of the small business startup to be able to build a secure system from the start versus hope they're nothing happens in time big enough to afford security. But you benefit so let's I totally agree and especially it's a great way to get started, right, you know, right build up everything because you kind of have to have everything secure.

You can't sort of well, this is open and this is really well tied down. Yeah. It's right doesn't that all be secure.

So if you drew a line in the sand and made it made the Assumption of okay, I'll buy the argument that the Amazons the Google's the azures and and other the alternative Cloud providers. There's a lot of good. Cloud service providers today, right?

Absolutely, and I could you know name. A bunch of them much better been around a while and doing this and and I would buy into the argument of they have to be good at security or else, you know, it doesn't take too many breaches and all sudden people live flocking from their service over to somebody else's right? Yes, there are instances.

Everybody has them today. And they're probably there probably at least as good if not better than you are in most cases now. Maybe you can make an argument in certain geographies or certain industries of where even if it is equal.

Maybe it isn't but even if it is equal, they'll still not want to go to put everything in the cloud. I mean, how would you view that that equation? Yeah.

Yeah, that's actually good point and interesting to bring up geography because one of the things I found was there was a huge. variation based on geography based on the acceptance of cloud security, you know, if you look at me early days of the cloud and who really took to the clouds sooner than than other areas, you know, the asia-pacific and the United States were really very early adopters of the cloud while Western Europe was very late adopting to the cloud and one of the reasons why that was the case is they didn't trust the cloud, you know, there was you know, if you if you think about the the things that people had concerns with with security in the cloud one of them was government oversight restrictions regulations, and I think the European focus on the oversight and regulations really hampered a lot of the early Cloud migration efforts as well as certain industries, you know health care, which I think we're gonna talk a little bit more about in a bit but also banking as well and I think one of the last holdouts on the cloud is the Swiss private bank companies, you know the back in 2020 right before the pandemic hit my last business trip was to Switzerland to It talk to a couple of private Banks there. That's when I was working in New Relic and still even then I was just you know, two years ago, you know, they were saying I don't see us ever moving to the public Cloud because our customers just don't trust us if we move our data out of our own data centers into the public Cloud.

So there's still going to be holdouts like that. But I think what you're gonna find is, you know, they're gonna be very Niche holdouts and they're gonna be based on geography which really means culture I think more than anything and they're gonna be based on industry. You know another aspect to that too is geopolitical and you kind of hinted at that right?

I don't want my data in such and so country, you know, right this geographic location under these regulatory Frameworks legal Frameworks what they can do can they take and they do whatever they want with it who have control over it. So that's that's also an aspect of where it is. Right?

We think of the clouds everywhere. Well, actually where in the cloud can make about a difference can make it you show stopper, right? Exactly.

Yes. Yes, and you know wasn't that long ago when you know, you know, everything starting in the US was okay, that's not true anymore. You know, there's a lot of of companies and a lot of countries that just don't trust the us as far as our laws for what how we can access data and what it means to be private and all those sorts of things and you know our borders so it's it's really as well as taxi.

Yeah, there's there's tax rate issues there as well too. So it It really does matter where your data is. What country you're in what country your data is and what country your cloud provider is in matters and in a Matters from a security standpoint.

It matters from a business standpoint. So much more nuanced than just is it secure enough exactly. Yes.

Well talk some more about you mentioned the pandemic accelerated. What accelerated and why did accelerate how when where did where does that take us to where we are now sure, so I think Certainly, I think a lot of Industries had an effect with the the pandemic and accelerated their use of the cloud but probably by far the most prevalent example as the healthcare industry, you know, the healthcare industry really wanted for many many years to move to things like centralized data essentialized patient data centralized coordination of care for patients Etc and really struggled from a from how to do it and getting companies to work together and providers and and Central to all of that was how do we share data in and area that's inherently private, right? How do you make that happen?

And I think the pandemic essentially forced that issue and a lot of respects and yes, there was a lot of motion that occurred leading up to the pandemic but you know, you think about it from you know, and Industry that was all in person. To an industry that wanted more than anything to get people to not be in the the office anymore. How do we get people not to come to the office when they're sick anymore.

How do you change it and by the office and talked about the doctor's office or the hospitals Etc? How do we change our mindset where people don't have to come in all the time. And it really truly required a a software effort to make that happen with the cloud being a central part of that, you know, the you know video visits were taking off right before the pandemic but they truly became normal during the pandemic feeling out forms and paperwork and test results, you know, things like my chart started before the pandemic, but they really took off during the panda and so, you know, it's not that the pandemic created the Oh, yeah, we have to use the cloud.

We'll move to the cloud. Everything's wonderful. Cloud it the pandemic then create that but what it did is it accelerated the mindset shift that had already started that said the cloud is safe.

We need to use the cloud. We can't survive without using the cloud in the future and that pandemic was proof that that was true and accelerated that recall those requirements. It really changed the delivery mechanism for a lot of services whether it's curbside pickup get your covid test at the drive-thru at the drugstore do tell them we've been talking about telling the medicine forever forever.

Yeah enough can the right conditions change, you know, the economics of a chain now, I like I could do a blood test without ever going to the doctor I would do it. I don't want to do well we're probably close actually, but that's true. That would be nice.

um, so so we mentioned we talked about how privacy is big part of this regulatory Frameworks legal Frameworks and influencing the geographic location. Of that we've also changed in sort of a from a lift and shift. We still do lift and shift of applications in the cloud.

You know, that hasn't gone away. That's an easy first step to to starting to build clap applications in the cloud and either take always. Sorry.

I'm still over this also taking all the way to doing Cloud native meaning we're doing microservices and services and everything's in a container we're using kubernetes or you know, an orchestration tool we're designing the applications deliver differently both because of the cloud is there the way it's resourced but also, Devops and those architectures let us increase velocity and deliver software much in much smaller increments in a much greater speeds. That's when things we want to be able to do for the business. But that whole framework has changed the nature of applications.

I mean I refer to it as a more porous application architecture when everything's through an API, like an API first kind of design for an app or just you know, microservices. Now, you've got apis to protect much greater numbers of them than just sort of Ingress and egress apis and I can build moats around everything else. Right?

Right. I think the cloud does help there too. You know what, you know, one of the fundamental principles of security in general is you know, the principle of least privilege right?

It's the idea that you don't want to give access to someone or something unless they absolutely need access to it. You know this it applies a lot of different areas, but I like to apply to apis I want to do a company not that long ago and who's doing some upgrades to their architecture and they're moving your service architecture and one of the the questions I had is how do we validate that the person calling our service is supposed to call our service and so we started talking about things like like a very tightly controlled firewalls to keep Network traffic from only flowing from services that are authorized to use service to to you know to send traffic through and then that brings up questions about debugging and Diagnostics and all that sort of thing, but The key and I think the thing that they saw all of that as being complex things to do, in fact the matter is and you know, it is hard to do all that stuff and do it, right. But the cloud makes it easier because you know just like building infrastructure on premise is hard and building infrastructure in the cloud.

You know, we have things like infrastructure as code which allows you to build infrastructure just in the code description and create it from there. You can do the same thing with security. Securing your own data center can be hard but creating a secure highly controlled secure environment in your in the cloud is a lot easier and then when you need to adjust settings like you needed you're adding a new service and needs access to another service or whatever.

It becomes an adjustment to code that's code. That's peer reviewed and checked into revision control and deployed and backed off when there's problems Etc. And so you can create some very Advanced security policies.

Manage them as code and keep your system highly secure that way much more so than you could ever doing Do by using, you know, a hardware solution or combining the software solution in your own data centers Etc. It's a much easier thing to consider and so since these things become a lot more possible in the cloud, they become more accessible to more people and therefore I think we end up with more secure applications. Nothing more so than the cloud native application.

Is that important where you have so many Individual Services talking to each other and keeping that whole environment safe and secure really is a complex. Scenario of security requirements you really want to do with with network level security Etc. And it's so hard to do that if you're not in the cloud environment.

And think about it is the Primitive still apply right on I still need authorization authentication all the elements that we have of security. It's just kind of how we do that and I think I think one a couple thoughts on this one is the accessibility of Solutions in the cloud in some ways as much easier right? I may have my favorite vendors that I've worked with, you know.

whoever might be you can like you can name your flavor of vendor for security or networking or software but in an Amazon or as you're whatever environment, you know, the ocean whatever might be There are Services right there on the wall ready to just like I want that and I need a key storage mechanism. I need SSO. I need I need a API Gateway or an application firewall versus you know web web firewall.

You know those things are right there and in some ways they're often better integrated or already pretty well integrated into the environment. It's just another feature. I'm using or third parties have put that into the marketplace and integrated it for you.

Right I'd argue in many cases. It's easier to construct what you're looking to do. Maybe a lot of it's done for you not all of it.

Then go visit all yourself, you know, so it's not just a physical data center You're Building you're building everything up that security stack all the whole thing you own doing it yourself. That's all absolutely. Yeah, and and the easier it is to implement a security process the better the security process you want.

I mean, it's it's a it's a fact of life. You've you know, you'll invest a certain amount of effort in building security as best as you possibly can and easier it is to do that the better the security system you're going to end up with So here's the thought I want to run by you. I did a talk at our apps that HD API security Summit in September.

And again, it boiled it down to three keys to application security. One of them is we have to stop thinking about people and things and start thinking about software that are being used by people and things everything is software, right and and part of that is think about it in terms of automation, right? You want everything you want your security automated because the environments infrastructure is code, you mentioned declarative environments gitops, you know, right go to something like that.

We're in an environment where not only are we rapidly deploying apps all of its changing the cloud service provider changed their service their apis have up been updated. They have something new, you know, we don't we don't get we don't aren't asked whether they get to upgrade their SAS or their service. We just use it.

So you're in this environment where? You can't track all of that. You can't make decisions for a lot of it even sometimes your stuff because some of it's coming from open source or third-party provider application that you're integrating to or connecting to so you've got to think about how do you build Security in in automated fashion?

Whether it's your own software development pipeline delivering code or any of the infrastructure stack that you're relying upon and apis and services and whatever else that might be. Feel free to disagree. Maybe that's an easy argument to make and I'm sort of preaching to the to the choir.

He definitely the choir I think that's You know that that's really I think if we talk about what the true value of the cloud is, it isn't the fact that you can get a server and turn it on anytime. You want to turn it off it only pay for half an hour time that's really valuable. But the real value of the cloud is you can do all of this with an API.

And once you can do it with an API, that means you can dynamically construct complex systems. And you know, imagine we'll give you the point in the future when we have infrastructure. So complex that we use AI to build the infrastructure for us that becomes possible in these sorts of environments and probably is already being that in some cases by some people but you can imagine the possibilities of you know, dynamically adjusting, you know, during the middle of an attack of a security attack dynamically adjusting your infrastructure to compensate for the attack without human involved in them.

There's some amazing things you can imagine that can happen with that but they're all enabled by apis and apis in this case that are talking to software. They're talking to infrastructure. They're talking security systems.

You know, we have that with self-healing, you know, we're kind of networks. We have that with intrusion response things like that. It's not AI but we have automated response to things already.

By the way the name for where you're describing is called Skynet didn't work out very well for the unit. That's true. That's true.

No not to be a part of it. No, I get what you're saying is, you know, the more the those things become routine and can be it's got the data which by the way all this data that we have in the cloud through automation. All these tools is a boon for our Regulatory Compliance reporting is that nice?

Yeah. Nice not to have fill out those forms and send Auditors your logs or, you know, try to grab five different logs and construct. What happened, right?

Absolutely. Yes. Yeah.

Yeah day is King data's King is king. So I'm curious too. I would like to go back to the industries you talk about health care.

You talked about banking Swiss banks. Um it will there be a day where we will eventually have everything in the cloud or we're gonna still live for a long foreseeable time where it's a hybrid environment. There's some things some organizations some industries that won't move everything to the cloud for whatever variety of reasons.

I mean, what's your crystal ball? Say? Yeah.

That's a great question. I think sooner or later almost everything will be in the cloud and I think there will be a couple holdouts. I think there's there's still unfortunately, you know, the a lot of very old complex applications that are still running on mainframes that need to exist and they're just not going away and You know, will they eventually go away?

Yeah. Well, we'll this need I mean if the crystal ball is going out 20 years probably yes, they will go away but it's it's a long time in the future. So I think there's still going to be a need for legacy applications that can't run anywhere that can't run on standardized Cloud components.

The have to run in your specialized Hardware that you have specialized running in your own your own data center. I think those are going to become rarer as time goes on and I think eventually as As you know as the clouds become more advanced they're going to become. Much easier to consider different options in the cloud.

For instance. I know AWS is starting to look at at you know, essentially mainframes in the cloud. That's that I know there's there's people over at AWS right now turning into a grave thinking about that particular phrase, but that's really what they're talking about is how do we get these Legacy applications that only run on and IBM blah blah blah, you know computer from 15 years 20 25 30 years ago.

How do we get that in the cloud and they're trying to find ways to do that today So eventually I think everything will be in the cloud but I think things like that will be the last to go and ultimately companies that have those sorts of things which is by the way Finance health care a lot of the same Industries we're talking about They will they will have to keep those. in their own data centers in a hybrid environment for an unfortunately long period of time and I think I lost your audio. There we go.

I'm okay. Yeah manufacturing is another one that comes to mind manufacturing. But absolutely, you know, what's interesting is maybe this scenario looks something like this Lee is it's already happened.

This part of it is IBM announced they have a Mainframe Cloud. It's not called that but it's Mainframe the cloud you want to you want you want resources great sign up here. Here's your portal.

You can do it, you know, there are open source tools. So there's you know, IBM taking zos and Those Linux into it and red hat services. And so they're kind of bringing things into the world or can be part of a devops flow or software development and delivery.

It's not like you're gonna do if you're you know setting up your own Linux computer to do development on but it's kind of bringing it into the world of how we're creating and managing software. So it seems like that's gonna continue to evolve and at the same time we've had the VM worlds, you know bmcs of the world sort of try to put wrappers around our Legacy environments to make them cloud like or make the cloud like our Legacy environments you can argue which to try to make it more manageable. So it isn't like bifurcated to very different things which is where we started.

Right, right? Yeah, and and that's where You know, the those are the last steps that will bring everything out into the cloud eventually, but I think that's the last step. I think where you know, we're yes, we're heading down that way but we're in you know, the the 2015 Cloud environment for those sorts of Technologies, right?

So we're we're yes, we're we're at least a half a decade away probably until we can finally say that you know, there isn't anything that can't be in the cloud. Mmm. Do we have also talked about so going to throw one out there is mobile and and iot and all the environments that aren't on our laptops or web browsers.

Right? And like we guys just delivers an important part of that too Edge my car my electric car, you know that's downloading terabytes of data every night Telemetry doing and getting updates from who knows who hopefully it's the right place. It's kind of the cloud isn't a thing out there.

The cloud is the thing all the way. To and encompassing, you know, the latest device whatever I'm running, right? Yeah, I think.

You know it was start talking about. Yeah, I'm gonna throw a buzzword out here, you know web 30 or whatever. What word you want to phrase the internet for you?

Whatever phrase no fun. Is that yeah. Yeah, you know the the distributed ownership.

It's really what that's about. Right? How do you do applications that are distributed without a central control?

distributed Facebook without Facebook Etc and you know the distributed money without a government Bitcoin and and that's I think is is going to become more important and more areas. I was talking to a company very recently. That's they're just getting into the space, but they're using blockchain to distribute CPU Cycles from cell phones from desktop laptop computers that are lining around and trying to find a way to sell that as a like a cloud computing resource.

And so that's true a distributed Cloud again. No ownership model you can you if you have spare CPU capacity on a laptop you have lying around you can make it available. It's an intriguing Concepts that are available there.

So the whole idea of the cloud being over here in these three or four or five or six providers is gonna be so 2020 sometimes soon and it's gonna be not the way for the future in the wave of the future is really going to be more distributed Cloud environment where everything is Cloud and everything's part of the cloud and it's all part of this. the Giant Infrastructure, that's all managed. It's part of you know one.

Big thing whatever that thing. But the Multiverse of the cloud Multiverse of the cloud. There we go.

There you guys looking for what how can I up went up you on a buzzword? That's exactly that's perfect. And and I know you know other terms like big brother fit into that another, you know, there's lots of lots of things you have to think about in those environments and and what's interesting is what's motivating a lot of this is a lot of you know of government oversight and how do you keep governments out of oversight?

And how do you you know, how do you keep big companies out of you know making decisions for you where you make your own decisions and and I think it's gonna be You know, the the Tactical aspects are going to be exciting. The political and the legal aspects are going to be scary. But I think it's going to be a very very exciting 20 years coming up.

It's interesting because we also you know, we've been on this globalization kick another buzzword, but of recent, you know, interesting companies countries Industries are looking at on showing like in the US right like I ordered electric vehicle and also it's all about to get the rebate the batteries have to be made in the US the RS to be a meal. There's X percentage of yeah, the elements of the car after you've been around as long as I've been around and you remember when I was exact opposite situation, we're offshoring with everything and how can we make sure that we're a global economy and you're it's just not the case anymore. It's you know pendulum swing back and forth, but that's that's the current path and It makes me think of is okay.

What about the cloud in country Cloud? Right? It's it brings up all the things, you know you and I've been talking about are.

Of in-country localization geopolitical considerations of what do we want? Where well, yeah, we weren't our batteries made here, but we went all that data here too. Right whatever.

I don't know that that's been said, but I can have that that's right. It has okay. Better than I do.

Well, let's let's do this as kind of a way to tie this together. You know, we're talking about Cloud container security. Summit and as much as you know new applications, you know large percentage of them are being built on cloud native Technologies at least containers and microservices moving that way we're so there's a influent anymore of it that isn't there either but as if you were thinking about advising companies that you work with on their security strategy for the cloud in the next three to five years.

I don't know what's going to happen Beyond five. I can barely figure out what's happening by 5 pm today. But what are what are some of the key questions for things you would recommend that they think about or ask themselves?

I think the biggest thing and I actually do get asked this question and one of the biggest things I tell companies is Security isn't about is not about building that. Best security it's about understanding how to do security in the best way. You know, you think of the story of the you know, the the the the person who built the highest walls under Castle on the deepest water in the mountain and think serious secure until the guy with the boat in the ladder comes along.

You know, it's just because you can build something that you think is strong. Bad actors will find a way to get into it. The real struggle isn't to build an impenetrable Design, the real key is to build in such a way that you can adjust and flow and keep up with what's going on, which means expertise.

So the most important aspect you can have in building a secure application is to understand security and understand how security works why it's important and understand how bad actors work and why they work the way they do. And finding the The Avenues to those resources. They right always be a lot of times.

They are ever internal right go. Outside whether it's Partners service providers Consultants experts come to this session and so read your book. Hey, by the way, so tell folks were where they can get a hold of you to engage you in your services, maybe get a hold of some of the books and contents if you've created.

Absolutely. com is my website and you can contact me there as well as there's links to all of my books and courses and articles and everything that I write but then my current book that's out is architecting for scale which is an O'Reilly publication. 0 what you imagine what that's about that's coming out later this year as well.

Nothing like a nice product placement there. So absolutely. Yeah.

I I saw someone do that in some You know some talk show or whatever. They were promoting their book about that's a great idea. I should do that.

Oh you see on every new show. That was all over the place. Yeah.

We definitely Endeavor to come in a new shows, right they do they do that. But definitely check out time you're writing for container Journal continue. So it's great place to find some of your new content that you're producing too.

com container Journal Security Boulevard and Tech strong TV. We do a lot of video content there and we have our you can find events whether they're webinars or virtual Summits like this one Tech strong events calm. com just where we do our analysis our industry reports and that's a good things there.

So great. Well, thank you and I have at least one video on texture on TV as well. We do check out and we have a podcast you asked me to join.

And so we're trying digital modern digital business is my podcast and you can go to any of your podcast tools and search for modern digital business. fm slashlisten and and sign up right there. Excellent.

So lots of resources a lot of great stuff whether it's definitely and I are doing or a lot of other good people definitely, please take advantage of that. So thank you everyone for joining us today. I hope that cloud containers security Summit has been fantastic for you.

I know the sessions that I've checked out are wonderful and thank you Lee for for being part of this with me and having this conversation about Cloud security absolutely great to be here.