Combatting the Cybersecurity Crisis – David Ngo, Commvault

This is Techstrong tv. Hey everyone, welcome back here to techstrong tv. I am happy to be joined.

It's actually his first time on Tetron tv. I guess he's a newcomer to the tech world. We'll, we'll find out.

Let me introduce you to David. No, David is the c t O of Metallic. And, and for those of you who may not be familiar with Metallic, they are a, uh, SaaS division or the SaaS division for Com Vault.

And I think most of you have heard of Com Vault. Of course, they big company with a lot of different offerings and market. But let, let's introduce David.

David. David, welcome to techstrong tv. Thank you so much for having me.

And, and thanks to, uh, everyone for joining. That's our pleasure. So, as I mentioned, you know, it's your first time on Techstrong tv.

Are you, are you new to the tech industry? Uh, I will say that I started in the tech industry when I had hair. How about that?

So it's been, uh, you and Me both. You and me both. Um, yeah.

Seriously though, David, you know, we were talking off camera. David is, is celebrating his 25th anniversary at Conal, which, you know, they used to give gold watches out, David, in these days in age, that should be like a platinum watcher or something. Unheard.

Yeah, I've been, I've been very fortunate to be able to work on, uh, a lot of different things that con and really grow with the company and see it through, you know, uh, quite a, quite a history. So I'm really happy about that. And, and you should be, you should be proud of it.

And congratulations to you on that. Thank you. And, and then also I think says something to Kaball, right?

That they, you know, you have person who's the C P O of their SAS division was 25 years in the company, right? They gotta be doing something right. And Yeah, I mean, yeah, we're very fortunate there.

You know, a lot of our, our executive team, uh, and our engineering leaders and others, I'm not unusual, which is fantastic. That is and unheard of actually. I I'll tell you, I was, I was at an analyst day last week up in New York for a large, you know, billion dollar revenue, uh, waste comp service integrators.

But they really, you know, they're consultants and, um, you know, the C e O got up and said his proudest accomplishment is that the exec team, uh, that came on board with him when he joined four years ago is still there. And that today's day and age for the team to be there four years later, intact is, you know, quite an accomplishment. So take that in relation to 25 years and, and I think you get an idea what, just how great that is.

Uh, anyway, David, your c t o of Metallic, which as I mentioned before is the, uh, SAS division at convo, but, you know, everything's SAS today. But let, let's dive in if you don't mind a little bit into what exactly Metallic does and his and Sure. Yeah, absolutely.

Yeah, absolutely. So, um, Kaul as, as you know, has been a leader in the, the enterprise data management protection space. Um, as, as long as I've been here, um, you know, we've had a ton of industry awards.

We've been, you know, leaders in various, uh, analyst reports for, you know, a a very long time. And so our customers really with the shift to cloud and the adoption of SaaS services was looking at different ways to consume our technology. And being able to bring it to them with a sa native cloud-native solution and service was really quite important.

And so, uh, we launched Metallic, uh, just a few years ago, and it's been, um, amazingly successful for us. We crossed a hundred million in a r r and in about three years, which is really, uh, exciting growth. I, that's the kind of numbers that move the needle even at a convo, right?

Yeah, absolutely. And, uh, and that's, that's fantastic. Um, before we dive into kind of the meat of what I want for people who say, Hey man, I, I really wanna investigate this right now.

io or where, where do they go to get information? Yeah, so for Conval, of course, since, um, you know, metallic is part of our portfolio of products, uh, and it's all based on common technology, it gives us a ton of synergies and capabilities. io, and we have a ton of information there and, um, you know, customer studies and our pricing.

And you can even sign up for Freetrial And just, you know, for those who are looking into that, the com vault is with two s C o m m. That's right. com.

All right, David, now that we've gotten that out of the way, I wanted to talk to you about, you know, what, well, certainly the folks at Con Vault Metall are calling the 2023 cybersecurity crisis. Now, some may, you know, it's like the old two song Meet the New Boss, same as the Old boss. Why is this year any different?

There's a cybersecurity crisis every year, but what, what, what about the 2023 cybersecurity crisis? Yeah, I think, you know, the conversation of the past few years, um, when we talk about data protection has really shifted in terms of the threats that people have to consider. Um, and, you know, those threats are only exhilarating in severity.

Like it, we've, we've started to see security and security breaches and ransomware really be top of mind for our customers. Um, what's really different recently is that there's been a shift from just straight ransomware where someone would encrypt your data and ask for a ransom to decrypt it, um, to, you know, double and triple extortion schemes where, um, where attackers are really moving towards exfiltration of data and going after company end users, right? Looking at, um, really stealing data versus simply destroying it.

So, you know, that really requires a, a, a significant change in thinking and strategy, um, on how you protect your data. Um, plus the fact that, you know, ransomware attacks in of themselves, uh, according to the 2022 Verizon data Breach Investigations report, uh, the total number of attacks has gone up 13%, which is equal to the last five years combined. So it's actually really getting worse.

Um, unfortunately, uh, it it's only a matter of, uh, when not if you're going to get attacked anymore. I, I, I, I agree with you. I agree with you.

Um, you know, I, I will tell you, David, that a a, a trend I've seen over the last two, two and a half years is a return to emphasis on data, data protection data, you know, the data really is the crown jewels. Mm-hmm. Right?

For a long time, especially in security, we were so focused on AppSec, securing the applications, securing that cloud, securing, you know, but we almost, and maybe cuz we can't concentrate on too many things at once, but we almost lost sight of, hey, it's about the data. You know, we recognize it here at techstrong. We're actually doing a virtual event in a couple months on DataOps, right.

And data in all of, and, you know, whether it be security or just, you know, operationalizing the data that, and, and there's more data than ever, right? We're, we're drowning in data in some instances. Um, so it, it's, it's good to see a return to emphasizing the data and data protection.

Let's talk a little bit about that and, and how metallic maybe is, is working with that. Absolutely. And, and you're, you're totally, um, you're totally aligned with what we're seeing as well.

Um, I think the, the emphasis on AppSec, as you mentioned, was really about putting up walls, right? How do we prevent a breach? Yeah.

And then the thinking was, okay, if there's a breach, then we will have data destruction, right? In which case we have to recover. And that's really where, um, back in recovery was, was kind of thought of in, in that security space.

I think with the expansion of, you know, an adoption of things like SaaS, applications, M 365 and Salesforce and other things as well as, um, cloud infrastructure and mixing that with on-premises applications like it, the, the, the challenge of managing and securing all of that, um, has become overwhelming in many cases, right? Visibility is really the key. Early warning is the key.

Um, and people are figuring out that recovery is not really the be all end all to what happens if you have a breach, right? So, um, you are right there. There's definitely a, a, a return to thinking that, you know, or I would say remembering that data is really what it's about, right?

People are not breaching environments just to poke around and, you know, play with some servers or you know, mine for Bitcoin or something, or they're after. Well, There are those people, but, you know, but that, but that's not, that's right. That's, you know, that's not the crown jewels.

That's not after your data pay off, they're after That's right. Your data. Exactly.

That is, That is at the end what they want. And, and thinking about how we then move from just recovery to, uh, defending data is an important part of, of what we've been concentrating on. Absolutely.

And you know, so look, I've been in security myself a long time, right? So in my mind though, you can't defend what you don't know. That's Right.

And when your data is literally all over the place, like it is for most organizations today, because I have it in, maybe some of it's in my M 365 OneDrive or whatever, maybe some of it's in in Box or Dropbox other than maybe it's in Google or some of my other stuff might even be in iCloud cause I did it on my personal device, or you know, or I store it in AWS or Google or Microsoft Red Dot Corporate cloud. I don't know how many organizations actually have a good picture. You know, it's 10 o'clock.

Do you know where your data is? Right? And, and you know, that that in itself is, is, that's the first step to defending it, is knowing it.

Correct. Absolutely. And that's, uh, a really important point, right?

Because as we look at more broadly beyond, you know, how can we back up or recover your data to how do we protect your data? What is the, what is new, the new reality of data protection, what that means, right? There are really two ways to, to get to what customers really need, right?

Which is to, um, get back to normal operations after reach. They want to minimize that time, right? They want to get back as soon as possible.

So the first thing to do is to minimize the attack surface and understand what data you have and where it lives, and is it, is it where it needs to be? And does it have the right permissions? Uh, is there risky data in, uh, uh, in, uh, insecure place or unsecured place, right?

That, that is exposed to attack. Then you have the stage of, you know, post attack, uh, which is and pre-data impact, right? So pre post-breach, pre-data impact is, is a really important window to consider where you actually have the opportunity to deflect the attack before your data's affected.

And then should your data be affected, then, you know, of course we need to recover, right? So that's where we take, uh, the approach that, that we call secure defend, recover in order to cover that, that whole, um, sec data protection life cycle. I would say, uh, to your point, first you have to understand your data, where it is, what your risk is, then how do you deflect attacks against it, and then how do you recover what you need to recover as quickly as possible.

Okay? Um, here's another thing I just gotta throw at, at you, and we, and we're running low on time, David, I apologize. But, uh, another, uh, issue I've heard from customers is, you know, I, I thought I had that backup and recovery I think solved.

Yeah, man, right? We used to have tape libraries for Christmas sakes. We, we've got, this is an old problem.

Well, all of a sudden ransomware becomes the, you know, the, the topic dejo in security and people, you know, people like, well, don't worry, I could just back it up. I got backup. I'm not paying the ransom.

And they find out the backup they had isn't the backup they thought they had. How, how do you, how does one know when you, you have the right solution? You know, that's, that's an important consideration.

Um, and that's where we've taken the strategy of having a platform that protects customer data wherever it lives, right? And we have broad application support from SaaS, the latest SaaS applications, the latest cloud, um, platforms and workloads to on-prem, uh, workloads and even legacy workloads, which are often, you know, the, the, the pieces that people don't think about, right? An application, running an old database and an old version of an operating system, right?

And it's important to secure and protect all those things. But in addition, like that's where our platform really comes into play with the addition of things like, uh, threat wise and some of the new capabilities that we just announced, right? Where we can, uh, we're the only data protection vendor, um, with advanced early detection and deflection capabilities combined with, uh, you know, our, our sensitive data discovery, uh, with our risk analysis capabilities that we also just announced and minimizing that attack surface, right?

So while, you know, it used to be that you just had to do a backup and you only had to think about, you know, does my backup really support what I, I have? It's really about thinking about the full attack surface and, and life cycle of an attack. And then to your point with recovery, how do I bring back clean data?

Because I don't want to bring back corrupted data or encrypted data or reinfect my environment from my backup data. Um, and that's where, you know, the capabilities that we have, uh, with, um, with some of our, our threat analysis, uh, products that we introduced, really ensure and, and auto recovery, right? Really ensure that you can not only identify corrupted and encrypted data and, and automatically bring back the right versions, but you can also make sure that the data is clean.

You're not bringing back a bringing back malware, um, or, you know, in, in an inefficient way, um, and not be able to recover at scale. So, uh, you're right, it, that problem has really exploded beyond just, you know, I have a backup on a tape in a closet, right? Yeah.

I'm that old. But anyway, David, we're almost outta time. You know, I think you killed your first text on TV interview here.

We loved having Yan, thank you, uh, the 25 years of experience at convo. They're certainly paid off. Um, we'd love to have you back and let's continue this discussion.

Yeah, thank you so much Ellen. And, and thanks to everyone really appreciated it and, uh, enjoyed being on today. All right, David, no CTO metallic the, uh, SA Vision over at convo.

com. We're gonna take a break here on Techstrong tv and we'll be right back in just a moment.