Shared Cloud Security Tips – Simon Jelley, Veritas Technologies

This is Textron TV. But the great place you're being joined by Simon jelly. Simon is general manager GM of SAS protection with Veritas Technologies.

Welcome Simon. Thank you very much Mitch. Very nice Stewart to be here and have a discussion with you today.

Absolutely good topic. I'm excited to have this conversation for jump into it. Tell us a little bit about you.

Tell us a little bit about Veritas. Yeah, absolutely. So I'm GM responsible.

So I've for all of our SAS protection here, you know, it's a obviously a big custom topic for organize action out there and moving to leverage software as a service whether it be for I'm sure yeah applications exactly like this right that we're using today's Zoom to talk to each other or for their collaboration on email increasingly moving their especially with the the move to working remotely as we've all been through over the last two and a half years. So that's my responsibility is how do you think about Protection security governance of information and data As you move to increasingly using software as a service and it's important topic for Veritas because we've been A leader in Enterprise data management and data protection for over 30 years. Now helping customers really protect their most critical assets as they go through using any kind of infrastructure out there right from physical to Virtual to Mainframe many years ago to now the cloud moving forwards.

Hmm. But, you know our landscape of solutions that we employing applications or productive mutuals or whatever one thing right? It's a complex mix of SAS Services.

Maybe we didn't have our own sass we're raining applications. We're building on platforms using cloud services all kinds of things. Of course that leads us to this idea of shared responsibility model assured responsibility doesn't mean no responsibility at all.

Ultimately falls back on us, right, even if we're working with the SAS provider who is also has a rule and that's your responsible. I'd love to hear your videos on that. Yeah.

So I think I'm really pleased to be talking this topic because I think a lot of people when they move to software as a survey so quite the cloud. Yeah. I think the good thing is that we're moving away from thinking about am I buying features and functions and capabilities to a lot of organizations look to the cloud and that's because they want to buy the outcome, right?

Want to buy the ability to collaborate with someone remotely or the ability to very easily log in and log their customer records management. So it's great and it's a great evolution in terms of really taking away the the need for organizations that have to build the outcome themselves from the combination of software and Hardware now, they can get it delivered to them directly as a service. That's a fantastic.

Obviously why they're growing so rapidly, right? I think you heard Microsoft with teams grow over 200% in the time over the pandemic itself, but I think what often organizations Miss is exactly the point you made around there's a shared responsibility in buying and deploying that service and what that means is while the organization you're purchasing that software be at Microsoft or from Salesforce or from whomever, you're buying your service from they provide guarantee of the service delivery, right? So the the up time the service it will be available to you as if it's in terms of being available, you know, it's fully redundant if they have a failure in their day to center it's immediately that's invisible to you.

It continues running they fail over to a different location what they don't guarantee is still your Possibility is the data itself. Right what you choose to store on and use that service for is ultimately still your responsibility, right? They provide no guarantees in terms of being able to recover that data.

So if you know we all we all mess with data all day long and if we accidentally delete that calendar entry, there's no guarantees to get that back and go so from accidental deletion to you know, ransomware attacks or obviously a big rise inside cyber security overall. They don't provide guarantees in terms of being able to get data back in those cases and then, you know the search and discovery of that data as well right from a legal compliance. If you need to get historic copies of that data back, that's a big topic obviously with the increase in privacy regulation thinking about data sovereignty itself.

How do you manage those things as increasingly the day to sits within those services so really it's about the rest as I think about it and and describe it to organization do the service itself. Yes, the service provider will provide that guarantee. Uptime the service being available to you, but the data that you're you're sharing and using within that service during that service is ultimately your responsibility and all the traditional things you thought about for on-premise right security governance protection backup recovery.

You have to think about those as much as you did in the quote and quote on-prem world as you do now within the cloud. You it's interesting. It's usually the situation where something event has happened.

Right? We need to go recover that day. It's something we had an incident whatever it may be and that's when you you know, we all read those eula's really closely.

Right? Well at least our legal teams usually do but that's when you discover like, oh you don't guarantee recovery the data. Oh you you want to keep 30 days.

We need 60 but you whatever it might be that and so that's the Trap we fall into because it's just so easy to click on something. Yeah, I think unfortunately, yeah, we we've certainly met organizations and you've you know, seeing some well publicized as you said, they they found out what the you said after the event right when it came to we've already lost the date or had the disaster event or you know, unfortunately, we've been to come to some kind of ransomware attack is when they found out the small print that we can't get that date back. Okay.

PMG has been a good publicized case. Know they moved to leveraging Microsoft stack and unfortunately had an outage and lost I think was over 140,000 users that lost access to a certain period of data and there was no guarantee of recovery, right the fine print made it clear. It was their responsibility to have provided that recovery service and that's not something they've set up.

So I'm sure they're investing in that now as they move forwards to the cloud and an investing further in as a service in making sure they're thinking about that moving forwards and books there that were there kind of using this as a this is now we got to do it right. Let's show you do it, right. We do you learn those lessons, but sometimes that are very, you know, very hard or sometimes costly way.

Well tell us about you know, very classes have been around for a while was not new to this Market of course thinking about backup Solutions and data and data recovery. How do you think about that in a cloud environmentally multiple providers and it's not all sitting in my data center or my office. Yeah location center.

It's it's everywhere right? It's in everybody's service that I'm connected to in music. So it's not two or three.

It's probably 20 or 30. Yeah, so I think I mean number one. We think about it really is it just an extension to the it landscape you're trying to manage.

I mean the reality of what we stood for for as you mentioned many many years is how do we bring bring complexity under control? The reality is you've always had a many organizations have had always had many different types of applications from productivity to data management tools and they you know, obviously the I like to say, you know, it has this regular kind of refreshing cycle we've gone from Mainframe to client serve to virtualization now as a service and cloud and nothing ever truly dies, right? There's always yeah nothing ever goes away.

So really being able to can that provide that continuity so number one, we think about it as managing complexity, right? We we take a single platform approach. So while we're looking at how do we innovate around being able to capture in the most effective ways that day to that build on top of our existing what we call Net backup platform.

So all the We've managed for 95 of the Fortune 100, you know, we managed their data today. We're adding the ability to capture SAS as part of that and drive through a single pane of glass the ability to govern and understand one. Do I have a governance view of that data.

Can I see that? It's been protected. When was the last copy of that day to protected and then obviously the ability to drive recoveries test drive recoveries do ransomware recovery rehearsal events you that's a big topic these days for customers knowing they can recover.

Unfortunately, they're ransomware topic is given birth to the you know, it's not when but if it's sorry, it's not if but it's when you're gonna get attacked from around somewhere else. There's a lot more of proactive preparation that we're seeing customers being doing these days as well. And again, you know folding it into that kind of single platform single protection strategy event is really the focus that we take to make that overall and I think You know, ultimately the you know, when we talk about cloud and SAS, you've already kind of alluded to this and many people think about it.

As one thing. The reality is, it's it's very much not I think a SORA a stat the other day we're over the averages well over 50 different types of SAS or Cloud applications that most organizations have deployed and for good reason right? There there specialized the different types of use cases different types of needs for the business, but they all ultimately need to protected because they're all succumbed to this shared responsibility model.

And just name the categories you can of kinds of software that you're using in a likely in this ass scenario and maybe my 20 to 30 that might fit the categories not on this the number of services and I'm not surprised to hear or your number of 50. Well as you engage with customers, you know, I know you have a lot of existing customers and as you talk to new new customers thinking about how do they maybe revamped their strategy? They're back up strategy and Recovery there.

This is continuity plans. Um, if I was on someone else's solution, I was looking for new better options. How does that conversation?

How do you have that conversation with them to now? Here's let's think about this way. If you're if you're if you're gonna build this, let's build it, right?

Yeah. Absolutely. Well, I think number one and it starts a lot with this conversation.

We're having around education on the shared responsibility model. It's still surprising to me certainly that people again make that assumption that they're getting the outcome and everything to built into that. So, you know, a lot of the time actually just educating that the basics of data protection good day a governance is still something they need to think about as a strategy moving to the cloud.

Obviously. What we promote is then look it's great that you have protection in place. But what you want to have is consistent policy consistently applied.

If you're gonna meet your regulation you governance needs it's not it's not effective. If you've got multiple Point Solutions trying to address your sass applications versus your virtual. Applications Etc one because it becomes very complex to manage that right.

How do you audit where to go for the recovery? It's a different tool set each time. Right?

So where it's very difficult from a training and and and kind of standardization of procedures perspective, but more importantly particularly. If you're a regulated organization, you're dealing with things like SEC or even new data privacy regulations, like the the US government's Cloud act, you know, they recently remember back to apply to data not just in the US but outside the US as well, you've got to have a means to consistently show that you don't just have a policy but it is consistently applied and obviously if you're trying to do that through multiple tool sets and we did a study a few years back now, but at that time it showed that most organizations have on average four different data protection Solutions in place, right and and some much more than that. It can come pretty Comfort complex in terms of doing that.

So one standardizing on a single platform is what we drive. Towards and a lot of that again is just to manage the complex take cost out of the equation. But particularly as they move to software as a service you yes standard back on recovery is kind of all the values of that in terms of protection against accidental deletion against disaster recovery events against ransomware protection those things we certainly help customers with we can do, you know single level item to full Disaster Recovery with all of our different SAS applications that we protect but we're also helping one key thing.

We are trying to help customers think about is the other big shift to SAS or cloud is you're typically moving from a Perpetual model right where you've kind of paid up front. It's all you can eat, you know, everything's paid for to a consumption model, right? So in your SAS application your potentially, you know, you're paying by the meter right by the whether it be by the date of only more by the object counts in terms of how much you're putting into that service and that can have a big impact on your you know, for example with SharePoint.

There's no tiered management built within storage so you can really get into a situation where you're paying large overage costs. If you don't manage the storage what we can provide is an extension to our data protection capabilities this the Ted storage management, right a identify what date you don't need to keep and just completely Purge it out and then be be able to tear that storage down to the lowest cost period storage effectively as possible. And then the third element we often talk to customers about is, you know, they they often are driven by the business users to particular SAS applications and they're being driven there rapidly.

Right and we again seen the growth of SAS particularly from a productivity and collaboration perspective during the covid pandemic. They haven't had a lot of time to think about what does that mean from a strategic Choice perspective, right, which cloud is for them? Which setup is for them.

So providing portability and Mobility between clouds is another strength of ours that we build into our application and into our platform. So that customers can you know, they can invest they can make that rapid business choice. They know the date of protected.

They know we're helping manage the cost around the cloud but they also know that we're providing accessibility and mobility of the data and all of the search and indexing data governance compliance. They can also hang off that as well. So those tend to be the the world a lot of it is educating in terms of the bigger.

What's the what's the bed you're making for yourself as it were that you're getting into and ensuring that you've got an insurance policy. That's not just about recovery. But again about managing costs managing accessibility managing governance overall.

So if one final question would just bet at a time here. I'm curious your thoughts on as you look forward. How are things we've talked about like being in the cloud like that.

I have environment and run in SAS applications. We've talked really about Cloud native. We haven't talked about infrastructure's code or things are Dynamic get Ops and sort of dynamically declaratively to find these environments devops microservices things that led us do software much more quickly and more.

Dynamically, right? We may be doing both releases a day or week or whatever. Our infrastructure could be changing.

Dynamically, you know without us even knowing we know that's providers change it without us knowing it. How does that informed or change, you know or influence your your kind of backup strategy? Yeah, this is right.

I makes exciting right the future in terms of what it could enable for people and you think about the higher the higher order jobs that people can go Focus there Innovation and talents on by automating with logic actually taking a very similar path. Have announced recently a strategy we call automated data management and it's very much focused on look you declare a tear of protection that you need for your organization for different types of data and then as data comes into the organization that we essentially pattern match to that how you've described it will automatically provide and protect that data because again the traditional World we've been where we provided tool set then you define the policies around you have to manually kind of match the data to our protection that isn't going to sustain us moving forwards, right? It's just not feasible.

So automated data management is All About Us putting all the smarts. We've already had around date protection and recovery, but making it automated to be a bronze silver gold tier of policy. That's what you said.

Then we go and automate and a lot of that we already have right. So in the an example of that in in our SAS protection today new users that come into the organization as long as they're put into the the right groups of Is will automatically protect that with the protection tier that you've already put there and that's the kind of Concepts we're taking forwards were also looking at autonomy around understanding what data is being accessed most often and then making sure that we put that closest to where it needs to be from a recovery time. Right?

And if you if we see the data go offline if we see issues within our appliances that where the disc is failing were automating the recovery of those the replacement of that Hardware. The replacement of those Services again automated data management is is certainly where we're going in response to a lot more of this automated world that we're living overall. And all the rest of the pipeline is getting automated too.

It's not already. That's what makes a lot of sense. I love to have you come back.

We'd love to delve into that somewhere fascinating topic working folks. We've covered a lot of ground working folks go find out more about Veritas, maybe see some of the solutions or options you have or trying them out buying them Etc. Absolutely.

com. We do actually a quick shout out. We do actually have a big event coming up a virtual event.

com and register life or on October 19th. We have our our third iteration of what we call conquer every cloud. So how do we help you move to the cloud with confidence and do all these things like protection governance ransomware protection that we've talked about.

com you'll find where to register for that. I'm Every Mountain conquer every class. Hey, we should have asked with your with your event on the 19th Simon and John a great talking with you with berta's technology.

So if you come back again soon, I would love to thanks for the time Mitch you bet.