Data Security and Cloud Solutions with Oracle and Qualys with Andrew Whitaker at QSC24

This is techron tv. Hey everyone. Welcome back here to, uh, QSC coverage, qua Security Conference Coverage.

We're live in San Diego. It's day two in the afternoon. It's, it's quiet here 'cause a lot of people are at the lunch, 10 where they're serving an excellent lunch.

I, I might add, if you ever come out to the koala security conferences, they feed you pretty well. Um, anyway, our next guest is Andrew Whitaker. Andrew is a field CSO with Oracle.

And, um, we're gonna talk a little bit about the Oracle, uh, Qualys partnership. But first, let's welcome Andrew. First of all, welcome.

Thank you. Thank you, Andrew. How are you?

Thanks for coming in. Um, field ciso, talk to us. How did, how did you wind up as a field CISO at Oracle?

Yeah, You know, the, the journey's been interesting. You know, I, uh, it Usually is, Yeah. You know, started out, you know, just, you know, desktop support and then, uh, uh, security started to become a thing and I said, sure, I, I'll figure that out.

Uh, got heavy into penetration testing and, uh, and, and hacking. So I really came from, uh, from the offensive security side, uh, and then kind of got to a point of where I was consulting businesses and thought, you know, what, if I have it wrong, like, let me actually go and be a CIO for a while. Uh, so I was a CIO for the city of Seattle.

Uh, and it was there that I started to recognize the challenges with, uh, with multi-cloud environments and getting that visibility across multi-cloud. Uh, from there I worked in some other big techs like AWS, but I ended up at Oracle because, uh, you know, our emphasis is around data and data security. And, uh, that really becomes the, the most critical asset, um, um, for most enterprises.

Uh, and, you know, the relationship with Qualys has been great. Um, but yeah, as a field cso, I work, uh, uh, with state and local government, uh, higher ed, uh, energy and utilities. And, uh, this is gonna sound a little like left field, but also ai.

Absolutely. We'll talk more about that in a second. So it, it's interesting, you know, so I, I've been in security myself for about 30 years.

I wasn't always on media. I was on the vendor side and, and involved in security. And, um, it's interesting, your background and how you got into security is how most of my friends got into security too.

We were network people Yeah. And or, or service desk people. No help desk people.

Yeah. We like to break things and then put 'em back together so they couldn't be broken so easily, but they would, they didn't have cybersecurity courses in college or schools or stuff. Yeah.

You had your C-I-S-S-P, that, that was, you know, the, the thing to go for that. But you know, today you get people who come outta school with a, a cybersecurity Security degrees and Yeah. Crazy.

Yeah. Um, but, and, and it's funny and, you know, so you could start out in like right field somewhere and, and all of a sudden, you know, next thing you know, you're the seesaw of the city of Seattle. Right.

And, you know, it's a long, strange trip. It's, it's great stuff. Yeah.

Um, Oracle, of course, is also has a huge emphasis now in the healthcare market, right. Headquarters are moving to Nashville. Yeah.

A lot of changes at Oracle, but, you know, they've always had an emphasis on security, because I think they always realized Oracle is about data. Mm-Hmm. And data goes together.

You know, data security goes to data really close. It never goes outta style. Yeah.

Um, so, so it, you know, it's no surprise to hear about, you know, coming from AWS and, and the multi-cloud environments winding up at Oracle. And, you know, of course Oracle Cloud is also like the fourth largest cloud provider. But an interesting thing I heard was if you strip out, like Office 365 from Azure and you strip out Google, uh, you know, the Google apps Yeah.

The Google office, whatever you want to call it from CP mm-Hmm. It's not a big difference in size between the three of 'em, right? Yeah.

So I, and I think people who are not dialed in don't realize how big the, the Oracle Cloud platform is. And, and you know, how wide widely used, so just putting it out there. Yeah.

You presented here though, talking about the Oracle, uh, Qualys, uh, partnership. Mm-Hmm. You know, our, I don't think our audience is familiar with it.

I'm going to guess a lot of folks aren't. Why don't you kind of tell us a little bit about the partnership? Yeah.

You know, just to kind of, uh, to take a step back, uh, and, and talk about the history here. You know, when, uh, you know, when OCI, uh, started to get into cloud, uh, they were a little bit late to the game, but that also gave them the advantage of let's learn from, uh, you know, let's learn from Microsoft. Let's learn from AWS.

And, uh, and with that, we knew right from the beginning that multi-cloud was gonna be important. And so here's a cloud service provider coming in and saying, you know what, we're not the only one. Right.

We don't want only you Exclusive. We're, yeah. And, uh, uh, so with that, you know, we now have partnerships with Microsoft, Google AWS you can, you can run your databases anywhere, but, uh, I know, you know, for me, when I was at cis o that visibility became so important.

I need to know what assets I have out there. Uh, I need to have that visibility. And while each cloud provider, including us, uh, we have our own native tools that can give you that visibility into risk.

But we also realized that it's important to have that partnership. Uh, and, and we chose Qualys because Qualys has, uh, you know, such a strong, uh, risk quantification and you can use multiple cloud providers. So regardless of where your databases are, you can use multiple cloud providers and get to that consistent, uh, uh, rating.

Uh, which makes it so much easier for, uh, our customers to be able to present to the board because they're not having to translate from one cloud provider to another. Um, so, you know, we work closely and as a result, it makes it super easy to just fire up Qualys. And whether it be vulnerability management or whether it be cloud security, posture management, or inventory, uh, because of that integration, it makes it really easy so that, you know, you don't have to spend all day trying to install and, you know, get something set up.

Absolutely. So that cloud agnostic, uh, profile is really important. 'cause as, as you mentioned, Oracle is about multi-cloud, right?

They, you do have strategic partnerships with the other three guys. Um, now if you're into risk, this must have been a, a nice cloud, uh, excuse me, uh, qua Security Conference, QSC for you, because this was all about risk. Yep.

Um, how is, how are you gonna translate that to the Oracle customer base now is, or have you already been talking that language and this just kind of gives you more ammunition in the, in the gun? Yeah. You know, uh, uh, I do have conversations with customers and, you know, certainly every customer is at a different place in their journey.

Uh, you know, some, some just want, you know, what are some pre services that are native to MyCloud provider that can quickly, you know, show. Um, but a lot of our, you know, more mature, uh, customers, they have, you know, multiple cloud providers. And so in terms of quantifying risk, uh, you know, uh, you know, the amount of of effort that, that we put in, as well as Qualys is able to get, give you that unified scoring and what's, uh, really what the trend is.

You know, I'm seeing CISOs get that seat at the board table more and more, but that means that now you can't talk about, well, here's our CVSS score, or here's this, you gotta translate that into dollars, dollars And cents. Exactly. Mm-Hmm.

Exactly. So, uh, so being able to have the risk quantification and say, okay, here's, here's what the actual loss would be. Uh, and you know, it's, it's by being able to quantify risk, it's really the same conversations that you have with CFOs.

Yeah. You, A CFO is there to let you know, Hey, this is a bad financial decision. Hey, we're at risk here.

And CISO's kind of come with that same mentality, but, uh, but we've, you know, security's been lagging behind in terms of the risk quantification that you have with CFOs and where they can show here's the actual business risk. And I think that's, we're getting caught up to that. Um, but it does mean a shift in mindset to, you know, how do you take a risk and then quantify it.

Sure. Yeah. And it's, it's, it's a shift in language.

Yeah. Is really, you went from talking one language to a different language. Now, every, look, I, as I said, I wasn't always media.

I've been VP of biz dev, SVP of biz dev corp dev, many companies, several companies, every successful partnership I've ever done it, it's not a one way partnership. You just don't take what the a a vendor gives you. And, and you've gotta add something to the mix.

So we know what Qualys is doing here, what is Oracle adding to this partnership? To the mix? Yeah.

Yeah. You know, one of the, uh, uh, best is that we integrate so easily. So if you wanna do vulnerability scanning, we're already built for that to integrate with Qualys.

Uh, you, uh, uh, if you're, you know, wanting, uh, uh, that, that visibility across the board by being integrated, uh, it's, uh, you know, we, we can help you with identity access management, the encryption, the, the crypto key management, uh, the, you know, network security list, you know, all of those other aspects so that you have a secure, holistic, um, uh, a holistic approach. Um, but, you know, we don't have much control over other cloud providers, and that's where Qualys can come in quickly get spun up, um, uh, um, um, within OCI and then, and now you can have the visibility across the board. Absolutely.

Yeah. Um, how do you think this whole emphasis on risk winds up playing out, you know, in terms of people making decisions about, you know, maybe I shouldn't go across all three clouds. Maybe I should minimize the amount of clouds I'm on.

Maybe I should minimize the amount of databases I'm running. Maybe, you know, how like, Yeah. It, it's one thing to, when stuff's theoretical, it's another thing when, when stuff gets real.

Yeah. Right. And, and so a, a large part of this true risk score is, is moving from theoretical to real.

Yeah. What, what do you think that'll have a, you know, a chilling effect on your customer base or an a liberating effect? Uh, honestly, I, I think it'll be liberating.

And, and I'll tell you why. You know, I was recently talking to a CIO, uh, of an energy sector company, and, uh, and he was using Qualys along with OCI, and he said that, you know, the reason why he really liked Qualys is it gave you, it gave them same verbiage, um, that was across providers. So it wasn't like, you know, AWS calls it this thing.

Yeah. Microsoft calls it this thing. Uh, but he said the, the big benefit that he saw is it made it easy then to translate to his board and, uh, uh, and that he said it, it saved him so much time from having to take this report and this report and trying to synthesize it together and always wondering, are you synthesizing it together correctly?

Uh, and so, uh, uh, I find that that, at least with the customers I talk to, that it's liberating to be able to empower them and say, here's a true risk score that they can easily translate, uh, and, and, and share with the board. So love it. Yeah.

It's good stuff. Yeah. Andrew, I want to thank you for coming on here.

Yeah, thank you, man. This is a great conversation. I didn't really know about the Oracle Quas partnership, so I'm sure a lot of people in our audience didn't either.

Yeah. Keep it up, man. Let's see where it goes.

All right. All righty. Thank you.

Oracle Cloud. Oracle. Well, field.

CC cso, you again? We'll at it there. Yeah.

We're taking a break. We're live in San Diego. We're back in a bit with some more great interviews and we'll wrap up our coverage later today.

You're watching Tech Drunk TV.