Martin Roesch, Netography | RSA Conference 2023

This is texturung TV. We're here at the last day of RSA. We're really happy to have you back with our continuing coverage for Textron TV.

I am really happy to introduce you to a friend of mine from the security world. 20 something years It's Marty Rush or Martin rushes. You may know him already is the CEO.

Of netography that's right, and they are the people bringing you the atomized network. But if you're a security person you couldn't make it to RSA this year. I'm sorry.

I know there's a lot of my friends out there who? Didn't get here this year, but you guys all know Marty anyway, right? He's the the not the inventor but the founder of snort Source fire.

And just a whole bunch of other great stuff in security all around great giant security Marty welcome. Thanks Alan. Thank you pleasure to have you here at me you here at RSA?

Yeah, kind of brings me back to meeting in the Old Source fire rooms. Yeah. Remember you guys always have your meeting rooms.

Yeah, and I I come in there that was good times good times. You know what not. Everyone's familiar with the photography.

Sure. I mentioned atomized Network and maybe a term not familiar to them. Yeah, why don't we start there if it's okay?

Okay, cool. Yeah Adelines Network. It's a term that we invented in photography.

And when I I came to the company a year and a half ago. I was hired into be the CEO, but obviously I'm very, you know studied in the discipline that we're doing which is kind of traffic analysis on networks. And as I started talking to customers I kind of realize that something had changed Under the Sun and what it was was that You know before the pandemic when when you wanted to move your data center like from whatever Dallas to the cloud you get like project manager and stakeholders.

You do weeklies you have readouts and do reports and then when the cios happy move the thing to the cloud cool, then the pandemic hit and everybody gets sent home. They're all told. Hey, just get your job done.

We'll be back in two weeks. Then I was like that's actually six weeks and it was like it's actually six months right and people just lucky if you're lucky right and people just kept getting their job done and what that consisted of in many cases was standing up whatever they needed wherever they needed it whenever they needed it with maybe maybe some level of overview or maybe not any oversight at all what they were doing what they were getting their job done and that's all that mattered and fast forward three years. Now, we're into these networks where you know, most Enterprises are multi-cloud or hybrid Cloud.

They've got still got on primary for structure in many cases. There's literally nobody there to turn off the lights. Yeah, so and as all the stuff got built up people start building dependencies between all so now it's like we don't even know.

What we can turn off if you can figure out what you have. So we call this the atomized network. This is the hybrid Cloud multi-cloud Plus on Prem mobile remote Workforce world that everybody lives in and you know, I kind of suss that out as I was talking to customers when I was just getting going the natography.

I was like there's something different here. And and that's what it was my favorite see so quote that I got since I started working again. I described that atomized Network and he said yeah, you know, the only thing keeps me up night anymore is that I got a thousand developers working from home.

They all have credit cards. Yeah. So there's a shadow it and there is and look making developers security Champions is something that we have been.

Discussing that's I did Monday our devsecops event. And that was one of the themes their security Champions. They're not security people, right but they're security Champions, but what's interesting is Marty.

I'm listening to you and you know, I started my tech journey in the hosting infrastructure business when we used to sell fingers eyes and ears. That's what our pink pipe fingers eyes and ears. I couldn't make a living doing that anymore.

Right because there's no one there who has fingers. I mean, it's kind of a it's a different world. We live in with this whole multi-home.

Multi. Oh, yeah, everything World. Well, the interesting thing about it is that you know in this kind of atomized world, we're networks are dispersed and the cloud stuff is ephemeral like our standard ways of getting our hands around the kind of what's going on in our networks really doesn't translate very well.

If you go around the show flooring you look at all the big vendors, this Cisco's in Palo alto's they still have you know, really the architecture that we develop 25 years ago, you know back back in the early Cisco days and the ISS and really sourcefire whether it's appliances and management platforms and all the stuff. It doesn't really work very well in the cloud. So we go out in the car different vendors from the cloud.

We try to kind of glue it together. And you know, if you go into these Enterprises that are atomized where I've got, you know, these numbers that are dispersed in the femoral all the traffic's encrypted and it's very diverse with Cloud it and OT environments. Ask them.

What have you got? What's it doing? They're like no idea no idea.

I don't use it. No idea of what they got and what it's doing but the very notion of having like one set of controls or one set of management for my quote unquote on-prem. That's not really on-prem anyway anymore.

And then once said for my cloud and once said from my you know, remember the we used to have this company owned devices and we lived in a world where we were gonna bifurcate our phones or we have two different way. That's my work phone. There's it's nonsense, right?

You can't exist in that today with those kinds of solutions. Yeah, totally so, you know and we'll surprise you we had an autography kind of like deal with this very capably and the real big differences that you know, it's a brand new platform that's architecture for this world that is atomized and it's like in the special things about it or that, you know, it's just it's a pure Cloud SAS solution that does real-time traffic analysis, but it does without having to deploy anything and it can see both your on-prem environment and your multi-cloud environment and I'm private can look at it and OT environments using one language one UI and you know, we have this frictionless deployment thing that we do it's like You know set up for this world so you can have visibility anywhere. You need it anytime you need it.

We don't care about encryption because we're not looking at packet data itself and and it can handle any environment and you know, it's an architectural thing like the architecture is fundamentally different but it's the other thing about it's just real time. Like nothing out there almost everything is just throw your stuff in a data Lake and we'll do reports. We'll figure out what's going on.

It's like well that's useful that you know, it is useful for friends. Yeah. It's really useful but but you're right that is that is The way right and not to get all men DeLorean on it, but that is the way right.

Where we just we collect this data and then we do analysis on it and then we pontificate and Ponder and and you know at some point in the near-term hopefully future we say, oh, yeah now we see what's going on. Yeah, and you know in the meantime, there is the bank they moved that money to the next bank and everything else is happening. Yeah.

Well, you know, so like we focus on what everybody expects, you know, me and people I live with to do is like compromise detection and threading stuff. Yeah, we do that but we can also this approach you can see configuration drift as it's happening. So like you can see in real time.

Hey man this we're getting it we're drifting out of our compliance policies our governance policies and stuff like that. So it's really interesting because you know, we focus on a few use cases because you have to right but the platform is very broad, right? So anyway, it's it's really cool.

And this Adam is Network thing people get it, you know, we brought in this kind of second level thing where we talk about, you know the attrib. Atomized environments so that people can comprehend, you know, you don't just say atomized and you make up whatever you want to it's like no, they are dispersed femoral encrypted and diverse. That's what we call them.

I love garments. Yeah. I want to talk about RSA.

Yeah, but before we do, I want to just try a little bow on this one. Okay, for people who want to find out more about the atomized network? com.

That's right. And I know you guys have done a bunch of white papers. They still calling white papers are my old you know, yeah, I think they do.

All right. I still call my parents. Okay?

Yeah, but your wife papers case studies. com and you know this term atomized Network. I mean to understand what it is and and What it means to you, I mean it there's no hidden magic meaning here.

It's it's the world we live in today. It's the world your it lives in today. Let's turn time RSA.

All right, so it's been it's back. You know, this is what I remember. What's been your impressions?

What are you hearing from? People? What are you see?

Um, well my impressions of largely been, you know, nonstop trade of meetings, but I hear you. It's obviously AI is on everybody's lips right now. Not the we're gonna use AI to detect funky behaviors and networks and stuff like that.

I mean everybody's doing that too. But now it's like we're gonna use llms to essentially as you know, it's automated decision support and automated Technology support for our security platforms. So, you know, we've been kicking around too.

We're not announcing anything but you know, it's very clear that if I can speak English to my product and have it spit out the language that the product runs on that just makes people more productive more quickly. So we've been kicking around and there's a bunch of announcements that have been done there from you around. Yeah around.

Yeah, there's been a lot of announcements, but you know, I Had someone sitting here yesterday and they told me that they now. generative AI enabled their product Okay. I said okay.

That's what I said. Okay. So what exactly does that mean?

Yes. well No, no, but what exactly that I mean, can I are you saying I could talk to it. It's gonna do things.

Well not exactly. Are you saying you've put like all of the knowledge from your product into it and I could it's like a super help system a really easy houses not exactly. So what exactly does it mean then tell me that you I mean, all right, or you just doing a press release here, but look I had a conversation with a woman a couple.

I don't know a half hour ago Chase Bannon. She's with miter. Yeah, and we were talking about this.

We're at the beginning in the beginning here. Oh, yeah, I think The killer app for generative AI has we don't know what that is yet now not only do we not it's the beginning of the beginning not the beginning of the end. I think prudent person says we're looking at it.

Yeah, we're gonna figure out look there's a lot of goodness here somewhere wrapped in this. Yeah. We got to figure out what that right goodness is for us and our customers and our unique cases.

And we also have to figure out. I mean, there are And I'm not in the Elon Musk Camp of saying we need a moratorium that's ridiculous. But we do have to figure out some issues here.

Oh, yeah. I mean as you start attaching these generative aisle and security data, it's just like I mean what could go wrong, right? Who would want that information?

I mean, I've only been doing this for like 27 years. But yeah, I've asked the answer what could go wrong a lot. And yeah it usually we find out pretty soon thereafter.

Oh, this is a pretty easy. What could go wrong though? Right?

You don't need to be I could figure it out. I don't need to be Marty. But yeah, well there's that.

Yeah, the the fake fake news kind of aspect. Oh, yeah, and we but we haven't even figured out like basic stuff like IP ownership right now. There's also like there's all sorts of hair on this that you know, and there's gonna be you know, there's gonna be the Facebook moment where somebody crystallizes what this is actually good for and hopefully the people who do that are gonna be more responsible than the Facebook people.

I hope so so that you just hit on my personal fear, which is you know, look these open AI folks and Microsoft invest the people are in Chad GPT. I'm sure they're Up outstanding upstanding whatever people but they're not the only ones that are gonna have I mean Google has their own and I'm not saying, you know, they do no evil of course, but there's a lot of other people who are gonna have these that aren't so well. Hey, it's software be the genie is out of the bottle.

So this thing is is going what the Russian flavor you want the kids actually. Well, you know, and he's flavor and and that that is what really gets to be the problem. I mean, we almost accidentally dismantled democracy was social networking for crying out loud because people were just like, I don't know it's so sure we haven't yet.

I think that yeah. Yeah still TBD but yeah, but yeah, you know if you and your misses already, right and it's like and and the people behind her like they know what they're doing and they're like, yeah, but it you know, it drives engagement to whip everybody into a frenzy and if we end up in a civil war, okay, oopsie, you know what so when I was in law school My con Lord teacher he used to be at Stanford and he had he was the con Lord teacher for rain quiz and Sandra Day O'Connor to Supreme Court, and he was talking about back then it was Roe v Wade and and abortion but he always said, you know technology solves these issues, but Society can take 25 years or more. Catch up to technology.

Oh, yeah. And that you know, I think that was still seeing that in social media as a society. We haven't figured out.

How to use social media without causing a Civil War and it's gonna be another 25 or 40 years until we figure out how to use AI. without this dark underbelly of potential Yeah, you know you have this well, it's interesting it interaction because not only do we have the kind of the rise of social media and the impact on society but also the delivery mechanism of the smartphone as well. You have this kind of right that I'm only a lion portal that oh, yeah.

I brought these never together. You're 100% correct? I just cleaned that term.

All right. Blame him. Yeah, but I agree with you and then but the potential for this is is equally yeah, maybe even bigger.

So I'll tell you a little story and I know we don't have a ton of time but all the time you want Marty. I'm glad you're here before before I got into photography. So in the time period between when the pandemic hit and I'm sitting on my couch and my sweatpants thinking about what I should do with myself and I joined the photography.

I spent a good I don't know six to nine months looking at disinformation Deep fakes and kind of the technological means of dissemination of disinformation misinformation things like that and I actually did work and worked on did some patent work and prototype software to figure out how to essentially mitigate deep fakes and it wasn't mitigating it by detecting deep fakes. It was mitigating it by, you know, people who are interested in having a healthy trust relationship with Society every monetary interest in being able to validate the stuff. That's there.

Anyway did all this work. Got to the point where I figured out the only companies that are capable of doing the absorbing The Upfront cost to do the model that I came up with. We're like Google or Microsoft or somebody like that Marty resch is not capable of generating that much VC.

No not today and the solution to this problem exactly but it's gonna be interesting time. What about netography specific here at RSA anything you've seen happening in your meetings or hearing from just people I think people are really they're interested in and they're ready for our kind of our thinking around. Hey, there's a big architectural problem here like the major vendors have a sun cost in the architectures that they're in and they don't match very well with the Enterprise architectures that most networks actually have today so You know, so we we claim like our things like you need a new architecture.

We actually have it and you should pay attention and you know, we're starting last year. It was like people were like This is weird this year. They're like, okay, I'm listening.

I get it, right. You know what? The I came here from Amsterdam.

I was like Cube contative car. Yeah. Flew out here in San Francisco.

This was that was probably my seventh or 8th kubecon as I do Europe in North America. Where it used to be very developer Centric that whole Cloud native movement was very different. You know, my good Services kubernetes is kind of thing.

Here it was what? I I say, it's all about the plumbing. In that it was about platform engineers and that's our reasons and Ops people about how we set our environments so that we can't expect developers to be Security Professionals.

They could be security Champions. They could be security cognitive security cognizant, but they're not gonna be a security person. Let's not let's not fool ourself, but this emphasis on creating environments That can be secured.

Yeah, that can do better more faster that understand. We're gonna live in whether it's you know, we're gonna live in this multi-honed world of public cloud and private Cloud it dated Center and and portable and mobile and work from anywhere do anything like the movie everything everywhere all at why? I was heartened to see that that is now becoming you know, an observability is a huge piece of this right how we observe and kind of Monitor and act and and look at the speed.

It's moving. We've got to automate some of those actually I think that's the model for the atomized network. Yeah, I think it very much is like the observes ability to do this environments is very low right now and you know, and our our position is that it needs to improve and you know, we have the way to do that.

I hope it will but oh, yeah, right. But yeah to your points. It's also interesting they're talking about it.

But there's also like Oliver over at Pangea and windows nighter at thistle. I think. Yeah, they're building the component tree.

So that it's much easier to build secure platforms and secure software because they're they're basically turning the tricky bits into apis now that you can use that are hard to screw up. Yeah instead of like trying to reinflate your own, you know roll your own over here we So that I think is a big issue too. Can't roll your own.

I mean you can well, you know, they screwed up, right? Things are more complex now. You can't just You can roll your own but I can guarantee you it someone's this systems.

Are there doing a better? Yeah, you can't it was like the whole thing. You think you do security for the infrastructure better than the cloud provider did work does maybe now and then but not consistently you don't have that kind of investment.

Yes. It's exactly like that. It's exactly like providing cloud services that have a dedicated team that secures the cloud now, we're securing your apis.

Now, we're securing your hard work component tree. Like it's great. Great idea.

Those guys are going in the right places. They've got their resources. Yeah.

Anyway Marty man. It's a pleasure to see you. It's great to see you at RSA to food.

com. It's the itemized Network. It's about how to manage control.

It's cure it. We'll be back with wrapping up RSA day. Whatever.

This is three or four. Well, I started Monday. Maybe that's AGC day.

Yeah it was that did they still do AGC Maria? Yeah. I didn't realize well, so for the last eight years we do the devsecops thing here with that much in my wood fire.

I say so I I don't get a chance to go over there anymore. Well, you know, I'm an early stage startup CES. I got a good you got to go see Maria and the AGC folks you speak to tell her I said hi.

I absolutely all righty. Hey, we're gonna take a break. We'll be right back.