Transcript of a BriefingsDirect podcast from the HP Discover 2012 Conference on how our views of security need to be expanded beyond protecting the perimeter.

1. Resiliency, Risk Management Add a New Dimension to
Discussions about Enterprise Security
Transcript of a BriefingsDirect podcast from the HP Discover 2012 Conference on how our
views of security need to be expanded beyond protecting the perimeter.
Listen to the podcast. Find it on iTunes/iPod. Sponsor: HP
Dana Gardner: Hello, and welcome to the next edition of the HP Discover Performance
podcast series. I'm Dana Gardner, Principal Analyst at Interarbor Solutions, your
co-host and moderator for this ongoing discussing of IT innovation and how it's
making an impact on people’s life.
Once again, we're focusing on how IT leaders are improving performance of
their services to deliver better experiences and payoffs for businesses and end
users alike. This time, we’re coming to you directly from the HP Discover 2012
Conference in Las Vegas. [Disclosure: HP is a sponsor of BriefingsDirect podcasts.]
At the event, I had a chance to sit down with Raf Los of HP Software. Raf has an interesting
personal perspective on “enterprise resiliency,” which I initially heard about through his blog,
Following the White Rabbit.
Raf will now share his point-of-view, and you can also read more about “enterprise resiliency”
on Raf's blog, or by following him on Twitter at @wh1t3rabbit.
With that, Please join me now in welcoming Raf Los. Welcome back.
Raf Los: Thank you for having me again.
Gardner: Tell me a little bit about your vision. We all understand security and why it’s
important, but you've developed, I think, an expanded category for security. Tell me what you
mean and where that is heading.
Los: Security, over the years, has evolved from an absolute concept of a binary decision: is it
secure or is it not? As we move forward, I believe very strongly that what we’re
evolving into is, as we’ve heard people talk about, risk management.
Risk management starts to include things that are beyond the security borders. As I
talked to customers out here, I was having an "aha" moment. A little while ago, at
one of our converged cloud chats, we were talking about how things fail.
Everything fails at some point, and chaos takes over.
So rather than talking about security, which is a set of absolutes or a concrete topic, and boxing
ourselves into threats from a security perspective, the evolution of that goes into enterprise

2. resiliency. What that means is that it’s a combination of recoverability, security, performance,
and all the other things that bring together a well-oiled business that can let you take a shot to the
gut, get back up, and keep going.
A lot of the CISOs nowadays are set up to fail by their organizations. It’s a non-winning position,
because you're put into a position where the board of directors, if you’re lucky, or your CTO or
your CIO asks, "How much money do you need to secure this organization?"
That's horrible, and no matter what you say, you lose. If you say nothing, you lose. If you have
$10 million, a billion dollars, there's no amount of money you can spend to make your company
completely secure.
Acceptable risk
So what are you aiming for? You're aiming for a level of acceptable risk. Well, acceptable risk of
what and how and how much you’re aiming for. It’s not just acceptable risk. We’re
looking at acceptable risk from a security perspective, but we need to incorporate
the fact that we're going to get owned.
We need to get out of our ivory towers and we need to start thinking about the
fact that attacks happen and insiders happen. There are things that are going to
transpire that are beyond our control and things that we cannot plan for.
Technology will fail.
People and processes will fail. Our own technologies, our own minds will fail us. Our best
friends will fail us. People get tempted. This is a human nature that the weakest element will
always be a human being, and there's no patch for that.
So how do we move and get back to business as usual? How we get back to being a resilient
business. That’s a cool concept -- that I have enterprise resiliency.
Gardner: This makes great sense to me, because we’ve been talking, over the past several years,
about how security needs to be applied to different parts of the organization holistically and
needs to be thought of in advance, be built in, and become part of a lifecycle.
But it makes double sense to me to expand the purview of security. It really is in making sure
that there's performance resiliency, failover resiliency, backup and recovery resiliency, and data
backup and duplication resiliency. So why not look at it through the resiliency lens? It makes a
great deal of sense.
Los: Absolutely, and that’s exactly where this is coming from. I’ve actually given a series of
talks and called it the introduction of Chief Chaos Officer. It’s not an actual role you’re going to
see on monster.com, but it’s just a concept. It’s kind of like the aging Killcraft, a Chaos Monkey
thing from Netflix.

3. Can you, as an organization, get comfortable with the fact that things will fail? In the talk that I
gave, it comes from the perspective of you’ve got a lot of great security technology. You've
probably got full disk encryption. You back up. You have firewalls, redundant networks, and all
these things that you do.
You have procedures that you’re supposed to follow in the red book, a big red binder that sits on
your incident response handler's desk, and you have all these things that are supposed to be
followed.
Your people are trained, and your developers are supposedly writing better source code. These
are all things that we can test through penetration testing, which means on Sunday between 7:00
p.m. and Monday 3:00 a.m. on the following four IPs, but only when we’re ready. Can you go
ahead and pen-test us?
No patch for the human
And it’s like, okay, we've tested ourselves, we’re confident that we’re secure. I'm making kind
of a scrunchy face, because that’s not really what this means. I've worked with folks who are red-
team testers. I've yet to meet a red team that's failed, because, as I said, there's no patch for the
human.
When you can’t penetrate a system or an organization via a new O-day, you'll walk in through
the front door by walking and carrying flowers from the CEO's wife or something, and you'll
own the organization that way.
But the question isn’t whether you'll be owned or not. What happens next is the big question, and
it encompasses things like how good is your PR strategy. Do you have all the legal pieces in
place? When your backup system fails or your entire data center gets wiped out by Hurricane
Katrina, in a worst-case scenario, do you just sort of throw up your hands and go, "Well, that
stinks? Well, we were in the cloud." Oh, your cloud just got wiped out. Now what?
Gardner: Okay, let’s go to the cloud. I've been speaking with a number of folks lately who hold
the opinion that at least for small-to-medium sized businesses (SMBs), going to the cloud can
improve their security and resiliency sufficiently to make it a no-brainer. For enterprises, it might
be a longer haul and there might be more complications and issues to manage.
Do you agree with that that the SMB can outsource some of this resiliency to the cloud provider
who needs to do it and has the resources and experience to do it better than the SMBs do?
Los: There's a number of SMBs that can greatly benefit from the fact that good security talent is
expensive and good security talent that can actually work towards a more resilient, more secure
enterprise is very difficult to come by. It’s becoming scarce.

4. So small companies do the best they can with what they have their hands on. And there's
certainly a ton of benefit to be gained from going to a shared model like a cloud. Does it raise the
bar for everybody? I can’t say yes. On the whole, do I believe it raises the bar? Absolutely. Let's
take the angle of threat intelligence.
I'm a small entity with five IP addresses on the Internet. How do I know what bad guys look like?
If I have my five IP addresses in a public cloud some place, that public cloud is attacked billions
of times a day and probably subscribes to numerous threat-intelligence services. They know
exactly what to look for. And if they don’t, they can find out pretty quickly. They probably have a
ton of resources from the security perspective.
Do I think it’s better? Absolutely. SMBs have a lot to gain by taking that step. You have to be
intelligent about it. You can’t just say, "I'm going to move to the cloud and I'll be secure." Let’s
be realistic about it. Get a partner that will get you there. Do due diligence on the partner that
you’re choosing to work with. You still can’t run into the water with your eyes closed, but I think
there's a lot of benefit to be had, absolutely.
Gardner: And as we’re learning more here at Discover about the HP Converged Cloud. In a
sense, it’s a cloud of clouds. You have hybrid delivery. You might have a variety of sources for
applications and services. You might have data in a variety of sources across a variety of
organizations, running from on-premises to managed hosting to multiple cloud and SaaS
providers.
Is there a way that, in addition to the security that's going on within those organizations, you can
add more security at that converged cloud layer, particularly when you’re converging network
storage, workload provisioning, governance, and so forth. What’s the add-on value that the HP
Converged Cloud can bring resiliency-wise?
Choice, consistency, confidence
Los: Our Converged Cloud strategy focuses on three very simple words: choice, consistency,
and confidence. We’re focusing on consistency and confidence here and perhaps a little bit of
choice as well.
What we’re saying is that because we focus on OpenStack, because we’ve chosen to build our
platform completely on OpenStack, because we’re building across a single model, a single way
of operating, as Meg said yesterday. You can build a single security operating model and you'll
be able to implement it across your private, public, and hybrid models.
I don’t think it’s realistic to say every company will have a public cloud-only presence, just as I
don’t think it’s realistic to say companies won’t have a public cloud presence. Most organizations
will be a combination of on-premise IT, private cloud, virtual private cloud, and public cloud, all
of that somehow sharing space and workload, bursting out to each other when necessary.

5. As I said systems fail, clouds fail, everything fails. So when we think about, and we’ve had this
on our converged cloud chat, when things fail, you have to start architecting for failure and
resiliency.
Because of this architecture that we’ve had, if you choose to get one other partner to back up
what you have with us, pick a partner that's got the same OpenStack platform and the same
models. It’s not going to be hard. There are lots of them out there.
OpenStack is a big platform. You should be able to build once, package once, deploy many
times. This saves on manpower, on cost, and on having to redevelop the security wheel over and
over and over again. That provides unbelievable amounts of flexibility of what you can do with
your enterprise.
When one cloud or a connectivity to one cloud fails, or maybe not fails, but you get attacked in
one position, you can bring up other capacity to compensate for that. That's where the true value
of cloud comes in. It’s elastic computing. It’s not a marketing buzzword.
Gardner: And when we think about the HP philosophy about cloud that it’s not lock-in, that’s
it’s not tied to a single nameplate on the cloud, it seems to me that there's an opportunity to
reduce risk further, when you have open fungible elasticity and bursting. If there is a trouble, a
problem that comes up, or a red light goes on, you can, according to people I've spoken to,
literally move an entire data center virtually from one location to another, reconstitute your
perimeter, and so forth.
So is there an inherent benefit, security and resilience, in the ecumenical bursting approach that
HP is adopting?
Los: Absolutely. That’s what that whole choice part is. That's the word that we’re using. It’s
choice, consistency, and confidence. We were all consumers, Meg was a consumer of ours as
well, at some point. I was a consumer before I became a vendor.
Option to standardize
This is the longest I’ve ever worked for a vendor in my life and I can’t imagine myself
anywhere else. The reason for that is because I think we give people the option to standardize on
us, but if they chose to move off of us at some point, it’s okay. We’re not going to make them
completely redevelop their platforms. That makes the reason to stay with us that much more
compelling.
This is one of those things where locking somebody into a platform is a terrible idea. Vendors
used to do this years and years ago with the more proprietary platform. "We'll get them on it, and
they’ll never be able to get off." That's not smart thinking. It's just not.
Gardner: It’s not resilient.

6. Los: It’s not resilient, because it fails everybody. It builds animosity and tension, and when
something fails, everybody loses.
Gardner: One last area I like to get into is this idea that we’re seeing highly virtualized
environments. We’re talking about virtualized server instances, workloads, and network storage.
Disaster recovery (DR) technologies have evolved to the point where we're mirroring and
moving entire data centers virtually from one location to another, if there's a resiliency issue like
a natural disaster or a security or cyber attack that impacts an electric grid or something along
those lines.
Is there a sort of a tipping point that we’re at, when it comes to higher levels of virtualization,
some of the DR speeds, working with de-duplication and reducing the amount that needs to be
moved in these instances, that gives us this higher level of security, simply because of the
mobility in which we can now exercise for vast amounts of data and applications?
Los: I believe so. Do I have an answer for that that’s clear and crisp? No, I don’t know, and I saw
a lot of that fantastic stuff. One of the things that caught my attention is we’ve broken the 100-
terabyte-an-hour backup barrier. That blows my mind. I used to work in IT when we were lucky
to get 100 gigs an hour and I remember 100 megabytes an hour being a challenge on those giant
DLT tapes sometimes over networks.
The idea that we can take an entire cloud and because of data de-duplication, because of the way
we move workloads and policies all in one fell swoop, and the way we package things once and
move them, as a model, rather than everything together, moving metadata rather than the actual
data, it gives us the ability to move things.
One thing that everybody needs to think about is what is this doing for our bandwidth
requirements. Bandwidth is a silent thing nobody really thinks about. I've had this discussion
with our networking folks. People are building clouds all over the place now and that's great, but
it’s really easy to get out to a vendor, to get out to a public cloud or whatever, amass an absolute
metric ton of data, and then say, "I want to move." How are you going to take your data from
there to there? That’s a big question.
You need to do your homework ahead of time, make sure you know what you’re getting into, and
make sure you know what technologies are being supported. Don’t get in and know the dinosaur.
This is all important stuff, and you want to have a vendor and a partner that is at the cutting edge
of technology for stuff like this.
As Jeff Katzenberg, somebody who has been into cloud business since before cloud was a
marketing buzzword, said, "Hi. We’re HP. We’ve been doing this for a while. Join us. The water
is fine."
Gardner: Very good. I'm afraid we'll have to leave it there. We’ve been talking with Raf Los of
HP Software on his interesting personal perspectives about the evolution of security into the
concept of enterprise resiliency, and how that also impacts the move to cloud and cloud models.
Thanks so much, Raf.

7. Los: Thank you for having me once again.
Gardner: And thanks to our audience for joining this special HP Discover Performance podcast,
coming to you from the HP Discover 2012 Conference in Las Vegas. I'm Dana Gardner, Principal
Analyst at Interarbor Solutions, your host for this ongoing series of HP-sponsored discussions.
Thanks again for listening, and come back next time.
Listen to the podcast. Find it on iTunes/iPod. Sponsor: HP
Transcript of a BriefingsDirect podcast from the HP Discover 2012 Conference on how our
views of security need to be expanded beyond protecting the perimeter. Copyright Interarbor
Solutions, LLC, 2005-2012. All rights reserved.
You may also be interested in:
• HP Expert Chat Explores How Insight Remote Support and Insight Online Bring
Automation, Self-Solving Capabilities to IT Problems
• Investing Well in IT With Emphasis on KPIs Separates Business Leaders from Business
Laggards, Survey Results Show
• Expert Chat with HP on How Better Understanding Security Makes it an Enabler, Rather
than Inhibitor, of Cloud Adoption
• Expert Chat with HP on How IT Can Enable Cloud While Maintaining Control and
Governance
• Expert Chat on How HP Ecosystem Provides Holistic Support for VMware Virtualized
IT Environments