Next in Tech | Ep. 289: Storage and Security Pivots

View Full Transcript

[00:00:00] Eric Hanselman: Welcome to Next in Tech, an S&P Global podcast where the world of emerging tech lives. I'm your host, Eric Hanselman, chief analyst for industry research at S&P Global. And today, we're going to talk about what has become an interesting pivot to security that many of the participants in the storage infrastructure market are making.

[00:00:23] Eric Hanselman: It's everything from core storage capabilities, a lot of backup and resilience players, lots of different aspects that are starting to maybe embrace their security side. And with me to discuss it are analysts Henry Baltazar and Justin Lam. Welcome back to the podcast to you both.

[00:00:42] Henry Baltazar: Thanks for having us, sir.

[00:00:43] Justin Lam: Yeah. Hey, thanks for having me.

[00:00:46] Eric Hanselman: It is great to have you back because this is an area where I guess we'd seen early rumblings in this for years now really in terms of some of those capabilities. And if you think about it, if you happen to have an understanding about where all of the most critical data of an organization happens to be stored, how it's accessed, the dynamics of how it's accessed, that starts to be really valuable.

[00:01:14] Eric Hanselman: And we saw things like, the early efforts to go protect from ransomware, because what did ransomware do? It pivoted from the traditional sort of, lock down, blow up, exfiltrate, whatever, to, encrypting all of your data. Well, guess what? Your storage system would figure that stuff out.

[00:01:30] Eric Hanselman: Clearly those ideas have been at play for a while. But I guess maybe Henry, if you can set the stage a little bit, it now seems like there are many more players that are starting to do more and becoming more ambitious about their desire to step into a greater role in security.

[00:01:47] Henry Baltazar: Yeah, I think you're correct on that. I mean, you know, definitely ransomware and cyber resiliency issues have really driven the reasons for why storage to know more about security and play a bigger part in the security roles or a bigger part in the security processes. So that's not really a big surprise, and I think that'll continue to happen.

[00:02:08] Henry Baltazar: And, I think the issues are, as this market develops, what types of overlaps wind up happening, what kind of confusion starts happening, and also how do these storage players wind up having a relevant voice to stakeholders that really don't care about storage, which is going to be a big

[00:02:25] Eric Hanselman: Could it be confusion and overlap in the security market? Never before, right, Justin? This is, we’ve had lots of overlap, but I guess, is this different and are there new opportunities?

[00:02:36] Justin Lam: Yeah, I'll take a pass at this. I certainly do think there are new opportunities. I think that first and foremost is that organizations fundamentally are understanding how important data is. Like data management, data protection, data security, these are increasingly no longer just IT or infrastructure problems. These are strategic issues that organizations, even business-facing ones, have to attest for. We just see more and more companies offering their services, including S&P Global. We offer our services as a subscription. We also have contractual obligations to privacy. So being able to attest for that is no longer just a checkbox sort of thing.

[00:03:21] Justin Lam: It is very much a revelation of how organizations internally look after their data, whether that is in terms of data protection, data availability, data integrity, data security, those are all increasingly related. So, I think there's huge amount of opportunities for that, and I think it's not necessarily driven by central groups.

[00:03:45] Eric Hanselman: That does start to raise the question of, you're now working across constituencies. And we saw this in years back in the pivot of network monitoring, application performance monitoring. Those kinds of approaches got pivoted into network detection response and XDR and a number of interesting things.

[00:04:08] Eric Hanselman: It was something where you had to move from the networking teams' views and capabilities, and meld, integrate, fuse in some way those together with the security teams. And that wasn't really all too alien to either side. It seems like though, with storage there's a much larger gap, chasm, and more distance between security teams and storage teams.

[00:04:36] Eric Hanselman: And I guess, this does seem to be something that is moving from those in the storage realm looking to go embrace those sort of security capabilities, as opposed to security teams necessarily, leaping into their storage assets and trying to extract more data. Is that, that a fair statement?

[00:04:53] Henry Baltazar: I mean, from the storage guy perspective, and obviously the back foot perspective, I think the issue is, I mean, we're working on our jobs and working on what we need to do to get the infrastructure running and cost efficiency and things like that. But at the end of the day, if you start looking at all the new challenges and what's going on with sovereignty issues, more of the resiliency issues, and what are we doing with cloud and where should data be and reside? All these issues, when you look at them, all need better data intelligence. So, though you may have storage tools that look at things and, "Oh, I could see all my LUNs. I could see all my file shares," and blah, blah, blah, that's... I think what people are realizing is that's not good enough to know about that in just my on-premise storage silo. It has to be everything else beyond what they're looking at, and I think that's why they have the pressure, and that's why the vendors also want to make sure that they're opening up the capabilities so they can do things like discovery beyond what's just a normal storage claim. Do other capabilities like that to make sure that, these stakeholders actually know what data they actually have and where that data resides and, know, and have a, at least a meaningful idea that they can help provide as they try to help, you know, the other, their adjacent stakeholders like whether it be their security teams or compliance teams or application teams, helping them better understand where their data is and what value they could help them in terms of resiliency, performance, blah, blah, blah.

[00:06:24] Eric Hanselman: So to expand beyond the on-prem, is that just simply a matter of, "Hey, we've got all these access statistics being generated out of our cloud environments. We just bolt up to that and integrate them together, and voila, we're done," right?

[00:06:37] Henry Baltazar: Yeah, but it's becoming more and more difficult too, right? Because now you also have political issues and sovereignty, physical where does it reside now is becoming an issue. And also, is that physical location going to be a vulnerability also? Because we've obviously seen issues with data centers also under duress.

[00:06:57] Eric Hanselman: So, I guess that sort of starts to raise that question of what's going to add value in this shift, and what are the capabilities that are necessary to really make this relevant for security teams and give security teams the motivation to be able to start to really leverage some of this capability?

[00:07:18] Justin Lam: I'll take a pass at this. You know, I think that there has to be, there has to be a true north, between the security and the infrastructure storage teams. You know, if you just simply are asking security teams to become familiar or more operationally aware of the challenges of storage or vice versa, you're just going to show how big the chasm is. I think if you unify and say, "What are we doing this for? Why do we care about data security? Why do we care about organizational resilience? Why do we care about the lowest cost of operation?" Like, what are those unifying things that determine, you know, how we collect, monitor, process, leverage data for our organization? You have to look at it through that lens. You have to be able to identify what is the business issue. You fundamentally will have historically two different cost centers trying to compete with each other, when in reality, if they both think of themselves as business enablement and they think about what business they're enabling, I think that's where the opportunity really lies, and that sets the right context for how these teams can work closer together.

[00:08:38] Eric Hanselman: It means that you've got to take, well, I was going to say a big step back. Maybe that really is a big step up in terms of perspective. You’ve got to raise the altitude from which you're observing all this.

[00:08:50] Justin Lam: Yeah, I just don't think that, you know, there's, there is... I think everyone, especially today, you know, if they don't necessarily understand, like, where the data is or, what are the possible threats against it, they certainly don’t know how important it is for them to manage operationally.

[00:09:10] Justin Lam: They know the opportunity costs, behind that. I mean, that is something that I think every business executive knows. You know, not to pour salt in the wound for, you know, some recent ransomware incidents, but these are resulting in material events in the Securities and Exchange Commission. And as you see some of the breakdowns for them, they have really high opportunity costs. So, I think every executive out there, even if they're not in a technology role, they understand they have to be accountable to the possible detriments or the possible losses to data, whether that's via a breach or whether that is downtime. And so, being able to identify then what is that business issue? How is this organization earning more customer trust? That has to be the unifier between different security and infrastructure storage teams.

[00:10:07] Eric Hanselman: I guess it sounds like that winds up being necessary to raise a level beyond the existential risk concerns of, if we can't keep the business running, to actually starting to think a little further ahead. Clearly there are existential risks behind this. Where does that start to happen?

[00:10:26] Eric Hanselman: And I guess, the reason why I'm questioning around this is because, these are the things that it seems like it's always been really difficult for organizations to get their heads up out of the day-to-day slog and start thinking about what is that much bigger picture, that higher level kind of view.

[00:10:45] Henry Baltazar: Yeah. Let me jump in here for a second. I mean, I think I agree with you. I think the issue is the problem organizationally. How do we look at these problems, and how do we put ourselves in other people's shoes, right? if I'm in an infrastructure perspective, I want to know that type of data intelligence or those type of metrics because selfishly, I want to be able to say, "Hey, it's not our fault" when the trouble ticket comes in saying, "Why is your storage system not responding and blah, blah, blah?"

[00:11:14] Henry Baltazar: And it's like, you want to be able to say, "It's not my fault. Let's triage this and get going forward." So selfishly, you're going to want to have some of those capabilities. The problem is nobody wants to have another tool and more and more tools. So those type of issues also have to get resolved on the organization level as well, higher up. But I think the problem is we're all chasing things and everybody wants a little bit of knowledge; everyone wants a little bit of those capabilities. The problem is what ends up happening if you have these overlapping tools.

[00:11:45] Eric Hanselman: And certainly, being able to minimize the mean time to innocence for any problem is a big motivator. That, that's a biggie. But do security teams need to walk a terabyte in the shoes of the storage teams in order to get this?

[00:12:02] Eric Hanselman: Clearly there's a ton of value here, and I guess the thing that I’m wrestling with is how do we start to get the other parts of the organization to understand that, hey, this stuff is here. You can use it. This is really valuable. You could use that stuff. I just... it seems like, knocking on the security team's door and saying, "Hey, we've got all this cool stuff," isn't going to, gain immediate success.

[00:12:24] Justin Lam: You know, I think there is an opportunity for security teams and let me just say this, that is obvious, but it's really hard for security teams to necessarily affect or influence changes to data itself. Data has a tremendous amount of gravity to it, I think that being able to make any changes to data where it resides, what rules are applied to it, that's frequently beyond the control of individual security teams, even though they may dictate policies. As far as operationalizing those, infrastructure teams become closer together. when it comes time to, I think, to being accountable to the risks and the measures taken, if there is a tabletop exercise and we don't know where their data is to be restored in the event of ransomware, or I need a clean place to rehydrate the data that is not going to be infected for incident response purposes or what have you, you know, that sort of partnership, I think, is increasingly needed.

[00:13:26] Justin Lam: But I think that there's an opportunity for security teams to literally, consume a terabyte or two, understand what that is, and then understand how that quantitatively lowers the risk.

[00:13:38] Eric Hanselman: I guess it's one of the problems we've always had in security, which is this sort of abrogation of the data owners of responsibility for securing the data. And it's something where we've been how many years of trying to push back some of that data ownership and the responsibility for managing data onto what, what ought to be the logical owners of it.

[00:13:59] Eric Hanselman: And that, that certainly is a struggle, and maybe, I don't know, does AI and expanded data awareness maybe start to offer a way out of that? In that we are starting to get to a point at which we're discovering more data, we're understanding it better, hopefully a little, and maybe starting to get back to some of the owners and generators of that data to maybe have a greater role in how it's managed and secured.

[00:14:27] Henry Baltazar: Yeah, but I think that's the difficult part, right? Because you've got the application stakeholders, you've got the security team, you got the infrastructure team. Everybody else has their own motivations in what they're working on, it winds up being difficult. Like, if I'm taking, like, a storage example, a lot of the storage providers recently or over the last couple of years, they've been adding detection tools.

[00:14:47] Henry Baltazar: So, they notice "Oh, wait a second. The compression or dedup ratios are off now. Why?" And then they go look, and they found out, "Wait, why did that volume get encrypted?" So, I've got to go and either talk to the security guy and say, "Hey, did you encrypt this," or "Is this something that shouldn't have been encrypted?"

[00:15:05] Henry Baltazar: And the security team also has to go talk to the stakeholders too. It's "Hey, application person, did you encrypt this data? Why is this data encrypted?" So, it's one piece of information, but then how does that flow through the organization in the appropriate manner? How do we know it gets prioritized the right way? Because I'm sure Justin’s stakeholder is looking at a giant dashboard of stuff they have to fix. So how do they prioritize that also? So, I mean, I think there's going to be a lot of challenges in terms of how the communication happens, especially across the different silos of an organization.

[00:15:37] Justin Lam: I would say just as a little bit of, add a little bit of hopefulness to this, it's, I think there's opportunities ahead, too. You know, I don't think we can... any of us can understate the possibility of AI in a lot of toil infrastructure and storage operators. A lot of times, you know, what we have applied as policy has of been either, some combination of so-called best practice. And I think that, you know, when you have more and more operational telemetry, more observability, more of those things, and then you can be able to simulate, "Hey, if I make policy changes, I am going to see what it's like to apply these levels of protections, can I take that out, that guessing game out? Can I reduce what that guessing game might be?" I think there's some intriguing opportunities in order to expedite some of the inter-team communication, and to make that overall improvement of the infrastructure and the security posture better.

[00:16:47] Eric Hanselman: Well, because it does seem that takes it out of the realm of, hey, we did the tabletop exercise and said when the security person sees that, this particular volume got encrypted, that they should immediately notify these folks in the security team. If in fact we've got a fully AI-enabled security operations environment, this is data and more signal that starts to help feed that and is hopefully another indication and something that makes that process that much simpler.

[00:17:22] Eric Hanselman: Are we kind of close to that? Are we, do we have environments that can actually play that way today?

[00:17:29] Justin Lam: There probably are. The question I think is for the enterprises, do they want that? Do they anticipate the need for that? You know, you have some organizations that are, frankly, they are more cloud and AI native. They are more technology forward. And so, they're going to want that generally for the ability to more quickly address regulated or dynamic environments. And so, yeah, they're going to want to augment their automation. But other organizations, you know... It's a great question, and I don't know if they necessarily want that or can necessarily afford to have that.

[00:18:09] Eric Hanselman: That things continue on in much the, the way they have. Although again, you look at the way in which the regulatory environment is changing to really start to require more and more of this. We saw it, originally with, all of the data protection legislation that came out, which pushed a need to be able to know where your data was and what you were dealing with.

[00:18:30] Eric Hanselman: We've now got resiliency starting to be codified in regulatory language. The UK's DORA and what looks like maybe some follow-on regulatory pressures on that. Maybe that's enough of a motivation. I guess that's  the next stage of this journey maybe, and maybe that's the driver.

[00:18:49] Henry Baltazar: Yeah, but that's scary too, right? Because it's going to be a matter of, as Justin said, every organization's going to have their threshold for what's acceptable. Maybe in some cases it's okay for AI to play the referee in between these little squabbles between different groups. Letting AI just do all the remediation, I'm not sure a lot of my stakeholders would want to do that just yet. So, I think it's going to be a learning process and it's going to take time, but could have a place, but it's going to be different from organization to organization.

[00:19:17] Justin Lam: And to that point about being different from organization to organization, it's also going to be different for every downstream stakeholder to downstream stakeholder. As much as the regulations and compliance frameworks are valuable, really of the nature of the economy, because more and more organizations license or offer some sort of subscription, subscribed offering digitally, that there is, there are things like indemnity that are in a lot of license agreements and MSAs. And how you want to be able to understand, you know, when an end user customer issues a security questionnaire and finds out how is this organization storing, processing, managing, collecting, securing the data that I'm entrusting to it? It's going to be very much on a customer-by-customer basis, and you want to be able to have the agility to respond to those so that you can recognize revenue. So again, looking at talking about what is a North Star of security and infrastructure? What is that business enablement? Being able to understand, hey, the storage, the infrastructure choices that we make, the security decisions that we take, have a direct impact on how we can pursue new markets, pursue those customers differently, extend our trust with them.

[00:20:50] Justin Lam: I think there's huge opportunities ahead, but it has to be through that guiding function, not necessarily just a nice to have or something, this is something we should do.

[00:21:01] Eric Hanselman: That is one of those things that I think we've been pushing on for a while. If you think about what Sheryl Kingstone's been doing in the customer experience side, Paige Bartley's been doing from some of the data research and data privacy and regulatory pieces. Hopefully that's the, up level and the, the more positive, destination that organizations start to move towards because hopefully that's what's motivating them to be able to make those improvements.

[00:21:24] Justin Lam: Yeah, for sure. Especially with, you know, the organizations that we're working with, they want to be able to understand a lot of people, they say, "Oh yeah, we want more resilience. We want more security." And then you ask them what are they going to do with their data, and a lot of times those stakeholders just don't know. And so, it's really hard to understand the prioritization, of how important are these things that we should do, how important are they actually? And just like, you know, any New Year's resolution, I say I want to live healthier, but then you look the contents of my refrigerator and you get a quite a different story. I think the same thing is true when anyone's thinking about data resilience and data security. These are all things that people should do but will they? I think you really see it in the motivations and what the organization is capable of pursuing.

[00:22:23] Eric Hanselman: So, we should all be getting more of the security salad as a side, not ordering fries along with that meal.

[00:22:30] Justin Lam: Yeah. And, you know, always be thinking about the so what. I eat more salad, I label, you know, the sensitive data that I have, I isolate what I need, I have redundancy, I do tabletops so that and fill in with the blank what that “so that” is. I think that's what both sets of teams need to be able to do in order to bridge the chasm that they have.

[00:22:53] Eric Hanselman: And hopefully this is something that starts to make that gap maybe a little narrower and starts to move across it. Again, hopefully some good motivations, but a lot of different aspects to this.

[00:23:05] Eric Hanselman: This has been great. Thank you both for your insights on this. It's, again, something that has a lot of potential, and I guess we, we all sound like we're hoping that we can actually start to capitalize on this.

[00:23:18] Justin Lam: For sure. For sure. I think especially, you know, in this agentic world that we're in, data is, it's the longest lasting asset any organization has. The data that I have stored for record retention, for intellectual property. Never before has it been such a great moat for large organizations. And so, I think anything that you're doing to leverage that data and harness that data for your success, you want to be thinking about my organizational resilience, my security around that. And I think that these are becoming really strategic imperatives, even more so. So, there's huge opportunities ahead for both sectors

[00:24:02] Eric Hanselman: One more agentic forcing function. All right, Henry, any final thoughts to close this out?

[00:24:09] Henry Baltazar: No, I definitely agree. I think you're right. This has to happen. There's an appetite for it to happen, but again, it's going to be, it's going to be a lot of effort and a lot of work.

[00:24:18] Eric Hanselman: It get, gets back to appetite. I guess we'll close ourselves out on that.

[00:24:23] Justin Lam: For sure.

[00:24:23] Eric Hanselman: Thank you both. This has been great. I appreciate you both being back on the podcast.

[00:24:28] Justin Lam: Yeah. Great to be with you

[00:24:32] Eric Hanselman: That is it for this episode of Next in Tech. Thanks to our audience for staying with us, and thanks to our production team, including Dylan Schieble, Sophie Carr, and Feranmi Adeoshun on the marketing and events teams. If you liked this episode, please subscribe or like us. I hope you'll join us for our next episode, because there is always something next in tech.