IBM: Future-Ready Storage That Redefines the Boundaries of the Data Center | Computational Storage & advances in Flash memory | Cyber and Data resiliency

Clips
News
More from IBM: Future-Ready Storage That Redefines the Boundaries of the Data Center

Andy Walls

CTO & Chief Architect, IBM FlashSystem

IBM

Ian Shave

VP, IBM Storage Data Resilience Solutions

IBM

Three insights you might have missed from theCUBE’s coverage of IBM’s ‘Future-Ready Storage’ event

With the integration of artificial intelligence into data management systems, IBM Corp.’s conversation around storage has shifted into a whole new gear.The company made a series of storage announcements during theCUBE and IBM’s “Future-Ready Storage Redefining Data Center Boundaries” event. A key element of the latest releases involved the inclusion of AI-powered predictive analytics and data placement for the IBM FlashSystem 5300, yet another example of how AI is reshaping the IT ecosystem. (* Disclosure below.)“Generative AI has hit us as an industry,” said Denis Kennelly, general manager of IBM Storage at IBM, during an interview on theCUBE, SiliconANGLE Media’s livestreaming studio

New IBM all-flash storage platform includes AI-powered security solutions for monitoring and data protection

A key element in IBM Corp.’s storage announcements on Thursday involved security and a critical need to protect vital business data in the event of a breach.With the IBM Storage 5300 release, the company unveiled new technology, enabled by its FlashCore Module 4, which continuously monitors I/O statistics using artificial intelligence and machine learning to detect anomalies.“We’ve been able to do something with our FlashCore module technology that is very unique,” said Andy Walls (pictured, right), chief technology officer and chief architect, IBM FlashSystem, at IBM. “The FCM-4 in particular has the capability of detecting statistics, of keeping track of statistics on a per IOP basis

play_circle_outline IBM's FlashCore Module technology for detecting statistics on a per IOP basis

play_circle_outline Importance of immutable copies of data for normal business operations

play_circle_outline Compliance with operational resilience regulations

play_circle_outline Impact of cyber resilience on society

play_circle_outline Summary of next steps for customers: assessment, storage system capabilities, modernizing backup.

Info

Computational Storage & advances in Flash memory | Cyber and Data resiliency

Andy Walls

CTO & Chief Architect, IBM FlashSystem IBM

Ian Shave

VP, IBM Storage Data Resilience Solutions IBM

search

Andy Walls

>> Hello everyone. This is an extremely exciting announcement that we are making for IBM Storage, and the question has to be asked, Ian, why do you think cyber resilience is relevant for this flash announcement?

Ian Shave

>> That's a great question, Andy, and I may talk about that every now and then at the moment, or more to the point, I think almost daily. I think fundamentally it is very clear it is still very top of mind. In this particular survey you can see cyber security came out on top. And actually, when one of the analysts, or sorry, industry independence was taking us through their report, I actually asked on some of the questions they had, why is cyber not coming out top? And they said, on some of the questions we have to not put cyber as an option or it would come out on top for every single question. So, I think it just shows how top of mind it really is and that's no surprise, with three quarters of organizations now having experienced an attack. It's such a prominent issue that everyone needs to resolve. In fact, if you really think about it, if organizations don't work out how to resolve this cyber resilience challenge, there is no generative AI option for them. They're all thinking about generative AI. How do that if your data is open to being manipulated or deleted? So, it is very real problem for people. And then, these last two, obviously such high data loss after an attack. The statistic actually for this one was only one in seven customers was able to fully recover all of their data after an attack. But, I think for almost any organization, this last one is the one that will, to me is the reason why they need to do something different, 89took more than one day to resume normal business operations. And for what, nearly two thirds of them, that was more than four days. Now, Andy, you and I have been around this industry a little while and I can't remember the last time I spoke to organizations that if you said to them, if you have an outage I'll get you back in four days, that they would go, yes, that would be fine.

Andy Walls

>> Ian, as a matter of fact, if we were to say you're going to have an outage and be out for five minutes, they would be concerned, wouldn't they?

Lillian McNealus

>> Exactly. So, clearly something different needs to happen. There's just a very different threat.

Devang Pandya

>> And that really leads into this, Ian. Why is discovering the threats fast or discovering them quickly, why that so important?

Lillian McNealus

>> And I think, Andy, that leads to a discussion I know you and I had, and we have with the other members of our development team or performance team. We looked at this graph and just went, hypothetically, if someone's data was under an attack, and we were doing this based on, this could be whether they're encrypting the data, corrupting the data, deleting it, how quickly could they cause damage? And obviously the team did the calculation and worked out, in 24 hours it would be possible for two and a half petabytes worth of data to be impacted. Now, that's assuming nothing else was happening. So, I know Andy, I know you're a perfectionist with these things. You kind of said, and it's probably not really going to be like this. It's probably maybe 30but this was a calculation based off just one array. The point is, the enormity of the problem is absolutely there. If they don't find the problem, by the time they do, far too much data will be damaged.

Devang Pandya

>> Losing terabytes is serious, ian, right? Losing terabytes is

Lillian McNealus

>> not so long ago we were barely thinking about petabytes. Now, you could be losing that amount of data. So, I think that leads, Andy, really nicely on too. So, we should probably get into what is it that IBM is doing to address this problem?

Devang Pandya

>> And I'm really excited about that, Ian, as I know you are, because we've been able to do something with our FlashCore Module technology that is very unique. And the FCM4 in particular has the capability of detecting statistics, of keeping track of statistics on a per IOP basis, and that is really critical to be able to detect something's going wrong. I need to be able to see every IOP and I need to be able to do things like calculate the entropy. I need to be able to see how the compression has changed. I need to be able to collect statistics on what is the percentage of reads and writes, and what's the block size and how all those things are changing. So, if you show the next slide, Ian. The beauty of the FCM is that it fits into this entire architecture that you can see here that has the flash system. And we can think of this as the new 5300, with the spect-V running, spectrum virtualize running on 5300. The FCMs then are keeping track of all of these statistics, including entropy. Entropy is a measure of the randomness of the data. Also, FCM calculates the compression. And so, as data comes in, the FCM knows what the compressibility was, and it can determine how the compressibility has changed. Now, it's not just that, it's important to know the entropy and such, but there's a lot of different ransomware attacks. So, there's a lot of statistics that we can keep. And so, what you see in this diagram here at the bottom is that in the FCM4, we have running on a processor, something we call the summarizer. And our research team helped us write this. And what the summarizer is doing is taking all of those statistics gathered on every IOP and putting them into a statistical format that summarizes what happened in the last two seconds, all right? And it does this for every volume that the client has that is in this system. And so, you can imagine that's a lot of data. And the then every two seconds passes this data up to the aggregator, which is running in the flash system. Again, think of it running in the 5300, and it's collecting all of this data on every volume. And then, every two seconds it passes that to the inference engine, what I call the revealer, Ian. It reveals the deepest, darkest secrets, all right? And what it's using is AI. It's using artificial intelligence that we have, our research team has trained a model, an inference engine that's running real time and it's been trained for many different use cases. And we've injected real ransomware, we've injected a simulated ransomware, and we've done it with a bunch of different use cases, a bunch of different workloads, and collected this, and then trained this model. And this will be running on every flash system that has the new release on 5300, along with the FCM4s. And then, if we detect that a ransomware intrusion has occurred, we then raise an alert to storage insights. And storage insights then will alert the customer, and that is critical. And so, this what we are announcing specifically for the 5300, Ian.

Lillian McNealus

>> And, I guess, Andy, that some of those pieces you were just going through there like the your aggregator and things, those things that we got built in at that level, but also the technologies you built straight into the FCMs itself, I assume is why no one else is going to be able to do this type of detection, right?

Devang Pandya

>> That's right. Because, doing things like entropy and calculating the delta of compression consume a lot of CPU resources if you do it in software. In fact, so much so that you would lead many cores. The beauty of doing it in the FCM, we can do it in parallel in the FPGA And what do you think the performance impact is, Ian, when we're running this? Try zero, no performance impact whatsoever, and no one else can claim that. No one else can do it, Ian, because they don't have that computational storage device in the FlashCore Module. Now, to be clear, the FlashCore Module is not what's doing the AI, but you cannot do AI without data, can you Ian? You can't.the FCM's collecting the data that is then passed to the model, and the model uses this data and it's every two seconds. And Ian, I think you like to talk about this, we can detect in less than a minute. In fact, it can be as low as 46 seconds that we can detect, and in some cases even less than that. And having it that quickly is extremely important.

Lillian McNealus

>> And it's very interesting for me, Andy, that you mentioned the 26 seconds there, because I remember when you first told me it was under the strict instructions, I didn't tell anybody. But, in all fairness, I now tell the story to everybody that yes, this IBM fellow told me I'm not allowed to tell anyone, which tells me it's a great data point, so I'm now going to tell you. But, you've revealed it, so that's fantastic.

Devang Pandya

>> Well, why not let the world know what we have done, right, Ian?

Lillian McNealus

>> Exactly. Well, and how great we are, let's be honest.

Devang Pandya

>> And so, Ian, I think it's important then that we talk about why is it that immutable copies of data critical for normal business operations, why is that important? We have this detection we talked about, but why are immutable copies so important?

Lillian McNealus

>> Well, we often talk about these steps to resilience, and we'll come back to this a little bit in a moment as well, but clearly having secure immutable copies of data is the way in which businesses are going to be able to recover. You to know you've got a copy of data there that nobody can change, nobody can delete, it is the fallback plan. And I know a lot of people will probably be thinking, well, isn't the backup the fallback plan? And it probably is for a of things. But, as we've talked about, when you don't want outages and certainly don't want prolonged outages, you certainly don't want them to be a day or four days or weeks as it has been for some organizations, having a secure immutable copy on the storage array itself provides the ability to recover that storage volume in seconds. you can recover that storage volume in seconds, you might have a chance of recovering your business in minutes or maybe even small number of hours depending on obviously the other influences that have happened from the attack. But, that's why I think it is so incredibly important.

Devang Pandya

>> And Ian, it's interesting, you and I have focused so far on the real need, that there are unfortunately these villains in the world that are out to make money at the expense of others. But, governments and civil authorities also are concerned about this, so regulations are coming around as well. You want to speak to why having immutable copies of data and all of what we're talking about here is critical in light of these operational resilience regulations that are coming around?

Lillian McNealus

>> Absolutely. I'll fill out the rest of these steps, because it's the combination of all of these things when we think about the regulations. So, for a start, they have to know they've got a copy of data that they can come back from. They have to be able to prove that they can actually recover, and probably depending on which organization, depending on where they are in the world, it could be for example, two hours. They have to prove they can recover in two hours. And that's where this last piece of the automation and testing is so important, because it's not, you have to show it in theory. You have to show what have I done, and then prove it, and then document the testing that has been done, et cetera. So, all of these steps become so incredibly important. And I think as we've kind of alluded to, the discovery is a real key element in here, because it's potentially easy if you like about, how can I come back? But, what if you could find the threat like we were talking about if we could find instead of that a half petabytes, if we could find it when it was two terabytes, clearly that's going to lead to faster recovery because, and probably try and disagree with me here, Andy, because if I tell you something's impossible, I know you're going to try and create it, but I don't think there is any technology out there that is going to recover two and a half petabytes faster than we can recover two terabytes. So, you want to keep that blast radius impact as small as possible, and you do that by finding it faster.

Devang Pandya

>> It's interesting, Ian, as you and I talk to clients sometimes they bring up the resilience regulations even first, because they have to comply.

Lillian McNealus

>> Oh, it's very top of mind obviously, particularly in Europe right now, because those regulations are coming into effect at the beginning of next year. We've heard from many organizations their audit slot has already been booked for early part of next year for them that they are complying. But, we're seeing around the globe now. We know other areas in the world where they are in the process of trying to put their own sets of regulations together, it's going to have to become regulated. The potential impact to any geography's economy is just too great.

Devang Pandya

>> It is. is great technology that we have, and what's beautiful is that this is a real important aspect to IBM and to IBM Storage. And talk a little bit about how this fits into what we call Defender, and how it fits into our cyber resilience story for IBM Storage in particular?

Lillian McNealus

>> Absolutely. I think there's a couple of areas where it fits in. I'm going to just fill this right out. So, Defender has two aspects to it. One element, of course, is the automation it can bring to help with managing the copies. So, if you think about these two examples of what does good look like? the top here, if we even assume it's a storage flash system 5300, given this announcement, we can detect the threats quickly. We can do those secure copies that we were just talking about. But, it's really important to have all of that automated as we just spoke to in that fifth step. And Defender can help with delivering that automation, the scheduling of the copies, the scheduling of scanning copies if they want to do that as well, and obviously the recovery piece. But then, there's also a secondary element, of course, which is for those workloads where maybe it doesn't need to be back in minutes, maybe a day, maybe two days, if it's archive data, maybe a week or two weeks would be okay. They still need a robust backup solution that you know is going to be there, isn't going to be corrupted. We know it's a primary attack vector these days for these cyber attackers. And, of course, we've got a very comprehensive solution there that not only can ensure that it is secure, actually in itself can help recover VMs in minutes to hours, for example. I think it's something like 2,000 VMs we can recover in about 45 minutes, for example. So, we have a great set of capabilities. And obviously, we are making sure through Defender that we're going to make this from an end-to-end perspective its integration with security tools really seamless and simple.

Devang Pandya

>> Ian, I've told you this story before, but what really got me started on thinking about what we could do here in terms of cyber resilience detection in addition to the immutable copies and such, was a conversation I had with a healthcare software provider who I asked them, have you guys seen any ransomware attacks in your customers? They provide software to hospitals. They said, oh yes, Andy, two or three a month. That kind of took me aback. Then they said, patients have died. What we're doing is not just good for IBM, it's not just good for our clients, it is good for society. It is so critical what we talked about here, and I'm so proud of what we have announced here and that it fits in so well with the 5300 and that I really think it gives our clients the capability not just to meet regulations, but to help them defeat these attackers.

Lillian McNealus

>> I completely agree, Andy. I completely agree. And I think it probably brings us neatly to maybe just quickly summarizing at the end here. I think for those that have been listening, for those customers listening, not sure maybe what to do next after hearing some of these things, if you really don't know where to start, we would strongly encourage you to take our secure and resilient assessment. It also takes into account some regulations, so we can help you with that piece. It can help you find those blind spots. If you are looking for a storage system right now, then please come and talk to us about these capabilities. And I use this example from a customer of ours very recently who after hearing our sets of capabilities literally just said, why wouldn't I want that? Why wouldn't I want to discover those threats in seconds? Why wouldn't I want a system where I know I've got a copy I can come back from? And I'll say then this last piece, if you're looking to modernize your backup, if you're looking to go for a backup solution that you know is secure, because there are many out there that unfortunately are not, then again, please give your IBM business partner or your representative a call and we can help you find the right answer to the problem.

Devang Pandya

>> Ian, it's always fun presenting with you, and hopefully our customers on this very exciting day where so much is being announced will see how the cyber resilience is just instrumental and key to all of this that we're doing.

Lillian McNealus

>> Completely agree, Andy. And always a pleasure talking with you.

Devang Pandya

>> All right, thanks everyone.

Computational Storage & advances in Flash memory | Cyber and Data resiliency

search

Andy Walls

>> Hello everyone. This is an extremely exciting announcement that we are making for IBM Storage, and the question has to be asked, Ian, why do you think cyber resilience is relevant for this flash announcement?

Ian Shave

>> That's a great question, Andy, and I may talk about that every now and then at the moment, or more to the point, I think almost daily. I think fundamentally it is very clear it is still very top of mind. In this particular survey you can see cyber security came out on top. And actually, when one of the analysts, or sorry, industry independence was taking us through their report, I actually asked on some of the questions they had, why is cyber not coming out top? And they said, on some of the questions we have to not put cyber as an option or it would come out on top for every single question. So, I think it just shows how top of mind it really is and that's no surprise, with three quarters of organizations now having experienced an attack. It's such a prominent issue that everyone needs to resolve. In fact, if you really think about it, if organizations don't work out how to resolve this cyber resilience challenge, there is no generative AI option for them. They're all thinking about generative AI. How do that if your data is open to being manipulated or deleted? So, it is very real problem for people. And then, these last two, obviously such high data loss after an attack. The statistic actually for this one was only one in seven customers was able to fully recover all of their data after an attack. But, I think for almost any organization, this last one is the one that will, to me is the reason why they need to do something different, 89took more than one day to resume normal business operations. And for what, nearly two thirds of them, that was more than four days. Now, Andy, you and I have been around this industry a little while and I can't remember the last time I spoke to organizations that if you said to them, if you have an outage I'll get you back in four days, that they would go, yes, that would be fine.

Andy Walls

>> Ian, as a matter of fact, if we were to say you're going to have an outage and be out for five minutes, they would be concerned, wouldn't they?

Lillian McNealus

>> Exactly. So, clearly something different needs to happen. There's just a very different threat.

Devang Pandya

>> And that really leads into this, Ian. Why is discovering the threats fast or discovering them quickly, why that so important?

Lillian McNealus

>> And I think, Andy, that leads to a discussion I know you and I had, and we have with the other members of our development team or performance team. We looked at this graph and just went, hypothetically, if someone's data was under an attack, and we were doing this based on, this could be whether they're encrypting the data, corrupting the data, deleting it, how quickly could they cause damage? And obviously the team did the calculation and worked out, in 24 hours it would be possible for two and a half petabytes worth of data to be impacted. Now, that's assuming nothing else was happening. So, I know Andy, I know you're a perfectionist with these things. You kind of said, and it's probably not really going to be like this. It's probably maybe 30but this was a calculation based off just one array. The point is, the enormity of the problem is absolutely there. If they don't find the problem, by the time they do, far too much data will be damaged.

Devang Pandya

>> Losing terabytes is serious, ian, right? Losing terabytes is

Lillian McNealus

>> not so long ago we were barely thinking about petabytes. Now, you could be losing that amount of data. So, I think that leads, Andy, really nicely on too. So, we should probably get into what is it that IBM is doing to address this problem?

Devang Pandya

>> And I'm really excited about that, Ian, as I know you are, because we've been able to do something with our FlashCore Module technology that is very unique. And the FCM4 in particular has the capability of detecting statistics, of keeping track of statistics on a per IOP basis, and that is really critical to be able to detect something's going wrong. I need to be able to see every IOP and I need to be able to do things like calculate the entropy. I need to be able to see how the compression has changed. I need to be able to collect statistics on what is the percentage of reads and writes, and what's the block size and how all those things are changing. So, if you show the next slide, Ian. The beauty of the FCM is that it fits into this entire architecture that you can see here that has the flash system. And we can think of this as the new 5300, with the spect-V running, spectrum virtualize running on 5300. The FCMs then are keeping track of all of these statistics, including entropy. Entropy is a measure of the randomness of the data. Also, FCM calculates the compression. And so, as data comes in, the FCM knows what the compressibility was, and it can determine how the compressibility has changed. Now, it's not just that, it's important to know the entropy and such, but there's a lot of different ransomware attacks. So, there's a lot of statistics that we can keep. And so, what you see in this diagram here at the bottom is that in the FCM4, we have running on a processor, something we call the summarizer. And our research team helped us write this. And what the summarizer is doing is taking all of those statistics gathered on every IOP and putting them into a statistical format that summarizes what happened in the last two seconds, all right? And it does this for every volume that the client has that is in this system. And so, you can imagine that's a lot of data. And the then every two seconds passes this data up to the aggregator, which is running in the flash system. Again, think of it running in the 5300, and it's collecting all of this data on every volume. And then, every two seconds it passes that to the inference engine, what I call the revealer, Ian. It reveals the deepest, darkest secrets, all right? And what it's using is AI. It's using artificial intelligence that we have, our research team has trained a model, an inference engine that's running real time and it's been trained for many different use cases. And we've injected real ransomware, we've injected a simulated ransomware, and we've done it with a bunch of different use cases, a bunch of different workloads, and collected this, and then trained this model. And this will be running on every flash system that has the new release on 5300, along with the FCM4s. And then, if we detect that a ransomware intrusion has occurred, we then raise an alert to storage insights. And storage insights then will alert the customer, and that is critical. And so, this what we are announcing specifically for the 5300, Ian.

Lillian McNealus

>> And, I guess, Andy, that some of those pieces you were just going through there like the your aggregator and things, those things that we got built in at that level, but also the technologies you built straight into the FCMs itself, I assume is why no one else is going to be able to do this type of detection, right?

Devang Pandya

>> That's right. Because, doing things like entropy and calculating the delta of compression consume a lot of CPU resources if you do it in software. In fact, so much so that you would lead many cores. The beauty of doing it in the FCM, we can do it in parallel in the FPGA And what do you think the performance impact is, Ian, when we're running this? Try zero, no performance impact whatsoever, and no one else can claim that. No one else can do it, Ian, because they don't have that computational storage device in the FlashCore Module. Now, to be clear, the FlashCore Module is not what's doing the AI, but you cannot do AI without data, can you Ian? You can't.the FCM's collecting the data that is then passed to the model, and the model uses this data and it's every two seconds. And Ian, I think you like to talk about this, we can detect in less than a minute. In fact, it can be as low as 46 seconds that we can detect, and in some cases even less than that. And having it that quickly is extremely important.

Lillian McNealus

>> And it's very interesting for me, Andy, that you mentioned the 26 seconds there, because I remember when you first told me it was under the strict instructions, I didn't tell anybody. But, in all fairness, I now tell the story to everybody that yes, this IBM fellow told me I'm not allowed to tell anyone, which tells me it's a great data point, so I'm now going to tell you. But, you've revealed it, so that's fantastic.

Devang Pandya

>> Well, why not let the world know what we have done, right, Ian?

Lillian McNealus

>> Exactly. Well, and how great we are, let's be honest.

Devang Pandya

>> And so, Ian, I think it's important then that we talk about why is it that immutable copies of data critical for normal business operations, why is that important? We have this detection we talked about, but why are immutable copies so important?

Lillian McNealus

>> Well, we often talk about these steps to resilience, and we'll come back to this a little bit in a moment as well, but clearly having secure immutable copies of data is the way in which businesses are going to be able to recover. You to know you've got a copy of data there that nobody can change, nobody can delete, it is the fallback plan. And I know a lot of people will probably be thinking, well, isn't the backup the fallback plan? And it probably is for a of things. But, as we've talked about, when you don't want outages and certainly don't want prolonged outages, you certainly don't want them to be a day or four days or weeks as it has been for some organizations, having a secure immutable copy on the storage array itself provides the ability to recover that storage volume in seconds. you can recover that storage volume in seconds, you might have a chance of recovering your business in minutes or maybe even small number of hours depending on obviously the other influences that have happened from the attack. But, that's why I think it is so incredibly important.

Devang Pandya

>> And Ian, it's interesting, you and I have focused so far on the real need, that there are unfortunately these villains in the world that are out to make money at the expense of others. But, governments and civil authorities also are concerned about this, so regulations are coming around as well. You want to speak to why having immutable copies of data and all of what we're talking about here is critical in light of these operational resilience regulations that are coming around?

Lillian McNealus

>> Absolutely. I'll fill out the rest of these steps, because it's the combination of all of these things when we think about the regulations. So, for a start, they have to know they've got a copy of data that they can come back from. They have to be able to prove that they can actually recover, and probably depending on which organization, depending on where they are in the world, it could be for example, two hours. They have to prove they can recover in two hours. And that's where this last piece of the automation and testing is so important, because it's not, you have to show it in theory. You have to show what have I done, and then prove it, and then document the testing that has been done, et cetera. So, all of these steps become so incredibly important. And I think as we've kind of alluded to, the discovery is a real key element in here, because it's potentially easy if you like about, how can I come back? But, what if you could find the threat like we were talking about if we could find instead of that a half petabytes, if we could find it when it was two terabytes, clearly that's going to lead to faster recovery because, and probably try and disagree with me here, Andy, because if I tell you something's impossible, I know you're going to try and create it, but I don't think there is any technology out there that is going to recover two and a half petabytes faster than we can recover two terabytes. So, you want to keep that blast radius impact as small as possible, and you do that by finding it faster.

Devang Pandya

>> It's interesting, Ian, as you and I talk to clients sometimes they bring up the resilience regulations even first, because they have to comply.

Lillian McNealus

>> Oh, it's very top of mind obviously, particularly in Europe right now, because those regulations are coming into effect at the beginning of next year. We've heard from many organizations their audit slot has already been booked for early part of next year for them that they are complying. But, we're seeing around the globe now. We know other areas in the world where they are in the process of trying to put their own sets of regulations together, it's going to have to become regulated. The potential impact to any geography's economy is just too great.

Devang Pandya

>> It is. is great technology that we have, and what's beautiful is that this is a real important aspect to IBM and to IBM Storage. And talk a little bit about how this fits into what we call Defender, and how it fits into our cyber resilience story for IBM Storage in particular?

Lillian McNealus

>> Absolutely. I think there's a couple of areas where it fits in. I'm going to just fill this right out. So, Defender has two aspects to it. One element, of course, is the automation it can bring to help with managing the copies. So, if you think about these two examples of what does good look like? the top here, if we even assume it's a storage flash system 5300, given this announcement, we can detect the threats quickly. We can do those secure copies that we were just talking about. But, it's really important to have all of that automated as we just spoke to in that fifth step. And Defender can help with delivering that automation, the scheduling of the copies, the scheduling of scanning copies if they want to do that as well, and obviously the recovery piece. But then, there's also a secondary element, of course, which is for those workloads where maybe it doesn't need to be back in minutes, maybe a day, maybe two days, if it's archive data, maybe a week or two weeks would be okay. They still need a robust backup solution that you know is going to be there, isn't going to be corrupted. We know it's a primary attack vector these days for these cyber attackers. And, of course, we've got a very comprehensive solution there that not only can ensure that it is secure, actually in itself can help recover VMs in minutes to hours, for example. I think it's something like 2,000 VMs we can recover in about 45 minutes, for example. So, we have a great set of capabilities. And obviously, we are making sure through Defender that we're going to make this from an end-to-end perspective its integration with security tools really seamless and simple.

Devang Pandya

>> Ian, I've told you this story before, but what really got me started on thinking about what we could do here in terms of cyber resilience detection in addition to the immutable copies and such, was a conversation I had with a healthcare software provider who I asked them, have you guys seen any ransomware attacks in your customers? They provide software to hospitals. They said, oh yes, Andy, two or three a month. That kind of took me aback. Then they said, patients have died. What we're doing is not just good for IBM, it's not just good for our clients, it is good for society. It is so critical what we talked about here, and I'm so proud of what we have announced here and that it fits in so well with the 5300 and that I really think it gives our clients the capability not just to meet regulations, but to help them defeat these attackers.

Lillian McNealus

>> I completely agree, Andy. I completely agree. And I think it probably brings us neatly to maybe just quickly summarizing at the end here. I think for those that have been listening, for those customers listening, not sure maybe what to do next after hearing some of these things, if you really don't know where to start, we would strongly encourage you to take our secure and resilient assessment. It also takes into account some regulations, so we can help you with that piece. It can help you find those blind spots. If you are looking for a storage system right now, then please come and talk to us about these capabilities. And I use this example from a customer of ours very recently who after hearing our sets of capabilities literally just said, why wouldn't I want that? Why wouldn't I want to discover those threats in seconds? Why wouldn't I want a system where I know I've got a copy I can come back from? And I'll say then this last piece, if you're looking to modernize your backup, if you're looking to go for a backup solution that you know is secure, because there are many out there that unfortunately are not, then again, please give your IBM business partner or your representative a call and we can help you find the right answer to the problem.

Devang Pandya

>> Ian, it's always fun presenting with you, and hopefully our customers on this very exciting day where so much is being announced will see how the cyber resilience is just instrumental and key to all of this that we're doing.

Lillian McNealus

>> Completely agree, Andy. And always a pleasure talking with you.

Devang Pandya

>> All right, thanks everyone.