Black Hat USA 2024 | John Spiegel | HPE

theCUBE.net

Clips
News
More from Black Hat USA 2024

John Spiegel

SASE CISO

HPE Aruba Networking

AI transforms network security amid remote work challenges

The world of network security is being greatly impacted by artificial intelligence, the rise of the data lake and the ramifications of a pandemic that forced companies to adopt a remote work model. Hewlett Packard Enterprise Co. recently acquired Juniper Networks to meet this tough transition in cybersecurity, with an emphasis on deploying AI.HPE’s John Spiegel talks about the evolution of network security.“It’s a tough life to be a CISA right now … our thesis is that it’s really about AI

play_circle_outline Rise of infrastructure and AI impact

play_circle_outline Shift in data platform with rise of data lake

play_circle_outline Importance of securing remote work and SASE

play_circle_outline Challenges of securing IoT devices in the office

play_circle_outline Revolutionizing AI Success through Rethinking Network Architecture and Vertical Workflow Integration

Info
Transcript

John Spiegel | HPE

John Spiegel

SASE CISO HPE Aruba Networking

John Spiegel, CTO at HPE for Cybersecurity and SASE, discusses the rise of data lakes and the importance of SASE in light of remote work trends. Securing IoT devices in the office is a challenge, with AI profiling and securing being essential. Networking is critical for data flow optimization and security. The trend of AI companies moving closer to hardware emphasizes low-level access coding's importance. Combining networking and security is crucial for threat inspection and optimal pathing. AI tools like NDR are crucial for real-time threat response. Segment... Read more

explore Keep Exploring

What recent trends are being observed in the tech industry, particularly in terms of infrastructure and AI impact? add

What changes are happening in the data layer with the rise of data lakes, Snowflake, Databricks, and the emergence of the next data platform? add

What were the challenges faced by companies transitioning from on-prem applications to cloud applications and how did the emergence of SASE address these challenges? add

What are some challenges in securing IoT devices in the workplace and how can AI be leveraged to address these challenges? add

What needs to be considered in order to make AI successful in a data center environment? add

bolt Powered by CUBE AI

John Spiegel | HPE

search

>> Welcome back everyone to theCube's coverage here at Black Hat. I'm John Furrier, host of theCube, day two of wall-to-wall coverage. We are here in the Mandalay Bay. John Spiegel, who's the CTO at HPE for Cybersecurity and SASE. John, great to see you. Thanks for coming on theCube.

John Spiegel

>> It's great. I'm excited to be here, and the show's already started and things are happening.

>> What an interesting time to have as Black Hat. Two weeks ago, we saw the disruption that got everyone's attention, and then just overall the inflection point we're in with infrastructure and AI's impact on all the action in the infrastructure. You're seeing leadership come at Silicon level. You're seeing a lot... It's cool to be hardware guy back. It's like, okay, hardware's cool again, more servers. You can't get enough compute these days. And so you see the shift that the infrastructure layer. Data layer, you're seeing the rise of the data lake. You see Snowflake and Databricks. We just had an event last week in our Palo Alto studio called Supercloud 7, where we're starting to see signs now that the data platform, this next platform is coming where data needs to be available because of the GenAI need for application. So open table formats are driving changes there for interoperability, and you're seeing data being decoupled from the database. Okay, now you see the rise of catalogs, not the way it was before. So you start to see stuff that was traditionally boring, governance, table formats, we are seeing a massive shift in how things are developing technically because you can see this wave coming in. It's secular, it's real, it's a category, and it's going to be an opportunity for folks who can manage this transition. And in tech, it's always winning transitions. And HPE acquired Juniper. That's going to probably close soon. So you're in the middle of all the action.

John Spiegel

>> Yeah.

>> Explain what you do, your group, how HP in cyber exists. What's their purpose? Obviously HPE, we cover that really strongly, but talk about their cyber capabilities and what they do.

John Spiegel

>> Yeah, so really what it's about is the network and securing the network. My entry into HPE was part of an acquisition Access Security in March of 2023. And really what that was about was SD-WAN, in my opinion, it was the technology of the last decade. Everything was about SD-WAN from an infrastructure perspective. That was really the accelerant that happened. And the challenge with SD-WAN was how to secure it. You had multiple ways of doing it. You could send the data back to your data center. And when you did that, you slowed down applications. You could put a firewall out on the edge from a scale perspective, hard to manage, high cost, or you could send it to a central location. Again, you had that latency problem. And what came along was this concept called SASE that was really fostered by the team over at Gartner. And what they wanted to do was really take what you did well in the data center but cloudify it. So take what in the past were hardware devices, maybe it was a firewall, maybe it was a CAS-V style device running inside your data center or VPN, or a SWIG device, transform that into software, and then place that at the edge of the network in the form of what they call a point of presence. So transforming what in the past was hardware into software, and then thereby eliminating that challenge with latency. And that is a... That pivot happened in 2019. Surprisingly, 2020 hit and everything changed as we know, and this thing called remote access became very important. And this security stack for SASE really took off at that point because it really addressed those challenges of companies that were pivoting from on-prem applications to cloud applications. They needed to secure it because you have people at home and people working together. The father may... If they have kids at home, the father may be working at one company, the wife at another company, and then you had your kids. So how do you segment that data when your network is not traditionally your network? And SSE was the way to do it with ZTNA. So that was kind of where I started in. At that moment, I joined a company called Access Security that was very focused on the ZTNA, solving that ZTNA problem. We also created a SWIG and filled out that portfolio. But to solve the problem of security with SD-WAN, SSE was the method. SASE was the method. And HPE Aruba Networking realized we needed to get in on that game, because we were solving for SD-WAN, but weren't solving for the security side. And that is where the primary growth is seeing.

>> Yeah, it's interesting you bring that up because one of the things we're seeing now, that was a moment in time where who would've forecasted that the remote worker would be almost 100%? And at past, people forecast maybe 20, 30%. So massive shift, but also put the cloud trend back on the table because then the cloudification happened.

John Spiegel

>> 100% accelerated it.

>> So you had all this acceleration, and all the budgets were there. So I think we're kind of seeing the same thing with generative AI. It is a shift. It's like this is happening, people are recognizing it, but generative AI is load slower to kind of grow because the applications aren't truly ready, but you start to see the boardrooms and recognize that work at home with COVID, GenAI is a generational thing. It's going to happen, and budgets and activity owners are saying because it's a whole nother thing. So how do you look at security in that context? Because you have infrastructure that has requirements and you got a data opportunity. What's the thinking right now around securing what will become probably more surface area? You talk about zero trust and edge point end points. You're talking about now people bring in GenAI into the office, into the network. Okay, more surface area to attack.

John Spiegel

>> Well, it's not only that. It's also about IoT too. We're seeing a proliferation of devices. And it's not just within the factories or manufacturing, it's actually in the office itself. You've got printers, you've got... Just think about what happens in an office these days. Video systems coming in, people are bringing in other devices. I've even seen virtual assistants and robots moving around. Somebody wants to do a video call or a face-to-face call, they may be at home, the person's in the office. And that is one of the biggest challenges right now in my mind as being somebody who's more network focused. How do you secure those devices, especially if you can't apply identity to them? We did that in the past with ACLs, very clunky. We had some other techniques, very difficult. But in a day in and age where these devices are proliferating and a lot of them are consumer based, how do you secure those? So that's an area, I think where we can start to leverage AI to target, understand, profile these devices, but then make sense of it. The humans have a hard time at scale, and I think that's really where the opportunity is.

>> It's interesting. You put a device, if it has a processor and it has the IP connection, malware could be on there. And with AI multimodal, you're seeing computer vision, really a hot application for these smaller devices, little cameras.

John Spiegel

>> Right.

>> They're going to be everywhere. We're seeing sensing, all kinds of new applications. This is a tsunami. It's a Cambrian explosion of app development.

John Spiegel

>> Right.

>> So how do you look at that? Do you just lock everything down? What's the approach? What do you guys see as a recommended direction for CISA to start taking? Because they're kind of hurting right now. They're going to look at this and say, "Hey, I got more product sprawl. I got more... Consolidation was supposed to happen. Nothing really happened. I got risk management now to really worry about, and I got to interoperate, integrate, and rationalize my portfolio. What's-

John Spiegel

>> And you have legal concerns as well. If you're a privately traded company, the SEC, certain reporting requirements, you have to attest that you have your cybersecurity in a good way. It's a tough life to be a CISA right now. And I think the other challenge that they have is they're not getting a lot more budget. Maybe a little bit, but for the most part, you're being asked to do more with less. So how do you overcome that? And I think what we're heading and our thesis is that it's really about AI. It's really about taking the things that we can do as HPE Aruba Networking, leverage our network background, the switches we have, the APs, we have, the intelligence that we have put into these devices, our DNA. If you look at what we did as Aruba, we put a lot more into our APs than some of the other vendors did. There's security mechanisms within it. So how do we leverage those and take the telemetry from those devices, put it into our central platform, and then start to provide insights, recommendations, understand what the device does, what is its meaning, what is its purpose, what's the why behind it, and then start to apply policy or at least recommend policy based on that. The days of doing static access lists, there's not enough time for it. These devices pop up. They're generally commercial devices. They don't have a very strong IP stack. They don't have an Okta ID or an Azure AD account. You've got to figure out where they are, how they pop up, and you can't control it, so AI is the big key here.

>> One of the big things, most people think they know everything in their network, but some of the things aren't even... They need to know what's out there. So discoverability and one identifying threats. Networking is where the last action is. You see the footprints. You see the packets. Packets move from point A to point B. It's stored somewhere. You got storage. So you got the classic storage, compute, and networking to look at. And the trend right now we're seeing in AI, some of the best AI companies that are on the consumer side, you see what they're doing is they're getting closer to the hardware, they're getting closer to the network. Kernel developers are up, well, but in demand more than ever before. So you starting to see that low level access coding is one. And the other one is that with networking, you have security for networking, and then networking for security.

John Spiegel

>> Right. Exactly.

>> So this is... We're in kind of this weird dual mode where, okay, we got access to connections, and networking could help. You see patterns, so you can look at them. AI can look at them. So talk about that dynamic. It's not just security for networking. Networking also helps security.

John Spiegel

>> Yeah. What networking's about is optimal pathing, and you hit it, nailed it out of the park there. Network's all about optimizing, making things faster, moving those packets as quickly as possible from point A to point. B. Security, on the other hand, is all about looking at it, inspecting it, understanding the risk. Should that packet really go to that destination? And that slows things down. So you got to really kind of bring them together. And inserting what I call legacy devices inside there that basically inspect them all the time, I think is the wrong approach. We got to work together. And that's really where we feel there's an opportunity and an advantage to leverage, again, tools like AI, we announced NDR, Network Detection Response. At Black Hat, there's a big announcement around that. And we keep on adding more and more features into our products. As well with SSE, we also see an opportunity to de-complexify policy creation for the network administrators and the security administrators. Because if you think about it today, we talked a little bit about hybrid work, and it's here to stay. We thought, okay, well everyone's going to go work at home, and then things are going to return back to normal. They never did. A recent Gallup poll showed that 80% of workers are still remote. That's a combination of definitely always remote and hybrid. So we're four years in, it ain't changing. And then the other side of it is do the people that want to work remote are probably the more talented ones, so now they have choice. In the past, I'm from Portland, Oregon, I worked in an area of 15 miles continuously. I wouldn't go beyond that. Now, I can work for a company that's halfway on the other side of the planet. I worked for an Israeli company. I could work for a company that's based out of Houston, Texas, which I do now. Where I work really doesn't matter, but how I'm secured does. But it also matters when I go to the campus and the branch. How do I get on that? Am I getting a secure connection? Because that could be another avenue, another area for attack, and you need to monitor that.

>> Interesting. You mentioned static lists and policy. You brought up policy. That's interesting. Now you have AI to assist.

John Spiegel

>> Yes.

>> So you can actually create policies potentially on the fly or new ways to kind of use the resource. How advanced are we on that front yet on networking? It seems like we got some great progress in that where networking is a little bit more robust and more agile.

John Spiegel

>> Yes. Yeah. I think that's an area that's under development. It's certainly an area that we're investing in. We see the opportunity for that. I think the challenge is trust. It all comes down to trust at the end of the day, right? And do I trust the policy decisions from that controller to apply those policies? And I think that's another area where we're iterating on, is can we take essentially a digital twin, take your network? Because we can see it within our controller, can we take that network, separate it out, look at it, apply change, and understand how that change will impact my network? And that's based on almost real-time data because collecting all this telemetry so we can look back 24 hours. If I apply this policy, what will my network look like? Will it go dark? Will everything turn off and I will get phone calls? Or if I apply it in this way, will everything stay in the area that I want to attack and defend against? Will that change? I think that's really where we have to be. Because as somebody who has been a leader in the network space for a company and had that responsibility and knew that if my team made a change and the phone started ringing, I knew the CISO is going to call me, the CIO is going to call me, it's going to be a long night, the ability to take a look at it, understand how that change is going to impact the network, that's the most important thing. If you can develop that trust, you can see what's going to happen. Then you can start to apply policy. To your point, I think we're still early in that space, but it's going to develop rather rapidly.

>> SASE has to get faster and smarter because more devices are coming on, you mentioned earlier. And access modes on the road, what device? Where are they? What's the other identities do they have? What other credentials do they have? Interesting access kind of theory. It's not just active directory or some sort of list. It's moving beyond that. It's more of a graph. What do you have? It seems to be a trend here.

John Spiegel

>> Yeah, definitely. And then the other piece, we talked a little bit about SASE and what SASE is, SD-WAN plus this technology stack from security of SSC. We feel like it's missing something. It's missing what happens in the campus. And the branch SASE's great for remote access, it's great for SD-WAN connectivity into the branch, but what happens when that packets dumped off onto the land? Does it solve for that? And that's an area that we feel like we have that opportunity, that advantage because we own the network. If we are the provider for your APs, for your switches, that gives us the opportunity to help you simplify your network, but also secure it in a new way, leveraging the principles of SASE and extending that into the campus or branch.

>> It's not just a remote thing. It's really-

John Spiegel

>> No.

>> It is distributed computing. It's a cloud native, cloud operating model running distributedly.

John Spiegel

>> Right, but ZTNA isn't just remote access.

>> Yeah, exactly.

John Spiegel

>> It got pinned with remote access due to the events of 2020, but it's a lot more than that. It essentially architecting your network and segmenting it off. And we need to get back to that. Yeah,

>> I think that's the key. I want to ask you about the show. First of all, thanks for the comments. Great commentary there. The show here, what's the main story? In your view, what's the hot... What's the most important story being talked about this week at Black Hat if you have the summarize top 3?

John Spiegel

>> So if I didn't say AI,-

>> Of course....

John Spiegel

>> I would be remiss. That is

>> AI and workforce shortage

John Spiegel

>> Yeah. Yeah. Yeah. Yeah. Workforce shortage, not enough security engineers, CISOs. So burnout is actually a topic. I've had a few conversations around... Just because the responsibilities are becoming so great. In the past, it was a very technically oriented job, but now security is horizontal across an organization. So what a see so is and what they do, it's evolved. So that's a topic. The other one is... And this is surprising, and it was a theme that came out of RSA, segmentation. It's an oldie that's come back. But if you think about it, AI and what AI requires is massive data lakes. You have to segment that data off. You have to really protect it. So segmentation has come back hot as well.

>> I think the role of what a SIM is with human capital involved and identifying threats with automation coming around the corner is interesting. One I heard, Next-Gen SIM really is not really Next-Gen SIM. It's going to be last gen SIM. A whole nother generation of kind of analysis is coming big time. That seems to be the story. The other one that we're hearing I want to get your reaction to real quick as we wrap up is there's also a trend for some of the bigger distributed computing customers looking at the complete reset the platform from scratch. There's some design going on. Do I vertically integrate end-to-end workflows? What is the best architecture and foundational infrastructure look for them to have for the next 20 years? And they're looking at it like a do-over. What's your reaction to that?

John Spiegel

>> I think, well, I don't want to talk too much about futures here because I think the answer to this, and we will hear more about it as we get into later in the year, but I think that's one of the things that's driving it. I think there's a huge opportunity right now to rethink the network. From a data center layer perspective. You need low latency, you need non-blocking to make AI successful, and then you start to see what happens next. The AI co-pilots are now moving over to laptops and those PC devices. So you probably need to rethink-

>> Opportunity for a hacker.

John Spiegel

>> Exactly. Exactly.

>> I'm a hacker. I love that.

John Spiegel

>> You got to rethink the campus and the branch network as well. So I think there's an opportunity there too. And then tying it together with a centralized control mechanism like we have with HPE Aruba Networking. And it also starts to address some of the challenges with the workforce, getting people in. Especially in the networking space, that is, I think you mentioned it, it's kind of the last bastion of very challenging technologies. We still... BGP is the protocol that runs the internet. How old is it? We're harkening back to the early 90s here.

>> If the plumbing works. Don't fix it.

John Spiegel

>> Right. Right. Right.

>> Let it work. Let it go.

John Spiegel

>> But it's a very challenging protocol. I've configured it before, and you don't want to make a mistake. And that's the underpinnings of this. Getting people into that realm takes a long time, a lot of training that has to happen. And if we can abstract the complexity of it, leveraging a GenAI mechanism, a ChatGTP interface to say, "Hey, you've got a problem over here. I recommend that you take this action. And then being able to apply it and not just doing that at a high level network engineer level, but down to a knock where they can really take a look at it, provide that information to that high-end engineer, and he's going to nod his head or her head and say, "Yeah, apply that. Fix the problem." I think that's really where it is.

>> It's interesting. It's the networking data and risk management paradigm. All those are three key variables. In fact, theCUBE research was the first research analyst firm that actually identified compute and store as separating. That created the hyper convergence.

John Spiegel

>> But it's also how we make it simpler.

>> Yeah, exactly.

John Spiegel

>> How do we make it simpler? Because we can't keep going down this path of complexity, complexity, complexity. We've got to simplify it.

>> I think the cataloging, the governance piece, and the data is a tell sign, so we're watching that closely. John, thanks for coming on theCUBE.

John Spiegel

>> Hey, thank you.

>> We'll certainly see you again now that we know that you're at HPE. You've been hiding from us on theCUBE. We got to get to you soon. It's a great area. It's security for HPE.

John Spiegel

>> Thank you.

>> Thanks for coming on.

John Spiegel

>> Yeah, thank you.

>> All right. CUBE coverage here, Black Hat. I'm John Furrier, host of theCUBE. Thanks for watching.