RSA Conference 2024 | Tim Van den Heede & Dimple Ahluwalia | IBM Consulting

Clips
News
More from RSA Conference 2024

Tim Van den Heede

Vice President of Global Security Services Sales

IBM Consulting

Dimple Ahluwalia

Global BISO and Global Senior Partner, Cybersecurity Services

IBM Consulting

NATO and quantum computing are part of the cybersecurity agenda for IBM Consulting

Starting this January, IBM Corp. began working with the NATO Communications and Information Agency to help strengthen the Alliance’s cybersecurity posture.IBM is working with the organization to improve its security visibility and asset management across NATO enterprise networks. As part of the agreement, IBM Consulting has been tasked with building a customized solution that will provide NATO with a unified view of its security landscape.“With the attack surface that NATO has, it’s quite a different ballgame,” said Tim Van den Heede (pictured, right), vice president of global security services sales at IBM Consulting

play_circle_outline Emphasis on expanding the focus of cybersecurity to areas such as operational technology (OT).

play_circle_outline Mention of the increasing importance of security in the adoption of new technologies like AI and cloud.

play_circle_outline The Growing Significance of Quantum Computing: Understanding Its Impact on Cybersecurity and the Urgency for Quantum-Safe Solutions

Info

Tim Van den Heede & Dimple Ahluwalia | IBM Consulting

Tim Van den Heede

Vice President of Global Security Services Sales IBM Consulting

Dimple Ahluwalia

Global BISO and Global Senior Partner, Cybersecurity Services IBM Consulting

search

>> Hi everybody. Welcome back to 2024. You're watching theCUBE, our continuous coverage of RSA, the big conference here, four days, about 40,people here. I think it's back to its pre-COVID levels. Tim Van den Heede is here. He's the vice president of global cyber security services sales at IBM Consulting, and Dimple Aluwalia is the global BISO. We're going to find out, Dimple, what that means, and global senior partner cyber security services, IBM Consulting. Folks, welcome to theCUBE. Thanks so much for coming in.

Tim Van den Heede

>> a pleasure.

>> B-I-S-O, what does that stand for?

Dimple Ahluwalia

>> Business information security officer. So, it's essentially an extension of CISO role that organizations have. Someone who's focused on protecting the organization, our data, our systems, our people. And then, making sure that we're good stewards of doing that for our clients because they entrust in us. So, I get to be the business unit CISO, essentially, for all of IBM Consulting.

>> Ah, okay. Great. Because you guys have had some success with that role with, I know, the chief data office.

Dimple Ahluwalia

>> Exactly.

>> It's a similar sort of format.

Dimple Ahluwalia

>> Exactly.

>> Good to see that scaling across IBM. And Tim, explain your role.

Tim Van den Heede

>> So, I'm responsible for our go-to-market for our teams in the field to help our clients understand our value proposition, understand the requirements, and bring that together in solutions that drive your security posture upwards.

>> Okay, so we all know IBM Consulting, it's where tech meets industry. You guys go deep. You guys are world-class capabilities. Zooming out, let's start with the big trends that you see in cyber. Obviously, a lot of AI. We heard a lot of that last year. We're hearing more of it, of course, this year. But the big picture is every year we spend more, we stay the same. I joke if you're a general manager of a football team, you'd be fired for staying the same. But that's basically what the industry can do. But what are the big picture trends that you guys are seeing, Dimple, in the field.

Dimple Ahluwalia

>> So, there's a lot of focus around expansion of cyber in terms of areas that perhaps haven't been cared for as much in the past. A lot you've mentioned in terms of investments andor areas of attention have been around traditional IT security, we see that expanding. We see that expanding in a big way around operational technology or OT. And making sure that the systems that many of our countries, many of our cities and states operate on, whether those are simple things as our metros, or industrial plants, or energy and utilities, really protecting that as well. That has always been an area that needed the same level of attention and focus, but it wasn't in scope of traditional CISOs. And we see that expanding from IT to OT security. We also see areas where security is being positioned early for conversation as businesses and governments look at expanding their areas and adoption of new technology. You mentioned AI. You're right, looking at around in RSA, there's not a single place that I can turn to that doesn't say the word AI. Just like if you recall back in the day, not so much back in the day, is around cloud, right? So, I think we see that again. And then, quantum-safe again also brings that. So, we see security being thought of earlier enough these days. We're not quite there yet. I think there's a lot of socializing and bridging to do between different stakeholders within an organization, so that they fully appreciate what security can be doing for them as an enabler. So, we see those areas of certainly focus.

>> I mean that OT very fascinating. Digital world meets the physical world. Frankly, as you well know, we're highly exposed in that regard. And they have largely been separate. I mean the way we used to secure the physical world, it was wasn't connected, but now it is connected. So, they were by design or maybe it was by luck, air-gapped. No longer are they air-gapped. And Tim, what are the big things you're seeing with customers? And I want to get into this NATO example, which maybe touched on some of the things that Dimple was just talking about.

Tim Van den Heede

>> So, if you look at our clients, our business, our CXO counterparts, what they say is we have a lot of innovation to do in our business. That's the way that we grew our business. Now, with that, comes the responsibility to do it in a secure way. Even for AI, you need to do it in a secure way, but all the traditional stuff that we're still doing, it needs to be secured to the boat. And so, what we've seen that clients that have a higher growth of revenue over time also have higher security posture levels. So, there's a correlation between how secure they are and how fast they can grow their business. And the reason for that is because they can launch new programs and innovation faster if they address the security problem heads on and by design.

>> So, that's interesting. The previous guest that we just had on it was a startup. And it's sometimes hard for organizations to get their arms around security as a driver of business value specifically. It doesn't throw off a lot of cash. But you've got data that suggests that by lowering your risk, you can actually drive more business value. Is that what I'm understanding?

Tim Van den Heede

>> Right. And there's a second element to that is any project that you do, whether it's business, security, IT, you will look at what yield you get from a project. Now, for security, that has always been challenging to see the value of security because it was seen as an insurance or a policy that you would need to put in. Being able to correlate your risk reduction and monetary value to the investments that you make in security make it a much easier conversation to put it at the forefront of a very board-level discussion.

>> So, I want to double-click on that, because essentially, the business case for cyber is the reduction the expected loss, right? Okay. So, you expect to get hacked. That's probably more prevalent. The impact is probably greater than it's ever been. So, you can quantify that, presumably, by making some assumptions. Are the CFOs buying this? And obviously, it's not across the board. But how you getting the CFOs to buy into this the lines of business to buy into it?

Tim Van den Heede

>> Well, you mentioned the notion of expected annual loss, and so that's how they look at it. You can look at it as value or as a cost. And so, if you have 60 programs, you need to prioritize those programs. If you do that from a risk-quantified perspective, you can go the CFO and say, These are the five most critical things we need to go do because they have the biggest impact on our bottom-line PL,and that's something they listen to.

>> When we to customers, there's a big theme in the industry about there's a skills gap, there's too many tools, 50, hundreds of tools installed, and it just increases complexity. We'd love to consolidate that. We know that's not happening. Actually, people are adding more. Are we thinking about it wrong, Dimple, in terms of just so focused on the tools and the technology, not enough on the people and process?

Dimple Ahluwalia

>> People and the process? Yeah.

>> And how you helping organizations squint through that maze of tooling that they keep layering on? I live in an old house and there's a lot of layers of paint on my house. Every time we have to paint it's like, Oh,it gets worse and worse and worse every time we cover up the warts. How you helping customers deal with that problem?

Dimple Ahluwalia

>> So a couple ways, when you talk about certainly the people and process side, you're absolutely right because you can always apply whatever the best-of-breed technology is. Challenge is if you don't really have a well-defined security program with the right level of governance to understand what it is that you're trying to protect. You can have the best of technologies, but it's not necessarily going to help improve your security posture. So, really looking at an integrated program that is applying the right set of technologies that will better support all different aspects of whatever you're trying to protect as an organization. And then, looking at how do you also have the right set of partnerships? And I say partnerships because two fronts. One is it's important to always make sure that the providers you're working with share your same methodology, your same focus and energy around security, not just as a provider, but also as a company in itself. So, it helps to kind of say you share certain characteristics because if you live and breathe it yourself, more likely you're going to understand what the pain point is for the client and be able to help them do that. Skills, I think is in a similar way is... The skill shortage, we've been talking about it for a number of years. The number of open roles continues to fluctuate, but the problem hasn't been necessarily solved. One of the areas that I do find encouraging is around public-private sector partnership, in that we're looking at bringing in individuals with different backgrounds, experiences, life experiences, who can really learn cyber and apply that knowledge. So, if you think about people who can test for security vulnerabilities, who can look at being able to look at business process and how do you make it inherently more secure? So, this whole notion that even Tim was just mentioning about secure by design. So, we're trying to work with our clients and helping them evaluate the skills and talent they have and figure out what may be growth areas for them in cyber, and then helping with the enablement and such. And then, certainly, as a service provider in helping with managed services.

>> Thank you for that answer. So, zero-trust pre-pandemic was a buzzword, and it sort of became this mandate. It's getting kind of buzzy again. Does zero-trust lean in enough to those business process aspects in your view? Where are we in terms of zero-trust adoption? Do you feel like it's kind of buzzy? Does it have teeth? I certainly know, I talk to enough CISOs, that if you actually take it seriously and you implement that, it's a journey, it's not something you buy off the shelf. So, I believe in it. I don't mean to be negative on it, but it's very challenging to operationalize. So, how do you think about zero-trust and how do you help folks operationalize it?

Dimple Ahluwalia

>> Yeah, so we think about it in terms of it is a shared responsibility. Like you said, there's no silver bullet or a single technology that's going to necessarily solve the problem. And for us, where we've seen greater success is being able to bring the line of business leaders because they have a right use case. You want to make sure that you are building something or you understand what it is you're trying to secure. And then, couple that with individuals who have different areas of functional responsibility. So, if you think about it, in most cases when it comes to zero-trust, a CISO security leader within an organization is an influencer because they're setting the policy. They're saying, These are the type of controls that we need.But really, the operational execution of it typically resides with those who are in CIO organizations, with infrastructure responsibility, application development responsibility. So, really, the greater success I've seen is when all stakeholders are in sync and prioritizing it about the same time, how we tend to help is facilitate that conversation honestly is rather than jumping straight into, Here are great technologies that we can apply,it's more about we bring those stakeholders together and do what we call design thinking workshops to help make sure there's clarity on what is the outcomes that they want to achieve and then helping them, to your point, is mapping out their journey to do exactly

>> It's no question in my mind it's the right approach, but when the bombs are dropping, we're going to talk about NATO, no pun intended, people just say, Give me a tool to plug that hole.And then, it's like my barn that I paint every other year. Okay. Let's get into the cyber piece of this, Tim. I mean the NATO piece of this. So, you've got this relationship with NATO, they've got certain objectives. Take us through this case study. I'm really interested in this.

Tim Van den Heede

>> So, NATO, North Atlantic Treaty Organization, I'm going to 75 years old, 32 countries. Mission is both political as a military. So, you can see the complexity of an organization like that across the globe with different countries, different policies, different systems, networks that are collaborating together. And they set out to go and improve the fundamentals. And the fundamentals are really making sure you deal with your vulnerabilities. Now, in order to be able to deal with your vulnerabilities in such a complex landscape, there's really three things that you need to know. You need to know what are my assets and where are they? What kind of controls do I have on those assets and how are they patched? Now, if you need to do this in 50-people organization, it's fairly straightforward. With the attack surface that the NATO has, it's quite a different ballgame. So, they engaged with us on a three-year program to transform that whole concept that I just explained to get full visibility on all their assets, their controls and their patches, in order to drive that vulnerability management program. Because it's a foundation for everything else that they do in terms of systems, applications they build, and they're going to consume it and there are other instruments of power. So, instruments of power for the NATO are the land, sea, air, space, and now, the fifth one is cybersecurity. But cybersecurity also taps into the other four because as they deploy into the field, they need to have access to systems, whether it's OT or IT. They need to make sure that the data they're building decisions on and the applications that they're using have a foundation that has visibility, transparency and is kept to date every single moment of the day. So, that's the whole program that we are running with them.

>> Obviously, you referenced there's politics involved. Now, you able to get kind of consensus on what the priorities are across those different constituencies. How were you able to do that?

Tim Van den Heede

>> So, that was not part of our scope. So, the NATO themselves, they organized that. what they did is because they knew it's going to take time to go through the process and make a decision you're going to work with. So, it took about, I think a year, a year and a half. So, rather than sending out a request for proposal to 10 companies, they had a limited set of companies they went with, and then they did iterative co-creation across different towers and different phases of the program. What they did is they could tune and work with their constituents throughout that period to make sure everybody's aligned on what the outcome should be. So, they made the decision on what the scope would be, but we helped them obviously shape it throughout the process of the engagement.

>> So, they had to figure that out. But you helping them understand their posture, and then really where to apply the resources. You mentioned patching, I mean something as basic as patching is actually making that happen. So, what's the life cycle of this project? When did it start? Where are you in the maturity cycle?

Tim Van den Heede

>> So, we started only a couple of, I'm going to say months ago, and it's going to be running for three years. And then, an additional one or two years we could extend it into.

>> So, here we are talking about how technology kind of secondary to people and process, but I want to talk about technology. You mentioned quantum. I heard Jensen say at GTC a couple months ago, maybe it wasn't that long ago, Well, most of the stuff that they're talking about in quantum we can do with AI.Of course of people that I've talked to have said, No, no, that's not true,particularly cryptography. So, where does quantum fit in this whole world of cyber?

Dimple Ahluwalia

>> I think it's pretty high. There's been a lot of commentary around is it real? What's going to become of it? Look, quantum computing definitely is real. The business cases and application use cases are being proven day in, day out. So, as that comes about, for me honestly, it's less about creating a FUD that something is going to happen and be imminent. But there is a defined timeline of when this could become reality around introduction of threats, particularly as organizations... We talked about patching. Patching is one of the areas that people think about, but there are just as many areas that companies haven't paid attention to. And I think certainly around cryptography, really looking at the encryption that's in place, the type of applications, the type of data. And right now, where we're at is having very clear conversations with our clientsboards to help educate them around what is the potential, the good sides of certainly for adoption of quantum computing, but then also looking at quantum-safe and how they need to be assessing their environment to first understand you can't protect something that you don't know about, right? It's an old thing that we've highlighted when it comes to vulnerabilities, but the same thing around quantum-safe is really take inventory of what you have in place, understand where your gaps are. As you do technology refreshes, make sure that you're selecting technologies that provide you and advance you in your quantum-safe journey. Make sure you understand what's the time it's going to take people process. So, technology, yes, you could deploy it, but if you have ingrained in your applications and everything in your organization, if you don't look at the people process side, then they're going to be stumbling blocks. And so, really, that's where we're having the conversation is take inventory of what you have, define a road map and a strategy. Get the stakeholder alignment in your organization because of line of business owners and then an execution or operational timeframe that's appropriate for your organization and for the risk that you're willing to take. Tim mentioned earlier about risk quantification, risk management. It's a risk-based decision, honestly. So I think that's where we've been focusing on with clients before we ever get to the remediation part of it, first start as a part of your governance framework.

>> Yeah, and quantum's real. Last November, we were to the Thomas J. Watson Research Center in New York. We got the quantum deep dive. And I left there, because I haven't been spending a lot of time in quantum, but I left there saying, Wow, this is actually getting real.So, I have spent more time trying to understand it. There are a lot of different options, a lot of different trade-offs, but it's coming, no question. Guys, thanks so much for coming on theCUBE.

>> Our time flew by. I hope we can have you back. Maybe see IBM Think.

Dimple Ahluwalia

>> Looking forward to it. See you in Boston.

Tim Van den Heede

>> Thank you.

>> welcome. All right, keep it right there. This is Dave Vellante for Shelly Kramer and David Linthicum. You're watching theCUBE's live coverage of 2024. We'll be right back after this short break.

Tim Van den Heede & Dimple Ahluwalia | IBM Consulting

search

>> Hi everybody. Welcome back to 2024. You're watching theCUBE, our continuous coverage of RSA, the big conference here, four days, about 40,people here. I think it's back to its pre-COVID levels. Tim Van den Heede is here. He's the vice president of global cyber security services sales at IBM Consulting, and Dimple Aluwalia is the global BISO. We're going to find out, Dimple, what that means, and global senior partner cyber security services, IBM Consulting. Folks, welcome to theCUBE. Thanks so much for coming in.

Tim Van den Heede

>> a pleasure.

>> B-I-S-O, what does that stand for?

Dimple Ahluwalia

>> Business information security officer. So, it's essentially an extension of CISO role that organizations have. Someone who's focused on protecting the organization, our data, our systems, our people. And then, making sure that we're good stewards of doing that for our clients because they entrust in us. So, I get to be the business unit CISO, essentially, for all of IBM Consulting.

>> Ah, okay. Great. Because you guys have had some success with that role with, I know, the chief data office.

Dimple Ahluwalia

>> Exactly.

>> It's a similar sort of format.

Dimple Ahluwalia

>> Exactly.

>> Good to see that scaling across IBM. And Tim, explain your role.

Tim Van den Heede

>> So, I'm responsible for our go-to-market for our teams in the field to help our clients understand our value proposition, understand the requirements, and bring that together in solutions that drive your security posture upwards.

>> Okay, so we all know IBM Consulting, it's where tech meets industry. You guys go deep. You guys are world-class capabilities. Zooming out, let's start with the big trends that you see in cyber. Obviously, a lot of AI. We heard a lot of that last year. We're hearing more of it, of course, this year. But the big picture is every year we spend more, we stay the same. I joke if you're a general manager of a football team, you'd be fired for staying the same. But that's basically what the industry can do. But what are the big picture trends that you guys are seeing, Dimple, in the field.

Dimple Ahluwalia

>> So, there's a lot of focus around expansion of cyber in terms of areas that perhaps haven't been cared for as much in the past. A lot you've mentioned in terms of investments andor areas of attention have been around traditional IT security, we see that expanding. We see that expanding in a big way around operational technology or OT. And making sure that the systems that many of our countries, many of our cities and states operate on, whether those are simple things as our metros, or industrial plants, or energy and utilities, really protecting that as well. That has always been an area that needed the same level of attention and focus, but it wasn't in scope of traditional CISOs. And we see that expanding from IT to OT security. We also see areas where security is being positioned early for conversation as businesses and governments look at expanding their areas and adoption of new technology. You mentioned AI. You're right, looking at around in RSA, there's not a single place that I can turn to that doesn't say the word AI. Just like if you recall back in the day, not so much back in the day, is around cloud, right? So, I think we see that again. And then, quantum-safe again also brings that. So, we see security being thought of earlier enough these days. We're not quite there yet. I think there's a lot of socializing and bridging to do between different stakeholders within an organization, so that they fully appreciate what security can be doing for them as an enabler. So, we see those areas of certainly focus.

>> I mean that OT very fascinating. Digital world meets the physical world. Frankly, as you well know, we're highly exposed in that regard. And they have largely been separate. I mean the way we used to secure the physical world, it was wasn't connected, but now it is connected. So, they were by design or maybe it was by luck, air-gapped. No longer are they air-gapped. And Tim, what are the big things you're seeing with customers? And I want to get into this NATO example, which maybe touched on some of the things that Dimple was just talking about.

Tim Van den Heede

>> So, if you look at our clients, our business, our CXO counterparts, what they say is we have a lot of innovation to do in our business. That's the way that we grew our business. Now, with that, comes the responsibility to do it in a secure way. Even for AI, you need to do it in a secure way, but all the traditional stuff that we're still doing, it needs to be secured to the boat. And so, what we've seen that clients that have a higher growth of revenue over time also have higher security posture levels. So, there's a correlation between how secure they are and how fast they can grow their business. And the reason for that is because they can launch new programs and innovation faster if they address the security problem heads on and by design.

>> So, that's interesting. The previous guest that we just had on it was a startup. And it's sometimes hard for organizations to get their arms around security as a driver of business value specifically. It doesn't throw off a lot of cash. But you've got data that suggests that by lowering your risk, you can actually drive more business value. Is that what I'm understanding?

Tim Van den Heede

>> Right. And there's a second element to that is any project that you do, whether it's business, security, IT, you will look at what yield you get from a project. Now, for security, that has always been challenging to see the value of security because it was seen as an insurance or a policy that you would need to put in. Being able to correlate your risk reduction and monetary value to the investments that you make in security make it a much easier conversation to put it at the forefront of a very board-level discussion.

>> So, I want to double-click on that, because essentially, the business case for cyber is the reduction the expected loss, right? Okay. So, you expect to get hacked. That's probably more prevalent. The impact is probably greater than it's ever been. So, you can quantify that, presumably, by making some assumptions. Are the CFOs buying this? And obviously, it's not across the board. But how you getting the CFOs to buy into this the lines of business to buy into it?

Tim Van den Heede

>> Well, you mentioned the notion of expected annual loss, and so that's how they look at it. You can look at it as value or as a cost. And so, if you have 60 programs, you need to prioritize those programs. If you do that from a risk-quantified perspective, you can go the CFO and say, These are the five most critical things we need to go do because they have the biggest impact on our bottom-line PL,and that's something they listen to.

>> When we to customers, there's a big theme in the industry about there's a skills gap, there's too many tools, 50, hundreds of tools installed, and it just increases complexity. We'd love to consolidate that. We know that's not happening. Actually, people are adding more. Are we thinking about it wrong, Dimple, in terms of just so focused on the tools and the technology, not enough on the people and process?

Dimple Ahluwalia

>> People and the process? Yeah.

>> And how you helping organizations squint through that maze of tooling that they keep layering on? I live in an old house and there's a lot of layers of paint on my house. Every time we have to paint it's like, Oh,it gets worse and worse and worse every time we cover up the warts. How you helping customers deal with that problem?

Dimple Ahluwalia

>> So a couple ways, when you talk about certainly the people and process side, you're absolutely right because you can always apply whatever the best-of-breed technology is. Challenge is if you don't really have a well-defined security program with the right level of governance to understand what it is that you're trying to protect. You can have the best of technologies, but it's not necessarily going to help improve your security posture. So, really looking at an integrated program that is applying the right set of technologies that will better support all different aspects of whatever you're trying to protect as an organization. And then, looking at how do you also have the right set of partnerships? And I say partnerships because two fronts. One is it's important to always make sure that the providers you're working with share your same methodology, your same focus and energy around security, not just as a provider, but also as a company in itself. So, it helps to kind of say you share certain characteristics because if you live and breathe it yourself, more likely you're going to understand what the pain point is for the client and be able to help them do that. Skills, I think is in a similar way is... The skill shortage, we've been talking about it for a number of years. The number of open roles continues to fluctuate, but the problem hasn't been necessarily solved. One of the areas that I do find encouraging is around public-private sector partnership, in that we're looking at bringing in individuals with different backgrounds, experiences, life experiences, who can really learn cyber and apply that knowledge. So, if you think about people who can test for security vulnerabilities, who can look at being able to look at business process and how do you make it inherently more secure? So, this whole notion that even Tim was just mentioning about secure by design. So, we're trying to work with our clients and helping them evaluate the skills and talent they have and figure out what may be growth areas for them in cyber, and then helping with the enablement and such. And then, certainly, as a service provider in helping with managed services.

>> Thank you for that answer. So, zero-trust pre-pandemic was a buzzword, and it sort of became this mandate. It's getting kind of buzzy again. Does zero-trust lean in enough to those business process aspects in your view? Where are we in terms of zero-trust adoption? Do you feel like it's kind of buzzy? Does it have teeth? I certainly know, I talk to enough CISOs, that if you actually take it seriously and you implement that, it's a journey, it's not something you buy off the shelf. So, I believe in it. I don't mean to be negative on it, but it's very challenging to operationalize. So, how do you think about zero-trust and how do you help folks operationalize it?

Dimple Ahluwalia

>> Yeah, so we think about it in terms of it is a shared responsibility. Like you said, there's no silver bullet or a single technology that's going to necessarily solve the problem. And for us, where we've seen greater success is being able to bring the line of business leaders because they have a right use case. You want to make sure that you are building something or you understand what it is you're trying to secure. And then, couple that with individuals who have different areas of functional responsibility. So, if you think about it, in most cases when it comes to zero-trust, a CISO security leader within an organization is an influencer because they're setting the policy. They're saying, These are the type of controls that we need.But really, the operational execution of it typically resides with those who are in CIO organizations, with infrastructure responsibility, application development responsibility. So, really, the greater success I've seen is when all stakeholders are in sync and prioritizing it about the same time, how we tend to help is facilitate that conversation honestly is rather than jumping straight into, Here are great technologies that we can apply,it's more about we bring those stakeholders together and do what we call design thinking workshops to help make sure there's clarity on what is the outcomes that they want to achieve and then helping them, to your point, is mapping out their journey to do exactly

>> It's no question in my mind it's the right approach, but when the bombs are dropping, we're going to talk about NATO, no pun intended, people just say, Give me a tool to plug that hole.And then, it's like my barn that I paint every other year. Okay. Let's get into the cyber piece of this, Tim. I mean the NATO piece of this. So, you've got this relationship with NATO, they've got certain objectives. Take us through this case study. I'm really interested in this.

Tim Van den Heede

>> So, NATO, North Atlantic Treaty Organization, I'm going to 75 years old, 32 countries. Mission is both political as a military. So, you can see the complexity of an organization like that across the globe with different countries, different policies, different systems, networks that are collaborating together. And they set out to go and improve the fundamentals. And the fundamentals are really making sure you deal with your vulnerabilities. Now, in order to be able to deal with your vulnerabilities in such a complex landscape, there's really three things that you need to know. You need to know what are my assets and where are they? What kind of controls do I have on those assets and how are they patched? Now, if you need to do this in 50-people organization, it's fairly straightforward. With the attack surface that the NATO has, it's quite a different ballgame. So, they engaged with us on a three-year program to transform that whole concept that I just explained to get full visibility on all their assets, their controls and their patches, in order to drive that vulnerability management program. Because it's a foundation for everything else that they do in terms of systems, applications they build, and they're going to consume it and there are other instruments of power. So, instruments of power for the NATO are the land, sea, air, space, and now, the fifth one is cybersecurity. But cybersecurity also taps into the other four because as they deploy into the field, they need to have access to systems, whether it's OT or IT. They need to make sure that the data they're building decisions on and the applications that they're using have a foundation that has visibility, transparency and is kept to date every single moment of the day. So, that's the whole program that we are running with them.

>> Obviously, you referenced there's politics involved. Now, you able to get kind of consensus on what the priorities are across those different constituencies. How were you able to do that?

Tim Van den Heede

>> So, that was not part of our scope. So, the NATO themselves, they organized that. what they did is because they knew it's going to take time to go through the process and make a decision you're going to work with. So, it took about, I think a year, a year and a half. So, rather than sending out a request for proposal to 10 companies, they had a limited set of companies they went with, and then they did iterative co-creation across different towers and different phases of the program. What they did is they could tune and work with their constituents throughout that period to make sure everybody's aligned on what the outcome should be. So, they made the decision on what the scope would be, but we helped them obviously shape it throughout the process of the engagement.

>> So, they had to figure that out. But you helping them understand their posture, and then really where to apply the resources. You mentioned patching, I mean something as basic as patching is actually making that happen. So, what's the life cycle of this project? When did it start? Where are you in the maturity cycle?

Tim Van den Heede

>> So, we started only a couple of, I'm going to say months ago, and it's going to be running for three years. And then, an additional one or two years we could extend it into.

>> So, here we are talking about how technology kind of secondary to people and process, but I want to talk about technology. You mentioned quantum. I heard Jensen say at GTC a couple months ago, maybe it wasn't that long ago, Well, most of the stuff that they're talking about in quantum we can do with AI.Of course of people that I've talked to have said, No, no, that's not true,particularly cryptography. So, where does quantum fit in this whole world of cyber?

Dimple Ahluwalia

>> I think it's pretty high. There's been a lot of commentary around is it real? What's going to become of it? Look, quantum computing definitely is real. The business cases and application use cases are being proven day in, day out. So, as that comes about, for me honestly, it's less about creating a FUD that something is going to happen and be imminent. But there is a defined timeline of when this could become reality around introduction of threats, particularly as organizations... We talked about patching. Patching is one of the areas that people think about, but there are just as many areas that companies haven't paid attention to. And I think certainly around cryptography, really looking at the encryption that's in place, the type of applications, the type of data. And right now, where we're at is having very clear conversations with our clientsboards to help educate them around what is the potential, the good sides of certainly for adoption of quantum computing, but then also looking at quantum-safe and how they need to be assessing their environment to first understand you can't protect something that you don't know about, right? It's an old thing that we've highlighted when it comes to vulnerabilities, but the same thing around quantum-safe is really take inventory of what you have in place, understand where your gaps are. As you do technology refreshes, make sure that you're selecting technologies that provide you and advance you in your quantum-safe journey. Make sure you understand what's the time it's going to take people process. So, technology, yes, you could deploy it, but if you have ingrained in your applications and everything in your organization, if you don't look at the people process side, then they're going to be stumbling blocks. And so, really, that's where we're having the conversation is take inventory of what you have, define a road map and a strategy. Get the stakeholder alignment in your organization because of line of business owners and then an execution or operational timeframe that's appropriate for your organization and for the risk that you're willing to take. Tim mentioned earlier about risk quantification, risk management. It's a risk-based decision, honestly. So I think that's where we've been focusing on with clients before we ever get to the remediation part of it, first start as a part of your governance framework.

>> Yeah, and quantum's real. Last November, we were to the Thomas J. Watson Research Center in New York. We got the quantum deep dive. And I left there, because I haven't been spending a lot of time in quantum, but I left there saying, Wow, this is actually getting real.So, I have spent more time trying to understand it. There are a lot of different options, a lot of different trade-offs, but it's coming, no question. Guys, thanks so much for coming on theCUBE.

>> Our time flew by. I hope we can have you back. Maybe see IBM Think.

Dimple Ahluwalia

>> Looking forward to it. See you in Boston.

Tim Van den Heede

>> Thank you.

>> welcome. All right, keep it right there. This is Dave Vellante for Shelly Kramer and David Linthicum. You're watching theCUBE's live coverage of 2024. We'll be right back after this short break.