Billy Spears, Teradata

Clips
News
More from Teradata Possible 2024

Billy Spears

Chief Security Officer

Teradata

Three insights you may have missed from Teradata Possible 2024

Integrating AI-driven data analytics into enterprise systems presents both opportunities and challenges. As businesses embrace artificial intelligence to drive efficiency and innovation, they face a growing need to balance technological advancements with robust data strategies.For companies such as Teradata Corp., this focus on scalable AI and reliable data management is vital to maintaining a competitive edge. By leveraging strategic partnerships, Teradata enhances its AI capabilities while ensuring that its data infrastructure supports innovation and operational resilience

Cloud security and compliance in the AI era: Insights from Teradata

As artificial intelligence becomes increasingly relevant, the mandate to prioritize data security has never been more pronounced in the enterprise. However, artificial intelligence for IT operations is introducing new threat vectors for malicious actors to infiltrate networks, steal crucial data and proliferate ransomware. How can companies approach the delicate task of balancing efficient cloud operations with cybersecurity for AI?Teradata’s Billy Spears talks with theCUBE about cybersecurity for AI.“Today we have these cloud products, two amazing products customers can choose from,” said Billy Spears (pictured), chief information security officer of Teradata Corp

play_circle_outline Importance of security in data protection and privacy

play_circle_outline Transition from on-prem to cloud-first driven by CEO

play_circle_outline Incident management improvements and disaster recovery options

play_circle_outline Planning for worst-case scenarios to build trust with customers

play_circle_outline Strengthening Security: Teradata’s Solutions & Tips for Cyber Hygiene

Info
Transcript

Billy Spears, Teradata

Billy Spears

Chief Security Officer Teradata

Teradata's focus on security in the context of AI, cloud, and network protection is driven by CEO Steve McMillan. The company offers solutions like Vantage Cloud Enterprise and prioritizes regulatory compliance with various certifications. Incident management processes have been enhanced, and the company emphasizes trust-building with customers and resilience to security threats. Teradata uses sandboxes and containers for threat isolation and promotes a strong security culture. Billy's background in magic has influenced his cybersecurity communication approac... Read more

explore Keep Exploring

What processes and security measures are in place for the cloud products being offered? add

What was the vision that the CEO, Steve McMillan, shared with the company four years ago? add

What has been the transformation in Teradata's incident management over the last three years? add

What is the importance of building trust with customers in order to extend the longevity of relationships? add

have had in a while! What should I do to ensure the security of my network and devices? add

bolt Powered by CUBE AI

Billy Spears, Teradata

Savannah Peterson

>> Good morning and welcome to Sunny Los Angeles, California. We are here for Teradata, possible steaming into our second interview of a power packed day of coverage. My name is Savannah Peterson. Delighted to be here with Rob Strechay today. Rob, you're a Teradata OG.

Rob Strechay

>> Yeah, again, I've been around the community since I was an end user back in the early two thousands. So not quite the 40 years it's been around, but I think one of the things that everybody has always come to love about Teradata is really the security of it, and I think there's probably no better person to talk security with than our next guest.

Savannah Peterson

>> I know, and without further ado, single-handedly the best energy I've encountered all day today. Billy, thank you so much for taking time to hang out with us this morning.

>> Thanks for having me. I'm excited to be back on the show again and excited to get into the conversation about my favorite topic, security. And for all the youth outside in home or in around listening, happy Cyber Security Awareness Month. This is an awesome month for me, not just about ghosts and goblins and Halloween, but also to talk about my favorite topic.

Rob Strechay

>> Yeah, I think there's a lot of people talking about it outside of this, but when Steve was on stage earlier, it was definitely one of the main messages, and Radhika also talked about it, about how security ... She talked about malware, worms and AI, which I didn't even think about a worm infiltrating my AI and taking all of my prompt history and stuff like that. It definitely got me thinking about it to set me up perfectly with this. But-

Savannah Peterson

>> You have something to hide in your prompt history?

Rob Strechay

>> I don't know. I don't. But it made me think that maybe why would somebody want my prompt.

Savannah Peterson

>> I raised the question.

Rob Strechay

>> I wonder why somebody would want my prompt, but then they would get all the data. But again, and we have our own LLM and we have our own little CUBE AI that we use as well. But really I think when you look at it, security is such a big theme around AI and around the cloud and around networks and things like that. How do you see this from a data protection and data privacy perspective really come into play?

Savannah Peterson

>> Yeah, it's an amazing question, but before we get started, I brought a little props this time and I want to talk basic end using of the concept of what a network is, and then I think it helps really talk about the privacy and data protection aspects. So right here at the table.

Rob Strechay

>> I love it. We love a good prop, Billy. Let's go.

>> I did. I brought these things. These are not handcuffs, audience, these are horseshoe ring puzzles. The horses won't miss them. It's okay. So the idea here is over here on this side call this the network or your endpoint, maybe a cell phone. This side is what you're talking to. Hopefully you don't have Verizon, maybe, I don't know, T-Mobile. But if you have something else, that's okay too. Top chain, data going in, bottom chain, data going out. And the little ball here in the center of this ring, this is security. That's it. So if it's done right, everything moves back and forth, but typically that's not what happens. In our business, the data goes here, the security pops out. We'll put that right there for now. You still have a network but my security just left. Again, happy Cyber Security Awareness Month. We need to get the security back on, otherwise Rob's going to lose his AI prompts. We put it back on and there we go. That's a network. So it's incredible. And then what we have here, we'll talk about a little later, it's a little bit more advanced than the horses losing their shoes. When we think about things like AI, what's really cool, especially here in Teradata, is we've thoughtfully processed what we need to do for the future. Teradata, 45 years old plus. We've been on-prem the entire time. So really what happens is that exchange between security, we build the product, we rely on our customers to implement that product and also manage the security. Ha-ha, no more. Today we have it and now we have these cloud products, two amazing products customers can choose from. And inside of that we've built things like threat models. That's all the behind the scenes risks. We think about it so you don't have to. And then what we do is take that information and we build things in with all kinds of application security testing. We start from the open source testing, we bring it in on a static environment. Once we're ready to go to production, we have runtime environment. And all that stuff is hidden behind the best encryption in the world to make sure that what happens at rest also happens in transit so your stuff stays with you.

Savannah Peterson

>> That shift from on-prem to cloud first, was that customer driven? Was that security driven? Was that innovation driven?

>> That was our CEO, Steve McMillan driven. Four years ago, he joined this company and the first thing he said is, "We're going to be a cloud first company." And people got behind him, they got goosebumps. I don't know if you can zoom in and see it, but I got goosebumps today with you guys. It's incredible. He stood up here and said, "We're going to be cloud first." And this company said, "whoa, we have the power on-prem, but we're going to take this stuff into the stratosphere in the cloud." And what do you think everyone did? They looked up. Nobody knows where the cloud is, but all it is, folks, is taking physical infrastructure, things you can touch to virtualized infrastructure. Maybe yours in Microsoft, and it's sunk in the middle of the ocean. I don't know, but it's there. And what we have around security, encapsulated around that is we have purposeful investment across all the major categories. We don't worry about defensive layers, we don't worry about the posture. We follow the data at the scale you want, and we meet you wherever you are and we have options for you.

Savannah Peterson

>> I love that. What are some of your favorite use cases of meeting these customers where they are?

>> Well, first you have to understand the customer. That's a great question. The idea of the customer. They could say, "Hey, we're halfway through the journey. We want a little bit more responsibility." So we might offer up our Vantage Cloud Enterprise solution, which is great. It's a great hybrid infrastructure deployment option. We still get the power of the cloud, but you get all the control. Personally, I'm not a control person, but we want to help you. So the idea is we give you all the stuff, whether you start with the perimeter and the network, move down to the data layers. If you're an infrastructure person, we have all the things there. But really the power of the cloud starts with identity and access management. All the controls around authorization, access management, who gets in when they get in, how you SSO, et cetera. We have this really cool feature called bring your own identity. You bring whatever you want. You don't have to change for us. We understand that. You hook it in, all of a sudden you have all the controls back, but you still have the power of Teradata.

Rob Strechay

>> Yeah, I think one of the things that has always been around, again with Teradata has been these large customers, and there's very complex regulatory environments and things like that that they have to worry about. You must see this from all the customers. Again, cloud is like you said, computer in somebody else's data center for the most part, and you're using that, but you want to be able to make sure that's secure. So there's cloud security process for management and things of that nature. How do you see the regulatory balance and the cloud balance working from a CISOs perspective? Because like you said, it is Cybersecurity Month and everybody's really looking at this. And everybody's got something in the cloud now, so how do you see this and talk to customers about that, about what steps they should take as well?

>> It's fair. I think I feel bad for customers. It's complicated and there's so many regulations, there's so many rules, there's so many frameworks, there are so many different sets of controls. We're talking to the hundreds if not thousands of controls you have to think about. On-prem, you have to manage that all by yourself. In the cloud, we do all that homework for you, which is phenomenal. So I have this incredible team that sits behind me, and we look at all the best and the brightest frameworks in the business. And what we've done over the last three years is expand our external compliance to all these frameworks. It's cool. Two, three years ago, we had maybe four or five certifications. You're talking about HIPAA, PCI, ISO, SOC 1, SOC 2. We've now taken that and expanded that across all of our platforms. We've also included high trust, some of the hardest certifications to achieve on the planet. And we just didn't do the easy one, we went for the full-mountain, we were like, "Let's do this head on." Then we expanded there across the globe into something called IWRAP, not a rap video. We're not talking about Run DMC. This is a real thing for the government and what it helps us do is come back to the United States and think about things like FedRAMP, which to me in my personality, this is the most secure framework built off of the NIST pillars of protection, if you will, on the planet.

Rob Strechay

>> Right. And I think when you get into FedRAMP and things like that, organizations look to that. I know I was talking, even organizations, FedRAMP is obviously a US thing, but for the federal government and there's different levels of FedRAMP. But I've even talked to banks in Singapore and what they require is FedRAMP. Are you seeing that security is front and center When people approach Teradata's cloud platform and, "Hey, we need to know what your certifications are. We need to understand your incident response. How do you classify CVEs and things of that nature?"

>> Yeah, you got it. Those are a lot of complex questions. Let's just unpack some of that. The first thing we see is global regulations. Wherever you are, again, we want to meet you where you are. So wherever you are, you're looking at the toughest and most stringent regulations in your area of the world. We think about things like FISC in Japan. We think about GXP is an umbrella. We think about TrueSight, which a lot of the big banks and other folks sign up for. We think about GDPR, new one, DORA coming out of Europe.

Rob Strechay

>> Not the Explorer, by the way.

>> That's true. We know exactly where this DORA is, and it is probably the most stringent regulation since we've seen GDPR. We're already ahead of those things. So like I said before, we have all these certifications across all of our product lines now and we're still achieving greater heights. FedRAMP is the next big one for us That's on the roadmap. We've already looked at what we need to do for DORA and we'll be ready for January 2025, so our customers don't even have to worry about saying, "Hey, have you thought about whatever comes next?" Because we're already there.

Rob Strechay

>> Yeah, and DORA, just for those who don't know, is something that came out ... It started in France but has gone across the EU and it has that you have to be able to recover from one cloud to either on-prem or another cloud within for the financial services industry within a certain amount of time so that there's no downtime and people can actually get at their money, hence not the Explorer.

Savannah Peterson

>> So I was going to say, so you don't don't have a Bank of America moment like they had?

Rob Strechay

>> No. So you don't have a Bank of ... But I mean one of the important things, and you can talk to this, is that just because you're a US company doesn't mean DORA isn't something you have to worry about.

Savannah Peterson

>> It's true. DORA's actually pretty interesting. In one of the sections, they have a risk management section. And if the company in the EU believes that you're a critical company to their operation, then by default they pull you into compliance. So it's really important for companies, especially software companies like us that hold some of the world's most valuable data to figure out ways to achieve compliance right now before it's too late and then you're struggling at the last hour. And then when you think about that and you flip to incidents, what Teradata's done with incident management over the last three years, in my experience, and I've been around for a long time, more than two decades, less than three, but I won't tell you exactly how many. Google it if you must. But the idea here is it's truly transformational. When I first arrived, we were looking at about 20,000 of events a week and I was like, "That seems like a big number." It certainly would be a lot if that was my rent or mortgage or something. But now last week we looked at over 70 billion with a B event. That is astronomical. So what does that mean? It means we look at everything. And then you think, "Oh my gosh, that's overwhelming." So as we look at things and we've changed configurations and we've fixed a lot of our primary concerns that we had at the time, we've also automated and put steps in place. So now what's happening is over 95% of those things that are coming in are automatically being driven to a decision. What also was interesting is when we first came in to understand when we had an issue, it was over 127 hours for us to even acknowledge we had an issue and then another 140 hours to close it. That's a lot of hours. Think about that. If you're getting your oil changed for 15 minutes, you got to be there for a month. That's crazy. Today, all those things, 70 billion things, less than 15 seconds for us to know. Go ahead, challenge us. You're going to get a phone call or we're just going to cut you off. It's like you didn't pay your bill, your lights are going out. Then the next thing is how fast does it take to fix it? We're less than an hour and a half. 15 seconds to acknowledge, hour and a half to complete. 70 billion things last week. We are not messing around with world-class security here and we're ready for any kind of incident. And just in case you're worried, you're like, "I don't believe you." That's okay. We have all those certs we talked about, and we also have three different options for our customers to fail over with disaster recovery. So again, we meet you wherever you are with security in mind for our customers to be first.

Savannah Peterson

>> To stay ahead of that and to be building with regulation and compliance in mind, how often are you as a team getting together and saying, "Hey, this might happen. We heard rumor this might come through." So that you can be there when it is actually enacted?

>> Oh my gosh, have you ever dated anyone that you want to go to the beach and you want sit on a roller coaster or you want to go on a Ferris wheel or something and they're like, "Whoa, no, something bad's going to happen." That's me. I always held the purses and I hold the strollers and never get on the rides, because I'll be the guy that the stuff will fall apart and I'll fall off and I'll end up in the ocean and you're like, "There's no water around." I don't know how it's going to happen either. So when it comes to security, I think the same thing. I think about the worst situation. I plan for it. We're always hoping for the best, but without resilience, we can't build trust. And that's what we believe at Teradata. We want to build trust with our customers so we can extend the longevity of our relationships.

Savannah Peterson

>> Even more important now as we enter an era of AI mass adoption at scale.

>> Yeah, absolutely. Especially when you think about AI and your guys' LLM and all the scary things that could happen, it's really, really important to use the power of AI to leverage the data you have to bring those insights to life. I believe that every piece of data is connected to a story. At Teradata, it is our great responsibility to work with every single customer to bring that story to fruition, not narrate it, not navigate it, not tell you what the story is, but give you all the tools, tricks, techniques, but also with safety in mind so you can bring that story for your customers to life.

Rob Strechay

>> So I think that you actually hit on a really good thing, and I think the technology is one part of it, but the people is another part of it as Savannah was going down that. And a lot of the things that we hear about with security is, again, it's not a technology failure, it's a social engineering thing. How do you see that from the Teradata vantage point with the social engineering? Because that goes a lot into things like change management and how different processes go together.

>> Yeah, this is really a bigger technology problem. When you think about human deception, because that's really what we're talking about here. We say social engineering, I might use term like pretext. I might throw a bunch of another acronyms at you and you think I'm getting ready to start a Run DMC rap video. But really what happens-

Savannah Peterson

>> We're here for it. If you want to start that right now.

>> Hey, let's go. Just got to get my Roger Rabbit and I got to stretch first, but it's good. When you think about it, that actually brings some other tools I brought to the table. If you look to my left, viewer's right, you have this older lock, and the older lock really dates back to the Houdini area. If you guys don't know who that is, go look it up. It would take up a whole other segment of the show. But the idea is this is old school lock. You think about irons, chains, really, really difficult to open. If you look to all the way on the other side of the table, you see a more modern lock, something you might have on this shed. It's called a 40 millimeter lock. It's a Master lock. It's supposed to be secure. I promise you if I had 10 more minutes, I would show you how not secure that is and you'd start to be a little bit frightened. There's another lock called a 55 millimeter lock, which I didn't show because I don't want to scare all the viewers at home. But the issue here is that's the most common lock in the United States. It's a Schlage door lock. So if you have one, you go to Home Depot, it's a seven pin lock. And if you're someone like me, I can get through that faster than you can pull out your keys. So if you think about social engineering, the trick isn't social engineering. It's really done with how I can read and react and get you to respond. With one or two movements, I can do all kinds of things, and that brings the thing to the center of the table, it's called a flipper. If you don't know what it is, look it up, then be afraid and put it away. The idea is if it has a frequency, think about your phone, think about your credit cards, think about anything in life, your door locks if you're in a hotel or in your office, this sucker can pick it up. You just want to use it to change the remote on your TV, it can do that too, and a whole bunch of other things. The idea behind social engineering is to create urgency, get you to act so that the bad guys can then respond. And if you think you're one of those people who are like, "I'm not going to click." And then go to your CIO and show them all the things you didn't click on. I promise you the security team already knows. And at Teradata what we've done is we've worked really hard to prevent all of that stuff. So we've created these sandboxes and containers, so if you do something by accident, you're in a container and it doesn't expose the whole network. We can isolate the endpoint or the chain on the desk. We can isolate that away from everybody else, and then we can get you back up and running before anything severe really happens. So that's just another way that we've fought above and beyond to foreshadow all these problems. The last thing that we've done is we've built a robust culture at Teradata. So we're always trying to, in a humorous way with the carrot, we're trying to trick and we're trying to convince and we're trying to get people to click and tell us all their cool passwords. What I really like is out of office messages. That's my favorite thing in the world because the out of office message is the gateway into your soul. You tell me who to talk to, what the number is, how to get ahold of you, and how to get them to respond. What? You're talking about the best information I've ever seen in my life. So all I have to do is take that, package it forward at the people you tell me, they're going to take some action. I'm in your network. Don't do it.

Savannah Peterson

>> So how do you let your colleagues know you're not going to be in the office?

>> I give them an out of office message. If you don't know, send me an email. You'll get my out of office message today. It talks about magic and possible and all the delightful things around LA, but what it doesn't tell you is who to talk to, what the phone number is and how I'm going to respond.

Savannah Peterson

>> I love that. So now I have to ask, since you brought up the lock, what lock do you use to secure your home? Should we all be taking inspiration from you?

>> I use biometric locks with security capabilities. So you cannot pick these locks because they have a weighted mechanism on the top. So just like a traditional lock with spindles and locks and they have springs, it has another weighted mechanism, so the actual tools that you would use to get through a lock don't work.

Savannah Peterson

>> Did your love of magic or your love of security come first?

>> Magic for sure. I've always been fascinated with the art of showing effects and using those effects to mirror them with the appropriate stories. I found that really complicated and technical topics can be heard by non-technical call audiences with simple effect display.

Rob Strechay

>> Yeah, no, I think that this is the first time in a long time other than the swag segments that Savannah has done with KubeCon, that somebody has brought these. And I know about the flipper and the thing scares the living daylights out of me. So it's great to bring this in there. What do you say to people? What's your final message to people this Cybersecurity Month and what they should be thinking of and why Teradata is at the forefront of thinking about that for you?

>> Yeah, I think two things. One is at home. Remember, everybody's working from home post-COVID, so that your work network ... I know I said work, it's a four-letter word. It freaks you out even at home right now watching, but work extends into your house. You have networks. That's called Wi-Fi. You're like, "I just have a Wi-Fi." No, you have a network. It's incredible. Your network connects to your TV. Your TV connects to Netflix. Netflix has your credit card. Your neighbors can get that from the street. You're crazy. Go change those passwords. It's incredible. And if you don't know there's an admin side, look on the box. It's crazy. Change that password too. Otherwise, your neighbors are watching your Netflix and charging Amazon stuff all and you don't even realize it. The second thing is in the office. It's really important to get basic hygiene down. Don't click. I know you're tempted. You want that free car wash or you want this gift card or the end of the year prize or you want to close out things so that your CFO doesn't really give you a hard time. But I promise you, do a little more research. Get a URL check or something very, very simple. Change your passwords. Here's another thing. The industry spends 12 to $14 billion with a B on human security. That's our security, locks, keys, widgets, pass codes, whatever. But that's not what's connected to your network. It's devices. How many actors are on your network? Two actors, humans and machines. Protect the machines. No, this is not Skynet. They're not coming for you. But the idea is you still have to rotate those passwords. And then from a bigger business are the third thing, what Teradata actually does. We can deliver the perfect and safe solution for you. The challenge is you still have to connect MFA. You still have to connect your geographical filters to lock people out that shouldn't be there, to eliminate things like impossible travel. And then lastly, you must rotate your keys, people. That is just a very long password, but you must rotate them and not forget about the machines.

Savannah Peterson

>> Billy, this has been the most entertaining 20 minutes I think I may have ever had on this desk. I really appreciate the spirited description, the parallels between magic and security. I now need to go change the locks on my house, but that's a whole nother story. I'm questioning Rob's prompt history. But either way, I think-

Rob Strechay

>> We're changing everything. We're deleting it all.

Savannah Peterson

>> We have our homework cut out for us. You said you did your homework before seeing us today. We now have our homework before we see you again at next year's show. But seriously, thank you so much, Billy. This has been a true blast.

Rob Strechay

>> Thanks for having me. This was awesome. And just remember, security's a feeling. If you're feeling some way and it's negative, get some new security.

Savannah Peterson

>> Security insecurity. Wow. All the things we've covered today, I can tell the production team has enjoyed this as much as we have because I've heard there occasional giggles in my IFV, which is great. Oh, thank you so much, Billy. And thank all of you for tuning in for this magical, awesome segment that we just had here at Teradata Possible. My name's Savannah Peterson from Los Angeles, California. You're watching theCUBE, the leading source for enterprise tech news.