Cyber Resiliency Summit | Mihir Maniar & Rob Emsley, Dell

Clips
News
More from Cyber Resiliency Summit

Mihir Maniar

VP of Security Services

Dell Technologies

Rob Emsley

Director, Cyber Resilience Product Marketing

Dell Technologies

Dell expands MDR portfolio to guard backup systems against attack

As cybercriminals learn how to attack backup infrastructure, it’s become even more important to have a process to detect intrusion and respond quickly. This escalation has led Dell Technologies Inc. to announce an expansion of its managed detection and response, or MDR service, which can manage and monitor Dell’s entire backup systems portfolio.“Think of it as a black hole where attackers are going after backup systems, and organizations have not been able to prioritize it as much,” said Mihir Maniar (pictured, left), vice president of product and services at Dell. “Data is important for organizations, and backup is a very important part of their entire infrastructure

play_circle_outline Challenges in cyber attacks sophistication, data protection, and AI innovations impact.

play_circle_outline Services provided by Dell including advisory, implementation, detection, recovery, and cyber hygiene.

play_circle_outline Partnership with CrowdStrike for XDR services and end-to-end comprehensive security services.

play_circle_outline Enhancing Security with Managed Dell Backup, MDR Expansion, and Next-Gen SIEM Collaboration

play_circle_outline Collaboration model for organizations with existing security operation centers

play_circle_outline Cyber resiliency through security-first mindset and proactive controls

play_circle_outline Emphasis on cyber hygiene, incident response, and trusted vendors for protection

Info
Transcript

Mihir Maniar & Rob Emsley, Dell

Mihir Maniar

VP of Security Services Dell Technologies

Rob Emsley

Director, Cyber Resilience Product Marketing Dell Technologies

In a discussion with Christophe Bertrand from theCUBE Research, Mihir Maniar, VP of product and services at Dell Technologies, and Rob Emsley, director of data protection marketing at Dell, explore the pressing challenges of cyber resiliency. They emphasized the need for secure data governance, zero trust security and proactive security controls to minimize vulnerabilities. Dell's secure-by-design infrastructure and comprehensive detection, response and recovery solutions play a pivotal role in reducing the attack surface and enhancing cyber resiliency.
Read more

explore Keep Exploring

What are the key elements of cyber resiliency versus cyber security that are emphasized in our strategy? add

What services are provided by the company in terms of data governance, security controls, vulnerability management, breach attack simulation, and incident response and recovery? add

What are some examples of strategic partnerships for an integrated managed services platform? add

What strategic partnership does Dell have in place for managing and monitoring their backup portfolio? add

What services does our MDR portfolio offer in terms of monitoring, managing, and responding to threats across the entire threat surface area? add

What is one key piece of advice for viewers in terms of cybersecurity and building a strong security posture? add

What are some important factors to consider when it comes to cybersecurity and protecting against cyber attacks? add

bolt Powered by CUBE AI

Mihir Maniar & Rob Emsley, Dell

search

Christophe Bertrand

>> Hello, and welcome back to the Cyber Resiliency continuing coverage here with theCUBE. My name is Christophe Bertrand. I'm a principal analyst here at theCUBE Research, and I'm very pleased to be joined by two experts in this session. From Dell Technologies, Mihir, welcome to theCUBE.

Mihir Maniar

>> Thank you, Christophe.

Christophe Bertrand

>> Welcome to the summit. Could you introduce yourself? Tell us what you do?

Mihir Maniar

>> Sure, Christophe, pleased to be here. I'm Mihir Maniar, VP of portfolio at Dell in the ISG group. ISG is the Infrastructure Solutions Group, which consists of our servers, including AI servers, storage portfolio, data protection portfolio, multi-cloud, as well as the AI solutions and Edge and security as a service.

Christophe Bertrand

>> Small job. And also joining us today is Rob Emsley. Rob, tell us about what you do.

Rob Emsley

>> Yeah, Christophe, good to see you again. So Rob Emsley, I'm the director of product marketing for our data protection portfolio. So I've been working with the Dell portfolio for probably almost 20 years, post-acquisition with EMC, and lucky enough to have rejoined the company in 2018 and been looking after the data protection portfolio. And as you can imagine that scenario where data protection and cyber resiliency has morphed incredibly over the last number of years.

Christophe Bertrand

>> Right. That's a very important point because I think it's really a source of challenges, not only for vendors, but obviously, more importantly, for end users, for your customers. So Rob, let me continue with you here for a second. What do you see as the top challenges that you've observed from your conversations with customers and maybe partners also?

Rob Emsley

>> Yeah, we've certainly seen a number of things occurring within infrastructure. And as you can imagine, as Mihir was saying, we cover a lot of enterprise infrastructure, all the way from endpoints, all the way through to servers and everything in between and going into the whole world of hybrid cloud. So one of the challenges that we've seen is really the sophistication of cyber attacks over the last few years. Certainly as you think about going into 2025, we believe that cyber resiliency is really in the age of AI. And AI has been a double-edged sword. It's been an aid to the good guys from a defense perspective, but it's also been an aid to the bad guys from making their cyber attacks more sophisticated. And I think one of the things that is clear is that data is the main attack vector for bad actors to go after in this age of AI. So the data, if it's good, can be a great benefit to AI infrastructure, but if it's compromised and tampered with, it can really have a very negative effect on the outcomes that you can achieve. So that's certainly one of the things that we've definitely seen, and certainly from my space, from a data protection and backup and recovery perspective, is that one of the realities is that cyber criminals definitely realize that backup's infrastructure is a place where they need to focus because they recognize that without good backup and without good backup data, the ability to recover is almost impossible. So that's really an area that we've definitely been very, very focused on within our strategy.

Christophe Bertrand

>> Yes, it's definitely a multi-level conversation or maybe a three-way conversation between AI as a tool and also as a potentially protected workload. We'll talk more about that in a few minutes. Mihir, I'd like to ask you the same question. What, from your standpoint with your organization, more focused on servicing customers, end users, what do you see as the main cyber resiliency challenges?

Mihir Maniar

>> Yeah, as I think Rob pointed out correctly, if you go to see the new threat vectors are coming out from the innovations happening in gen AI, generative AI with large language models and that infrastructure that is being used to create productivity in organizations, that is a new threat vector for organizations. And from that perspective, there are these new governance mechanisms for data governance, for cybersecurity controls, whether it's the MITRE ATLAS extension or the NIST framework extensions for AI and the compliance with the presidential mandates and stuff that we have to deal with. And also what's happening is there is a proliferation of security tools that is already in organizations for protecting today. With these new threat vectors, now we're adding new tools, which complicates the situation even more, and the new tools could be for access control, for data loss prevention, could be for AI firewalls being used and so on. So it's very important that organizations who are dealing with shortages of skills, of skilled professionals to deal with these challenges, they can rely on a trusted vendor, a trusted partner who can take over their burden for dealing with all these different challenges and new threat vectors. Like our partner, CrowdStrike, has a rule of 1, 10, and 60. One is basically you should be able to threats in one minute, 10 minutes to go and investigate the threat, and no more than 60 minutes to basically contain the threat, remediate the threat, so it doesn't laterally propagate. And that's why these challenges are something that everyone's grappling with that we are here to solve.

Christophe Bertrand

>> Right. So this is very interesting because there are so many challenges. I think you've touched upon technology, integration, organizational challenges. So it seems to be the perfect storm, the confluence of multiple markets, multiple threat vectors, surface of attack that's only expanding, and data, that's the fuel of the business being at stake. So Rob, I'd like to turn back to you, back to the portfolio a little bit more, but in terms of differentiation, how do you stand out with the Dell Technologies portfolio when it comes to cyber resilience?

Rob Emsley

>> I think a lot of it comes down to breadth. One of the things that we're able to do is to really work on a secure-by-design philosophy across all parts of your infrastructure. Certainly when we think about helping customers advance their cyber security posture, we think of that in three specific areas. First is reduce the attack vector to minimize the opportunity for disruption that starts in the manufacturing facilities as far as how we actually design security into all of our infrastructure elements. And then, design that security to hold true all the way from the manufacturer, all the way through to the deployment with a secure supply chain methodology. So that's an important element of reducing the attack surface. Secondly, which is where we will get into some of our news today, is regarding detection and response. So, as Mihir was saying, the speed of detection and the speed of response and the ability to bring advanced skill sets to bear to help customers when they are attacked is the second element of our strategy. And then, third, and not least, is the ability to recover from a cyber attack. And that's I think where, with all of those elements, you really start talking about cyber resiliency versus simply cyber security. Certainly from a product perspective, when we think about our data protection offers, it's really driven through our PowerProtect portfolio with a foundation of data domain. Data domain, as you know, has been a bedrock of the industry for the last 20 years. Certainly has been a market leader in delivering a purpose-built back-of-appliance technology to our customers. And being purpose-built, it gives us the ability to really provide what we believe is the most secure backup of infrastructure in the industry. But then we pair it with our data manager, data protection software. And then with the combination of both of those, we deliver cyber recovery capabilities, especially in the world of cyber recovery vaulting, which is something which we certainly introduced way back when, in 2016, and have continued to deliver both cyber recovery vaults on premises. And that's really one of the big differentiators for us is that many in the industry believe that cyber recovery should be done solely within the public cloud. But the challenge is that cyber recovery, unlike disaster recovery, nothing's really gone away on premises. So the ability to have a good-known copy of your data to recover from on-premise is a very important element of our strategy that we continue to really focus upon over the last number of years.

Christophe Bertrand

>> And if I may add to this, I think I've known the offering for quite a bit, and I think the biggest maybe complexity for our viewers and users watching us is, well, is this cybersecurity? Is this backup and recovery, and what is this term of cyber resilience? And really cyber resilience as you've explained it in the context of the differentiation of the Dell Technology's portfolio, starts at the supply chain all the way through. It's all interconnected and it's really a combination of technologies and disciplines. It's not just a one thing that will work. And I think it brings up a bunch of other questions around organizationally, how do you deal with that? Do the teams talk to each other, et cetera? But the point is that you have to have a secure end-to-end, secure infrastructure and end-to-end secure data, for sure. Look, I'd like, Mihir, to ask you now, we've talked about the products a little bit here with Rob. I'm curious about the services because that's really what brings it together. Can you walk us through the portfolio and really what your teams actually do in the field and what they deliver to your customers?

Mihir Maniar

>> Yes, Christophe, as Rob said, Dell stands out in our product portfolio, but then combined with our services, security services portfolio, we are unmatched in what we can provide customers. So from a services standpoint, we provide an end-to-end comprehensive set of services, starting with advisory services for data governance, given data as a new fuel. So data governance is important, and then zero trust security controls. We provide whole roadmap for customers where they are today, where they have to go, and what the gap is and so on. The next set of things we provide is implementation of security controls. What we want to do is reduce the threat surface area. We reduce the attack surface area and that we do it with proactive controls, proactive security. And so using security controls like the NIST framework with 853, or the DOD, the Department of Defense zero trust framework with the 152 capabilities, we use those frameworks for proactively setting up controls for our customers. And then, that's not enough, you got to check the controls. And how do you verify the controls? We have a set of services, things like vulnerability management to provide a customer's view of the vulnerabilities that exist, breach attack simulation to simulate like an attacker, pen testing, penetration testing for the entire environment externally exposed to kind of point out the issues, or if the controls are working or not. And then training for employees. So we provide this entire reduction of the threat, the attack surface area with our MDR, leading flagship MDR Pro Plus service, which provides this proactive set of security services for achieving this. And that's a 24/7, 75 countries, global service to manage customers SOC and it's doing really well. And then, setting up control's not enough. You need to have a set of cyber hygiene for resiliency because things are going to happen. And when breaches happen, resiliency kicks in. And for resiliency, we have a set of services like business impact analysis with BCDR, which is a business continuity and disaster recovery to see the RPO, recovery time objective, point objective for customers. And based on that, decide to set up, as Rob said, the cyber recovery vault, which is an air gap solution to host the mission critical data in the air gap, which is tamper free, immutable and so on. And then, we have to be able to detect and respond to threats, as I mentioned before, the CrowdStrike rule of the 1/10/60, detect a threat in one minute. And so we have our MDR service, which is a flagship service for detecting and responding to threats in a very quick amount of time and be able to offer that to our customers in a global fashion. And if the breaches happen, which are going to happen, we have our service called IRR, which is incident response and recovery service, where we come up with a run books for customers proactively. We have a retainer so customers can buy it in advance and make sure that if the breaches happen when they happen, we are there to protect them. We are there on the ground with them in 24 hours. We are on the call with them in two hours as soon as the breach happens. And so we have a full comprehensive set of services to augment the product portfolio and provide this value to our customers with this global footprint across 75 countries. It's a global digital footprint as well, because a managed security services platform is the one that integrates all our technology partners to provide this end-to-end set of services. And we have a large set of strategic partners we work with for an integrated managed services platform. Things like whether it's a XDR and next-gen SIEM from CrowdStrike and Microsoft, or identity platforms from Oktane, Microsoft over there, or network platforms from Zscaler and so on. So we have a set of partnerships that we take the burden away from customers, where they don't have to worry about identifying, procuring these partners, dealing with them in terms of the agreements, implementing the controls, managing the partners. We take away the burden from them with our comprehensive set of services, global footprint with our managed security services platform, and we provide this unmatched a set of value prop for customers where they're struggling with skills shortage and sophistication of attacks and volume of attacks and so on. So that's where we stand out dramatically.

Rob Emsley

>> Yeah, one of the things that Mihir shared with me as we were preparing for today was just the number of incidents that the Dell has responded to. It's literally hundreds around the world. And one of the interesting things, as you can imagine, is that some of those incidents come from environments where maybe customers have not been as prepared as they would like to have been, may not have implemented some of the products and solutions that they could have done. But regardless of where they are in their cyber-resiliency journey, the 1-800 call Dell from an instant response perspective is there to help them. And there's been many examples of customers around the world that have really taken advantage of the global scale and the ability to put boots on the ground to help them when they really need it, and then start thinking with them about how they can avoid further incidents. So you really have a really circular, closed-loop capability with the combination of products and services that we can bring to bear.

Christophe Bertrand

>> I mean, the perfect scenario is they never have to call you. The truth is, it's only a matter of time. It's a matter of when, not a matter of if, really. So Rob, I'd like to continue with you because you've touched upon a number, both of you, a number of important points. If we think about the enterprise space, a lot of it is about scalability and integration. Certainly, we've covered a little bit here and we'll cover that even more in the next few minutes. So from your standpoint, Rob, and I'll start with you. How does the portfolio, and including the services, the whole thing together, how does that provide you with that adaptability for complex IT environments? Because we're really dealing here with sheer complexity.

Rob Emsley

>> Yeah, well, it's really twofold, I think. Firstly, it is the reality that we live in a hybrid cloud environment. And what we've always really looked at from our portfolio, and we've evolved it over the last, probably, decade, is to provide our solutions wherever they're needed, whether or not that be on premises or whether or not that be within the public cloud and everything in between. So that's something which we've been very proud of from certainly a data protection perspective. Everything that we do on premises, I mentioned around data manager and data domain is available to be deployed within the public cloud. In the public cloud is all the usual suspects, whether it be AWS, Microsoft, or Google Cloud. So that's a way of really bringing capabilities to bear that customers can take advantage of. In the same vein, we also, from a consumption perspective, we provide solutions that customers can deploy and manage themselves. But also, I think you've seen that many customers are looking for help, and one of the ways that we can help them is to deploy infrastructure and manage it on their behalf. Whether or not that's as a totally managed backup as a service offering. Or one of the things we recently announced was the introduction of our data domain and our cyber recovery vault technology as a managed service within Microsoft Azure with protection services. So really it's providing options for our customers to meet them with whatever demands that they have, because sometimes they're desperate and they need help. And that's where we can really bring the enormity of Dell Technologies to bear from both a product portfolio perspective, from an end-end portfolio, but also just as importantly, and really this is really our secret sauce, is the connection to our global services capabilities.

Christophe Bertrand

>> Right. So perfect segue because, Mihir, I was going to ask you the same question, but really from your standpoint with the services portfolio. Clearly I understand the product portfolio being very, very broad, deep, and broad at the same time covering multiple environments. Again, everything is fun and games until you start adding "at scale" at the end of the sentence. So how does your organization, what type of services do you bring to the table to help with the complexity that large enterprises are dealing with with their environments? How do you help them become more adaptable?

Mihir Maniar

>> That's a great question. So I think as Rob mentioned, choice is a fundamental imperative for Dell to provide customers that, and organizations that basically are all different shapes and sizes and requirements. So from a choice standpoint, security is a team sport, right? No one vendor, no one company can do it alone. So what we've done is we've given the fact that organizations can have many different types of security vendors and tools that they're using, we provide them the end-to-end security services portfolio for cyber hygiene and for reducing the attack surface and everything. We provide a lot of partnerships. That is provided as a choice to customers, whether you want a choice of an XDR vendor that is fully managed by Dell in our security platform with CrowdStrike or Microsoft, or whether the customers want maybe a hybrid cloud security kind of environment, whether it's an Azure security or AWS security as well as Red Hat. So we've kind of augmented our partnerships to provide customers the choice of, "Hey, what are you using today and what do you want us to come in, provide you the end-to-end comprehensive services around," given security is a team sport.

Christophe Bertrand

>> Right. I was going to say team sport is really the word here, but look, you mentioned CrowdStrike and I'm hearing there's some news about that. So can you tell us more about what's going on in the space of MDR, what's going on with CrowdStrike? What have you worked on with them? And then just give us a general perspective on what you see moving forward in the relationship.

Mihir Maniar

>> Yeah, I think it is a great question. As we talked about the fact that data is the fuel for generative AI systems, and a lot of the attackers are after backup systems that Rob talked about, because backup is where organizations are going to go to when they get a breach and recover from there. And that's the reason why the backup systems are not, for some reason, a priority for organizations today because they have all the crown jewels of the organization. But because of the fatigue of number of vendors that security operations teams are dealing with, the volume of attacks, the sophistication of attacks, all the problems you talked about before and the challenges they're dealing with, they have not prioritized integrating the backup systems. And being able to put agents, you can put agents inside a backup system to go and discover threats and integrate within the same systems. And so that's a, think of it as a black hole where attackers are going after the backup systems and organizations have not been able to prioritize it as much. So I'm super excited today to announce an expansion of our MDR portfolio, which can monitor and manage Dell's backup portfolio, the entire backup portfolio that Rob talked about. We can manage that portfolio. And the way we do it is, CrowdStrike is our strategic partner where ... and they've awarded Dell as well, a global partner of the year award last year. So we are truly a strategic joint partner where we are using the next-gen SIEM technology, by which we integrate our telemetry, which is proprietary telemetry coming from Dell's backup portfolio. We integrate that inside the next-gen SIEM from CrowdStrike to collect all the log information. And we built jointly with them like 60 IOCs, indicators of compromise, that can be used to go and detect the threats that could be occurring inside the backup portfolio and rapidly be able to, not just detect, but also be able to respond with the IRR team, the response and recovery team, on behalf of our customers. So that's a great solution. I'm super excited about announcing it jointly together with our CrowdStrike as our leading partner for next-gen SIEM technology, and it's a managed service. MDR is a fully managed service, global footprint, 75 countries. We manage SOC for customers, but this particular expansion of the MDR service for the backup portfolio is critical for our customers. And so we provide also a collaborative SOC model because our customers may already have a SOC of their own, like a security operation center, they're managing or they have outsourced to another vendor. So we provide a collaborative model for the backup portfolio where we come in and monitor and manage the backup portfolio for detecting threats, responding to threats, and then working with the customers and organizations on taking response actions kind of a thing. And once they're satisfied with that, our MDR portfolio goes across, not just for backup, it goes across the entire threat surface area. And I talked about the MDR ProPlus, which provides proactive security to go and reduce the attack office area chain, the shape of the funnel for threat vectors and so on. And that portfolio is what we can expand, not only for backup, but across the entire threat surface. So super excited to announce that. I think all the challenges Rob and I talked about, where AI systems require data. Data is important for organizations and they all ... backup is a very important part of their entire infrastructure. It's not being covered appropriately. So we are super excited to announce this managed service with MDR that can go and monitor, manage, detect threats, rapidly respond. It's just amazing. And we are one of the first ever that can do this in the entire industry.

Christophe Bertrand

>> Yeah, definitely very important news. And clearly I think in many ways this embodies the definition of cyber resiliency, the team sport, the integration, the full services view, and more importantly, protecting the protector and going straight to the backups is I think definitely a very big advantage that I think your customers will leverage. And I think in terms of outcomes, I expect this will change the nature of the type of actual recovery times from a cyber resilience standpoint you can get to, because I think those can be pretty extended unfortunately today because you don't really know what you're dealing with for a period of time and therefore it's hard to get back on your feet with good data. You are solving for that. And I think that's a great announcement. Look, we're almost at the end of our session here, so I'd like to ask both of you a quickfire question with your maybe one thought, one piece of advice. And Rob, I'd like to ask you what would be the one closing thought or piece of advice you would have for our viewers today?

Rob Emsley

>> Yeah, I think following on from what Mihir was just describing is to really realize that you need to start with a security first mindset. And you need to understand that security and good security is a process. You can't buy your way from a technology perspective to good security. And if people are trying to convince you about that, then you should be wary. I think from a good security posture perspective, it's the classic people, process, and products, and products comes at the last of those three elements. And I think that's where I think you need to think about security with very much a proactive and adaptive mindset. Things are changing constantly, so you need to really think about how you build an environment that can evolve as the threat landscape evolves around you.

Christophe Bertrand

>> And, Mihir, your closing thoughts or advice? You spend a lot of time in the field with customers, what would you recommend?

Mihir Maniar

>> Yeah, I think I would just keep it simple and say that cyber hygiene is super important. Reduce the attack surface area by proactive security controls, checking those controls, and then cyber resiliency hand-in-hand goes because attacks are going to happen. So cyber resiliency, make sure you have the right hygiene, incident response retainers are in place. The cyber security vault is in place. And then, MDR is used for detecting and responding quickly to attacks. And the last I would say, pick a trusted vendor like Dell, which can provide products and services for security for our customers to protect the crown jewels of the company.

Christophe Bertrand

>> Well, you're right, it's not just about data, it's not just about infrastructure. It's really about protecting the business at the end of the day. It's really business resiliency, more than even cyber resiliency in many ways. Well, I'd like to thank both of you for joining us in this session today. Mihir, Rob, thank you very much.

Mihir Maniar

>> Thank you.

Rob Emsley

>> Thank you.

Christophe Bertrand

>> And to our viewers, thank you so much. Please stay tuned for continuing coverage of our Cyber Resiliency Summit here with theCUBE.