W. Curtis Preston: Hi, and welcome to Backup Central's Restored All podcast.
I'm your host, w Curtis Preston, aka Mr.
Backup.
And I have with me my, uh, DIY flooring encourager Prasanna Malaiyandi.
How's it going, Prasanna?
Prasanna Malaiyandi: I'm good, Curtis.
I'm good.
Um, how goes the floors.
W. Curtis Preston: It, it, it goes well as you see.
And you know, I've been sending you the photos that, you know, there was a, there
was a pause there for a while while my knee injured injury, uh, I don't know,
Prasanna Malaiyandi: Well, I, Well, I think it was a knee entry,
but I think it was also like you were, you went to Hawaii, right?
You had other
W. Curtis Preston: was not too,
Prasanna Malaiyandi: Yeah.
So it wasn't,
W. Curtis Preston: hard to do flooring while you're on vacation.
Yeah.
Prasanna Malaiyandi: Bluetooth flooring,
W. Curtis Preston: It has resumed in earnest and I actually, what's,
once I'm done with the current room, which is the super hard room
where I have to work backwards.
I dunno if any of you ever done, you know, paneling or the luxury vinyl
planking or the laminate flooring.
There's a working for, there's a working backwards.
I am now currently working backwards as I have to in one of the rooms.
It's the hardest, it's the worst I'm doing.
Once I'm done with that, I will be half done with the project.
So I'm super, super excited to get to that.
Uh, and you're the only one who I can send photos and you're like, Good job.
And
you're the only one that like encourages me in my little DIY
Prasanna Malaiyandi: Well, I gotta try, you know.
Well, here's the thing.
I live vicariously through your projects, so it feels like I'm working on it.
When you're working on.
W. Curtis Preston: I wonder how many of our podcast listeners also live
vicariously through my projects or are going, Gosh, shut up about the
flooring and get to the tech already.
I just wonder,
Prasanna Malaiyandi: so if you, if you, Yeah, if you have a viewpoint
on this, please let Curtis know.
On Twitter,
W. Curtis Preston: Yes, at WC Preston on Twitter, uh, you know, we love to hear
opinions, you know, and just remember opinions are like, you know, noses.
Everybody has one and I usually pick my own.
Um, alright, so we're gonna bring on our guest today.
He is the CTO of Opti9 Tech, having been there since the late 90.
It could be found on Twitter, @SagiBrody, and LinkedIn as the same name.
It's having a unique name.
You get to go, right?
If you search on my name on LinkedIn, you get like
Prasanna Malaiyandi: I think, I think I'm the only Malaiyandi, by the
W. Curtis Preston: Yeah.
You, you're definitely yeah, as well.
So welcome to the podcast, Sagi Brody.
Sagi Brody: Thank you.
It's, it's great to be here.
I could already tell this is gonna be a fun conversation.
W. Curtis Preston: Well, it, it'll be something, it'll
be, it'll be lively for sure.
Uh, the two of us talk way too much and we, we invite you to the conversation.
Prasanna Malaiyandi: do you do any home DIY projects by chance?
Sagi Brody: I just finished, um, having a home built, uh, from scratch, but not
myself, a contractor, but, um, What I can tell you is I, I wouldn't do it again.
Um, it,
W. Curtis Preston: I hear that from almost everybody that actually has
a home built for them, um, is that it's a pretty stressful project.
But, uh, there, there's basically two groups of people though in this world.
There, there there's people like me who like to do a lot of DIY stuff, and I, I
like to do it partially because I like to process and I like to do it because I, I.
I get more, I can get more stuff done than what I could pay for if I
had to pay somebody else to do it.
And, but a but a friend of mine, uh, he learned from his dad the following
phrase, Do what you do well so you can pay other people to do what they do well.
And he does zero DIY and I can respect that as well.
It's all good, you know.
But, uh, anyway, so let, let's start with.
A summary of what, you know, when I see your company, I see you
talk a lot about hybrid computing.
Uh, what sort of, you know, give us an overview of the company to start with.
Sagi Brody: Sure.
Um, well, Opti9 is a, a managed cloud provider.
Two very vague terms, manage and cloud, um, talk all day about that.
But yeah, so what we're doing is, you know, we we're managing production
workloads for our customers, either in public clouds like aws.
Or in private environments like virtual private clouds or host of private clouds,
which we host in our data centers, which we have, uh, around the world.
And, um, so there's sort of like the line of business of, of taking
ownership and accountability for customers production environments.
And then we have a, the side of the house where we're providing managed offsite
backups and managed disaster recovery.
. Um, and I would say sort of what's, what's interesting or, or what we
find to be important is not, not so much the what, which is kind of what
I just described, but more of like the how, how do we, how do we integrate
those things within your existing framework of your network or security?
How do we.
Give you the best of both worlds so that you can consume these services
in a, in a way that looks and feels and acts like it's part of your
environment, but it's as a service.
So it, it's definitely a bespoke sort of model.
Um, and we, we get deep and, you know, a lot of people, a lot of organizations
have, uh, technical debt and skeletons in their closets and weird platforms
and you know, like sort of like the higher up the enterprise stack you
go, the more edge cases you encounter.
The less vendors that are out there that have an appetite to service
those, and for whatever reason, that's where we sit and we like it
Prasanna Malaiyandi: Yeah, it's interesting cuz when you're talking
initially about Oh yeah, we do hybrid cloud, I was like, why would someone
choose like Opti9 tech, right?
Versus, um, go with like an AWS or someone or like any of the other public.
Cloud companies, but like you were just talking about, right?
It's all those skeletons in the closets, the unique situations that you have
the ability to sort of customize and support for versus like some of
the public clouds, which is like, Hey, just onboard whatever you have.
If it fits into what we have, great.
If not, sorry.
W. Curtis Preston: Yeah, it, it.
I would, I would guess what it sounds like is, you know, comparing you to an
aws, you, it is that m it's the m right.
You know, not, not everybody wants to actually manage a cloud environment.
Right.
They'll, they'll, they'll hand it over to you, but, uh, but they don't,
they don't necessarily wanna manage.
It sounds like you manage both the, the cloud side as well as the
on-prem side, and that's, that would
Sagi Brody: Yeah, well, so we're not actually, we're not
actually manag anything, managing anything at our customers
premises in their, in your office.
Um, but within our, our facilities, um, which are all over the world,
you know, we'll stand up a, you know, wanna call it a legacy environment,
like a private VMware cluster and you know, which, which is analogous to
what they have prem, which we can.
Lift and shift.
Um, but I, I think the overall, our, our tagline is Right cloud,
right workload, right time.
The idea is that, um, we wanna have the workload's best interest at heart.
And you know, years ago you would hear people, you know, saying, I'm going
all in, we're going all in with aws, we're going all in with Azure, We've
picked our cloud, you know, strategy.
And it, it's all gcp.
And now I think the whole market has woken up to hybrid.
And it's very safe to say hybrid because what you're saying is, I'm
not ready to make a commitment.
I might need this tomorrow.
I might need that tomorrow.
And that's what hybrid is.
It's, it's mixing them and.
What we're trying to do is to, to be, you know, sort of like
fiduciary to the workloads and really build a, a reference architecture
from a networking perspective.
Um, for mo, for, for the hybrid.
So if we are doing an audit on our customers environment and, you know, we,
they have some legacy perpetual workloads that are gonna cost a lot less in a
private cloud and be more performant.
We'll put it there.
If they're looking to build a, you know, retool an old I series retail
application and have it be cloud native, we'll put it on aws, it'll actually help
with the modernization of the app too.
So it's hybrid from a platform perspective, but also from
a migration strategies too.
But I would say most importantly, you know, people are already hybrid.
They have stuff in organizations, but kind of, you know, who owns the glue
between those platforms and who's.
You know, figuring out the integration strategies, and so oftentimes
we'll do that, you know, for, for mid-market companies, we'll, we'll,
we'll manage in both environments and we'll do the network integration
back to wherever they need it to go.
W. Curtis Preston: So if I'm, so, you know, I'm a customer thinking
about using you, so it sounds like I have to move if I, if I'm, if I'm
fully on-prim at this point, right?
I have to move my workloads, or you help me move my workloads to
either a cloud provider that you support or to your, uh, private
cloud that's in your colo facilities.
Is that, is that a correct summary statement?
If I want you to.
Sagi Brody: On the production side, but every, almost everything that
we do from a, you know, an, an offsite backup and disaster recovery
perspective is, is, you know, sort of responsive to existing environments.
So, uh, we have tons of customers that are just using us to manage
their local backups, um, and their backups to the cloud.
And when it comes to disaster recovery, and kind of answer your
question, why would somebody use us?
You know, again, there's no right or wrong.
I mean, go using AWS without a managed provider.
That's fine.
Um, using a data protection software and building your own target
environment and building your own DR strategy, that's fine too.
What we really ask people is like, and it's kind of like actually
kind of like the quote that you said from, from your dad before.
Look what is, you know, what do you have an appetite to be
accountable for and responsible for?
Do you wanna be in the business of managing your DR.
Runbooks in perpetuity and nudging to be tested?
And who, who should own fail over?
Who should own fail failback?
Who should own the consumption strategy, which is more important
than just moving bits and bites.
So that's where we, that's where, you know, it's all white glove.
We're getting deep.
We wanna see those network diagrams.
We, we wanna, you know, make suggestions that are, are usable and don't require
them to re IP their entire network.
You know, so it's all about that, you know, it's a, we fit for those
organizations that are looking to shift ownership and just hold
someone accountable to an sla.
W. Curtis Preston: Interesting.
Uh, and by the way, uh, before we continue, I'll throughout our usual
disclaimer, uh, I work for Druva, Prasanna works for Zoom, and this is
not a podcast of either company and the opinions that you hear are ours.
Uh, if you'd like to join the conversation, I am available
at WC Preston on Twitter.
Or, uh, you can reach me at w Curtis Preston gmail.
And, um, then, uh, also be sure to rate us, um, I think by the time, I
think by the time this goes live, our current comment special will probably
be over, but, you know, we'll see.
We'll see if we extend it.
Uh, the idea was to get, uh, I think it was like eight new comments by
the end of October, and I would continue to grow my beard and
look, look more like Santa Claus by
Prasanna Malaiyandi: Come on, people You want to see Curtis
in a beard in a Santa Claus
W. Curtis Preston: beard
I'm, I'm, I'm, um, I've, I've been letting it grow.
I, I, uh, Sagi, I've, I've been trimming it pretty tightly, uh, kinda
like yours, and then I've been letting it grow because Prasanna over here
has a, is it a, is it a three or yet?
Prasanna Malaiyandi: Not a three year beard yet, so it's
a two and a half year beard.
Sagi Brody: You're
W. Curtis Preston: So he didn't cut, He basically cut tast, cut his
hair or his beard since, um, Covid and, um, I don't know, it's some
sort of weird protest or something.
But anyway, if you wanna see me grow my beard longer for Christmas and throw
out a few more comments, we'd love to see comments, uh, on, uh, iTunes there.
Um, I I am curious.
So, so now, so the reason, right, so I get that basically you, you manage
on-prem backup environments, but if I'm gonna move my production workloads
to you, how I is, I guess one thing, and, and let's just assume for the
moment that I'm not gonna, I'm not gonna retool, I'm not gonna refactor,
I'm just gonna run, I'm gonna take my, my, my on-prem stuff and I'm gonna.
Your cloud or their cloud I, Is there a cost advantage of one versus the other?
Is yours less expensive than putting it, uh, you know, in
AWS or VMware cloud on aws
Sagi Brody: Well, almost everything is less expensive than VMware Cloud on aws.
Um, I know we're not, Yeah, it's not about vendors, but I think I can say, say that
as an independent, um, participant, um,
W. Curtis Preston: It doesn't excel in, in, um, cost effectiveness
is what you're saying.
Sagi Brody: I, I think though that, um, VMware Cloud on aws, the fact that
it's been successful is really a good story for folks like Opti9 and others.
There's a lot of companies that are running, you know, private cloud as a
service, and the reason that I think it's successful is, you know, and I'm
sure you guys understand, is people were gonna shut down data centers.
There's a lot of pressure on them to just sort of turn it off and they had
to move their stuff and, you know, EC2 on AWS is, know you can run VMs, but
it's not, the same as running VMware.
Um, you know, it's designed to run, you know, sort of swarms of instances.
There's no inherent per node redundancy, and it, it was
designed for a different use case.
Um, and they, and then you have the whole sort of just operational overhead.
These people are very, very familiar with the VMware interface and, and, you know,
Prasanna Malaiyandi: that's what I've heard a lot about.
It's like once you have like a VMware admin trying to go beyond
VMware, they're like, No, no, no, no.
Kicking and screaming.
Sagi Brody: Yeah.
And so now you have, you know, basically move us to AWS because, you
know, you can't go wrong picking aws.
But, um, you know, so the right thing to do is, if you wanna bring it to EC2
and to AWS in general, is let's, let's, let's retool it to be cloud native.
Let's take advantage of PaaS, um, and SQL as a service and function as a service.
You know, how long is it gonna take to rewrite all these applications and do
we even want to rewrite all of them?
So, so VMC was this really good middle ground where it's like, Hey,
everything stays the same from a, from a technology perspective and interface
and operations and management, and you get to shut down your data center.
Um, and that's great.
I think what's different about companies like, like Opti9 and all the other
iterations that are out there is.
Vmc with vmc, they have to kind of, they have to kind of, it's like the Borg.
They have to assimilate everything into the AWS model.
And you know, that's a scale company.
So, um, you can't run a lot.
Like, for instance, you can't run a lot of the data protection
tools, um, that run on VMware.
They won't run on vmc, um, because you don't get sort of
native root access to esxi.
Um, and also if you try to put it inside your network, like one, one of the things
that I like doing, You know, integrating our cloud services into a customer's
existing MPLS or sdwan network from the closest location from the same metro.
So it looks and feels and acts like it's in just another node.
You, It's hard to do that with vmc and it's a lot of steps to go through.
So I use VMC as an example, you know.
That there is a model for these regional service providers, and if you can do all
the things that they do, they can do, but you have this level of flexibility
and customization and oh, you gotta put a half rack worth of networking
gear in front of it, no problem.
Oh, you have an MSSP that needs to monitor every packet.
No problem.
It's kind of like that, you know?
Um,
Prasanna Malaiyandi: A bespoke model a little.
Sagi Brody: Yeah.
Yeah.
Um, but, but to answer your question on cost, the least expensive
solution is the one that is, it is best sort of tuned for the use case.
So I do think running a, a SaaS platform, a modern day SaaS platform on a private
cloud is probably, it's, it's, it's not gonna be very cost effective at scale
when you start talking about traffic and also to run perpetual VMs like
legacy ERP systems and so on, on EC2.
It's, it's overkill.
And I'd say one of the things that people forget when they move to the cloud is
they've all been sold on virtualization on-prem, years and years ago.
And one of the reasons was, um, based on over subscription.
Hey, you can provision 16 gigs of memory on all your VMs and only
use four or five or whatever.
When you move to public cloud to EC2, to Azure, you're going backwards.
You're paying for provisioned again, um, whether you use it or not.
Hey, that's okay.
If you're using Ansible or Puppet or cloud formations to automatically
deploy and resize VMs, who cares?
But if you're moving a perpetual vm, like you want that over subscription benefit,
so the private cloud retains that part of it for you, which is really interesting.
W. Curtis Preston: Mm,
Prasanna Malaiyandi: I believe though, with VMC though, it would still hold
that same ability to over provision.
Right.
Just base,
W. Curtis Preston: within the VMC world.
Prasanna Malaiyandi: Yeah.
Within the VMC world.
Sagi Brody: Absolutely.
And that's, that's a really big factor that I, I think regardless of where you
go, what you do, people, it just kind of like, just forget about that aspect.
Prasanna Malaiyandi: Which is a big thing.
I think a lot of people don't realize, like the entire reason they went
virtualized was to deal with the, Yeah, I don't know the exact size and how
can I overprovision and not waste a bunch of resources and Interesting.
Yeah.
I'd never thought about the fact of, yeah, moving to EC2,
you're losing those benefits
W. Curtis Preston: And now instead of, instead of sharing something that you
own, you're now renting something that you don't own and you're paying, you're
paying for the whole thing, right?
I would argue that the better utilization of resources was the
OG reason for virtualization.
But to me, and again, maybe it's because I see things the
way I do, to me backup and DR.
Is like, if you do it right, uh, and, and things like ha and all of that stuff
that you can do with virtualization.
Like you can't do vmotion you know, with, with a, with a physical box.
Right.
It just, it just, well, you can, it just doesn't do anything right.
But, um, things like that, that just simp the idea.
It's just, there were just so many things that we could do from a backup
and DR perspective now that just simply weren't possible in the old days.
Now there was that period and you know, it sounds like Sagi, you've been
in this long enough that you remember that period when, when VMware came out.
and backup just broke, like, like overnight because everybody just kept
running their same old, same old.
Um, you know, And that's what created essentially the market for Veeam in
the first place was all the traditional backup products were just broke.
Um, and, and,
eventually we got there, right?
Sagi Brody: yeah.
I mean, our, our backup software, you know, was rsync.
That's, uh, what we ran, you know, a very long time ago.
And then VMware, there was nothing.
We, there, there was a script called, uh, Ghetto vcp, which
is what everybody ran, you know?
And, uh, It was called ghetto BCP for a reason, you know?
Um, but, but I agree with you.
I think once you get things, once you get sort of, sort of these, um, objects,
servers, connections, whatever, into, uh, like a virtual construct Yeah.
You can manipulate 'em in so many interesting ways.
Um, I mean, listen, we still do DR.
Today for physical servers and iSeries and P series and NFS and all the skeletons.
Do we like doing it?
No, it's not as easy as doing VMs.
W. Curtis Preston: Right.
Sagi Brody: the RPOs and RTOs are not the same, but you know, when
things are image based, there are so many cool things you can do with it.
I'll give you my favorite example is when people think about DR.
From, and I'm not like an old school networking guy, so from a, from a
connectivity perspective, um, whereas the virtualization might be replicated, you
know, using images in these cool ways, connectivity is still often thought of
in the old school way, where if I have, you know, three private connections
at my production, one's going to Fiserv and one's going Mackenzie, and
one's going to Bloomberg or whatever, and my MPLS, I, I still need to
duplicate all of those at the DR site.
And then I have to pay for double the circuits and I have
to have double the overhead.
And by the way, no one is monitoring those circuits until
I actually have to use them.
And then we find out they've been down for six months and blah, blah.
So one of the really cool things that we've been, we've been using, um, and it's
not something that we even sell, but if you look at these network as a service
platforms, um, the likes of Packet Fabric or Megaport, or even Equinix, uh, Ecx, you
know, if, if you take that cross, connect that transport circuit and you, and you
plug it into their fabric instead, you can fail over and fail back the physical
connectivity from production to DR.
Just like you do your VMs.
Right?
And and to me that's, that's the coolest thing, right?
Cause now I'm saving money and now I'm using that always during production too.
So if it breaks, I know immediately.
And I think it's tangible, you know?
Um, and it reduces the complexity greatly.
So this whole software defined, you know, buzzword.
For me as being someone who has to design DR infrastructure, um, I can
use that and leverage it to simplify and, and, you know, reduce the rto.
Prasanna Malaiyandi: That's very interesting.
I never thought, like, normally when I think about.
Doing DR testing, right?
It's like, Hey, can I fail over?
Can I bring it up?
But the networking aspect you just talked about, right?
It's like you really have to validate that entire stack top to bottom.
Not only of does your VM come up, but does your app come up?
Is your networking all good to go?
Right?
Does all the connectivity services all come up as well that you need
in order for it to be operational?
Sagi Brody: Yeah, I mean, DR.
Uh, networking is like the dirty little secret of DR.
You know, copying data is, is easy.
I mean, you know, companies like Druva and Veeam and, and many others have
done a really good job of, of data replication and data assurance and,
and, and, you know, I mean, they're, they're just amazing at what they do.
Um, But devil's in the details.
And so the first question I usually ask is, how are you gonna consume?
You know, what does consumption look like?
And the answer kind of changes if we're talking about a full failover versus a
partial failover, and so on and so forth.
W. Curtis Preston: And then you, you add, you know, we, we, we just
recorded yesterday, we recorded a, an episode where we, we were, we've been
doing a back to basic series and uh, we recorded an episode yesterday that
was just like, why we back up and, you know, all the things that can go wrong.
That backup is backup and DR.
Are meant to fix.
And we, we talked.
A true disaster, right?
We were talking about things like hurricanes and giant floods that take out
regions and one of the real challenges is, okay, how do you do connectivity to your
apps when, um, everybody is now working out of Starbucks and you are running out
of a cloud provider in another region?
Um, you know, there, there's all those things that you have to count on that,
that, that aren't necessarily available.
Um, I, I wanted to go back to there, there was a thought that Prasanna
that you brought up earlier, I think that was you that talked about,
you know, the, the OG reason why we went with, with virtualization.
When I think about the cloud, like, like, like a true IaaS
provider, um, to me that big reason.
Like, it may not be it, it definitely is not the reason most
people go to the cloud today.
I, I think they, they go to the cloud for false reasons, but the
true beauty of, of an IAS vendor is that dynamic allocation of resources.
I need a VM boom.
I need a, I need a PaaS platform.
Boom.
I don't need it anymore.
Boom, , right?
That, that, uh, that, that automatic.
You know, allocation and de allocation of resources and paying
for them only when you use them.
That that's the thing.
Going back to when we talked about virtualization, the stuff that is
possible now that wasn't possible then that's the thing that is possible
only in a public or, you know, cloud environment or I guess private cloud
environment like yours as well.
Where you can just grab a bunch of stuff, use it, and then get rid of it and pay for
it for the three hours that you had it.
That, to me, is the beauty of the public cloud, and if you're not
leveraging that, you're not really, you're not really getting the,
the beauty of the public cloud.
I don't know what, what do you think about that, that thought?
Sagi Brody: You're absolutely right because, and, and I, I, I talk up, I
talk about that sometimes with people and I tell them, when you're paying for
EC2 instances, you know you're paying for the APIs, you're paying for the
pleasure of being able to do all that.
And if you're, and if you're not actually using it, if your goal is
to deploy 20 windows VMs with 16 gigs of memory and maintain that in
perpetuity, um, you're overpaying you.
W. Curtis Preston: Yeah.
Sagi Brody: So it is true, and I think people that are using, you need to be
using X number of PaaS features, you know, to really sell me on the fact
that you need to be in public cloud.
And you know, I would say in general today, With all of this,
the, the real threat is complexity.
That's the killer and everybody in it, they're part of their goal should
be on sort of watching complexity, sprawl and reigning in complexity.
Um, because, you know, as you're aware, you know, the more complex, the harder
it's to manage, the harder it is to ensure it falls into your resilience, you
know, goals, um, or your compliance goals
Prasanna Malaiyandi: Or, Or your security goals.
Right.
W. Curtis Preston: Yeah, one of, one of my mantras is complexity equals risk,
Sagi Brody: Yeah.
Yeah.
And, and even like people that are like, you know, you have, you know,
departments going and, and just running, um, just using SaaS platforms.
I mean, it's great from a functionality, uh, perspective, but, you know,
how does that, how, how does that relate to those different things?
How does it relate to resilience?
And going back to, um, what you were saying before about
sort of DR testing, Right.
One of the interesting scenarios that's popped up with this and DR.
, you know, if you are, if part of your production environment is, you know,
Office 365 and um, Salesforce and Workday, and like you have, you know, critical
data that's sitting there, um, and your, your own applications are speaking to
them and integrated via APIs, can you actually do a DR test on your application?
Like when you bring up your app and DR.
I, if you haven't blocked off your firewall right?
And you start going in the app and making changes and playing with it and meanwhile.
It's connecting to your QuickBooks instance or your Salesforce, and
you're changing production data, like this whole thing around you.
You can actually poison your production environment by doing DR testing.
So, you know, we talk to our customers about that and you
know, how do you account for that?
And, um, it's not, so easy sometimes,
W. Curtis Preston: of the major platforms, you know, the say three
or four top platforms like that.
The one that I think gets that right is Salesforce, right?
Because they'll give you that sandbox environment.
There's not, I'm not aware, I don't think there's a sandbox.
Microsoft 365
Prasanna Malaiyandi: Maybe you clone your SharePoint site
Sagi Brody: Yeah.
I mean, the sandbox is nice, but now you have to, you know, um, and we've probably
thought about this way too much, but now you have to, um, Where am I doing, Where
am I doing the, the split to the sandbox?
Is it in my application and I have to go tell all my devs to run two
configs and I hit a button in the app?
Am I doing it at the network layer where I'm proxying the connections
and I'm redirecting it to the sandbox?
And you know, going back to what you said, it's all, it's all either
way, it's all complexity and.
I don't think it's a problem, but I think these are some of the things that
people need to think about at the very beginning, before they go and run and jump
on this SaaS or that SaaS or this or that.
You really have to kind of look at the big picture holistically.
W. Curtis Preston: Yeah, if, if your DR test is going to be actually
changing things in SaaS environments.
Yeah, I hadn't even thought about that actually.
But if it is, you absolutely can poison your, your production environment.
Sagi Brody: I've seen it happen, happen with the hospital where they,
they turned it on and they use a third party, you know, pharmaceutical
service for prescriptions and they put in a test prescription and, you
know, all of a sudden something pops outta the machine for, for John Doe.
And it's not supposed to be there,
Prasanna Malaiyandi: Oh
W. Curtis Preston: That's not good.
Yeah, I can think of all sorts of things where that happens and yeah.
My, my concern of the SaaS, the modern day SaaS world, as, as much as, you know,
I, I work at a SaaS provider, right?
But my concern of the modern day SaaS world is, well, two concerns.
One is the one you talked about about complexity.
You can have hundreds of SaaS providers that do various little things for you.
And, uh, I remember, uh, Prasanna, you remember when we interviewed that one
person who worked at a, you know, a startup, We asked them how many SaaS
providers they said, and they said 450.
, Holy crap.
Like how do you, how do you, like you said, how do you rein that in?
How do you manage, um, you know, provisioning to that and, and,
and, uh, sso to that and all that.
I mean, I guess that's what Okta's for.
But number two, and real, really this is number one, is, um, how many of
those SaaS apps have data that is critical to your production requirement
that, that your production environment that you're creating in that SaaS.
and then there is no backup of that data.
Right?
And the answer is all of it, right?
99% of SaaS customers don't do squat for backup of their SaaS environment, and
they think that people like you and me that happen to sell services to do that.
We're just being fear mongers when we tell them that Microsoft 365
might delete all their data one day.
Sagi Brody: It's, it's a very, there's so many bad assumptions in, in the industry.
I mean, not, it's not the industry, it's just the complexity.
You know, like it's, it's a good example.
And, uh, you know, with Office 365, certainly they have multiple
data centers and your data.
Is resilient.
If one of those data centers, you know, goes down or blows
up, you know, you're fine.
But, you know, can you, can you hit the rewind button and
bring back your office 365?
And, you know, as it looked like two weeks ago, you know, like you can do
in a, in a traditional environment.
No, you can't do that.
Absolutely not.
And I, I think there's, there's so many gotchas in the market.
I mean, one that, that we have been looking at recently, we actually
launched a product called Observer to kind of try to mitigate it, and it's
kind of been my baby, um, for the last few months, is we realize that the
backup and the backup and replication software running at the customer's
production environments have now become this sort of new attack surface.
Attackers are going after.
And it makes total sense if you're, if your golden life is to ransomware
companies and get as much money as you can outta them, then of course the
first thing you do when you get . In is you're gonna go look for all those
backups and those replicas and the DR site and try to destroy everything.
It increases your likelihood of getting paid.
And what we realized was that a lot of, a lot of people, you know,
mistakenly are using the same authentication for those tools locally.
And if an attacker gets into.
, Um, they can destroy everything at the, you know, at, at the DR site in seconds.
You know, there's no such thing as immutability when it comes
to disaster recovery for almost all, all the tools I've seen.
Um, and even with backups, there's immutability.
But you know, they can also delete stuff beyond that and they can
also disable your jobs and weight out the immutability timers.
So, and so what we did was we realized we're already connected into our customers
on-prem software, like just to pull whatever data we need to manage it.
And so what we started to do was we ran the, we are running the data through,
um, machine learning and artificial intelligence, and we're looking for,
quote unquote suspicious activity that an attacker might perform.
Um, things like, uh, encryption being disabled, um, on backups
or retention being modified, or, uh, jobs being modified, or
all the backups being deleted.
All these, you know, different things.
And we baseline what's normal for that site and what's not normal.
And then we set out threat alerts and we also, you know, integrate it
with some security tools cuz they don't have access to this landscape.
And then we also did this other cool thing where if and when this happens,
we can automatically air gap the offsite disaster recovery and backups environment.
So I'm really excited about that because within my organization everyone's like,
Oh, we should do more for security, we should do more for security.
And it.
How do we, like, we're not a security company, but this is an
area that we know a lot about.
And if most people are coming to us to buy those services because they're concerned
about security, hey, maybe we can, you know, address it in a more direct way.
Prasanna Malaiyandi: It's another line of defense, if you will, right.
That says,
W. Curtis Preston: Yeah.
Sagi Brody: exactly.
W. Curtis Preston: I want, I wanna ask you Sagi, um, you
know, you're, you're a Veeam msp.
We, we've talked to Veeam a couple times on the podcast and, you know,
I've often wondered, what does a service provider look like for Veeam?
And you're actually the first one that, that, that we've actually talked to.
I'm, I'm curious to know.
Obviously, you know, the value of security in a data protection environment.
What is your, how, you know, you don't have to give away secret
sauce, but, but how do you think is the proper way to configure Veeam?
That's secure and, and also, If you're gonna do DR.
Right, um, you know, if you're gonna do DR as a service for somebody,
how would you be configuring Veeam.
Sagi Brody: Um, well, I mean that's, that's, you know,
part of our bread and butter.
Absolutely.
Um, you know, Veeam is, is a software and we're, we're
wrapping our services around it.
Uh, you know, managing.
Monitoring, securing and scaling.
Veeam is not the only data mover that we support.
Um, we support, um, Zerto and, and Itera and a few others.
Again, it's all, you know, what's, what's the use case and what's the best tool
in our, in our tool, tool bag for it.
Um, but you know, there, there's definitely some best
practices technically around it.
What I mentioned before, you know, around, don't tie it into your production AD.
I mean, that's probably the best thing you could do, I would say.
I mean, they support
amu.
W. Curtis Preston: man.
Sagi Brody: Yeah, I mean, they support immutability now.
They support hardened repos.
Um, obviously those are part of best practices.
I would just say like, like I said before, just really acknowledge
what business you want to be in.
If, if, if you are a backups administrator and you want to take
this challenge and own it, then great.
I mean, there's tons of good resources out there.
In fact, I've done webinars about, you know, with, with Veeam around
what, what are the best practices.
. Um, we also are selling this observer tool as a standalone.
You know, you can just, you can just layer it on top of your Veeam infrastructure to,
to alert you of these suspicious actions.
You don't necessarily have to use us for offsite backups or DR.
And so that's a nice middle ground, Right.
Um, especially because we're doing a lot more with aws.
So, you know, we want to be able to provide these managed services
without forcing our customers to use any specific target.
W. Curtis Preston: Right with, with Veeam.
So I, you know, I know they supported immutability to like s3 object lock.
If you're gonna do dr, though, you, you want that to be on on block, right?
If you're gonna do DR from it.
Sagi Brody: Yeah, So Veeam supports immutability with object.
They also support immutability with their local backup servers.
One of the great things and one of the horrible things about Veeam is
that there's so many components.
Um, if you're a, if you're a big shop, it's good because you can
scale those components individually.
Um, if you would just want the easy button, you can run
it all on one server too.
Um, but I think, I think understanding what bucket you fall, fall into
and find, maybe finding the right information with the right time
might not be the easiest thing when there's so many different variations.
Um, but yeah, you can run immutability locally.
Yes.
When we, when we provide disaster recovery as a service and for anyone who's doing it
on their own in house, you're replicating to production ready infrastructure.
And so it's, it's typically an all flash or a hybrid array.
Um, you know, the VMDK is essentially sitting there
registered, ready to be booted up.
And our customers, you know, there's no, there's no sort of,
um, transformation of the data.
It's, it's immediately available.
But that's also what makes it susceptible to, to what I was saying before, is
if the tool is constantly replicating, And somebody gets into the tool.
Um, and this is not just Veeam, it's, it's, it's the same with
Commvault and Rubric, and even Zerto.
Someone gets in that tool, they can hit a button and say, Hey, let's,
let me delete all the data at the remote rep replica, like instantly.
W. Curtis Preston: Yeah, it's a concern that I have.
And I'm sure you're aware of the, the news where we've seen of the
ransomware folks directly attacking different, uh, backup vendors.
I guess I'm wondering if there's any way to, to get around that.
Sagi Brody: Well, I think, I think using a service provider like,
like us is good because now you.
You have the separation of data, data, plane and control plane.
Um, you have this firewall, you know, in a way between the customer's infrastructure
that's tied to their authentication and the recovery environment.
You also, like, as you were saying before, the, the beauty of the cloud is, you know,
all the spin up and spin down if we're doing disaster recovery as a service.
We're not talking to customers about how many, how much CPU of memory they need.
We basically give 'em an SLA that their applications will perform just
as good or better than production.
There's no cost for the CPU or memory.
We manage all that on the back end.
And, um, you know, we're, we're managing the replication, we're
monitoring it, we're owning the failover fail back testing, all that stuff.
So it makes it very simple for them.
And as you know, there's, you know, a gazillion other things.
All these IT folks need to manage these days, especially with security
so they can kind of move on.
But I do really think that when people think about security, they're
missing the whole DR component.
Um, people also need an isolated recovery environment to, to, you
know, like if you look at the Colonial Pipeline hack, um, it's, it's, it's
not that they were down so long cuz they didn't have backups, you know,
they had a full copy of all their data.
The question though is where do they bring that back up from?
Um, and you're not gonna, you don't wanna override your production environment.
You need to do forensics and see how they got in and what happened.
Um, and so a, a true disaster recovery environment, one where you can kind
of boot off multiple snapshots, gives you the ability to have an
isolated recovery environment to bring up the app in a way that it's not
gonna, in fact, back to production.
And also to bring up a recent copy to, to perform forensics.
And a lot of people kind of throw backups and DR.
In the same bucket.
It's the same thing.
And to your point, no.
Two separate services.
Two separate use cases, two separate goals.
When we sell backups, it's landing on cheap and deep storage.
When we provide disaster recovery, it's it's expensive
performance storage, ready to go.
W. Curtis Preston: Right, right.
Prasanna Malaiyandi: Uh, I, I remember just going back and thinking Curtis
to the talk with Tony Mendoza about Spectralogic and sort of the pain they
went through to recover from ransomware and how, just like identifying the
systems that they can boot from and trying to find like what is a known
good copy they could roll back to Right.
Took 'em days in order to just even figure that.
W. Curtis Preston: Yeah, their biggest challenge was just
figuring out what was infected.
Right.
What, what servers were infected.
So they did this, like what one?
I think that's what he said, right?
Where they shut everything down and then they brought everything up like one
server at a time to see if it was infected before they, Before they moved on.
Sagi Brody: Yeah, and that's a really good point.
That's half the battle, right?
So, and that's part of another reason.
Kind of when we built Observer, we kind of built it to, to give you
that, some of that information and all that, but that's, it's a challenge.
These are the things that people never think about until
unfortunately something bad.
Prasanna Malaiyandi: happens
Yep.
W. Curtis Preston: That's why we have people like you and Prasanna and me
Sagi, because we just, we just try to get 'em to think about that sort of stuff.
That is the whole purpose.
Of this podcast.
Well, I think it's been a great, great discussion.
Uh, thanks for, thanks for coming on
Sagi Brody: Thanks for having me.
W. Curtis Preston: and, uh, Prasanna, you know, as always, and I'll continue
to keep you updated on my floor progress.
Prasanna Malaiyandi: Good.
I wanna see finished pictures soon.
Tomorrow.
W. Curtis Preston: I'll see what I can do.
I'll see what I can do.
All right, and, uh, thanks again to the listeners.
Remember to subscribe so that you can restore it all.