You keep using that word air gap?

I don't think that word means what you think it means.

Uh, this is what we ended up talking about with analysts, Krista McComber

this week, both that term and another one that a lot of vendors are using that.

I don't think it means what they think.

It means.

Hope you enjoy the episode.

Hi, and welcome to Backup Central's Restore All podcast.

I'm your host, w Curtis Preston, a k a, Mr.

Backup, and have with me a guy who is possibly more excited about my recent

purchase than I am Prasanna Malaiayandi.

How's it going?

Prasanna.

I am good, Kurt.

I'm actually a little disappointed that like your sort of happiness,

excitement ended so quickly.

It's in end.

Uh, did well in the sense that you sounded not as excited.

I think your words just last night were, I'm starting to get buyer's remorse.

Oh.

Oh.

I did have a moment of buyer's remorse.

Yeah.

Yeah.

Well, you know, so, so for those that didn't listen to y uh, last week's

episode, uh, I bought a Tesla, um, after many months of, of, you know, Will

I, will I not, I decided that it was time to replace the, the old Faithful,

this trustee Steed that had, uh, you know, 10 years and 220,000 miles on it.

Uh, the Toyota Prius with an ev.

Or should I say the e v?

And um, it's funny, I, I had, I had lunch yesterday with a, another guy in

the industry down in La Jolla, and he, he was like, oh, you, you got a Tesla?

And I'm like, yeah.

And uh, he, he said, you know, I have a Kia ev.

Um, and my son was like, dad, Why didn't you buy a Tesla?

So he has a, he has a little bit of Tesla envy.

It is a really nice car.

It's really crazy the amount of extra things that the base model is able to do.

Um, you know, if I spend another.

Like six grand to get the enhanced autopilot.

The, the, the other things that that car can do are even more amazing, but just

the things that it can do and the, you know, the way it does things for you.

Um, and, um, You know, the charging is super, super easy and it is less

expensive than gassing it up even at the crazy rates that we pay for electricity

here in uh, Southern California.

I really wish I lived where you live, Prasanna, cuz you have, you

pay nothing compared to me cuz yeah.

of Santa Clara does have a benefit of having its

own power company, and so because of that, our rates are ridiculously low.

Like I, I want to say it's probably like a quarter of what you pay Curtis.

Yeah, cuz I'm paying like at like at night, like at like the

lowest rate that I pay when I would charge an EV is like 35 cents a kilowatt hour.

That's the lowest rate

So it's like a third of the ba.

Yeah,

You suck.

yeah.

I'm sorry.

I'll just rub it in.

Pour salt on the wound.

You know how it goes,

That's

but at least you should continue

enjoying your car, you know, and

Oh, I'm enjoying it every time, every time I'm in it.

Um, and, uh, my wife is still terrified of it.

We'll, you know, we'll see.

Get her over over it.

Um, and, uh, uh, she, yeah, she just, you know, it is, it is

definitely a different enough car.

We had an EV before we had a, a leaf, um, and this, this, this car is so

a, it's, yeah, it's, it's a very, very different

experience versus what you had

It's, it's a very, very different experience.

Um, and, you know, even, even just something so simple as

while I'm charging, right.

Cuz I, cuz right now I am predominantly charging at Super stations because

believe it or not, it's actually cheaper for me to charge down the

street at a super station than it is to charge at my house at midnight.

Right.

So, so I'm, I'm just doing that.

Right.

So I'll charge, I'll charge at the Super station for now.

So, But I can pull up, I can pull up, uh, what did I say?

Super Station.

Yeah.

The tbs.

The TBS Super Station.

Yeah.

So, uh, so I go to the supercharger and I can charge there.

And, you know, if I want a full charge and I've driven the car for a,

what, you know, I'm looking at 30, 40 minutes, um, which is still crazy that

I can do that in that amount of time.

And, but, but here's the thing.

I can sit there and watch Netflix or YouTube, I.

I might as well be at home.

I'm in this comfy seat right.

And I'm interacting with the, the video and yeah.

So it's kind of cool.

Um, so yeah.

But I, I did have a moment of buyer's remorse because, you

know I,

money

yeah, I know we talked about this yesterday.

I'm glad you sort of walked off the ledge there and came back to normal

civilization, you know, and, uh,

Yeah, yeah, yeah.

Uh, so I'm enjoying it.

But, um, well, our, our guest is, is probably at this point

wondering, you know, what in the world did she sign up for?

Couple of, couple of ev nerds.

She's, uh, she's an analyst and advisor and all things data

protection and cybersecurity.

Having been in the industry for 13 years, I ran into her insights

quite a bit on LinkedIn, and so I, I wanted to have her on the pod.

She's now a senior analyst at Futurum Group.

Welcome to the Pod Krista Macomber.

How's it going?

Curtis and Prasanna, thank you so much for having me.

I'm, uh, not lucky enough to, uh, own a Tesla, but definitely maybe someday.

Yeah, person, Prasanna.

Prasannawas my sort of, I was, I was living vicariously through Prasanna's.

Ev uh, ownership or Tesla ownership.

I don't know if it counts as being vicariously

living through my experience since I didn't really, I don't really

use the car as much as you, for

Isn't it ridiculous, Kristy?

He's, he's, how, okay, how long have you had your car

Prasanna Malaiyandi:

Four years, three months,

and how many miles do you have on your car?

uh, 12,700 miles.

I, your Honor, I arrest my

Even I, wow.

Even I do more than that.

Yeah.

That's just, that's just, it's just wrong.

But

Of which 750 was done over the long weekend when I

yeah.

Yeah.

That's crazy.

He had a long weekend and drove, you drove to, where'd you say you, uh, yeah.

Yosemite.

Beautiful.

Yeah.

Um, beautiful spot.

You don't have anything beautiful like that out where you live.

Do you, Krista,

Well, I am about a mile, uh, mile away from the ocean,

so that doesn't, that doesn't suck.

But it's not quite Yosemite, so.

but, and you're just surrounded by green all the time, right?

I mean, it's just, um, yeah, that's what you have,

bit of everything.

Beach trees, mountains.

Good mix.

Good mix.

Well, I, I, you know, I'm curious to know, um, I mean, I know how I got into

this business when I talked to somebody.

Um, you know, I, I am curious, like, how did you find yourself

in this side of the business?

Like

Sure.

Yeah, it is.

Um, it's an interesting story actually, Curtis.

Um, so when I was in school, I actually studied, um, journalism and, um, I had

a, a minor in business and so I wrote for the student paper actually here

at the University of New Hampshire.

And, um, there was a gentleman that.

Used to work at the first analyst company I ended up working for.

And um, I interviewed him for a story for the school paper.

Um, he actually won their business competition a few years prior.

Um, and he said, you know what?

We need some kind of research and, uh, proofreading and editing interns.

It's kind of a, you know, a good mix, good experience.

So why don't you kind of come on board and check it out.

So I interned for, um, about a year and a half or so, and then

I ended up coming on board.

Full-time, um, as I graduated and the rest has been history.

Yeah.

Nice.

Nice.

Um, what.

What, what's it been like?

I mean, you, you know, that like the, the backup side of things.

I think you, you, you've certainly expanded or I don't know how long,

if you've covered the cyber side of things, but you've certainly

now uncovered the cyber side.

What, I mean, what's it like covering this industry from the outside?

Cuz I mean, I, I, I've, I've been on the outside, I've been on the, I've been on

the, I've been sort of, I've been on three sides now I think of, of the industry.

So what's it like, what's it like being, uh, you know, doing that?

Yeah, so, you know, one thing that's pretty unique, I

think, in terms of where we sit in the market, um, so our team, so you

mentioned we're, we're with Futurum group, we're actually acquired at the

start of this year by Futurum group.

Previously we were evaluator group.

Um, and we work very closely actually with IT operations.

So when you talk about covering a topic like cyber, what I think is really

interesting because you get that sort of firsthand perspective in terms of,

okay, you know, I'm all of a sudden seeing everything being branded.

As security in cyber, um, you know, how do I know what's what, how do I really

know what my full stack should look like?

Um, and I think it's a very important topic because there is

no silver bullet, you know, cyber resiliency solution, unfortunately.

You know, it's all about how does you know, data protection

play, um, you know, with incident response as just one example.

Um, so that's been, I think, you know, Valuable just in terms of, you know,

we really have to be able to understand how the piece parts fit together, but

make sure that we're being very clear as well on our side about where does

our expertise, you know, sort of lie.

And so a lot of what you provide, like you mentioned,

it's talking to like the IT folks, right?

And figuring out like what does the process look like from there?

Like where do you go from there, right?

So it's like, okay, here's my problem.

Here's kind of what I'm looking to do.

Like, how do you help them solve those challenges, I guess?

Sure.

So it depends a little bit.

Um, I'll give you the analyst answer, but.

Yeah.

So I would say typically they might want us to help them to narrow down to a

small handful of solutions to consider, um, based on the particular criteria of

their environment and their requirements, which of course are always unique.

So they're never is sort of one size fits all just, you know,

for any customer of course.

Um, so that really does, um, That's where we do spend quite a bit of our time.

Um, and sometimes it might even be helping them to, um, you know, look at

their current implementation a little bit skeptically and say, okay, where

might some of the gaps, you know, exist?

Um, what are some of the things that maybe we aren't necessarily thinking about?

Um, That we might wanna consider moving forward.

And that's where actually we have what we call our IT insights community.

Um, and what we find is that does tend to be really valuable for IT

operations because that's a community where, um, not only can they get,

you know, kind of our feedback as.

Analysts, but they can also have some peer to peer conversations and

feedback and, um, you know, understand what are some of their peers maybe

doing to address particular, you know, challenges or requirements and, and

again, have those types of conversations.

You know, uh, a few years ago, uh, I give, um, I give Randy

some credit, um, from back in the day.

It was a few years ago when I was working, I.

Uh, by the way, before I continue, I'll remember this

time to do our usual disclaimer.

Uh, this is an independent podcast and, uh, you know, it doesn't reflect

necessarily, uh, anybody's employer and the opinions that you hear are ours.

And, uh, also, uh, be sure to rate us, go to your poca, your pod catcher and

give us lots of stars and comments.

We'd love to see comments, and we'd really love to talk to you.

If you, uh, you know, you wanna be part of the conversation, you wanna

send me a private message, you just say, Hey, make sure you cover abc.

Uh, you haven't talked at all about such and such.

Uh, the episode this week, uh, that, that, that I published this week is a

perfect example of that where somebody wanted to know like, how do I, you

know, like I lost everything, right?

Not just I lost all my servers, but I've lost, I.

Like the handhelds that I use to authenticate with my password management

system and my, my, uh, MFA system.

How, how do I start from a hundred percent scratch, which isn't something

that I haven't been asked before that.

So that's the show that went last week, and that was from a user.

Uh, or, or a listener of the podcast and, um, uh, we had her on.

So yeah, so contact us, um, you know, even if it's just privately.

And, uh, I am WC Preston on Twitter, w Curtis Preston gmail,

and, uh, linkedin.com/i n slash mr.

Backup.

Um, yeah, so a few years ago, one, one thing I think that.

When you get to talk to independent, independent analysts, they can

sometimes call you on your bs.

Right?

Um, and I was working for a vendor, right?

Um, the, the last time I talked to Randy, which was a few years ago, right?

And, um, he, uh, called me.

So the vendor that I worked at liked to use the word immutable a lot,

I knew where this was going.

Yeah.

Yeah.

And, um, and he's like, right, but do you have the, you know, he described

a very specific thing of like, you know, do, do you have a feature that

you can turn on so that even the users can't delete their own backups?

And I'm like, well, no.

And he's like, well, then you're not really immutable.

Right.

And I'm like, very good point.

And then I

went, I went and, and, and, um, I mean, you know, I still think

of immutability as, as a, as a.

Like a spectrum, right?

Nothing's a hundred percent immutable.

Um, and nothing's 0% immutable.

Is that right?

I don't know.

Anyway.

Um, so I think you could be more and more immutable over, over time.

Uh, but that, that specific request, uh, that feature made it into

my previous employer's product, uh, significantly because of the

input that I got from, uh, Randy.

Well, and I think sometimes we just sort of have

our own blinders on in terms of what we think people need in customers

these, and being able to talk to independent analysts and be like,

Hey, what are you actually seeing?

And hearing as you're going out and talking to all these people, right?

Because you see and touch so many different people who may not even

be existing customers, right?

It's like, yeah, that's critical.

Yep.

Yeah, it's, um, it really helps to keep us grounded.

Um, so I remember that conversation, Curtis distinctly, so I figured you

were, I figured you were going there.

Um, you

coffee shop in Vegas.

Yes.

Yes.

It was.

right where that meeting was.

We try to make sure people have thick

skin in those conversations.

Right.

But, um, yeah, it, it keeps us grounded.

I mean, one example that comes very clearly to my mind that

I've been, um, partaking in recently is around air gapping.

Um, because of course we're seeing all these different cloud solutions

and oh, they're air gapped and this it insights community that I referenced,

they're saying, well, wait a minute.

It's not really right, because there does need to be some connection somewhere

to get that data into the vault.

So why are they calling this an air gap and is it just, you know, um, an

AWS bucket that's sitting out there somewhere that I'm just putting data into?

How do I know right, that there is some sort of.

Um, you know, isolation there, right?

So we've kind of taken that feedback and not only does that influence

sort of, um, you know, our research and, and where we're covering.

So I wrote, um, you know, a piece about, okay, what we call this, you

know, operational air gap versus your more traditional physical air gap

where you're actually shipping, you know, tape media offsite, for example.

Um, but also kind of to what you're alluding to.

An actual air gap.

Exactly.

Exactly.

It, it's funny, this came up, this came up, uh, yesterday

on, we, we were recording with another, with somebody else, and they, they,

they said exactly the same thing.

So you're saying, you, you, you do, you're doing, you're using the term operational

air gap versus physical air gap.

I Either that or data vaults, you know, I'm kind of.

Playing with both of them.

Um, operational does seem to make more sense to it operations, um,

you know, versus like a, a virtual air gap or, or anything like that.

But, um, I, I'm even hesitating to use air gap in context.

If anything, that's not a, a pure physical air gap, just.

Due to the feedback that we've been receiving, you know,

from those conversations.

So, but yeah, operational seems to, seems to be sitting a little bit better.

I, I would describe it.

I like the notion of avoiding the term air gap

because like you said, it means so many different things and it sort of.

Also leads people down the path of saying, oh yeah, it's an air gap.

But it's like that first word becomes so key that they forget

about it and what it really means.

And I like using the word operational.

I was also thinking as you were talking, right?

Instead of like operational air gap, it's like operational isolation

or things like that because that's really what you wanna do, right?

It's like, hey, this is really a separate environment that is operationally isolated

from everything else you normally run.

And that's how you get the protection.

I completely agree Prasanna, and that's why a

vault is actually not a bad term in my opinion, because it does have

that connotation of being isolated.

But yeah,

Yeah.

You know, it's, it's funny, um, Krista, um, it's like the

argument that I have over.

Snapshots and, um, because like, and again, this came up yesterday, so I, I

don't like that vendors like AWS use the term snapshot to refer to image copies.

I.

Right, because like a, like a, an AWS snapshot is actually a backup.

Like it actually goes into s3, it goes to a different place.

It's not a snapshot in the traditional it sense.

But then the thing is, if you think about the word image, it's

just another word for snapshot.

It's just they're all, they're all pictures, right?

So it's like, you know, you're saying vault.

It's like, I, I agree.

I, I like that.

Basically you've chosen to use a different term and there's nothing wrong with it.

But vault is where I would make my air gap.

That's what I'm, that's historically I would put my tapes in a vault.

This is no more a vault than it was an air gap.

Um, I, but I, I understand what you're, you're trying to get

away from that term air gap.

I, I guess the question is like, if we're gonna keep, like the way, like the way.

The way Randy kept me honest a few years ago, if we're gonna keep vendors honest,

like there's, and I'm not gonna name the vendor, but there's one particular

vendor that has, has, uh, you know, an appliance that sits on-prem and it's an

on-prem appliance in the data center, and they call that appliance air gap.

And, um, and it just kills me.

I'm like, it's not even whatever.

Like, so how do, how do you, how do you like, That's, that's what

I'm saying is I'm, that's, hi.

Historically, when I, when I wasn't part of the vendor community, I

was trying very hard to get them to use term to not misuse terms.

And air gap is currently air gap and immutable, I'd say are the,

the two words that are very much

misused.

Absolutely.

Yeah, I don't, I don't know.

I dunno where to go from there, but it's just, it's just, uh, so, so, well, I

guess my question is, so do, would you, are you trying to get vendors to use

that term or, you know, does that matter?

What's your goal with that term?

The vault term?

I would say honestly, my bigger, um, Goal is

to try to get the vendors to be as clear as possible about what they're,

what they're actually providing.

Right.

Because it's okay, you can use any term you want, but you know, to your point,

Curtis, there's, there's only so many words and terms that we can use, right?

Because then if you do throw out something completely new, then the market.

You know, in, in, in it, they have no idea, you know, what you're talking about.

So there needs to be some education anyway.

Um, so I think I would say my, my goal wouldn't necessarily be to get the, you

know, the vendors in the industry to standardize on that term, but more, okay.

Let's consider, you know, is there something else we can

describe this as, but also bigger picture, you know, You, Mr.

Bender, please be aware that, you know, your customers are

looking at this messaging and they're wanting to understand

what's actually going into this.

To truly make it isolated and to make it more than just your, your general

purpose S3 bucket that's just sitting out there that anybody can penetrate.

They want that information and they wanna know, um, because this

is just too important for them.

Um, so I would say at the end of the day, that's really,

um, you know, my bigger goal.

Prasanna Malaiyandi:

It's a very noble goal.

Prasanna Malaiyandi:

I wish you luck.

Prasanna Malaiyandi:

No, because that's, because that's

Prasanna Malaiyandi:

always a hard thing like Curtis talked about, right?

Prasanna Malaiyandi:

It's like vendors like to make up terms, right?

Prasanna Malaiyandi:

And like to reuse terms because they think that's what customers want.

Prasanna Malaiyandi:

I, I've worked in with vendors my entire career, right?

Prasanna Malaiyandi:

And so I've always seen that path, right?

Prasanna Malaiyandi:

It's like, Hey, we could call it this, but it's not quite that, right?

Prasanna Malaiyandi:

We'll use the word snapshot when we really mean backup, but it's like people know

Prasanna Malaiyandi:

snapshots and it's like, Yeah, that's just confusing users in the end, right?

Prasanna Malaiyandi:

And so at least making sure users understand what they need to look for.

Prasanna Malaiyandi:

And it doesn't matter what terms a vendor uses, it's like, this is what I need.

Prasanna Malaiyandi:

I need a mechanism to make sure that my backups are protected.

Prasanna Malaiyandi:

And it's operationally separate.

Prasanna Malaiyandi:

And if you decide to call it a vault, or if you decide to call it a virtual layer

Prasanna Malaiyandi:

gap or whatever else you decide to call it, that's fine, but this is what I need.

Exactly.

Exactly.

And um, we've actually gotten hands on, um, with some of these solutions

in particular, there's a couple of them that we were contracted to actually

do an audit and say, okay, you have, you know, solution X and solution Y

that are, you know, you're calling.

Air gapped or whatever that term is.

Um, you know, let's break it down.

Um, let's spend some hours kind of really going through the solution.

Um, you know, as the analyst firm, we tried to put on our, our hacker hat,

I guess, if you will, and try to think about, okay, what are any ways that there

might be to get around, you know, using Curtis's example of the immutability,

you know, the controls for that.

And maybe when an IMMU bill copy expires, um, You know, do you have

your controls to be able to sever the network connection, um, so that it is

only open, you know, when your data's being transferred and maybe it's even

over a private link, for example.

So, um, you know, we've tried to do that as well, um, when

we've had the opportunity.

Um, and that way we can go to the customer and say, we got hands on

with these couple of solutions.

Um, you know, we're not saying pick one of these two, but what we are

saying is that based on what we've seen, um, you know, Here's some

things that you might think about.

Um, and by the way, here's, you know, the write up of what we did, if you

do wanna look at these solutions.

So

Yeah, it sounds like it, it sounds like, uh, air gap

or vault or whatever, um, is similar, at least my understanding of sort

of the, the modern manifestation.

Of it is that it's, it's like immutable in that some things are

more air gap than others, right?

Some things are, you know, you think, you think of air, air gap and immutable,

they're both binary terms, right?

It's, you know, it's like dead or pregnant, right?

You're either, you're either dead or alive, pregnant or not pregnant.

You can't, it's, it's a binary

term.

You, Yeah.

yeah.

But, but the, but these, these aren't, you would think they would be like,

that it, you know, immutable just means can, can or cannot be changed.

Right.

So you would think that this is a, this is a binary condition, but the,

but the thing is that, You know, because, you know, I make the point that

nothing's a hundred percent immutable.

Right.

You know, give me, gimme a solution that says it's immutable and hand me a torch.

Right.

It, it's not immutable.

It's not immutable anymore.

It can indeed be changed if I get access.

Right.

But think some things are more immutable than others.

Some things are more isolated than others.

I like, I like the term isolated.

I like that a lot.

Uh, some things are, are isolated, farther away, right on, on one end.

You know, you, you use the term s3, but all S3 buckets aren't,

aren't created equal either, right?

So an open, an open S3 bucket with no authentication, not isolated, not

air gapped, not immutable, right?

None of those things.

Um, and on the other end, I, I would put maybe not on the far,

like on the far end, might be.

Actual worm media, like optical or something like that, or, or,

or a worm tape, uh, where you actually have physical, uh, stuff.

Where would you, is there something you,

think is more immutable than

has one of those and Randy has one of those in his office.

Uh, Randy does,

Oh, he

has the already the,

in Boulder, one of the worm tapes.

Yep.

Yep.

Yeah.

So

that's like on one

terms, he

Yeah, absolutely.

Yeah.

been around for a long time.

Yeah, it has, right?

So that, that's like on, on, on the opposite end of the spectrum.

Um, but somewhere in between there, right?

Um, you know, you've got, you've got append only file systems.

You've got immutability built into, uh, Linux, right?

Um, you know, like Veeam uses.

The immutability feature of Linux for their harden, their

hardened Linux repository.

But at the same time, if I get root, I can turn that feature off.

Right?

And so it's, it's, it's more immutable than the other thing,

but, but it's not a hundred percent.

Um, so that's, that's, it sounds like what, what you're doing is

just digging into these vendors to see where they actually fall.

Yep.

Yep.

Exactly.

And um, a lot of what you're alluding to Curtis would be, you know, when we

do have more higher touch, more, you know, consultative type engagements

with it, that's where it might take into some of the nitty gritty and,

okay, let's look in your environment and let's think about where some

of the vulnerabilities might be.

You know, we're not necessarily.

You know, full security auditors, you know, by any means.

But we can certainly, you know, help with, um, you know, maybe thinking about,

about, um, some of those unique, you know, requirements and potential pitfalls.

So as you're talking to a lot of these IT operations

folks and various companies, Where do you see, like, how are people shifting?

Like I know back in the day, right, Curtis will probably, Curtis

has told numerous stories, right when he first started, right?

It was, you had your backup server, you had tape, right?

You were doing backups to it.

Now we've seen everything from that to sort of purpose-built backup

appliances, to integrate data protection appliances to SaaS based services.

How are customers shifting, um, what they think about when it comes to

data protection and how they plan to deploy and use these solutions?

Sure, sure.

So looking at the deployment itself, um, we are certainly, you know,

you mentioned SaaS Prasannaand we're, we are seeing a bit of that.

Typically it is for more point use cases.

So for example, okay, I've migrated over to Microsoft 365.

I'm already subscribing to Microsoft in the cloud.

It probably makes sense that I get my data protection for that.

In the same manner.

Um, so data protection is really interesting because it does have

that very long tail of adoption.

Um, you know, it's very, very hard right to migrate off of legacy systems.

Um, you might have, you know, legacy backup copies that

ultimately might need to recover.

Um, these processes are in place for, in some cases, you know, years, decades.

Um, so we're not necessarily seeing kind of that.

Wholesale lift and shift by any means.

But we are seeing, you know, kind of SaaS delivered data protection

for those point use cases that is starting to enter the equation.

Um, we've already been talking of, of course, a little bit about some

of these, you know, kind of cloud.

Air gap or cloud vault solutions?

Well, even just thinking about kind of a general, um, target for

backup or for disaster recovery, um, you know, we are seeing the

cloud being used for that as well.

Um, you know, and of course I think that makes sense when we think about, um,

Just, you know, kind of the simplicity of being able to subscribe to that

infrastructure versus having to buy and deploy it and manage it all in house.

Um, so, and, and that kind of brings me to, um, The big thing that, you

know, we're seeing face, um, you know, not only just IT teams that are

working on data protection, but you know, it operations teams in general,

which is just that they don't have it.

They just don't have time.

So staffing pressures, you know, our second only to.

PR, cost and budget in terms of the challenges that we're seeing

customers trying to address.

So that's where kind of a SaaS or a cloud type delivery, um, where it's appropriate

and where it can, you know, fit the bill.

Um, you know, that can really help to alleviate some of those pressures.

So I kind of threw a lot at you, but that's a little mixture of

what we've been seeing, at least from a deployment perspective.

That's a, that's a, that's a perfect answer.

I, but you and you, you brought up a, a favorite topic of mine,

so I want to ask you about that.

And that is, um, what percentage of people, when you're talking out, you

know, when you're talking out there and they go and they get 365 or G Suite

or Salesforce or pick some other SaaS offering, what percentage of those people.

Then realize they need to back it up and then get something, anything to

back it up versus, versus the percentage that go, well, it's, uh, it's included.

Right.

You know, it's, it's part of the thing.

Yep.

Yeah.

And that, honestly, that has been a problem for years.

Um, I would say Curtis, it's getting better.

Um, so

You are

that some.

Exactly right.

We're, we're

all doing it together.

We're all

doing it

Oh yeah, exactly.

Exactly.

It's like you, you, you know, if you scream enough people notice.

Right.

Um, so we fielded, um, a primary research study right around the turn of the year.

Um, we published it back in January and, um, what that research found

was that actually a little bit over.

Half of enterprises were, if they had Microsoft 365, we're protecting it now.

Which of course is not where we want it to be, but it's, you

way more than it was

Exact, yes, exactly.

The only time I saw a survey, it was like 5%.

So I'll take

and granted these were, you know, we did speak with

folks that were, you know, very hands-on with data protection.

So maybe that number you could make a case maybe was a little

inflated just based on the audience.

But I, I think it was still very heartening.

Um, I think when we look at.

Some of the other applications like Salesforce.

Um, you know, certainly we're seeing interest in demand there, but you

know, I think in practice we're certainly still getting there.

Um, you know, I mean, you've sort of alluded to, um, that concept that,

oh, well if it's in the cloud, then the protection is the cloud providers.

Problem, and I don't have to worry about it.

Of course, we on this call.

No, that's not true.

Um, and I think in part, due to the education, Curtis, as you were

mentioning, that we've all been doing, but I also think, honestly, some

of the ransomware attacks and those headlines, um, I think they probably

have helped a little bit because I, we've seen that that has grabbed the

attention of the C-Suite to say, oh, I'm seeing that this could potentially be

a major problem for us, so we need to make sure we've got a handle on this.

And of course, um, you know, your state of SaaS applications, um, is

certainly gonna play a role there.

Well, you look at, you look at what

happened with Rackspace, right?

Um, that, I mean, it wasn't 365, but it was, it was hosted exchange.

And, um, you know, basically they, they did get the customers, well,

they did make the customer's data available.

Right.

Be because they, they made, I don't know, they had a tough decision as to.

They, they couldn't get the data back quick enough, and so they made a decision

to just move everybody over to 365.

But all they did was they just moved their accounts over to 365.

Right.

And they started doing email.

Right.

Right.

And the customer's like, okay, good.

We're glad we have email.

What about the old email?

And the, there was no vehicle to get the, there was no path to get the data out

of exchange and sort of, Into, into 365.

And so they eventually, they created like little, little, um, PSTs basically

that customers could download their own data and then import it into 365.

Uh, but, uh, uh, but yeah, it just illustrates.

Uh, and by the way, that took months, right?

Um, and there's a, and there's a lawsuit about it, but there, I, I

don't think there's been enough there.

Um, I, I, as, as sad as this sounds, it will probably take a few more, um, very

public, very damaging, very newsworthy ransomware attacks on SaaS providers,

uh, for people to, to wake up and

To really get it.

Yep.

Yeah, it's, um, yeah, no, I, I completely agree.

And I think one thing that's kind of a little bit unique with this

market too, I think is just the number of SaaS applications that

enterprises are using and that they will be using moving forward.

And so, um, You know, how do you pick your battles, right, in terms of having a

solution that is, you know, specifically tailored to that, to protecting that one

application versus potentially something that's a little bit more general purpose,

maybe more API driven in terms of how it integrates with, um, the SaaS application,

just to make sure that there at least is some basic levels of protection.

So, um, I think that's something, you know, over the next maybe year or two,

I think we'll, we'll probably start hearing a little bit more about as

the awareness, um, increases and, um, just as enterprises are using more

SaaS applications, I think that's gonna be, well, one of the problems,

um, on the list to address for sure.

W I know we talked about SaaS applications, and I'm not

surprised, like enterprises probably have hundreds of SaaS apps, right?

Uh, that they're using internally.

And it's probably, like you said, it's gonna get worse because everyone's

constantly, like if you look at how many new SaaS apps are being built every day,

and it's like, Hey, here's this new app.

Should we start using it or not?

It gets difficult to manage.

Uh, Switching from Sapp.

So I was wondering your thoughts around Kubernetes, right?

I know Kubernetes has been hot for a while.

Um, everyone's been like, Hey, it provides availability and scalability

and just sort of, I know Curtis, when we've talked about Kubernetes and the

past had sort of exploded with like, how are you gonna protect things as they're

constantly spinning up, spinning down and

It's, it's the only thing I care about is that,

how are you gonna back it up?

Right.

And sort of like, what are you starting to see in this area?

Yeah.

Yeah, so it's been interesting and it's something that we've, um, so

we've been tracking it from, I would say three perspectives as a company.

So we have been looking at, um, you know, the adoption of what

we're calling some of these, um, container management platforms, right?

Like a Kubernetes.

Um, we've been looking at how the market for persistent storage, um, for Kubernetes

applications has been developing as well.

So that includes not just backup, it includes the production storage as well.

And then really my role has been to look at, okay, you know, as Curtis

is mentioning, that's all great, but what about the protection?

Um, so, um, we are seeing that, um, There still is a little bit of a disconnect.

I'm sure this will shock you between developers and IT operations.

I know this will shock

Shocked.

Shocked.

I am, I tell you.

Shocked.

don't try, don't fall outta your chair.

Um, so, um, you know, I guess double clicking down into, you know, really

the focus of, you know, Our perspectives and maybe our audience on this show.

So, um, these applications are beginning to enter production.

Um, so they are, you know, doing things like requiring persistent

storage, which as we all know is going to need protection.

Um, Now how that's translating over to IT operations by and large.

So I did not have the pleasure of attending KubeCon, um, in

Amsterdam this spring, but I was out in Detroit this past fall.

Um, and we did have a number of team members, um, at the,

the spring event this year.

And, um, for IT operations, it's still very much a narrative of, okay, I'm

hearing about this Kubernetes thing.

I am aware that I need to pay, be paying attention to it, and I

need to start figuring it out, but it's not really yet crossing my

desk, um, on a day-to-day basis.

So that's what we're seeing by and large, whether or not that is the reality

of the urgency that they should have.

That is maybe a different story, but, um, especially when we think about protection,

um, it's, it's still very nascent.

Um, And I would say what we're seeing is still a lot of the,

you know, do it yourself.

I'm using an open source tool like Valero, um, to kind of script it.

Um, and I'm maybe not quite really using a lot in the form of a third party tool

for protecting these applications, at least from a data protection standpoint.

and I'm guessing just like SaaS applications, right?

Until you get to that point where there's.

Data that gets lost because no one backed it up or I couldn't

restore it, or ransomware hit.

I was just reading something recently about ransomware now starting to target

like Kubernetes applications, right?

So until you get to that stage, right, there's probably no

driving force necessarily.

yeah, yeah, exactly.

Because it's, um, you know, Kubernetes has been driven into

the enterprise by developers and.

In fairness, developers are doing their job, they're developing

applications and they're trying to be as agile and quick, you know, all

those terms that we love as possible.

And they're, they're not trained, um, in data protection and

proper data protection, hygiene.

And, you know, I would argue, nor should they be, um, But you know, as

you're alluding to Prasanna, it's only when it becomes a problem, I think

that there becomes that awareness.

Um, and I think in the Kubernetes piece, you're also fighting against a couple

of other challenges, one of which I kind of alluded to, which is, oh, well

Kubernetes is only for test and dev.

Well, we're number one.

We're seeing that that's.

Actually not even true anymore.

We are seeing production workloads are being run on Kubernetes environments.

Um, but also when you think about if a developer needs to roll anything

back, well then there does need to be a form of protection there.

Um, and I think the other piece too is that there's this, um, Assumption

that because Kubernetes applications are architected to be very resilient,

that that then translates into data protection, which of course, you know,

I think we, we know that that's not true, but I, I think there needs to

be some education on that front also.

Yeah.

Uh, you know, it, it is just, it's just like the la you know, SaaS and Kubernetes.

It's just the latest.

Thing on a long list of stuff that isn't backup, right?

Like, you know, the, the first thing I remember was raid, right?

It was like, well, you know, we, we got it on Raid.

It's on raid.

We don't need to back it up.

Like, ah, you know, you know, I, I had the luxury at, when I first, my first

job, it was at a bank credit card company.

And we had a guy, his name was Joe Fitzpatrick.

He was the guy that always, he wasn't a backup guy, he was a cis admin guy, but

he would always, every time he was a, so he was in a lot more meetings than I was.

I was a backup guy.

I'm just, you know, the guy in the data center with the tapes, right?

He's in like the meetings where they're talking about new things.

And Joe would always raise his hand and say, are we getting this on tape?

That was Joe's question.

Are we getting this on tape?

Right.

As in this, this new application that you're describing sounds amazing.

I.

How will we back it up?

Right?

Because you know, you talk about, you talk about, when I hear like,

oh, it's only test and dev, right?

Dev is what?

Test.

Not so much maybe, but Dev, that's actual work that someone's doing.

Right?

That, you know, when I think about, oh, it's only Dev.

Uh, I think back again, back to that bank, one of the last things that

happened to me when I was there is a group of people came up and, um, they, um,

Okay.

they had lost their entire, it was like a group of

like, it was a bunch of developers.

Like the number 45 is up in my head, but this is.

You know, 35 years ago, it's like 45 developers.

They were consultants, right?

So they were being paid back then, probably a hundred,

150 bucks an hour, right?

And they had worked for three months on a source code tree,

and they had stored it in temp.

Okay, on, on, on hps, which on hps, back then temp was in ram.

So when you rebooted the server, temp was cleared out and um, they, um,

they were, they were coming to me.

They wanted me to restore the source code tree.

I'm like, we don't back up temp.

It's.

It's, it's ram, right?

They're, they're like, yeah, it's temp, it's temp.

And they're like, no, you don't understand this source code is really important.

I'm like, you don't understand, we, we don't back up temp.

Right?

Like,

wand.

who, who puts, who puts their source code in temp?

Uh, You know, it's like, like I, like I knew somebody that stored important

stuff and they would, they used the, uh, the recycle bin as a filing method.

Like they would do their stuff and then they would delete it and they

would put stuff into the recycle bin.

Like, and then they would pull it outta the recycle bin when they wanted

to work with it and then delete it and put it back in the recycle bin.

my God.

When you, when you, when you mentioned that like developers

or, or a lot of, just, a lot of people, not just developers, but a lot of.

IT people, they just don't have the, you know, the backup and recovery and

the cyber recovery chops to know the things they should be doing or not doing.

Right.

Yeah.

Yeah, it, yeah, exactly.

So how do we, how do we build that awareness, you know, and a little bit

more, but you know, you don't necessarily wanna bog, especially these devs down

with, you know, all the nitty gritty.

So then how do you start, you know, The term is kind of baking it in, but

how do you integrate tools across that pipeline, um, to make it at least as

streamlined and as easy as possible?

And that way you don't get to that point where, oh, well we just lost three

months of source code development work because we had to reboot our server.

yeah, I mean the, the key, I think the, the,

the, the first hurdle that we all have to get over for, for SaaS, for

Kubernetes, for, um, multi node.

Uh, high availability databases like Cassandra and Mongo, right?

Is we just, can we all just agree this needs to be backed up, right?

That, that's the, that's the first hurdle, right?

Because there's just way too many people that are like, well,

Microsoft's backing it up, right?

No.

Um, well, it's, it's, it's, it's a multi-node database.

It can survive, you know, all these things, right?

What happens when you drop a table?

Uh,

Can I add, can I add something to your list?

Add,

object store.

Oh, object story.

Yeah, absolutely.

Right.

Um, you know, the, the question is how do we, you know, can we, can we, can

we just, that's the, that's the hurdle.

You know, you, you talked, Krista, you talked about, um, you

know, we just need to educate.

That's the initial hurdle, right?

And then, So then it is like, well, how do you get any kind of backup, right?

So like Salesforce, you, you can manually get a crappy backup, right?

You can do it once a week.

You can download it, just get something so that when.

You know, and, and I've told the story, I'm not gonna tell it again,

but I, once, when I was administering a Salesforce environment with a million

and a half records, basically jumbled the thing and put all the wrong phone

numbers to all the wrong people, like in, in, in like, like that, I

managed to corrupt the entire company.

Right?

But in case something like that happens, What do you have?

Right.

Even, even and, and then, and then it's the walk before we can run.

Yes.

I, I do.

I hope I, I know, I know that over the next few years, the number of ways that

we can protect SAS apps will get better.

I was very encouraged by, I was at HYCU, uh, headquarters, uh, last week.

I was very encouraged by their approach of the.

The API so that the SaaS companies can program to them.

I was very encouraged by that.

I know they, uh, and at least one other company,

um, GRA is taking that approach.

I was very encouraged by that.

And, and, and there's a lot going on in the Kubernetes backup space.

Uh, S3 is problematic Prasanna, you know,

there's, well, granted, there's versioning, right?

There's cross region replication, right?

Uh, they've built a

No, what I, no, what I'm saying,

yeah.

sorry to interrupt you, but what I meant was, what I meant

was it's difficult to back up, right?

There's not the, the features aren't there necessarily.

You know, I, I, because I speak working at a company that was

trying to figure that out.

It was not easy.

Right.

Um, sort of like Microsoft 365, it's, they didn't want a backup.

They didn't want people backing it up.

Yeah.

They, it wasn't until just recently that they

actually came out with an API for it.

But anyway, my hope, my hope is for the future that stuff will

get better, but just like day one.

My, my, my thing is, and I think it sounds like you're on the same page,

Krista, is like, just make sure we can all agree that there is nothing magic.

The cloud is not magic.

Kubernetes is not magic.

My Tesla is not magic, even though it feels like it sometimes, right?

Um, you know what?

That, you know what?

I need Prasanna.

Prasanna Malaiyandi:

back up for your Tesla.

I need a backup.

Tesla.

Anyway, one, one step at a time.

One step at a time.

Right now my backup Tesla is a Prius.

Uh, that's sitting right next to it and very sad.

It's, it's thinking like I'm gonna get rid of her.

And it's probably true.

Um, but yeah, if we can just, if we can all just say, let's look at, let's

prayer, let's acknowledge the problem.

Right.

We need like a 12 step thing, right?

Acknowledge that we are powerless over data loss, right?

Uh, and then we just, and then we just, we prioritize, uh, what we, so

we're, we're, we're a company, right?

And we prioritize, all right?

We're using Kubernetes, we're using 365.

We're using Salesforce.

What would really shoot us in the foot if we lost it, right?

And we're like, oh my God, that's Salesforce for, for whoever.

No, it's just a fictional company.

Right?

So for us it's, so, it's gotta be all right.

So get something quick, get a backup of that.

Right?

Get us, save ours.

Backup.

It's not a good one.

It's a crappy manual and we gotta do once a week, just get that done.

And, and then, and then go out and start looking for like better solutions.

I'm sorry, I I, I got up on a soapbox there for a minute, Krista, but what do

you think, what do you think about that?

So.

I think it's great advice.

I think we need to crawl before we can walk, before we can run.

Um, and I think that having something basic in place is better than nothing.

Um, of course.

And then from there we can start to look at, like you were

mentioning, Curtis, what is critical?

Um, and if it is our Salesforce implementation, maybe we do

need, um, one of these more sophisticated third party tools.

You know, kind of what you're alluding to Curtis in terms of, okay.

All of these, um, different records and hierarchies, we need to be able

to, um, you know, bring those back as quickly as possible if something happens.

And so that's where some of these third party tools might come in.

But I do appreciate the soapbox.

I think it was good advice.

Yeah.

I, I think like, if, if, if we like just you, you got, we gotta triage, right?

And like in, in the case of Salesforce, I, yeah, I keep throwing it out.

In the case of Salesforce, they have a product, like Salesforce has a native,

they now have a native backup product.

My understanding is it's, it's expensive af but it's there, right?

And you could sign up for that.

I don't know, in classic Salesforce, you know.

World, you probably have to sign up for a year.

You know, Salesforce is right.

They, they charge you by the month, but they bill you by the year.

Right?

Um, so that, that might, that might be a way to do it, right?

Get something for those critical apps.

Uh, you know, maybe your critical app is Cassandra, right?

Um, you know, maybe it's Kubernetes, maybe god forbid Prasanna, maybe it's s3.

Who knows, it might be right, but I think this is

where, and Curtis just calling out your, uh, plug for your book, right?

Modern Data Protection.

Right?

But this is where, right, the, I think what it's chapter two, where

it's like, talk to the business and the stakeholders, right?

Get down the requirements.

Really understand what is important, because what you might think is important

is different than what someone else thinks is important or what someone else

thinks is important different than what someone else thinks is important, right?

So, Make sure you're all on the same page, and you can sort of prioritize that

list and be like, yep, Salesforce is our top critical app for our entire company.

Let's go figure that out.

Number one mistake.

Well, number one mistake made by backup people is not backing stuff up.

Number two is making up their mind on what's important.

Right?

You, you, you know, if you're a typical, as I make quotes in the air, a typical

backup admin, you're often junior, which I hate that, but that's just the way it is.

You're up to junior in the organization.

You're not privy to all these discussions on what.

Is important to your company?

Get get yourself in those discussions.

Um, I bet, I bet you see that a lot, Krista, where like, you know, people

that they don't, they don't know what they know or they don't, they

don't know what they don't know.

I think that was, I

think that's what I was trying to say there.

a hundred percent.

A hundred percent.

And that comes down to what you're mentioning, Curtis, those higher level,

more strategic conversations about what is important to our business.

But in the world of cloud and Dev DevOps, bringing these Kubernetes environments,

you know, into the equation as well.

It also literally comes down to what is our organization using?

What data are we even creating?

Um, you know, we're, we see in some cases significant blind spots

because, um, you know, it just was not kept in the loop and.

You know, somebody on the l o B side just went and swiped their credit card

and now they're using, you know, this different SaaS application, for example.

Um, and I know we already kind of talked a little bit about that, um,

you know, that little bit of breakdown between, you know, dev and IT ops.

So it's, I think it's, um, twofold from that perspective.

Yeah, shadow it and man, it seems like we could talk all day.

I, I just wanna, I just wanna finish this, this idea.

Yeah.

The shadow IT thing again.

Uh, um, I'll just plug HYCU again.

They, they've got this cool app, it won't fix the shadow IT problem,

but one thing they were able to do, if you do use like Okta, Right.

Um, and, and the SaaS apps that work with Okta, they can basically use Okta

as a way to inventory your environment.

I thought that was kind of, of the, of the SaaS apps that you plug into

because the first thing, you know, the first thing, uh, going back to that

list earlier, the first thing before we figure out what's important, we

gotta find out what we have, right?

Um, all those apps.

So shadow it, shadow it.

That's a problem, right?

I mean, the only way you can really a you, you can address that

with policy, like, don't do that.

Like, and you can address it with like, if you turn around, if you turn around

and you've tried to expense those apps and you're told, I'm sorry, what is this?

What, what, what is this product that you're using, right?

Um, this looks fascinating.

Uh, what is it and what does it do and, and why is it not plugged into Okta?

Right.

Or whatever it is that the company's using.

Anyway,

Yep.

uh, we could talk all day.

Krista, uh, I think we've covered enough.

Um, is there anything that we, that we didn't cover that you,

that you wanted to talk about?

I don't think so.

I mean, those are two of really the big, you know, the two big trends.

I guess three, you know, if you factor in, um, you know, cybersecurity as well.

You know, those are really kind of the big things that we're seeing.

Um, you know, of course we're getting into all these conversations about, you know,

I, you mentioned, you know, different third party tools need to be integrated

with the data protection solution.

Um, You know, you mentioned kind of Okta from, you know, kind of

authentication and things of that nature.

Um, you know, we're also seeing a lot of these, you know,

ransomware scanning tools.

Um, okay.

Where exactly does this fit within that stack?

But that probably could be a topic for a whole nother conversation, unless we

wanna hang out for another hour here.

Yeah.

Yeah, I, I honestly, I can't believe we

didn't talk about ransomware.

I mean, it came up, came up a little bit here and there.

Uh, but,

we'll have you back on to talk

yeah, we'll definitely

have you back

wonderful.

that, that's a, that's an incredibly important

conversation that we continue to have and I, I, I, I don't think we

can get enough perspectives on that.

Um, and clearly you care about this topic.

Clearly you understand this topic.

So, um, uh, I want to thank you so much, uh, Krista coming on.

Curtis and Prasanna, thank you both so much.

This was very fun as always, to chat with both of you.

And yeah, it was, it was a pleasure.

Thank you.

And Prasanna, I want to thank you.

And by the way, also, if you want to get me a backup, Tesla, it's okay.

one of those little tiny toy car ones

Yeah.

that counts.

Thank you, Krista.

That was so nice to meet you and I hope you come back on the podcast so

we can chitchat about cybersecurity.

Anytime I'd love to.

And, uh, we of course want to thank our listeners.

We'd be nothing without you.

Remember to subscribe so that you can restore it all.