You keep using that word air gap?
I don't think that word means what you think it means.
Uh, this is what we ended up talking about with analysts, Krista McComber
this week, both that term and another one that a lot of vendors are using that.
I don't think it means what they think.
It means.
Hope you enjoy the episode.
W. Curtis Preston: Hi, and welcome to Backup Central's Restore All podcast.
I'm your host, w Curtis Preston, a k a, Mr.
Backup, and have with me a guy who is possibly more excited about my recent
purchase than I am Prasanna Malaiayandi.
How's it going?
Prasanna.
Prasanna Malaiyandi: I am good, Kurt.
I'm actually a little disappointed that like your sort of happiness,
excitement ended so quickly.
W. Curtis Preston: It's in end.
Prasanna Malaiyandi: Uh, did well in the sense that you sounded not as excited.
I think your words just last night were, I'm starting to get buyer's remorse.
W. Curtis Preston: Oh.
Oh.
I did have a moment of buyer's remorse.
Yeah.
Well, you know, so, so for those that didn't listen to y uh, last week's
episode, uh, I bought a Tesla, um, after many months of, of, you know, Will
I, will I not, I decided that it was time to replace the, the old Faithful,
this trustee Steed that had, uh, you know, 10 years and 220,000 miles on it.
Uh, the Toyota Prius with an ev.
Or should I say the e v?
And um, it's funny, I, I had, I had lunch yesterday with a, another guy in
the industry down in La Jolla, and he, he was like, oh, you, you got a Tesla?
And I'm like, yeah.
And uh, he, he said, you know, I have a Kia ev.
Um, and my son was like, dad, Why didn't you buy a Tesla?
So he has a, he has a little bit of Tesla envy.
It is a really nice car.
It's really crazy the amount of extra things that the base model is able to do.
Um, you know, if I spend another.
Like six grand to get the enhanced autopilot.
The, the, the other things that that car can do are even more amazing, but just
the things that it can do and the, you know, the way it does things for you.
Um, and, um, You know, the charging is super, super easy and it is less
expensive than gassing it up even at the crazy rates that we pay for electricity
here in uh, Southern California.
I really wish I lived where you live, Prasanna, cuz you have, you
pay nothing compared to me cuz yeah.
Prasanna Malaiyandi: of Santa Clara does have a benefit of having its
own power company, and so because of that, our rates are ridiculously low.
Like I, I want to say it's probably like a quarter of what you pay Curtis.
W. Curtis Preston: Yeah, cuz I'm paying like at like at night, like at like the
lowest rate that I pay when I would charge an EV is like 35 cents a kilowatt hour.
That's the lowest rate
Prasanna Malaiyandi: So it's like a third of the ba.
Yeah,
W. Curtis Preston: You suck.
Prasanna Malaiyandi: yeah.
I'm sorry.
I'll just rub it in.
Pour salt on the wound.
You know how it goes,
W. Curtis Preston: That's
Prasanna Malaiyandi: but at least you should continue
enjoying your car, you know, and
W. Curtis Preston: Oh, I'm enjoying it every time, every time I'm in it.
Um, and, uh, my wife is still terrified of it.
We'll, you know, we'll see.
Get her over over it.
Um, and, uh, uh, she, yeah, she just, you know, it is, it is
definitely a different enough car.
We had an EV before we had a, a leaf, um, and this, this, this car is so
Prasanna Malaiyandi: a, it's, yeah, it's, it's a very, very different
experience versus what you had
W. Curtis Preston: It's, it's a very, very different experience.
Um, and, you know, even, even just something so simple as
while I'm charging, right.
Cuz I, cuz right now I am predominantly charging at Super stations because
believe it or not, it's actually cheaper for me to charge down the
street at a super station than it is to charge at my house at midnight.
Right.
So, so I'm, I'm just doing that.
Right.
So I'll charge, I'll charge at the Super station for now.
So, But I can pull up, I can pull up, uh, what did I say?
Super Station.
Prasanna Malaiyandi: Yeah.
W. Curtis Preston: The tbs.
The TBS Super Station.
Yeah.
So, uh, so I go to the supercharger and I can charge there.
And, you know, if I want a full charge and I've driven the car for a,
what, you know, I'm looking at 30, 40 minutes, um, which is still crazy that
I can do that in that amount of time.
And, but, but here's the thing.
I can sit there and watch Netflix or YouTube, I.
I might as well be at home.
I'm in this comfy seat right.
And I'm interacting with the, the video and yeah.
So it's kind of cool.
Um, so yeah.
But I, I did have a moment of buyer's remorse because, you
Prasanna Malaiyandi: know I,
W. Curtis Preston: money
Prasanna Malaiyandi: yeah, I know we talked about this yesterday.
I'm glad you sort of walked off the ledge there and came back to normal
civilization, you know, and, uh,
W. Curtis Preston: Yeah, yeah, yeah.
Uh, so I'm enjoying it.
But, um, well, our, our guest is, is probably at this point
wondering, you know, what in the world did she sign up for?
Couple of, couple of ev nerds.
She's, uh, she's an analyst and advisor and all things data
protection and cybersecurity.
Having been in the industry for 13 years, I ran into her insights
quite a bit on LinkedIn, and so I, I wanted to have her on the pod.
She's now a senior analyst at Futurum Group.
Welcome to the Pod Krista Macomber.
How's it going?
Krista Maccomber: Curtis and Prasanna, thank you so much for having me.
I'm, uh, not lucky enough to, uh, own a Tesla, but definitely maybe someday.
W. Curtis Preston: Yeah, person, Prasanna.
Prasannawas my sort of, I was, I was living vicariously through Prasanna's.
Ev uh, ownership or Tesla ownership.
Prasanna Malaiyandi: I don't know if it counts as being vicariously
living through my experience since I didn't really, I don't really
use the car as much as you, for
W. Curtis Preston: Isn't it ridiculous, Kristy?
He's, he's, how, okay, how long have you had your car
Prasanna Malaiyandi: Four years, three months,
W. Curtis Preston: and how many miles do you have on your car?
Prasanna Malaiyandi: uh, 12,700 miles.
W. Curtis Preston: I, your Honor, I arrest my
Krista Maccomber: Even I, wow.
Even I do more than that.
Prasanna Malaiyandi: Yeah.
W. Curtis Preston: That's just, that's just, it's just wrong.
But
Prasanna Malaiyandi: Of which 750 was done over the long weekend when I
W. Curtis Preston: yeah.
Yeah.
That's crazy.
He had a long weekend and drove, you drove to, where'd you say you, uh, yeah.
Yosemite.
Krista Maccomber: Beautiful.
W. Curtis Preston: Yeah.
Um, beautiful spot.
You don't have anything beautiful like that out where you live.
Do you, Krista,
Krista Maccomber: Well, I am about a mile, uh, mile away from the ocean,
so that doesn't, that doesn't suck.
But it's not quite Yosemite, so.
W. Curtis Preston: but, and you're just surrounded by green all the time, right?
I mean, it's just, um, yeah, that's what you have,
Krista Maccomber: bit of everything.
Beach trees, mountains.
Good mix.
W. Curtis Preston: Good mix.
Well, I, I, you know, I'm curious to know, um, I mean, I know how I got into
this business when I talked to somebody.
Um, you know, I, I am curious, like, how did you find yourself
in this side of the business?
Like
Krista Maccomber: Sure.
Yeah, it is.
Um, it's an interesting story actually, Curtis.
Um, so when I was in school, I actually studied, um, journalism and, um, I had
a, a minor in business and so I wrote for the student paper actually here
at the University of New Hampshire.
And, um, there was a gentleman that.
Used to work at the first analyst company I ended up working for.
And um, I interviewed him for a story for the school paper.
Um, he actually won their business competition a few years prior.
Um, and he said, you know what?
We need some kind of research and, uh, proofreading and editing interns.
It's kind of a, you know, a good mix, good experience.
So why don't you kind of come on board and check it out.
So I interned for, um, about a year and a half or so, and then
I ended up coming on board.
Full-time, um, as I graduated and the rest has been history.
Prasanna Malaiyandi: Yeah.
W. Curtis Preston: Nice.
Nice.
Um, what.
What, what's it been like?
I mean, you, you know, that like the, the backup side of things.
I think you, you, you've certainly expanded or I don't know how long,
if you've covered the cyber side of things, but you've certainly
now uncovered the cyber side.
What, I mean, what's it like covering this industry from the outside?
Cuz I mean, I, I, I've, I've been on the outside, I've been on the, I've been on
the, I've been sort of, I've been on three sides now I think of, of the industry.
So what's it like, what's it like being, uh, you know, doing that?
Krista Maccomber: Yeah, so, you know, one thing that's pretty unique, I
think, in terms of where we sit in the market, um, so our team, so you
mentioned we're, we're with Futurum group, we're actually acquired at the
start of this year by Futurum group.
Previously we were evaluator group.
Um, and we work very closely actually with IT operations.
So when you talk about covering a topic like cyber, what I think is really
interesting because you get that sort of firsthand perspective in terms of,
okay, you know, I'm all of a sudden seeing everything being branded.
As security in cyber, um, you know, how do I know what's what, how do I really
know what my full stack should look like?
Um, and I think it's a very important topic because there is
no silver bullet, you know, cyber resiliency solution, unfortunately.
You know, it's all about how does you know, data protection
play, um, you know, with incident response as just one example.
Um, so that's been, I think, you know, Valuable just in terms of, you know,
we really have to be able to understand how the piece parts fit together, but
make sure that we're being very clear as well on our side about where does
our expertise, you know, sort of lie.
Prasanna Malaiyandi: And so a lot of what you provide, like you mentioned,
it's talking to like the IT folks, right?
And figuring out like what does the process look like from there?
Like where do you go from there, right?
So it's like, okay, here's my problem.
Here's kind of what I'm looking to do.
Like, how do you help them solve those challenges, I guess?
Krista Maccomber: Sure.
So it depends a little bit.
Um, I'll give you the analyst answer, but.
Yeah.
So I would say typically they might want us to help them to narrow down to a
small handful of solutions to consider, um, based on the particular criteria of
their environment and their requirements, which of course are always unique.
So they're never is sort of one size fits all just, you know,
for any customer of course.
Um, so that really does, um, That's where we do spend quite a bit of our time.
Um, and sometimes it might even be helping them to, um, you know, look at
their current implementation a little bit skeptically and say, okay, where
might some of the gaps, you know, exist?
Um, what are some of the things that maybe we aren't necessarily thinking about?
Um, That we might wanna consider moving forward.
And that's where actually we have what we call our IT insights community.
Um, and what we find is that does tend to be really valuable for IT
operations because that's a community where, um, not only can they get,
you know, kind of our feedback as.
Analysts, but they can also have some peer to peer conversations and
feedback and, um, you know, understand what are some of their peers maybe
doing to address particular, you know, challenges or requirements and, and
again, have those types of conversations.
W. Curtis Preston: You know, uh, a few years ago, uh, I give, um, I give Randy
some credit, um, from back in the day.
It was a few years ago when I was working, I.
Uh, by the way, before I continue, I'll remember this
time to do our usual disclaimer.
Uh, this is an independent podcast and, uh, you know, it doesn't reflect
necessarily, uh, anybody's employer and the opinions that you hear are ours.
And, uh, also, uh, be sure to rate us, go to your poca, your pod catcher and
give us lots of stars and comments.
We'd love to see comments, and we'd really love to talk to you.
If you, uh, you know, you wanna be part of the conversation, you wanna
send me a private message, you just say, Hey, make sure you cover abc.
Uh, you haven't talked at all about such and such.
Uh, the episode this week, uh, that, that, that I published this week is a
perfect example of that where somebody wanted to know like, how do I, you
know, like I lost everything, right?
Not just I lost all my servers, but I've lost, I.
Like the handhelds that I use to authenticate with my password management
system and my, my, uh, MFA system.
How, how do I start from a hundred percent scratch, which isn't something
that I haven't been asked before that.
So that's the show that went last week, and that was from a user.
Uh, or, or a listener of the podcast and, um, uh, we had her on.
So yeah, so contact us, um, you know, even if it's just privately.
And, uh, I am WC Preston on Twitter, w Curtis Preston gmail,
and, uh, linkedin.com/i n slash mr.
Backup.
Um, yeah, so a few years ago, one, one thing I think that.
When you get to talk to independent, independent analysts, they can
sometimes call you on your bs.
Right?
Um, and I was working for a vendor, right?
Um, the, the last time I talked to Randy, which was a few years ago, right?
And, um, he, uh, called me.
So the vendor that I worked at liked to use the word immutable a lot,
Krista Maccomber: I knew where this was going.
W. Curtis Preston: Yeah.
Yeah.
And, um, and he's like, right, but do you have the, you know, he described
a very specific thing of like, you know, do, do you have a feature that
you can turn on so that even the users can't delete their own backups?
And I'm like, well, no.
And he's like, well, then you're not really immutable.
Right.
And I'm like, very good point.
And then I
went, I went and, and, and, um, I mean, you know, I still think
of immutability as, as a, as a.
Like a spectrum, right?
Nothing's a hundred percent immutable.
Um, and nothing's 0% immutable.
Is that right?
I don't know.
Anyway.
Um, so I think you could be more and more immutable over, over time.
Uh, but that, that specific request, uh, that feature made it into
my previous employer's product, uh, significantly because of the
input that I got from, uh, Randy.
Prasanna Malaiyandi: Well, and I think sometimes we just sort of have
our own blinders on in terms of what we think people need in customers
these, and being able to talk to independent analysts and be like,
Hey, what are you actually seeing?
And hearing as you're going out and talking to all these people, right?
Because you see and touch so many different people who may not even
be existing customers, right?
It's like, yeah, that's critical.
Krista Maccomber: Yep.
Yeah, it's, um, it really helps to keep us grounded.
Um, so I remember that conversation, Curtis distinctly, so I figured you
were, I figured you were going there.
Um, you
W. Curtis Preston: coffee shop in Vegas.
Krista Maccomber: Yes.
Yes.
It was.
W. Curtis Preston: right where that meeting was.
Krista Maccomber: We try to make sure people have thick
skin in those conversations.
Right.
But, um, yeah, it, it keeps us grounded.
I mean, one example that comes very clearly to my mind that
I've been, um, partaking in recently is around air gapping.
Um, because of course we're seeing all these different cloud solutions
and oh, they're air gapped and this it insights community that I referenced,
they're saying, well, wait a minute.
It's not really right, because there does need to be some connection somewhere
to get that data into the vault.
So why are they calling this an air gap and is it just, you know, um, an
AWS bucket that's sitting out there somewhere that I'm just putting data into?
How do I know right, that there is some sort of.
Um, you know, isolation there, right?
So we've kind of taken that feedback and not only does that influence
sort of, um, you know, our research and, and where we're covering.
So I wrote, um, you know, a piece about, okay, what we call this, you
know, operational air gap versus your more traditional physical air gap
where you're actually shipping, you know, tape media offsite, for example.
Um, but also kind of to what you're alluding to.
W. Curtis Preston: An actual air gap.
Krista Maccomber: Exactly.
Exactly.
W. Curtis Preston: It, it's funny, this came up, this came up, uh, yesterday
on, we, we were recording with another, with somebody else, and they, they,
they said exactly the same thing.
So you're saying, you, you, you do, you're doing, you're using the term operational
air gap versus physical air gap.
Krista Maccomber: I Either that or data vaults, you know, I'm kind of.
Playing with both of them.
Um, operational does seem to make more sense to it operations, um,
you know, versus like a, a virtual air gap or, or anything like that.
But, um, I, I'm even hesitating to use air gap in context.
If anything, that's not a, a pure physical air gap, just.
Due to the feedback that we've been receiving, you know,
from those conversations.
So, but yeah, operational seems to, seems to be sitting a little bit better.
I, I would describe it.
Prasanna Malaiyandi: I like the notion of avoiding the term air gap
because like you said, it means so many different things and it sort of.
Also leads people down the path of saying, oh yeah, it's an air gap.
But it's like that first word becomes so key that they forget
about it and what it really means.
And I like using the word operational.
I was also thinking as you were talking, right?
Instead of like operational air gap, it's like operational isolation
or things like that because that's really what you wanna do, right?
It's like, hey, this is really a separate environment that is operationally isolated
from everything else you normally run.
And that's how you get the protection.
Krista Maccomber: I completely agree Prasanna, and that's why a
vault is actually not a bad term in my opinion, because it does have
that connotation of being isolated.
But yeah,
W. Curtis Preston: Yeah.
You know, it's, it's funny, um, Krista, um, it's like the
argument that I have over.
Snapshots and, um, because like, and again, this came up yesterday, so I, I
don't like that vendors like AWS use the term snapshot to refer to image copies.
I.
Right, because like a, like a, an AWS snapshot is actually a backup.
Like it actually goes into s3, it goes to a different place.
It's not a snapshot in the traditional it sense.
But then the thing is, if you think about the word image, it's
just another word for snapshot.
It's just they're all, they're all pictures, right?
So it's like, you know, you're saying vault.
It's like, I, I agree.
I, I like that.
Basically you've chosen to use a different term and there's nothing wrong with it.
But vault is where I would make my air gap.
That's what I'm, that's historically I would put my tapes in a vault.
This is no more a vault than it was an air gap.
Um, I, but I, I understand what you're, you're trying to get
away from that term air gap.
I, I guess the question is like, if we're gonna keep, like the way, like the way.
The way Randy kept me honest a few years ago, if we're gonna keep vendors honest,
like there's, and I'm not gonna name the vendor, but there's one particular
vendor that has, has, uh, you know, an appliance that sits on-prem and it's an
on-prem appliance in the data center, and they call that appliance air gap.
And, um, and it just kills me.
I'm like, it's not even whatever.
Like, so how do, how do you, how do you like, That's, that's what
I'm saying is I'm, that's, hi.
Historically, when I, when I wasn't part of the vendor community, I
was trying very hard to get them to use term to not misuse terms.
And air gap is currently air gap and immutable, I'd say are the,
the two words that are very much
misused.
Krista Maccomber: Absolutely.
W. Curtis Preston: Yeah, I don't, I don't know.
I dunno where to go from there, but it's just, it's just, uh, so, so, well, I
guess my question is, so do, would you, are you trying to get vendors to use
that term or, you know, does that matter?
What's your goal with that term?
The vault term?
Krista Maccomber: I would say honestly, my bigger, um, Goal is
to try to get the vendors to be as clear as possible about what they're,
what they're actually providing.
Right.
Because it's okay, you can use any term you want, but you know, to your point,
Curtis, there's, there's only so many words and terms that we can use, right?
Because then if you do throw out something completely new, then the market.
You know, in, in, in it, they have no idea, you know, what you're talking about.
So there needs to be some education anyway.
Um, so I think I would say my, my goal wouldn't necessarily be to get the, you
know, the vendors in the industry to standardize on that term, but more, okay.
Let's consider, you know, is there something else we can
describe this as, but also bigger picture, you know, You, Mr.
Bender, please be aware that, you know, your customers are
looking at this messaging and they're wanting to understand
what's actually going into this.
To truly make it isolated and to make it more than just your, your general
purpose S3 bucket that's just sitting out there that anybody can penetrate.
They want that information and they wanna know, um, because this
is just too important for them.
Um, so I would say at the end of the day, that's really,
um, you know, my bigger goal.
Prasanna Malaiyandi: It's a very noble goal.
I wish you luck.
No, because that's, because that's
always a hard thing like Curtis talked about, right?
It's like vendors like to make up terms, right?
And like to reuse terms because they think that's what customers want.
I, I've worked in with vendors my entire career, right?
And so I've always seen that path, right?
It's like, Hey, we could call it this, but it's not quite that, right?
We'll use the word snapshot when we really mean backup, but it's like people know
snapshots and it's like, Yeah, that's just confusing users in the end, right?
And so at least making sure users understand what they need to look for.
And it doesn't matter what terms a vendor uses, it's like, this is what I need.
I need a mechanism to make sure that my backups are protected.
And it's operationally separate.
And if you decide to call it a vault, or if you decide to call it a virtual layer
gap or whatever else you decide to call it, that's fine, but this is what I need.
Krista Maccomber: Exactly.
Exactly.
And um, we've actually gotten hands on, um, with some of these solutions
in particular, there's a couple of them that we were contracted to actually
do an audit and say, okay, you have, you know, solution X and solution Y
that are, you know, you're calling.
Air gapped or whatever that term is.
Um, you know, let's break it down.
Um, let's spend some hours kind of really going through the solution.
Um, you know, as the analyst firm, we tried to put on our, our hacker hat,
I guess, if you will, and try to think about, okay, what are any ways that there
might be to get around, you know, using Curtis's example of the immutability,
you know, the controls for that.
And maybe when an IMMU bill copy expires, um, You know, do you have
your controls to be able to sever the network connection, um, so that it is
only open, you know, when your data's being transferred and maybe it's even
over a private link, for example.
So, um, you know, we've tried to do that as well, um, when
we've had the opportunity.
Um, and that way we can go to the customer and say, we got hands on
with these couple of solutions.
Um, you know, we're not saying pick one of these two, but what we are
saying is that based on what we've seen, um, you know, Here's some
things that you might think about.
Um, and by the way, here's, you know, the write up of what we did, if you
do wanna look at these solutions.
So
W. Curtis Preston: Yeah, it sounds like it, it sounds like, uh, air gap
or vault or whatever, um, is similar, at least my understanding of sort
of the, the modern manifestation.
Of it is that it's, it's like immutable in that some things are
more air gap than others, right?
Some things are, you know, you think, you think of air, air gap and immutable,
they're both binary terms, right?
It's, you know, it's like dead or pregnant, right?
You're either, you're either dead or alive, pregnant or not pregnant.
You can't, it's, it's a binary
term.
You, Yeah.
yeah.
But, but the, but these, these aren't, you would think they would be like,
that it, you know, immutable just means can, can or cannot be changed.
Right.
So you would think that this is a, this is a binary condition, but the,
but the thing is that, You know, because, you know, I make the point that
nothing's a hundred percent immutable.
Right.
You know, give me, gimme a solution that says it's immutable and hand me a torch.
Right.
It, it's not immutable.
It's not immutable anymore.
It can indeed be changed if I get access.
Right.
But think some things are more immutable than others.
Some things are more isolated than others.
I like, I like the term isolated.
I like that a lot.
Uh, some things are, are isolated, farther away, right on, on one end.
You know, you, you use the term s3, but all S3 buckets aren't,
aren't created equal either, right?
So an open, an open S3 bucket with no authentication, not isolated, not
air gapped, not immutable, right?
None of those things.
Um, and on the other end, I, I would put maybe not on the far,
like on the far end, might be.
Actual worm media, like optical or something like that, or, or,
or a worm tape, uh, where you actually have physical, uh, stuff.
Where would you, is there something you,
think is more immutable than
Krista Maccomber: has one of those and Randy has one of those in his office.
Uh, Randy does,
W. Curtis Preston: Oh, he
has the already the,
Krista Maccomber: in Boulder, one of the worm tapes.
Yep.
W. Curtis Preston: Yeah.
So
that's like on one
Krista Maccomber: terms, he
W. Curtis Preston: Yeah, absolutely.
Yeah.
Krista Maccomber: been around for a long time.
W. Curtis Preston: Yeah, it has, right?
So that, that's like on, on, on the opposite end of the spectrum.
Um, but somewhere in between there, right?
Um, you know, you've got, you've got append only file systems.
You've got immutability built into, uh, Linux, right?
Um, you know, like Veeam uses.
The immutability feature of Linux for their harden, their
hardened Linux repository.
But at the same time, if I get root, I can turn that feature off.
Right?
And so it's, it's, it's more immutable than the other thing,
but, but it's not a hundred percent.
Um, so that's, that's, it sounds like what, what you're doing is
just digging into these vendors to see where they actually fall.
Krista Maccomber: Yep.
Yep.
Exactly.
And um, a lot of what you're alluding to Curtis would be, you know, when we
do have more higher touch, more, you know, consultative type engagements
with it, that's where it might take into some of the nitty gritty and,
okay, let's look in your environment and let's think about where some
of the vulnerabilities might be.
You know, we're not necessarily.
You know, full security auditors, you know, by any means.
But we can certainly, you know, help with, um, you know, maybe thinking about,
about, um, some of those unique, you know, requirements and potential pitfalls.
Prasanna Malaiyandi: So as you're talking to a lot of these IT operations
folks and various companies, Where do you see, like, how are people shifting?
Like I know back in the day, right, Curtis will probably, Curtis
has told numerous stories, right when he first started, right?
It was, you had your backup server, you had tape, right?
You were doing backups to it.
Now we've seen everything from that to sort of purpose-built backup
appliances, to integrate data protection appliances to SaaS based services.
How are customers shifting, um, what they think about when it comes to
data protection and how they plan to deploy and use these solutions?
Krista Maccomber: Sure, sure.
So looking at the deployment itself, um, we are certainly, you know,
you mentioned SaaS Prasannaand we're, we are seeing a bit of that.
Typically it is for more point use cases.
So for example, okay, I've migrated over to Microsoft 365.
I'm already subscribing to Microsoft in the cloud.
It probably makes sense that I get my data protection for that.
In the same manner.
Um, so data protection is really interesting because it does have
that very long tail of adoption.
Um, you know, it's very, very hard right to migrate off of legacy systems.
Um, you might have, you know, legacy backup copies that
ultimately might need to recover.
Um, these processes are in place for, in some cases, you know, years, decades.
Um, so we're not necessarily seeing kind of that.
Wholesale lift and shift by any means.
But we are seeing, you know, kind of SaaS delivered data protection
for those point use cases that is starting to enter the equation.
Um, we've already been talking of, of course, a little bit about some
of these, you know, kind of cloud.
Air gap or cloud vault solutions?
Well, even just thinking about kind of a general, um, target for
backup or for disaster recovery, um, you know, we are seeing the
cloud being used for that as well.
Um, you know, and of course I think that makes sense when we think about, um,
Just, you know, kind of the simplicity of being able to subscribe to that
infrastructure versus having to buy and deploy it and manage it all in house.
Um, so, and, and that kind of brings me to, um, The big thing that, you
know, we're seeing face, um, you know, not only just IT teams that are
working on data protection, but you know, it operations teams in general,
which is just that they don't have it.
They just don't have time.
So staffing pressures, you know, our second only to.
PR, cost and budget in terms of the challenges that we're seeing
customers trying to address.
So that's where kind of a SaaS or a cloud type delivery, um, where it's appropriate
and where it can, you know, fit the bill.
Um, you know, that can really help to alleviate some of those pressures.
So I kind of threw a lot at you, but that's a little mixture of
what we've been seeing, at least from a deployment perspective.
W. Curtis Preston: That's a, that's a, that's a perfect answer.
I, but you and you, you brought up a, a favorite topic of mine,
so I want to ask you about that.
And that is, um, what percentage of people, when you're talking out, you
know, when you're talking out there and they go and they get 365 or G Suite
or Salesforce or pick some other SaaS offering, what percentage of those people.
Then realize they need to back it up and then get something, anything to
back it up versus, versus the percentage that go, well, it's, uh, it's included.
Right.
You know, it's, it's part of the thing.
Krista Maccomber: Yep.
Yeah.
And that, honestly, that has been a problem for years.
Um, I would say Curtis, it's getting better.
Um, so
W. Curtis Preston: You are
Krista Maccomber: that some.
Exactly right.
W. Curtis Preston: We're, we're
all doing it together.
We're all
doing it
Krista Maccomber: Oh yeah, exactly.
Exactly.
It's like you, you, you know, if you scream enough people notice.
Right.
Um, so we fielded, um, a primary research study right around the turn of the year.
Um, we published it back in January and, um, what that research found
was that actually a little bit over.
Half of enterprises were, if they had Microsoft 365, we're protecting it now.
Which of course is not where we want it to be, but it's, you
W. Curtis Preston: way more than it was
Krista Maccomber: Exact, yes, exactly.
W. Curtis Preston: The only time I saw a survey, it was like 5%.
So I'll take
Krista Maccomber: and granted these were, you know, we did speak with
folks that were, you know, very hands-on with data protection.
So maybe that number you could make a case maybe was a little
inflated just based on the audience.
But I, I think it was still very heartening.
Um, I think when we look at.
Some of the other applications like Salesforce.
Um, you know, certainly we're seeing interest in demand there, but you
know, I think in practice we're certainly still getting there.
Um, you know, I mean, you've sort of alluded to, um, that concept that,
oh, well if it's in the cloud, then the protection is the cloud providers.
Problem, and I don't have to worry about it.
Of course, we on this call.
No, that's not true.
Um, and I think in part, due to the education, Curtis, as you were
mentioning, that we've all been doing, but I also think, honestly, some
of the ransomware attacks and those headlines, um, I think they probably
have helped a little bit because I, we've seen that that has grabbed the
attention of the C-Suite to say, oh, I'm seeing that this could potentially be
a major problem for us, so we need to make sure we've got a handle on this.
And of course, um, you know, your state of SaaS applications, um, is
certainly gonna play a role there.
W. Curtis Preston: Well, you look at, you look at what
happened with Rackspace, right?
Um, that, I mean, it wasn't 365, but it was, it was hosted exchange.
And, um, you know, basically they, they did get the customers, well,
they did make the customer's data available.
Right.
Be because they, they made, I don't know, they had a tough decision as to.
They, they couldn't get the data back quick enough, and so they made a decision
to just move everybody over to 365.
But all they did was they just moved their accounts over to 365.
Right.
And they started doing email.
Right.
And the customer's like, okay, good.
We're glad we have email.
What about the old email?
And the, there was no vehicle to get the, there was no path to get the data out
of exchange and sort of, Into, into 365.
And so they eventually, they created like little, little, um, PSTs basically
that customers could download their own data and then import it into 365.
Uh, but, uh, uh, but yeah, it just illustrates.
Uh, and by the way, that took months, right?
Um, and there's a, and there's a lawsuit about it, but there, I, I
don't think there's been enough there.
Um, I, I, as, as sad as this sounds, it will probably take a few more, um, very
public, very damaging, very newsworthy ransomware attacks on SaaS providers,
uh, for people to, to wake up and
Krista Maccomber: To really get it.
Yep.
Yeah, it's, um, yeah, no, I, I completely agree.
And I think one thing that's kind of a little bit unique with this
market too, I think is just the number of SaaS applications that
enterprises are using and that they will be using moving forward.
And so, um, You know, how do you pick your battles, right, in terms of having a
solution that is, you know, specifically tailored to that, to protecting that one
application versus potentially something that's a little bit more general purpose,
maybe more API driven in terms of how it integrates with, um, the SaaS application,
just to make sure that there at least is some basic levels of protection.
So, um, I think that's something, you know, over the next maybe year or two,
I think we'll, we'll probably start hearing a little bit more about as
the awareness, um, increases and, um, just as enterprises are using more
SaaS applications, I think that's gonna be, well, one of the problems,
um, on the list to address for sure.
Prasanna Malaiyandi: W I know we talked about SaaS applications, and I'm not
surprised, like enterprises probably have hundreds of SaaS apps, right?
Uh, that they're using internally.
And it's probably, like you said, it's gonna get worse because everyone's
constantly, like if you look at how many new SaaS apps are being built every day,
and it's like, Hey, here's this new app.
Should we start using it or not?
It gets difficult to manage.
Uh, Switching from Sapp.
So I was wondering your thoughts around Kubernetes, right?
I know Kubernetes has been hot for a while.
Um, everyone's been like, Hey, it provides availability and scalability
and just sort of, I know Curtis, when we've talked about Kubernetes and the
past had sort of exploded with like, how are you gonna protect things as they're
constantly spinning up, spinning down and
W. Curtis Preston: It's, it's the only thing I care about is that,
how are you gonna back it up?
Prasanna Malaiyandi: Right.
And sort of like, what are you starting to see in this area?
Krista Maccomber: Yeah.
Yeah, so it's been interesting and it's something that we've, um, so
we've been tracking it from, I would say three perspectives as a company.
So we have been looking at, um, you know, the adoption of what
we're calling some of these, um, container management platforms, right?
Like a Kubernetes.
Um, we've been looking at how the market for persistent storage, um, for Kubernetes
applications has been developing as well.
So that includes not just backup, it includes the production storage as well.
And then really my role has been to look at, okay, you know, as Curtis
is mentioning, that's all great, but what about the protection?
Um, so, um, we are seeing that, um, There still is a little bit of a disconnect.
I'm sure this will shock you between developers and IT operations.
I know this will shock
W. Curtis Preston: Shocked.
Shocked.
I am, I tell you.
Shocked.
Krista Maccomber: don't try, don't fall outta your chair.
Um, so, um, you know, I guess double clicking down into, you know, really
the focus of, you know, Our perspectives and maybe our audience on this show.
So, um, these applications are beginning to enter production.
Um, so they are, you know, doing things like requiring persistent
storage, which as we all know is going to need protection.
Um, Now how that's translating over to IT operations by and large.
So I did not have the pleasure of attending KubeCon, um, in
Amsterdam this spring, but I was out in Detroit this past fall.
Um, and we did have a number of team members, um, at the,
the spring event this year.
And, um, for IT operations, it's still very much a narrative of, okay, I'm
hearing about this Kubernetes thing.
I am aware that I need to pay, be paying attention to it, and I
need to start figuring it out, but it's not really yet crossing my
desk, um, on a day-to-day basis.
So that's what we're seeing by and large, whether or not that is the reality
of the urgency that they should have.
That is maybe a different story, but, um, especially when we think about protection,
um, it's, it's still very nascent.
Um, And I would say what we're seeing is still a lot of the,
you know, do it yourself.
I'm using an open source tool like Valero, um, to kind of script it.
Um, and I'm maybe not quite really using a lot in the form of a third party tool
for protecting these applications, at least from a data protection standpoint.
Prasanna Malaiyandi: and I'm guessing just like SaaS applications, right?
Until you get to that point where there's.
Data that gets lost because no one backed it up or I couldn't
restore it, or ransomware hit.
I was just reading something recently about ransomware now starting to target
like Kubernetes applications, right?
So until you get to that stage, right, there's probably no
driving force necessarily.
Krista Maccomber: yeah, yeah, exactly.
Because it's, um, you know, Kubernetes has been driven into
the enterprise by developers and.
In fairness, developers are doing their job, they're developing
applications and they're trying to be as agile and quick, you know, all
those terms that we love as possible.
And they're, they're not trained, um, in data protection and
proper data protection, hygiene.
And, you know, I would argue, nor should they be, um, But you know, as
you're alluding to Prasanna, it's only when it becomes a problem, I think
that there becomes that awareness.
Um, and I think in the Kubernetes piece, you're also fighting against a couple
of other challenges, one of which I kind of alluded to, which is, oh, well
Kubernetes is only for test and dev.
Well, we're number one.
We're seeing that that's.
Actually not even true anymore.
We are seeing production workloads are being run on Kubernetes environments.
Um, but also when you think about if a developer needs to roll anything
back, well then there does need to be a form of protection there.
Um, and I think the other piece too is that there's this, um, Assumption
that because Kubernetes applications are architected to be very resilient,
that that then translates into data protection, which of course, you know,
I think we, we know that that's not true, but I, I think there needs to
be some education on that front also.
W. Curtis Preston: Yeah.
Uh, you know, it, it is just, it's just like the la you know, SaaS and Kubernetes.
It's just the latest.
Thing on a long list of stuff that isn't backup, right?
Like, you know, the, the first thing I remember was raid, right?
It was like, well, you know, we, we got it on Raid.
It's on raid.
We don't need to back it up.
Like, ah, you know, you know, I, I had the luxury at, when I first, my first
job, it was at a bank credit card company.
And we had a guy, his name was Joe Fitzpatrick.
He was the guy that always, he wasn't a backup guy, he was a cis admin guy, but
he would always, every time he was a, so he was in a lot more meetings than I was.
I was a backup guy.
I'm just, you know, the guy in the data center with the tapes, right?
He's in like the meetings where they're talking about new things.
And Joe would always raise his hand and say, are we getting this on tape?
That was Joe's question.
Are we getting this on tape?
Right.
As in this, this new application that you're describing sounds amazing.
I.
How will we back it up?
Right?
Because you know, you talk about, you talk about, when I hear like,
oh, it's only test and dev, right?
Dev is what?
Test.
Not so much maybe, but Dev, that's actual work that someone's doing.
Right?
That, you know, when I think about, oh, it's only Dev.
Uh, I think back again, back to that bank, one of the last things that
happened to me when I was there is a group of people came up and, um, they, um,
Krista Maccomber: Okay.
W. Curtis Preston: they had lost their entire, it was like a group of
like, it was a bunch of developers.
Like the number 45 is up in my head, but this is.
You know, 35 years ago, it's like 45 developers.
They were consultants, right?
So they were being paid back then, probably a hundred,
150 bucks an hour, right?
And they had worked for three months on a source code tree,
and they had stored it in temp.
Okay, on, on, on hps, which on hps, back then temp was in ram.
So when you rebooted the server, temp was cleared out and um, they, um,
they were, they were coming to me.
They wanted me to restore the source code tree.
I'm like, we don't back up temp.
It's.
It's, it's ram, right?
They're, they're like, yeah, it's temp, it's temp.
And they're like, no, you don't understand this source code is really important.
I'm like, you don't understand, we, we don't back up temp.
Right?
Like,
Krista Maccomber: wand.
W. Curtis Preston: who, who puts, who puts their source code in temp?
Uh, You know, it's like, like I, like I knew somebody that stored important
stuff and they would, they used the, uh, the recycle bin as a filing method.
Like they would do their stuff and then they would delete it and they
would put stuff into the recycle bin.
Like, and then they would pull it outta the recycle bin when they wanted
to work with it and then delete it and put it back in the recycle bin.
Krista Maccomber: my God.
W. Curtis Preston: When you, when you, when you mentioned that like developers
or, or a lot of, just, a lot of people, not just developers, but a lot of.
IT people, they just don't have the, you know, the backup and recovery and
the cyber recovery chops to know the things they should be doing or not doing.
Right.
Krista Maccomber: Yeah.
Yeah, it, yeah, exactly.
So how do we, how do we build that awareness, you know, and a little bit
more, but you know, you don't necessarily wanna bog, especially these devs down
with, you know, all the nitty gritty.
So then how do you start, you know, The term is kind of baking it in, but
how do you integrate tools across that pipeline, um, to make it at least as
streamlined and as easy as possible?
And that way you don't get to that point where, oh, well we just lost three
months of source code development work because we had to reboot our server.
W. Curtis Preston: yeah, I mean the, the key, I think the, the,
the, the first hurdle that we all have to get over for, for SaaS, for
Kubernetes, for, um, multi node.
Uh, high availability databases like Cassandra and Mongo, right?
Is we just, can we all just agree this needs to be backed up, right?
That, that's the, that's the first hurdle, right?
Because there's just way too many people that are like, well,
Microsoft's backing it up, right?
No.
Um, well, it's, it's, it's, it's a multi-node database.
It can survive, you know, all these things, right?
What happens when you drop a table?
Uh,
Prasanna Malaiyandi: Can I add, can I add something to your list?
W. Curtis Preston: Add,
Prasanna Malaiyandi: object store.
W. Curtis Preston: Oh, object story.
Yeah, absolutely.
Right.
Um, you know, the, the question is how do we, you know, can we, can we, can
we just, that's the, that's the hurdle.
You know, you, you talked, Krista, you talked about, um, you
know, we just need to educate.
That's the initial hurdle, right?
And then, So then it is like, well, how do you get any kind of backup, right?
So like Salesforce, you, you can manually get a crappy backup, right?
You can do it once a week.
You can download it, just get something so that when.
You know, and, and I've told the story, I'm not gonna tell it again,
but I, once, when I was administering a Salesforce environment with a million
and a half records, basically jumbled the thing and put all the wrong phone
numbers to all the wrong people, like in, in, in like, like that, I
managed to corrupt the entire company.
Right?
But in case something like that happens, What do you have?
Right.
Even, even and, and then, and then it's the walk before we can run.
Yes.
I, I do.
I hope I, I know, I know that over the next few years, the number of ways that
we can protect SAS apps will get better.
I was very encouraged by, I was at HYCU, uh, headquarters, uh, last week.
I was very encouraged by their approach of the.
The API so that the SaaS companies can program to them.
I was very encouraged by that.
I know they, uh, and at least one other company,
um, GRA is taking that approach.
I was very encouraged by that.
And, and, and there's a lot going on in the Kubernetes backup space.
Uh, S3 is problematic Prasanna, you know,
Prasanna Malaiyandi: there's, well, granted, there's versioning, right?
There's cross region replication, right?
Uh, they've built a
W. Curtis Preston: No, what I, no, what I'm saying,
Prasanna Malaiyandi: yeah.
W. Curtis Preston: sorry to interrupt you, but what I meant was, what I meant
was it's difficult to back up, right?
There's not the, the features aren't there necessarily.
You know, I, I, because I speak working at a company that was
trying to figure that out.
It was not easy.
Right.
Um, sort of like Microsoft 365, it's, they didn't want a backup.
They didn't want people backing it up.
Prasanna Malaiyandi: Yeah.
W. Curtis Preston: They, it wasn't until just recently that they
actually came out with an API for it.
But anyway, my hope, my hope is for the future that stuff will
get better, but just like day one.
My, my, my thing is, and I think it sounds like you're on the same page,
Krista, is like, just make sure we can all agree that there is nothing magic.
The cloud is not magic.
Kubernetes is not magic.
My Tesla is not magic, even though it feels like it sometimes, right?
Um, you know what?
That, you know what?
I need Prasanna.
Prasanna Malaiyandi: back up for your Tesla.
W. Curtis Preston: I need a backup.
Tesla.
Anyway, one, one step at a time.
One step at a time.
Right now my backup Tesla is a Prius.
Uh, that's sitting right next to it and very sad.
It's, it's thinking like I'm gonna get rid of her.
And it's probably true.
Um, but yeah, if we can just, if we can all just say, let's look at, let's
prayer, let's acknowledge the problem.
Right.
We need like a 12 step thing, right?
Acknowledge that we are powerless over data loss, right?
Uh, and then we just, and then we just, we prioritize, uh, what we, so
we're, we're, we're a company, right?
And we prioritize, all right?
We're using Kubernetes, we're using 365.
We're using Salesforce.
What would really shoot us in the foot if we lost it, right?
And we're like, oh my God, that's Salesforce for, for whoever.
No, it's just a fictional company.
Right?
So for us it's, so, it's gotta be all right.
So get something quick, get a backup of that.
Right?
Get us, save ours.
Backup.
It's not a good one.
It's a crappy manual and we gotta do once a week, just get that done.
And, and then, and then go out and start looking for like better solutions.
I'm sorry, I I, I got up on a soapbox there for a minute, Krista, but what do
you think, what do you think about that?
Krista Maccomber: So.
I think it's great advice.
I think we need to crawl before we can walk, before we can run.
Um, and I think that having something basic in place is better than nothing.
Um, of course.
And then from there we can start to look at, like you were
mentioning, Curtis, what is critical?
Um, and if it is our Salesforce implementation, maybe we do
need, um, one of these more sophisticated third party tools.
You know, kind of what you're alluding to Curtis in terms of, okay.
All of these, um, different records and hierarchies, we need to be able
to, um, you know, bring those back as quickly as possible if something happens.
And so that's where some of these third party tools might come in.
But I do appreciate the soapbox.
I think it was good advice.
W. Curtis Preston: Yeah.
I, I think like, if, if, if we like just you, you got, we gotta triage, right?
And like in, in the case of Salesforce, I, yeah, I keep throwing it out.
In the case of Salesforce, they have a product, like Salesforce has a native,
they now have a native backup product.
My understanding is it's, it's expensive af but it's there, right?
And you could sign up for that.
I don't know, in classic Salesforce, you know.
World, you probably have to sign up for a year.
You know, Salesforce is right.
They, they charge you by the month, but they bill you by the year.
Right?
Um, so that, that might, that might be a way to do it, right?
Get something for those critical apps.
Uh, you know, maybe your critical app is Cassandra, right?
Um, you know, maybe it's Kubernetes, maybe god forbid Prasanna, maybe it's s3.
Prasanna Malaiyandi: Who knows, it might be right, but I think this is
where, and Curtis just calling out your, uh, plug for your book, right?
Modern Data Protection.
Right?
But this is where, right, the, I think what it's chapter two, where
it's like, talk to the business and the stakeholders, right?
Get down the requirements.
Really understand what is important, because what you might think is important
is different than what someone else thinks is important or what someone else
thinks is important different than what someone else thinks is important, right?
So, Make sure you're all on the same page, and you can sort of prioritize that
list and be like, yep, Salesforce is our top critical app for our entire company.
Let's go figure that out.
W. Curtis Preston: Number one mistake.
Well, number one mistake made by backup people is not backing stuff up.
Number two is making up their mind on what's important.
Right?
You, you, you know, if you're a typical, as I make quotes in the air, a typical
backup admin, you're often junior, which I hate that, but that's just the way it is.
You're up to junior in the organization.
You're not privy to all these discussions on what.
Is important to your company?
Get get yourself in those discussions.
Um, I bet, I bet you see that a lot, Krista, where like, you know, people
that they don't, they don't know what they know or they don't, they
don't know what they don't know.
I think that was, I
think that's what I was trying to say there.
Krista Maccomber: a hundred percent.
A hundred percent.
And that comes down to what you're mentioning, Curtis, those higher level,
more strategic conversations about what is important to our business.
But in the world of cloud and Dev DevOps, bringing these Kubernetes environments,
you know, into the equation as well.
It also literally comes down to what is our organization using?
What data are we even creating?
Um, you know, we're, we see in some cases significant blind spots
because, um, you know, it just was not kept in the loop and.
You know, somebody on the l o B side just went and swiped their credit card
and now they're using, you know, this different SaaS application, for example.
Um, and I know we already kind of talked a little bit about that, um,
you know, that little bit of breakdown between, you know, dev and IT ops.
So it's, I think it's, um, twofold from that perspective.
W. Curtis Preston: Yeah, shadow it and man, it seems like we could talk all day.
I, I just wanna, I just wanna finish this, this idea.
Yeah.
The shadow IT thing again.
Uh, um, I'll just plug HYCU again.
They, they've got this cool app, it won't fix the shadow IT problem,
but one thing they were able to do, if you do use like Okta, Right.
Um, and, and the SaaS apps that work with Okta, they can basically use Okta
as a way to inventory your environment.
I thought that was kind of, of the, of the SaaS apps that you plug into
because the first thing, you know, the first thing, uh, going back to that
list earlier, the first thing before we figure out what's important, we
gotta find out what we have, right?
Um, all those apps.
So shadow it, shadow it.
That's a problem, right?
I mean, the only way you can really a you, you can address that
with policy, like, don't do that.
Like, and you can address it with like, if you turn around, if you turn around
and you've tried to expense those apps and you're told, I'm sorry, what is this?
What, what, what is this product that you're using, right?
Um, this looks fascinating.
Uh, what is it and what does it do and, and why is it not plugged into Okta?
Right.
Or whatever it is that the company's using.
Anyway,
Krista Maccomber: Yep.
W. Curtis Preston: uh, we could talk all day.
Krista, uh, I think we've covered enough.
Um, is there anything that we, that we didn't cover that you,
that you wanted to talk about?
Krista Maccomber: I don't think so.
I mean, those are two of really the big, you know, the two big trends.
I guess three, you know, if you factor in, um, you know, cybersecurity as well.
You know, those are really kind of the big things that we're seeing.
Um, you know, of course we're getting into all these conversations about, you know,
I, you mentioned, you know, different third party tools need to be integrated
with the data protection solution.
Um, You know, you mentioned kind of Okta from, you know, kind of
authentication and things of that nature.
Um, you know, we're also seeing a lot of these, you know,
ransomware scanning tools.
Um, okay.
Where exactly does this fit within that stack?
But that probably could be a topic for a whole nother conversation, unless we
wanna hang out for another hour here.
Prasanna Malaiyandi: Yeah.
W. Curtis Preston: Yeah, I, I honestly, I can't believe we
didn't talk about ransomware.
I mean, it came up, came up a little bit here and there.
Uh, but,
Prasanna Malaiyandi: we'll have you back on to talk
W. Curtis Preston: yeah, we'll definitely
have you back
Krista Maccomber: wonderful.
W. Curtis Preston: that, that's a, that's an incredibly important
conversation that we continue to have and I, I, I, I don't think we
can get enough perspectives on that.
Um, and clearly you care about this topic.
Clearly you understand this topic.
So, um, uh, I want to thank you so much, uh, Krista coming on.
Krista Maccomber: Curtis and Prasanna, thank you both so much.
This was very fun as always, to chat with both of you.
And yeah, it was, it was a pleasure.
Thank you.
W. Curtis Preston: And Prasanna, I want to thank you.
And by the way, also, if you want to get me a backup, Tesla, it's okay.
Prasanna Malaiyandi: one of those little tiny toy car ones
W. Curtis Preston: Yeah.
Prasanna Malaiyandi: that counts.
Thank you, Krista.
That was so nice to meet you and I hope you come back on the podcast so
we can chitchat about cybersecurity.
Krista Maccomber: Anytime I'd love to.
W. Curtis Preston: And, uh, we of course want to thank our listeners.
We'd be nothing without you.
Remember to subscribe so that you can restore it all.