GRC in Cybersecurity: What It Is and Why It’s Important

Transcript:

Pete Wright:
Hello, everybody, and welcome to Trilio Insights on TruStory FM. I’m Pete Wright. KubeCon 2024 wrapped up scarce weeks ago, and our very own senior solutions architect, Rodolfo Casás, was there. Today, he brings all the news, announcements, and innovations on display. Rodolfo, welcome back.

Rodolfo Casás:
Thank you very much, Pete. How are you doing?

Pete Wright:
I’m doing very, very well, and I’m glad to see you. I’d love that you come back to share with us what happened at KubeCon and see if you can find your way through all of the AI talk to tell us some interesting discoveries.

Rodolfo Casás:
Oh yeah. My God. There was a lot of AI. Yeah. It’s like the new thing. They even mentioned in the AI events, they say that Kubernetes is legacy. Right? So a project-

Pete Wright:
Does that hurt your heart?

Rodolfo Casás:
Yeah. Yeah. So yeah. There’s something that is so new, and now it’s legacy. It’s just unbelievable.

Pete Wright:
All technologies last about 15 minutes now. I don’t know if you’ve heard that. That’s all you get, 15 minutes.

Rodolfo Casás:
Yeah, yeah, yeah. The speed of innovation is truly amazing. Yeah.

Pete Wright:
So KubeCon’s a big deal, but for those who weren’t able to travel and aren’t sure what it is or what the value is, why don’t you give us a little bit of a brief? What is KubeCon? Why is it valuable to you and Trilio?

Rodolfo Casás:
Yeah. So KubeCon, I wasn’t in the first events, but right now, it’s 10,000, 12,000 people goes to this, to the KubeCon. What you can find over there is people with similar interests. Now, the technology is so big that some people will find information for databases. Other people will find information for coding, others for observability. So really, there’s a plethora of different talks you can attend. It’s really difficult sometimes, because some of them are at the same time.
So you have an agenda you can suit to yourself and then you can choose, “Okay. I want to go to this one. I want to go to this one.” Every day, for the first couple of hours, are general keynotes from the CNCF people, or sponsors, or highlighted keynotes. All right? But then, after 11:00, you have to choose what talks you want to attend. Right?

Pete Wright:
Sure.

Rodolfo Casás:
So you build out your own agenda, trying to find the most interesting every single half an hour or one hour. Then, you can find different types of talks. Some of them are related to a project, like, for example, what’s coming new to the Operators Framework or a comparison between different databases, how they work, or different technologies. Right? Then, there are workshops. Okay? Some vendors, they want you to test their technology. So you go with your laptop, and then you follow some lab or some instructions so you can learn something new. Okay?
So it’s all completely flexible and customizable. So you can have your own experience, and probably, your experience will be completely singular. No one else will have the same experience as you had. On the other hand, as many people is going, probably, you will see old friends. You will see customers. You will see prospects. You will talk to different people. You will learn new stuff all the time, or if you’re interested in some vendor, you can go and visit their booth and, “Hey. Can I have a T-shirt? Can I have some socks?” Then, you discuss their technology, their approach, their story, where they are on their path to the success, whatever. It’s really interesting.

Pete Wright:
Sure. Sure. So okay. So let’s talk about the major announcements of interest to you in particular. What jumped out at you this year?

Rodolfo Casás:
Yeah. When we got there, I think everyone was thinking the same thing. Okay? The first keynote had started, and it was everything about AI. Even Priyanka Sharma, the CNCF lady, she was doing a demonstration of AI, pointing a camera to the audience, and the AI was saying what it was able to see and understand that it was in a big conference, in a big room. Okay?

Pete Wright:
Okay.

Rodolfo Casás:
So for the first hour and a half, everything was related to AI integration of GPUs, of Kubernetes, cost management, management of GPUs in the Kubernetes platform. Okay? So it was all about AI. Also, I heard similar stuff, like this time, a call for responsible innovation. Okay? As I’m quite involved in the telco industry, that’s a huge concern for telcos, because they consume a lot of energy. Okay?

Pete Wright:
Right.

Rodolfo Casás:
At this time, it was a gentleman from Deutsche Bahn, and on top of his talk about talking about sustainability, resource consumption, improved resource efficiency, it was really nice. Because he was actually mentioning some things that you can do today in your clusters to improve resource consumption so you will consume less energy at the end of the day. That was quite interesting.

Pete Wright:
That is interesting, especially coming from Deutsche Bank. He’s also talking about when you consume fewer resources, you’re also costing less money. Right? Don’t forget about cost.

Rodolfo Casás:
Actually, actually it’s not Deutsche Bank, but Deutsche Bahn, like the train company.

Pete Wright:
Deutsche Bahn?

Rodolfo Casás:
Yeah. The train company.

Pete Wright:
Okay.

Rodolfo Casás:
Its name’s very similar. Sorry for my English.

Pete Wright:
I misunderstood. Yeah. No. That’s okay. But in any case, I mean, that’s part of it, is like don’t forget about some of these constraints in our efforts, especially coming on the heels of such an exuberant presentation about AI, which is very expensive.

Rodolfo Casás:
Yes. Yes. It is. It is. Yeah. It was all about the intersection about cloud native and AI. Okay? It mainly focused on using cloud-native technology for inference rather than model training, particularly inference at or near the edge. Okay? Many telcos, many telco companies are using Kubernetes or trying to use Kubernetes at the edge with the small Kubernetes clusters that are not very big. They have very limited amount of resources, memory, CPU. Okay? If you want to know what inference is, it’s a process that a trained machine learning model uses to draw conclusions from brand new data. Okay? So the edge is coming big for the self-driving cars, for the … when you play with these virtual glasses and everything. So yeah. That was a big topic.

Pete Wright:
Okay. So one of the things I thought was so interesting in our … As we were just getting ready to record this morning, you said it was only after all of the AI talk that you found something that really hit home for Trilio.

Rodolfo Casás:
Oh yeah. For Trilio, and I think, well, for the rest of the people in the conference, they were saying, “Oh. Gosh. After 90 minutes, something different. Okay?” For me-

Pete Wright:
“Yeah. I’m ready.”

Rodolfo Casás:
“Yeah. Yeah. We’re ready. Okay. Bring it to me.” For Trilio, it was very good, because one of the big topics in the industry right now is virtualization in Kubernetes. For Trilio, because we’re a data protection company and bringing virtual machines to Kubernetes, it is really interesting. I think it’s a big challenge for the industry, especially with the VMware acquisition by Broadcom. Okay?
So all their customers are looking for different platforms, different solutions to run their virtual machines. Could be Nutanix. It could be all different distributions of OpenStack, Proxmox, even Kubernetes, and we are already seeing this. Okay? So for our two products, one is for OpenStack, and the other one is for Kubernetes, we both do backups of virtual machines. So then, being the next topic, not being AI, that was really interesting. It was, yeah, it was very nice to hear that.

Pete Wright:
Let’s talk about WebAssembly. That was a big topic. What are people getting excited about with Wasm?

Rodolfo Casás:
Yeah. I was saying to one of our sales representatives the other day, like, “Hey. There’s something new coming. Containers might be over.” He was like, “What? Now that I learned containers, you’re telling me this is over already?” I laughed.

Pete Wright:
“I only just figured this, man.”

Rodolfo Casás:
Yes. Yes. “After so many years now, I figured out containers, and you tell me this is over.” I said, “No, no. Don’t worry. It’s not over. Okay? It’s like virtual machines and containers. They will have all their own space.” Okay?

Pete Wright:
Mm-hmm.

Rodolfo Casás:
So the thing about WebAssembly was a technology created for the browser, and it has become increasingly popular on the server side, as well. Okay? I’ve been on a couple of talks already. Even last KubeCon, it was discussed. Okay? In my view, WebAssembly is gaining popularity in the cloud native ecosystem due to certain advantages over containers, including smaller size, faster speed, enhanced security, and greater portability. Okay?
So WebAssembly was designed to solve, from the ground up, the performance problems of JavaScript, and now developers can compile code to a low-level binary format that can be executed by modern web browsers at near native speeds. Okay? So what’s interesting to us in the cloud native ecosystem is that in March 2019, Mozilla announced the WebAssembly System Interface, WASI, an API specification that defines a standard interface between WebAssembly modules and their host environments. Okay?
Then, WASI allows Wasm, WebAssembly modules to access system resources securely, including the network, file system. Okay? So that enhanced WebAssembly’s potential. So it not only works in browsers, but also on servers. Okay? That is when it’s coming to the servers in Kubernetes. Okay? So you get better security, faster load times, smaller images-

Pete Wright:
Lightweight.

Rodolfo Casás:
Yeah, so lightweight. So yeah, yeah. From a lot of megabytes to just a couple of megabytes for an image, from seconds to load to milliseconds, it’s all advantages. Okay? Of course, there are certain, still some limitations, but time will come. Okay? So just let them work, and it is going to be really a big breakthrough.

Pete Wright:
You want to talk about operators?

Rodolfo Casás:
Yeah. I went to a very interesting talk for me, was the most surprising talk that I attended. Okay? It was a talk about two guys. They were discussing the status of data protection in operators that deploy databases. Okay? I was there. I went there thinking, “Okay. Trilio can do that. We can protect databases. We have a way to do that. We can cache the databases. We can do the backup. We can restore.” Okay, and now, I’m going to this talk. I expected to hear that no, everything is solved. All these operators, they can do their own backups. There’s no problems anymore.
But what I discovered is that they did a very thorough job comparing different databases of different operators, and some of them, they were not shy. They literally say, “No. This operator sucks.” Okay? I’m not going to say their names. They did, and I was like, “What?” So Trilio has still a lot of game in the game. You know?

Pete Wright:
Yeah.

Rodolfo Casás:
We still have a lot of things to say and to do in this particular environment, protecting databases. So yeah. Databases backup in Kubernetes is a big topic. Many companies still don’t trust to run their databases in Kubernetes. They think it’s, oh, it’s scary. Many, when I talk to prospects and customers, they say, “No. I just prefer to have my applications inside Kubernetes and the database outside.” Okay?

Pete Wright:
Outside.

Rodolfo Casás:
So yeah. They think it’s better, but whenever I hear someone, “No, no. We tested it. We liked it, and we are not coming back.” That’s what I hear. So so many people can be wrong. I’m not saying everyone is going to run their databases in Kubernetes in Persistent Volumes, right, imports. But I think there’s still, it’s a matter of time. Companies, we were talking about this before. Technology is evolving so fast that companies, they lack skills. They cannot test everything all the time at the same time. Okay?

Pete Wright:
Right.

Rodolfo Casás:
The database is a critical piece of the infrastructure. So they will take their time, but once they go to Kubernetes, I think it’s going to be big, as well.

Pete Wright:
Well, I think that leads to one of the interesting bits of, we’ll say vulnerability at the conference. When you start talking about the challenges that are coming up, and you’re talking specifically about security, and how easy it is to run what you think is a great system and find vulnerabilities that can be picked apart. Let’s talk some about some of these concerns.

Rodolfo Casás:
Yeah. Security is a big concern for companies new to Kubernetes. I think every single poll that some companies do about, “What are your main concerns about Kubernetes and implementing Kubernetes in production?” is security. So that’s why, also, why major Kubernetes providers and vendors, they already bought or they are buying security startups to embed their solution into their distributions. Okay?
With Kubernetes, you can build all yourself, like with a Linux distribution, but at the end of the day, I don’t know many people building their own Linux distribution. At the end of the day, you go to use Debian, or RHEL, or SUSE, so everything is done for you, maintained, its components, its support. You know? So it’s the same thing with Kubernetes. It’s not that easy to, “Oh. No. I will do my own. I will take this piece. I will take this software or that software, and I will build it.” It’s very difficult to maintain. Okay? So one of the pieces is security, and there are a lot of security startups and projects, like Falco, for example, Sysdig, and there are a lot of them. Yeah. It’s still a big challenge in this industry.

Pete Wright:
Well, and what was the statistic, 40% of folks responding say that security is a big challenge? Almost half, that’s significant.

Rodolfo Casás:
Yeah. Yeah. Yeah. Yeah. Yeah, yeah, And I think the other half is crazy for not being concerned.

Pete Wright:
Okay. Excellent. [inaudible 00:15:40].

Rodolfo Casás:
I think everyone, because everyone’s a bit concerned. Yeah, yeah, yeah.

Pete Wright:
Yeah. It’s-

Rodolfo Casás:
So I’ll give you an example. I was not going to say anything about Trilio, but I will take the chance to say it. Okay?

Pete Wright:
Sure.

Rodolfo Casás:
Because right now, I am testing our integration with an S3 vendor and our integration with S3 Object Locking capabilities. What we achieve with this is, what if you suffer a ransomware attack? Okay? A ransomware attacker will attack your production workloads, your data in production. Then, before that, when you try to restore from the backup, you will find that they also corrupted or encrypted your backups. Okay? So how do you prevent that from happening? Okay? The only solution is to have immutable backups. Okay? So Trilio integrates very nicely with the S3 Object Locking mechanism of S3.
So, for example, you could create a bucket and say, “Okay. Every object, which are the backups, every object I put on this S3 bucket needs to be immutable, for example, for 30 days.” Let’s say Amazon S3, which is the most famous, every object, every backup I put in the bucket will not be deleted for 30 days no matter what. Okay? Then, for example, you can establish a life cycle policy that every object in that bucket that is older than 25 days, you move it to Glacier, which is like long-term archival. Okay?

Pete Wright:
Mm-hmm.

Rodolfo Casás:
So your backups will be immutable end-to-end. Okay? Then, if you add up encryption capabilities from Trilio, your data will be encrypted, immutable until they reach their final rest destination. Okay? So yeah. I had to say it. Sorry, Pete.

Pete Wright:
No, it’s good. You’ve got the stage, man.

Rodolfo Casás:
Okay.

Pete Wright:
Second big challenge, lack of training.

Rodolfo Casás:
Yes. One big announcement from the CNCF is that, well, they have several certifications, like the Certified Kubernetes Administrator or the Certified Kubernetes Developer Security. Okay? I think they have like five right now. Then, they did, similar to what I know, because I’m a Red Hat Certified Architect, they did something similar. When you pass all of the exams and all of them are current, you will become a Kubestronaut. Okay? I think you will get an exclusive jacket. Okay? Plus, so yeah, yeah. Several people-

Pete Wright:
Unless you get a helmet, I’m not interested.

Rodolfo Casás:
I don’t know about the helmet, but you will get discounts for events and certifications. But I think there were like 20 people already, Kubestronaut, and they had their jacket. It was nice. Okay?

Pete Wright:
It’s a lot of work, too. I mean, that’s-

Rodolfo Casás:
Oh yeah. A lot.

Pete Wright:
Yeah.

Rodolfo Casás:
A lot.

Pete Wright:
Yeah.

Rodolfo Casás:
I can tell you, it’s a lot of work.

Pete Wright:
The jacket, I haven’t seen the jacket, but I’m sure it’s lovely.

Rodolfo Casás:
Yeah. I saw it very far, from far away, so I don’t know how the jacket was. Maybe it’s amazing. Maybe-

Pete Wright:
Yeah.

Rodolfo Casás:
Yeah. Maybe it’s worth it.

Pete Wright:
Hey, but you saw it from far away. That’s what they’re counting on.

Rodolfo Casás:
Yes.

Pete Wright:
Out of curiosity, is there a bigger impact that they’re talking about in the industry? Is this a-

Rodolfo Casás:
Oh. Yes. Yeah. I forgot about that. Sorry. Yes. I think they’re fully aware of the complexity of these new platforms, and it’s a change of mentality for every system administrator. So yeah. There are not many people, Kubernetes, that were in the companies these days and when they learned they are changing companies, so there’s a lack of people, a lack of skill set. Okay? So that’s why they are-

Pete Wright:
A high churn.

Rodolfo Casás:
Yeah. Exactly. Exactly.

Pete Wright:
Yeah.

Rodolfo Casás:
So they want to train people, and that’s also … What they did was this, and they also did another announcement. They partnered with Udemy. Okay? It’s a learning skills marketplace where people put trainings, and then you can buy trainings. I’ve used it a couple of times, and actually, some trainings are quite cheap, and they’re quite good. I can’t complain. So I think this is great. This is actually very good.

Pete Wright:
It’s great. Anything, because training raises awareness, raises retention.

Rodolfo Casás:
Yes.

Pete Wright:
This is great.

Rodolfo Casás:
Yes, yes. That is true, a hundred percent, a hundred percent. The more you know about a platform, the better you use it, the better you consume it. You will extract the most out of it. So yes. You need to be trained, and then you can work with it. Correct.

Pete Wright:
The general vibe as you leave with KubeCon this year, what is your general impression on the state of the platform and the state of the industry?

Rodolfo Casás:
I think we’re still in an early market. Okay? Many companies are still building on Kubernetes. For sure, there are big companies that have adopted Kubernetes, and they’re using it at a massive scale, let’s say the big ones like TikTok or Uber or, yes, but many companies. Sometimes, I go to events, and I talk to people. They say, “You know what? We’re still running our stuff in virtual machines. We still have many problems, are updating software.” So many companies are still starting their digital transformation path. Okay? I think containers and Kubernetes, it is a must for their digital transformation.
I think we’re still in a very early market. No matter what, no matter, I think AI is coming. It’s going to be very popular. You can run even … There are certain software projects where you can integrate the command line in Kubernetes with AI tools. Many software vendors and startups are trying to integrate AI tools with their software to make a user’s life easier, trying to, exactly what I do when I talk about Trilio, trying to reduce complexity, and give flexibility and reduce complexity at the same time. Those are also two big topics, but yeah, early market. I also think virtualization, what I mentioned before.

Pete Wright:
Just one poke at AI. Is there anything specific about AI that you are most intrigued by right now?

Rodolfo Casás:
I think all the startups in the market, we are trying to find ways of integrating AI into our products, every startup. And so I think people is very creative, and we’ll start to see really, really, very good things. Well, we all use it on our daily job to do outlines or content. I use it sometimes, and it is really incredible how an AI can link concepts and order stuff faster than you can. Okay? Of course, a human in the back, in the background, giving directions, it is really useful for the AI, but I think the future looks really good, really good.

Pete Wright:
Okay. Speaking of the future, one interesting thing that comes out of this particular KubeCon is a lot more KubeCons than we would’ve expected.

Rodolfo Casás:
Oh. Yes. Yes. That was surprising. Certain gentleman was saying, “KubeCon is so complex to organize that in this KubeCon, we are announcing not next one, but the next four.” Okay? So the next one was already known, which was Salt Lake City. But then, we will have London in Europe. We will have Atlanta in the US, and then we’ll have, in Europe, we’ll have Amsterdam again. There you go.

Pete Wright:
Excellent. Excellent. Back to Amsterdam.

Rodolfo Casás:
Start booking your hotels, your tickets, and everything, because you know what it is. So KubeCon 2025, KubeCon 2026. There we go.

Pete Wright:
They just keep coming. That’s a good sign. We’ll put the links in the show notes, so if you’re listening on the road, get back to your desk, swipe up. You will be able to jump straight to what turned out to be a little bit of a complicated link to find, but we found it.

Rodolfo Casás:
Yes. Yes.

Pete Wright:
We sleeved it out, and it’s there. And so check that out. Any other resources you’d like to point folks to as we wrap up?

Rodolfo Casás:
There are other podcasts that I find interesting. I found one the other day, which is called, well, I think it’s very popular, it’s called Cloudcast. That was very interesting, and there are a lot from Red Hat. Red Hat, many people don’t know, but they have plenty of podcasts. I will share with you a couple of links. I think my preferred one, at least the first season, is the Command Line Heroes. I really love that podcast, because it starts talking about old technologies. Well, for us they’re old. Right?

Pete Wright:
Yeah.

Rodolfo Casás:
But it’s all still very new. Okay? So talking about the technology in the ’70s, and Grasshopper, and all these people, it was like, “Yeah.” It’s like you leave it again, because I’m a bit younger. My father also worked with computers. My son is studying computers, but we were not there in the first wave, not many people. Okay? So being able to hear someone or even the real person that was doing that, now they’re quite old, but they were speaking in some of the episodes. I like that one, Common Line Heroes. I highly recommend it.

Pete Wright:
Outstanding. We’ll share the links. Great resources, especially for the tech historian vibe in you. I look forward to it. That’s right up my alley. Thanks, Rodolfo.

Rodolfo Casás:
Thank you very much.

Pete Wright:
Thank you all. Thank you all for hanging out and listening to this show today, and for checking out the resources, and your interest in KubeCon, of course. We sure appreciate your time and your attention. We encourage you to learn more. Just swipe up. In the show notes, you’ll find all the resources that we are sharing on behalf of the great Rodolfo Casás. I’m Pete Wright, and we’ll see you next time right here on Trilio Insights.