RSA Conference 2010 Keynote - Enrique Salem

Enrique Salem: Good morning. Well, here at the RSA conference, we get an opportunity once a year to come together as an industry and spend a little bit of time talking about what are the challenges that we face today and how are our jobs and our industry going to change over the next several years. One of the things that we see is that information is continuing to grow at a very rapid rate—every minute, every hour, every day. Industry analysts place that growth at 60% per year. And I've talked to customers who tell me it's 15%, and I've had some tell me it's as much as 100% growth per year. But this information is no longer sitting in a filing cabinet or a file on your desk. It's now on your cell phone, your laptop, your netbook, and it's being accessed from everywhere, from your home, from the beach, from a chairlift at your favorite ski resort, or an airplane that's flying across the country. This year, 2010, marks the beginning of a decade that will see enormous change. But what we've got to do is take a much closer look at information. Where does it come from? What do we do with it? How do we manage it? And really, what does it mean to all of us? This decade will define what we call the information economy. It's an economy that is defined by the value of intellectual property. It's defined by the value of content. It's defined by the value of ideas. It's all about the value of information. What makes digital information so powerful, though, is they can be created very easily. It can be distributed. It can be replicated. It can move from place to place, but that same flexibility is what creates the real risk. What we've done is we need to think about how do we protect that information from the moment it's created to the moment it's stored to the moment it's accessed. How do we manage it and secure it? As the information economy continues to change, one of the things that we need to think about is what are the major trends are going to be the dominating forces in this new economy. We've talked a lot about cloud computing, mobile devices, and social media. We believe that these are forces that will absolutely change IT. One of the things that's happening right now is that as people think of those trends, what we know is that they're absolutely inextricably linked. More of the computing power is moving from our desktops and our servers in our data centers out onto the cloud. That power is fueling digital devices because it's providing greater access to applications and information from wherever you are. The thing that's driving this, though, is ultimately the underlying ubiquitous connectivity that we all now have access to. First, let's talk about the growing trend that we all know as cloud computing. There are many facets to this trend. First, you've got public clouds, you've got private clouds, and you've got a hybrid. You've got many layers. You've got software as a service, you've got infrastructure as a service, and you've got platform as a service. These are benefits both to the IT organization, but also to the end users. Cloud computing is gonna pose a major shift in how services are delivered by IT. It'll challenge our traditional thinking. It'll move us from a service provider model that is based on our own IT department to a service provider that is external, and it'll change the relationship between that service provider and the service consumer. Now, this relationship hinges on trust. It hinges on the confidence and trust between the service provider and the service consumer. Despite the real benefits that we see, there's also concerns about privacy and security. Security is ultimately the key to enabling trust that will make this model succeed. As you think about some of the key issues, those who can successfully address security, compliance, and privacy will be the big winners. And I'll talk about how we as an industry can do that. But first, let's talk about the growth in digital devices. One of the things that's interesting is that we're seeing a big growth in devices that are non-Windows-based. We're seeing growth in devices like iPhones, Android devices, BlackBerrys, e-readers, and just a few other things that we're seeing come up on the horizon. But what we've seen is a change that we haven't seen— as dramatic a change in as many as 20 years from the inception of the PC. As we think about what's happening, consumers are driving the adoption of these devices. They're asking us to basically accept those devices and allow them to access corporate information from wherever they are. IDC predicts that there'll be 1 billion cell phones accessing the internet by the end of this year. To put that in perspective, today there are 1.3 billion PCs accessing the internet. Like many of you, I carry multiple devices. And right now, I'm not exactly sure where mine is. I'm sure Justin, who's our CISO, is wondering, where the heck is it? Because that device has all of the information that we use as our company. I can access the intranet. I can access our corporate data. I can access our customer data. And so we need to think about, how do we secure that device? Now, these trends are absolutely transforming the industry— cloud computing, social media, and mobile devices. And so what I'd like to do now is I'd like to invite Marc Benioff, the CEO of Salesforce.com, to share his perspective. He today has over 70,000 customers at Salesforce.com, and they're clearly recognized as the leader in enterprise cloud computing.

Thank you, Enrique Salem, and I'd like to say hello to everyone at the RSA conference. And thank you very much for giving me an opportunity to greet you today. You know, I was just thinking this week, and you may have seen I wrote about it on TechCrunch, that when I started Salesforce.com in the mid-'90s, I asked myself a simple question: why is all enterprise software not like Amazon.com? It just seemed to me that Amazon.com was just so easy to get going and was such a robust application, but that if we made enterprise software like Amazon.com, well, then it would be low cost, it would be easy to use, and wow, the speed that you would get compared to traditional client-server would be amazing. And that's why I quit my job at Oracle in 1999, And I decided to start Salesforce, because I wanted to make all enterprise software as easy as Amazon. And behold, now we have such a tremendous industry of software as a service, applications as a service, even platforms as a service. But just this weekend, I was thinking to myself, and maybe you've had the same experience, why is all enterprise software not like Facebook? I mean, that seems like it has become the new compelling application on the internet today. Almost half a billion users and a dramatic growth rate. When you look at the core fundamentals of internet usage, where people are spending their time on the internet, it's on Facebook, it's on YouTube, and it's on fundamental search. And that's a big shift that's going on from just a few years ago. When people are on very different services. Look, the power of this idea is that the world is not just becoming the cloud, but it's going social, and there's powerful new metaphors there to increase productivity, make things much easier to use, and even lower cost. So this whole idea of cloud and social, and this idea also that everything is going into the mobile internet, How many people in the audience have an iPhone? How many people have a BlackBerry? How many people have an Android device? Okay, that's probably everyone in the audience at the RSA conference. You know, the question that I think you just have to look at is, when are we gonna let go of the past, and when are we gonna start creating a compelling future for enterprise software? At the end of the day, Lotus Notes was conceived before Mark Zuckerberg was. I mean, it's time for a change. And I think the advancement is a nod from the consumer and internet once again, an advancement into the next generation of enterprise software. And that's why this week we're so excited that we put Salesforce Chatter into beta. And we believe in this new vision. We believe in the imperative of a new enterprise industry. We call it The Facebook imperative. And you can see our vision at www.salesforce.com/chatter. Thanks, Enrique, and have a great conference.

So just as Marc mentioned, the world is going social. And to bring that point home, just a couple weeks ago, I was meeting with a large company in the Northeast. And they had told me that using internal social networking technologies, they've changed their onboarding process from 3 weeks to 1, and their employee productivity has gone through the roof. But with these new social networking capabilities, it does bring new risk. It can drive real value by making us more efficient, but we also need to manage the risk that it creates. The privacy of our information must be protected. And as much as we tell employees that they can't put information out on the internet, it will happen. And while we can control perhaps a little bit of what they say about our companies, What they're not able— what we're not able to do is control what they say about themselves. Now, ubiquitous connectivity, cloud computing, digital devices, and social networking all put information at our finger— at our fingertips. And they're changing how we think about IT. They accelerate the need for us to take an information-centric view to security. And that is the theme of everything that I'm covering. If our organizations are going to be successful, we need to adopt new approaches to securing, storing, and managing information that are independent of where the information lives or what device it's on or what employee is communicating with other people in the industry or around the world. The other thing that we know is that cyber criminals and hackers are more determined than ever to steal confidential information. These attacks are shifting from being broad-based to being very targeted. Since 2006, we have been predicting that these highly targeted attacks, these silent threats, would go after confidential information. Our 2010 State of Enterprise Security Report, where we surveyed 2,100 CIOs, CISOs, and IT managers, came back with some very clear data. Over the last 12 months, 75% of the companies in the survey had had a cyberattack. The same study found that 100% of the survey respondents had experienced a cyber loss in 2009. Now that loss could have come from an external attacker, a malicious insider, or a well-meaning insider. But we know that the target was always the same. It was information. Now the top 3 losses they reported: first, the theft of intellectual property; second, they talked about stealing financial data or credit card data; and lastly, they talked about theft of customer PII. But what's dramatic to me is that 100% of the 2,100 companies surveyed said they'd had a cyber loss. Now we've been saying that these attacks would absolutely become targeted, and Hydra brought that point home. It targeted specific companies across the world and looked for confidential information. It leveraged a zero-day vulnerability in IE and used sophisticated social engineering techniques and tactics to distribute its payload. What we saw was that IM with malicious links or emails with PDF attachments and malware embedded inside of them was the way that the attackers got into the organization. They also targeted specific individuals inside of specific companies, and a backdoor ultimately made it possible for them to get free access to a lot of the information inside of their targeted companies. And what were they trying to steal? Clearly, it was the intellectual property and information inside of those companies. Our traditional signature-based approaches to security are not keeping up. In 2008, we had to produce 1.6 million signatures. That's more than the previous 17 years combined. In 2009, we had to produce 2.9, almost doubling the previous year. So what we've had to do is come up with a new approach, an approach that we call reputation-based security. The idea is it has to be able to deal with attacks that we've never seen, targeted— targeting attacks that have been previously unseen. Our reputation-based security will leverage the wisdom, the knowledge of the tens of millions of users that use our products around the world. Reputation-based security is based on a few simple characteristics: origin, age of the program, and prevalence. We bring that together with other information that we have about the programs, and we can create a reputation. Today, we have over 1 billion reputation ratings. In the last 6 months, we've had 177 billion queries to our reputation database. We believe that this is the only approach today that can be used to detect these highly targeted attacks. And we're seeing great results. We launched in our Consumer 2009 products this new technology, and one in every two PCs detected a previously unknown threat. That was 500,000 threats on the first day. What we also have seen is that that gave us a 15% increase in detection on the first day. Now this new technology was designed specifically with Hydra-like attacks in mind, and we believe that these attacks will continue to spread and become much more targeted. Now while we're using this technology today on a PC platform, it's not just gonna be limited to PCs. It will also help secure a range of mobile devices, because we know that what attackers do is they target platforms and devices that achieve critical mass. So it's only a matter of time before they'll come after whatever is the latest new technology where information is being stored. In 2009, we saw the first real attacks on smartphones. The SexySpace worm, uh, basically targeted the Symbian OS platform using a —text-based messaging approach to spreading. What we also know is that while these devices are becoming targeted, we're also seeing that there's an increase in the rise of insiders, people who we have come to trust that are stealing information. We're also starting to see that the malicious insiders are being able to embed significant new malware in our environments that can create opportunities not only for information to be exfiltrated out of the organization, but also to create the potential for other future access points to be used. Now the question I pose to all of you is, how do you know that an individual who sits next to you back in the office, or here today, is not masquerading as a trusted employee who is only planning when they'll attack? The answer is you don't know. Ultimately, you can never be sure who you can trust. These threats are real, and the trends continue to make it clear that we need to be more careful of the information that we create. Now let's look at the requirements that we're seeing as they change around cloud computing, mobile devices, and social networking. What do we need to do about security? Well, we think that there are ultimately 4 key things that have to happen. The first is we have to move security much closer to the applications and to the data. In a shared infrastructure, it's not sufficient to share— to protect the cloud perimeter, the data center, the server, or the storage array. We have to think about how do we protect the entire environment. In a highly virtualized, multi-tenant environment, What becomes important is we have to think about specific applications. We have to think about the virtual machines. We have to think about the storage volumes that are associated with each individual customer. For example, if today we were to scan every virtual machine to detect if there was any malware, that would potentially bring down the entire server. So there's some simple things that we can do. We can start staggering the scans. We can start thinking about how we create— we what we call a single instance security module. That means a single engine. That means a single instance of the content that drives those engines. It means a single set of updates, regardless of how many virtual machines you're currently running on. The goal is to infuse security into the whole virtual infrastructure so it can automatically protect everything that you're doing. Last October, we delivered a new technology that we called Filestore. Which is a cloud-based storage product that makes it possible for you to create cost-effective, scalable storage services. But most importantly, we infused it with our endpoint security technology because it became clear that a storage system without embedded security was ultimately not going to be secure. And these are just examples of how we're moving security closer to the applications, closer to the data. Next, you must have an information governance model. You must define it, you must put procedures in place, and you must educate your org, and most importantly, you have to enforce it. That's easy for me to say and much harder to do. I've talked to lots of CISOs across the world, and what they worry about is that the information that their organizations are creating will be strewn across the internet, and they've ultimately lost control. But they're still accountable for the protection of their organizations. This is a real issue. And so what we've got to do is think about how do we keep the users from doing an end—end run around the IT organization. We have to have a new approach. So how should we respond? At this point, putting an SLA in place is an important first step. As we vet cloud providers, there's a series of questions that we can ask that allow us to determine if they're gonna take the right steps to protect our information. But what we need to know is where is that information gonna be? Who's gonna have access to it? Where is it? How often is it accessed? And so what we've got to do is put in place the appropriate tools and technology that will allow sensitive information from being removed. Two years ago here at the RSA conference, we spent a lot of time talking about data loss prevention. And that was an important step. But we need to do a lot more. Today, we're announcing a breakthrough technology that we call Data Insight. What it does is it brings together the capabilities we have in knowledge of file systems and knowledge of security to solve one of the problems that plagues everybody who manages information, and that is data ownership. If you're gonna secure information, you ultimately have to know who owns it. Our DOP technology will be integrated with the Data Insight capabilities, and what it'll do is 3 primary things. It will automatically determine data ownership by keeping track of who's using it. The second thing is it'll scan file shares, and it'll determine what file shares are exposed to everyone. Because those are the file shares that are targeted both by malicious insiders and external attackers. And it'll also monitor who is accessing and modifying what files. Because what that'll allow you to do is very quickly determine if an employee is suddenly has an unusual usage pattern of data that can warn your security team and alert them to potentially a breach in security. Data Insight will work and reside— Data Insight will work independent of where the information resides, whether it be on-premise or off-premise, and this will help you to have a better data governance model. The third topic is it's important for us to think about how do we have the same visibility into the security posture of off-premise solutions as we do on-premise. Last December, we created a partnership with Amazon.com and their web services group to extend their EC2 cloud platform and allow us to bring security and cloud services together. So what I've done is I've asked Werner Vogels, the CTO of Amazon.com, to share his perspective of what we're doing.

Thank you, Enrique Salem. I appreciate the opportunity for being part of your keynote today. I regret that I cannot be there in person. Cloud computing is changing the way IT is being delivered. It removes most of the heavy lifting that every IT department has to do by managing scalability, reliability, performance, and security of their IT infrastructure. Cloud improves the cost efficiency through the elimination of capital investments and by reducing operational costs. IT organizations that have moved to the cloud also cite increased agility and flexibility as major benefits, greatly improving their time to market. Over the past 4 years, Amazon Web Services has provided companies of all sizes with an infrastructure web services platform in the cloud. AWS is built on the same global compute infrastructure that is the backbone of Amazon.com's retail business and transactional enterprise. This means that you get the benefit of the operational excellence that Amazon has developed and improved upon for over 15 years running Amazon.com. I've been visiting with many IT decision makers, and I know that, just like for us at Amazon, Operational excellence and security are very important to you. It is a top priority for you to make sure your business can leverage cloud-based environments in a secure and well-managed manner, and preferably in a way that the significant investments that you have already made in this area can be leveraged. Which is why we are so excited about the partnership with Symantec. Symantec understands that the security industry must evolve as cloud computing changes the IT landscape. In particular, Symantec understands the importance of information security, reliability, and privacy in cloud environments. We're very pleased that Symantec is offering their security and storage management solutions on Amazon EC2, ensuring that customers have the right level of protection and are able to manage their storage in a way that gives them confidence in their information while using cloud-based services. Thank you again for asking me to join you here today. We're excited about working with Symantec and wish you all great success in the cloud.

So as Werner says, Symantec and Amazon have a common vision of what we need to do to protect the internet and protect the cloud services. Ultimately, the same security that you use on-premise you want to use in the cloud. And so that's what we're delivering together. But that's an important step, and it's a step in the right direction. But we as an industry and as cloud service providers need to do a lot more. What we need to do is think about, how do we manage system configurations, access controls, vulnerability scans, and retention policies? Because there are commitments that are being made to all of us, but how do we know that those are actually being met? So as an industry, we need to come together and create a set of standards that will allow us to more efficiently have visibility into the infrastructures that we're taking advantage of. Standards like SCAP will give us a vocabulary that we can use to talk about vulnerability assessments, configuration data, and are we getting updates and patches deployed as we should. Putting these controls in place is another step in the right direction. Thinking longer term, we're working with the National Institute of Standards and Technology and the Cloud Security Alliance to define a set of standards that we think will make a further step to bringing higher visibility into the infrastructure of everybody delivering cloud-based services to, uh, to all of us. Lastly, I want to talk about this notion of taking advantage of today's cloud-based security services. By taking advantage of these services, you can reduce complexity in your environment. You can focus on the core competencies of your business and not be dependent on putting up infrastructure in your environment where you can allow a third party to do so. This is something that we know very well. Today, Symantec has over 17 million customers who are using our online backup and security services worldwide. If you think about it, though, what we have to do is bring together interoperability between on-premise and cloud-based solutions. So for example, if one of our customers is using our DLP solution, and they're also using a hosted email security service, they need to oper— interoperate. Because what becomes important is the ability to block sensitive information from leaving your environment. Whether that's done through an on-premise email system or an off-premise system, the DLP technology and the cloud-based delivered email services need to work together. It's important that the same security you use today on-premise extend out into the cloud. And this is a clear example of why interoperability has to exist. Cloud computing, digital devices are exciting new trends. They're driving our industry forward. They're propelling the evolution of the information economy. What we know is information will live in many places. It'll be accessed from more places than ever before. And we also know that that same information will absolutely be targeted. Above all else, we know information will be our greatest asset. Recently, I was speaking to a very large company who told me 1% of their total data is what really matters, and that's what's gonna get targeted. So security is not about placing higher walls around our information or locking down a device. It's about enabling our businesses to take advantage of these emerging technologies. To receive the benefits of these new trends. It's not about picking a computing model or an OS or a device or trying to figure out who's gonna win. It's about thinking about how do we secure and manage diverse environments, because all of our environments will continue to become more diverse. None of us can say exactly what the next decade will bring, but what we know is there'll be more connectivity, There'll be more access to information that will bring greater productivity, more collaboration, and better ideas. We need to provide the ability for people to access information wherever they are, from whatever device. As security professionals, we have to enable this freedom, not block it. As we think about it, if done right, the security industry can enable the future of the information economy. It's up to us to nurture and provide a path for your organizations to seize these opportunities with confidence. If we work together, we can help the information economy reach its full potential. Thank you very much.