The Fog of War: Security and Cloud Computing with Symantec's CEO, Enrique Salem at Tuck

The cloud is absolutely the biggest change in IT in the last 30 years. A lot of people have different interpretations of what, what does cloud computing, what does the cloud stand for. As I think about it, it really is just a new way of delivering IT services or computing services to an end-user community. Now you get the flexibility of being able to scale up and scale down. You also get better utilization of all the resources that you have. This is, in my opinion, the biggest change in IT in the last 30 years, if not longer. It will absolutely change how we use computing resources. This is something that is counterintuitive, but you also can get more protection. Because the people who are responsible for building some of these cloud-based services that I showed, they're very focused on it. Lots of small businesses and other companies don't have the resources to focus on security. And so this is a challenge. This is one of the things that's a misperception in my opinion, that inherently the cloud has to be less secure. That is absolutely not the case. Done right, it can be more secure. And then I think it ultimately will translate into better utilization of resource and more business results. Okay, so what are the challenges? Misaligned expectations. One of the biggest challenges is that you start with and say, "I can get something done very quickly because it's gonna be on some third party's infrastructure." That's not always necessarily the case because building out a cloud-based solution that integrates with your business still requires many of the same approaches you used before. One of the biggest issues is IT organizations are not necessarily prepared. The CIO of a major Fortune 500 company said to me, this is what I told my team. I said to my team, moving to the cloud for us is gonna be like jumping into the deep end of the pool and swimming to the shallow end. Some of you are not gonna make it because you have to change. You have to think about how you use technology very differently than how we've traditionally built monolithic systems. And it seems obvious that you would be able to make that change, but a lot of people can't, and IT is not necessarily completely prepared. Shadow IT. This has been a big issue. I think this one continues, where people believe that ultimately you're in a situation where instead of using your internal IT resources, you can go to a cloud provider, and now you don't have to depend on those internal folks. Well, that creates a lot of problems because that shadow IT organization isn't necessarily prepared to deal with some of the big issues. Issues like security. The cloud doesn't have to be less secure, but it's less mature today. Same thing with any of these devices, right? There's a lot of IT folks who will tell you, you know, you can't— they're not gonna allow iPhones on their corporate networks. That's a mistake because ultimately this is just another device. The maturity of this platform is what's at question, not is this a good device or can we make it secure. I promise you there's nothing on this device that is gonna make it harder to secure than that PC or that Mac. It's just a matter of maturing of the platform. And so when we think about security, there's a number of things that people worry about: access to the information, mistakes, maturity of the processes. And so I absolutely and fundamentally believe there is nothing inherently insecure about the cloud. It's more a matter of what vendors, what companies you work with that will enable you to know, can you trust it or not. All sites are not created equal. You mentioned in the opening comments that we used Salesforce.com. All our customer data is at Salesforce.com. We're the largest security company in the world. The reason that they like to use Symantec as an example is because they like to tell people, if it's good enough for the largest security vendor in the world, then it should be good enough for you. Now, what did we do to get ourselves comfortable that it was okay? We audited their infrastructure. We made them walk us through their processes that they use to make sure who has access to their systems. We took time to understand what was their scale-out plan. What was their plans around where their data would reside? We had to be very careful with that because we work in countries all over the world like Switzerland, who has data privacy laws that say, All their data has to reside in Switzerland. Meaning if you've got data on Swiss nationals, it has to reside in Switzerland. And so we went through and did an extensive process to make sure that we were comfortable that there was nothing that Salesforce would do that would put us at a higher risk than if we were running it ourselves. There's a couple myths. There'll be a big switch to the cloud. It won't, right? This is going to be— IT will continue to run a very large percentage of the total infrastructure of a corporation for many years to come. I met with Tim Campos. He's the CIO of Facebook. He told me that 70% of Facebook's infrastructure is cloud-based and 30% is still on-premise. They're the highest total percentage. This is not gonna be an A or B. This is going to be a combination. We'll still have plenty of on-premise capabilities and plenty of cloud-based services. Next myth. Ta-da! Cloud computing is IT commoditized. What's interesting is cloud computing should commoditize infrastructure. What it should also do is allow IT to spend their time doing high-value services and become more strategic inside of their companies. Instead of doing commodity work, they can focus on the applications that really make a difference to the business. Next myth: the cloud comes in a box. I don't know who makes this stuff up, but it's true. People think that you can just buy a piece of hardware, it's got some storage and compute power, and now you can set up a cloud. You'd be amazed how many vendors go out there and tell you, "You can just buy our box and you'll have a cloud instantaneously." Absolutely the wrong approach. The idea of the cloud computing is to use commodity components. I'll give you a number. Symantec manages 80 petabytes of data. It grows at 5 petabytes a quarter because we do online backup. We've got it down to 60 cents per gigabyte. So 60 cents per gigabyte is what it costs us to run that 80 petabyte storage infrastructure. We help companies like Apple build out their 500,000 square foot data center, it's all on commodity components. The idea is not to buy some expensive piece of hardware, it's to quite frankly commoditize the infrastructure. And then the last myth is customers are moving to the cloud. I, I kind of feel like this one's an interesting one because customers are utilizing a range of cloud-based services. As I mentioned earlier, 10 or so, 6 to 10 services per corporation, probably 400 or 500 being used by any large company at any given time. There's no such thing as the cloud, right? It's just a combination of a lot of publicly available services that are being utilized by companies to more efficiently run their business. From a consumer perspective, this one's kind of interesting. I spent some time on this one. We're more and more every day using new services. We're trying to figure out what are those great things that we use. Obviously we started with things like iTunes and other things, but it's just the beginning. If I think about all the possibilities, and this is what I think is a great thing to think about with these new services, is what are all the things that you can deliver to a consumer that previously they didn't have the ability to have? I'm confident we can secure public cloud-based services. I'm not confident we can change user behavior. And so that's where technology comes into play because we do have to figure out how do we keep folks like Mariel from making mistakes that will make them ultimately targets for wherever business they work in. Alright, as we wrap up here, couple more comments. What, what we like to talk about is any of these trends, you should take an information-centric view of the world because this is how you're going to be able to protect yourself going forward. What does this ultimately mean? What it means is what really matters is not this device or this device or the Kindle Fire or the next generation of Android that comes out. What matters is the information that you are utilizing every day. And so we like to say is you need to know how you protect the infrastructure where it is stored, how you have intelligence about who owns the information and who is ultimately accountable, and then some governance, some visibility into Who is using the information for what purpose? The reason I tell you this is because ultimately if we are going to make cloud computing secure, it requires an information-centric approach. Why do I say that? Because you just need to know what information you are going to put in somebody else's data center. I work with a chemical company that spends $1 billion creating a chemical. I met with the chief information security officer and she said, Enrique, it's 1% of our data. That's not getting out of my control. I'm going to have a very locked-down environment and I'm going to control that 1%. The other 20% or 30% that I need to be— keep confidential, I can put that in a cloud-based service. And the rest of it, it's public anyway, so it's okay. And so our approach to securing the cloud has to be this notion of taking an information-centric view. Because then you know what you can put out there without creating unnecessary risk. Now why is this hard? Seems— hopefully you think it is the right approach. A lot of folks in security think it is the right approach. The reason it is hard is because categorizing information is very difficult. Knowing what the 1% is a very, very difficult challenge. In the '50s, a book was written called "What Computers Can't Do." In the '90s it was updated and it said what computers still can't do. Computers struggle to be very good at knowing context so they can effectively categorize information. And so that's why this problem is not as trivial or as easy to solve as I make it sound with this one chart. But this is the approach we believe is important to securing cloud-based services, is taking an information-centric view of the world. And so my final slide is really— oops, my final slide is really that you can move to the cloud with confidence. It creates a lot of opportunity for consumer-based services and business-based services. We think it is the biggest change in technology over the last 30 years, and we expect a lot of new businesses to come out as a result of the move to both the public and private cloud.

Can you talk about what you're doing for national defense in terms of nation-states attacking US corporations and public sectors and grids?

Yeah. So the question is what are we doing as far as helping governments to protect themselves against cyber attacks. It's a big area. The Department of Homeland Security in 2001, 2002 created 17 sectors that they considered critical infrastructure. And so our goal is to work with DHS and other governments to do 4 things. First one is early warning. How do you know where and when you're going to be attacked? And so Symantec has built out something called the Global Intelligence Network that allows us to have data from all over the world that we combine with their data to try and determine where and when will the attacks happen. Andy Purdy, who used to be the Deputy Secretary at DHS, When he first testified for Congress, he said, "It's not a matter of if we will get attacked, but when and how often." Absolutely believe he was right. And if you look at our data today, critical infrastructure is absolutely not only under attack, but it's being— it's been completely mapped. We've got information that says networks that have air gaps, meaning they're not connected to the public internet, have absolutely completely been mapped. And that means that they can be attacked and are vulnerable. So one is early warning. Number two is protection. How do we protect against an attack? Because you're gonna be attacked. And so what are all the techniques? I mentioned early on that, uh, how rapidly we have to update our signatures and we can't keep up. It's not possible for us to keep up. So we've invented new technologies that we call reputation-based. And so now we have reputation on applications. 3.1 billion applications, we know their reputation. That's because we've collected information on 250 million endpoint devices. So if someone writes a malicious attack that's only running on one computer, we can determine that that doesn't have a good reputation because we can say— or at least we will categorize it as saying it doesn't have an initial good reputation. Because not many people are running it, potentially it was recently created, and we use a couple of other components to determine is it good or bad. So number 2 is protection. Number 3 is remediation. You have to believe that you're gonna be attacked, meaning people will get through no matter what defense you have, people will get through, and so you have to be able to clean it up. And the question is, can you remediate faster than the attack can spread? And in an interconnected world, you'd say it's hard to do that because attacks move at the speed of the network. But you got to be able to remediate. And then number 4, which we're not actively involved in, but governments around the world are, are the countermeasures. So if somebody has launched a massive denial of service attack against your infrastructure, how do you shut it off? I'd like to know how you protect your privacy online and what steps you take to protect your privacy. Yeah, well, I do a lot of different things. First, I have two credit cards. I have one credit card I use for online purchases, and I have one credit card I use for everything else. And if my online credit card gets compromised because I go to a site that I felt I should purchased something from and they decide to use those details, I can turn all of that off. That's the second thing though, is I try to only go to sites that have a good reputation. Unfortunately, sometimes you do a Google search or a search in your favorite search engine and a site comes up and you go say, okay, that's— I'm an avid skier, I love to ski, and I'm always looking for different paraphernalia to use on the ski slopes. Some of those are sites I don't recognize, and so I try to be mindful of what sites I'm visiting. And there's new tools out there and new things to try and help you know what sites you can trust and what sites you don't trust. The other thing is, you know, I try to make sure that anything I say is something I'm comfortable with everybody knowing, whether I put it up on a blog post or I put it up on a social media site. I want to make sure I tell myself I'm comfortable with that being out there forever. So those are 3 things that I think about. How do I do commerce? How do I put out information? And what sites do I visit? Professor's got a question. This could be a stumper. He's going to try to stump me.

So the hard one. You guys are not in the quiet period yet. So when we did the analysis looking at your stock price, of course, one thing that's obvious is that a lot of your competitors have been acquired by other big players. You guys kind of stand out as the big kahuna that has not yet been acquired. What do you think about Symantec as a standalone company?

Yeah, so today Symantec is about $7 billion in revenue. And I'm comfortable that the world needs an independent software company that works across platforms, meaning that PCs, Macs, AIX, Solaris, Unix, Windows. The world needs somebody who works across all of those different platforms and makes it easier for users to take advantage of those platforms. Now I would tell you, I think part of the reason that Symantec hasn't been acquired is that we have a fairly diverse business. We have a big consumer business. It's a $2+ billion business and we have a $5 billion enterprise business. and so there aren't a lot of companies that look like us that work on the diversity of platforms. And so that's another thing that I think keeps certain people away from our company. Now the good news is every quarter roughly 70% of our business comes off the balance sheet. It's recurring revenue. We've got $2 billion in free cash flow each year. And today I think I saw it on the drive up, we're valued at about $12 billion. So we're trading at 6 times cash flow. So your models are right. We absolutely are undervalued, and my job is to turn that around. So ultimately, I think when you're in this industry, you know, you're on the right side. You're trying to help people. You're trying to eliminate bad things from happening. And what we know is the hackers, the thieves, and the spies, they are very persistent. And so we've got a great opportunity to help a lot of people take advantage of technology. And the biggest barrier, I mean, to cloud adoption, to using these mobile devices, is security. And so protecting people from these attacks we feel is a worthwhile endeavor, and we feel pretty good at it. Thanks.

How secure is my iPhone, and how long until you guys really ramp up in that space?

How secure is your iPhone? Look, Apple's done a number of good things on the iPhone. The first thing that they did was they've isolated the applications from the core operating That isolation is a good thing because it doesn't allow malicious programs to get underneath the applications. So we think that's a plus. As far as the issue though is, it's really not about the device, it's about what you're gonna go do. And so for example, if somebody gets on this device, I use the internet on this thing every day, right? And so I go out to websites and And so how do I know that that website is not going to— when I try to authenticate myself and I think it's my bank, that it isn't, it's something else? Or when I go to— I pull down an application from the App Store, Apple tries to vet it, right? Apple goes through steps to try to vet the programs. But ultimately there's— what I know for sure is that applications have vulnerabilities. Vulnerabilities are hard to detect, and given that, you end up in a situation where the applications you run— and I'll give you an example. I use Pandora on here. I use Spotify on a device. So how do I know Pandora doesn't have some backdoor built in or inadvertently been left behind? And so the reason that you haven't seen attacks on these devices is because there's 1.4 billion PCs today in the world that are all easy targets. And so it's only a matter of time. When this device becomes 30% of the market, it will also be a target. We're investing around opportunities to— or we're investing in technologies to protect devices. We really think about it in a couple of different ways. One, we want to be able to authenticate you. You are who you say you are, because today this 4-digit PIN that I use on this device, 4 or 5, I have a 5 on this one, isn't sufficient, so we're gonna come up with new ways. Now I'll tell you, there's a big breakthrough gonna happen shortly if people are willing to use it, and you don't have to, 'cause some people will say it's a privacy violation, but because these devices have geolocation, if somebody tried to log in as me today in California, they shouldn't be able to, 'cause my device and I am at the Tuck School of Business in Hanover, New Hampshire, and so somebody logging in as me in California, the system should deny that access using the geolocation technology built into this device. So authentication is a big deal. Protecting information on this will become a big deal. And also managing the device, because as you put more applications, you see the way you manage this device today is through iTunes and the App Store, and that's not good enough. Corporations aren't going to allow this device into their environment if they can't manage it effectively. And so ultimately we're ramping up in those areas: authentication, data protection, and how do you manage the device effectively.