Cloud computing offers many benefits, including scalability, flexibility, and cost-effectiveness. Still, many enterprises face significant challenges when trying to adopt cloud technologies. The top reported challenges companies face when adopting cloud services include security and compliance concerns, integration and interoperability, cost management, lack of expertise, cultural resistance to change, performance and reliability, data migration, and managing multiple cloud vendors. So what strategies are IT leaders using to tackle these challenges and make the most of the potential cloud offers?

Contributor

• • Kemal Badur, Chief Technology Officer, The University of Chicago

Download Podcast

Apple Podcast, Google Podcast, Spotify, iHeartRadio, SoundCloud, TuneIn, and Stitcher. Find other syndication channels here or search CIO Talk Network podcast on any other app.

Explore More

• How Cloud Communications Is Driving Digital Transformation
• Optimizing Customer Experience and Engagement with Cloud-Based Platforms
• Make global deployment of direct routing seamless – Global Cloud Calling for MS Teams
• Report – Hybrid and Multicloud Strategies Accelerate Digital Transformation
• Whitepaper – Cloud Assured Cloud Secured
• Cloud Security as a Shared Responsibility
• Controlling Cloud Security Through Continuous Visibility
• Managing Cloud to Manage Itself
• Cloudy with a Hint of
• Cloudy Conversations

Transcript

Sanjog Aul [00:00:00]:
Hello and welcome to CTN. To learn more about the show, please visit ciotalknetwork.com and the topic for today is Cloud Security, Cost And Culture. Technology is concerned so what am I talking about here? So no one has to be sold on the value of cloud computing because it is utilized very well within the organization. It’s actually been well adopted but then at the same time we hear quite a few reported challenges, significant ones when people are trying to adopt and scale the use of cloud technology. So the ones which people are reporting the most are including like the security and the compliance concerns. There is an issue with integration and interoperability.

Sanjog Aul [00:00:49]:
There is a cost management or spend management issue, expertise, availability of people who know cloud well and who can manage and configure it to get the best output from it and then some of those organizations even have said that they have had cultural resistance to change when it comes to moving from regular apps to cloud based apps. Then there is performance and reliability, data migration and then when there are people who are or organizations who are using multiple cloud vendors, how do you handle that ecosystem? How do you have them work well with each other and how do they handle all the things that are required for you to manage when you’re handling multiple cloud vendors? Lot of different issues which of course we have to tackle effectively for us to make the most of this cloud based investments. So what are the specific strategies IT leaders are using to tackle these challenges and get the most out of cloud investments? So to discuss this I have Kemal Badur, who is the Assistant Vice President and Chief Technology Officer with the University of Chicago. Hey Kemal, how are you?

Kemal Badur [00:02:02]:
Good. Sanjog, how are you?

Sanjog Aul [00:02:04]:
Very good. Looking forward to having this conversation with you.

Kemal Badur [00:02:07]:
Same here.

Sanjog Aul [00:02:08]:
All right, beautiful. So Kibal, let’s start with the security and compliance concerns people are having when migrating to cloud. So while we know that it can give you amazing throughput, it can have almost unlimited compute power and everything else but then security and compliance has been holding a lot of organizations back from going full throttle. So what are those these IT leaders, including yourself, doing to tackle that and any best practices which in my view are best practices, Something which works. What is that best practice that you can share share with the listeners here.

Kemal Badur [00:02:49]:
First, thank you for hearing me. I’m really looking forward to this conversation. I would say for us the secret is to treat security as a first class citizen in our cloud journey. We include our security partners in everything we do and everything we have built in the cloud for our users has security baked in. Monitoring, identity training, auditing and more. And we believe we are very are successful in moving quickly, getting, giving our users what they want, but we are doing it with security. And I would also say the different people we have on our cloud team, whether they are developers, engineers, business analysts, they all consider security part of their job. So when they talk to a customer they will not just say, I’ll build this amazing thing for you.

Kemal Badur [00:03:37]:
Security will then come clean it up. And we did all of this because we believe we will not be successful if we just let people lose on these platforms to create digital tools to digital transformation and that security can come follow and clean up after that.

Sanjog Aul [00:03:53]:
So when you are looking at security and compliance, do you think we have to stop at just tech level or you’re also looking at the business users who we normally use to always caution to say, hey, anything do you do with an email click or something else you got to behave. Is there anything specifically that needs to be done with the user community or cloud is a behind the scenes and anything related to cloud security and compliance is more of a behind the scenes task.

Kemal Badur [00:04:21]:
So we have two different kinds of users in my perspective. The first are the people who are very worried about privacy and security all the time. The people in our medical center, the people who treat patients who do sensitive research, and the people who are either doing just regular work, office work, or doing research that is not sensitive. So between those two there is always, I mean, their interests are not the same. And when we are talking to them, our role is to make sure that we understand what they are trying to do and then advise them on what they need to pay attention to. For the compliance driven people, we need to be able to prove to them whatever cloud strategy we are pursuing or whatever vendor we are bringing in is going to be able to follow the requirements. So in our procurement guidelines, for example, we have a lot of, we have security checklists, including cloud stuff, we have business associate agreements that we signed for anything that will touch patient data. So all of that is the homework that we do upfront to make sure that anybody can see that they can trust whatever platform we are talking about to do what they need

Kemal Badur [00:05:25]:
and I would say at least 80% of cloud platforms that we have a relationship with have these contractual compliance frameworks in place because if we done that, we couldn’t get our work done. And for people who don’t care about this stuff at all, who just want to go do quick, crazy innovative things, it’s on us to make security kind of invisible to them and be able to say, we did the groundwork, we have the guardrails, they’re not going to bother you, but we will be able to onboard you quickly to your provider of choice but we have all the stuff in place to keep you secure without you having to worry about that. So we try to balance these two approaches to make sure that we are serving everybody well.

Sanjog Aul [00:06:10]:
Let’s talk about the integration and the interoperability issues that most organizations talk about when they are looking at this cloud adoption journey. It’s obvious that there will be integration and interoperability, but then the ecosystem keeps shifting. So is this a moving target or have you been able to figure out a way, it’s almost like a playbook that you have created to stay on top of all the changes that are coming?

Kemal Badur [00:06:42]:
Well, I mean, the answer is yes and no. It’s complicated. You’re right, it’s totally a complicated thing and the environment is shifting all the time. But what we have done is so about five years ago, we started deploying a very critical business function to a new platform provided by a SaaS vendor and at the very beginning of that journey, we saw this coming. We saw this requirement of pulling data from that platform to use it in other places, feeding data into the platform from existing on campus and other cloud systems and how complicated that will be. The business had a vision of what they want to accomplish there, and we had not done this before in a very meaningful sense.

Kemal Badur [00:07:27]:
And the great thing, I think, to the credit of our business and technology leaders at the time, was to say, we are not just going to buy this one tool, we are also going to invest in integration platform and we are going to have an integration strategy. So with that, so those two projects went side by side and as of a couple of years ago, we have an integration platform that we are using not just for that project and for that business, but we are using it in now in our finance business. We are using it to feed our data warehouse. We are using it to move data around across many platforms. So we were able to create that not just by the tool, but also create a strategy and an approach. We built a team, we built documentation, all the things you need, and now we can use that tool to apply to different problems that we have in the business and be able to do this together. Trying to do it one at a time, trying to take your data from this platform and writing a script to send it to your data warehouse, or vice versa, doing it one at a time is not a sustainable way of doing this.

Kemal Badur [00:08:33]:
So you need to have a strategy, you need a vision to execute on that strategy.

Sanjog Aul [00:08:38]:
Now, with that said, when you are looking at all the things that you’ve tried any suggested, again, I keep coming back to the word playbook, right? So since this is going to be a moving target, do you have a way to as soon as a new shift in the way the same old, or what I call as today’s normal is what do you do to pivot? Because while you’re trying to continue to set integration interoperability, you might reach a stable state, but suddenly there’s a disruption or while you’re working on integration interoperability, the very destination changes.

Kemal Badur [00:09:12]:
Yes.

Sanjog Aul [00:09:13]:
Is there a playbook to continue to stay on top of it or kind of change the tire of a moving car?

Kemal Badur [00:09:20]:
I think, I mean we actually went through that exact same exact situation you described recently on our financial system. We are currently on a mainframe, we are moving to a cloud based financial system. That’s a huge transformation and we realized during the project that the mainframe file transfers that we do to move data from one system to another or to send it to a bank for your payroll or whatever we are doing the system we have for that is not going to be sufficient for this new platform and we had not even planned for that but because we had an integration strategy, we could bring the same tool in play. We wrote same team that was doing the integration play for the whole organization and told them can you solve this business problem we have here with the tool sets you have and turns out they could. So we were fortunate that we had already made that investment and we could handle that problem and pivot in the right direction.

Kemal Badur [00:10:14]:
I would say my advice would be as a playbook, look at what you have today and talk to your leadership to see in five years, do you see the implications staying the same? Do you see this data staying in the same place or staying in the same level or whatever you want to call it and then based on that, see how we can actually plan, see how we can figure out what you can much you need to build, where you need to build it. I mean, to us I would say that has been the most beneficial thing to have some level of vision, some level of guidance from the business and from our technology leadership to be able to say, yeah, we can figure this out together and we can work on it together. That makes the people think much easier because we have talked about it before again, I mean, it’s hard, it’s easy to say this right now because we are In a relatively good spot. But I would say there is no time like today tries to build your strategy.

Sanjog Aul [00:11:09]:
And one of the biggest thing that came up was the spend management when it comes to cloud, right or rather bleeding that starts happening or hemorrhaging in some cases when they opened up the cloud usage to even the business users, the developers, so there was no holding back and only for them to find out there was a huge bill and now that you want to take away a facility that made their life easier, there’s an internal uproar about that. What is a good balanced approach to introducing cloud within an organization and to maintain a healthy ROI so that people don’t start or the management doesn’t stop frown, start frowning and in fact say you know what bring this stuff in house because I guess you our guys are making it too costly for us.

Kemal Badur [00:12:00]:
Yeah. So there are two answers to this question because there are different business models in the cloud. So for SaaS platforms where everything is subscription based, the subscription is usually on per user basis and those user based licensing is mostly beyond IT’s control. I can’t go to my finance business and say you don’t need licenses for your accountants on the finance cloud or you don’t need CRM licenses for your alumni relations people. So without that control we try to do two things. One, writing a great contract up front when you’re negotiating, when there is still competition, everyone that is willing to give you concessions and to write a long term contract. We’ve done that several times. It’s worked out really well for us to write a 5 year, 10 year contract and negotiate caps on annual raises

Kemal Badur [00:12:55]:
that’s been really good. After those expire you still negotiate but you again not no day like today to start figuring it out and the second thing that we do in a very distributed environment that we have a lot of people go buy their own subscription for this or that on the on their own for a three person team, for a ten person team and we work with procurements to get a review of what we are spending money on and now find opportunities to consolidate those licenses into one enterprise license. Which was great for security reasons, for compliance reasons, but also for cost savings. I mean this way we saved probably hundreds of thousands of dollars in excess funding by consolidating contracts. Now this is the SaaS side on IaaS, on infrastructure as a service, things are more complicated.

Kemal Badur [00:13:41]:
Just yesterday I listened to Airbnb’s CTO talk about how they saved $60 million a year in cloud infrastructure costs by rationalizing their usage and he talked about building dashboards, building building logic to establish the cost of doing business for a reservation, for onboarding a host, for a search, which is very interesting stuff. But the key thing that he mentioned was that the average virtual machine utilization they saw in their environment was 15% means machines are sitting idle 85% of the time. So I would say to save money here you need to have good insights, good monitoring. You need to know what your patterns look like, you need to know what your trends look like and then you need to be able to talk to your developers, system admins, whoever who is working on these platforms to get them to think about this. Not just the techno, as a technologist, but as a finance person this is called finops, it’s the cutesy abbreviation for it. You need to have people think about this and you need to pay attention to it

Kemal Badur [00:14:52]:
there is a lot of money to be saved. The Airbnb CTO said he estimates 50% of all cloud infrastructure spend as waste, which is embracing number and he believes that it can be saved. So I think it’s, there is a lot of opportunity out there, but it starts with looking at what you are doing and making sure your business is aware of what’s, what it’s trying to accomplish out there and hopefully we can help them do it in a more cost conscious way.

Sanjog Aul [00:15:20]:
And when you are trying to do this cost related management, it’s not just the money that you would spend with the public cloud, but also the talent that you want to bring in. Cost is of course one of the factors, but the availability and then keeping them engaged and excited and keeping them within the company. So there is a culture, there is a talent development plan, there is the technology skill development plan and the money you have to throw at it because these people don’t come cheap.

Kemal Badur [00:15:53]:
They don’t.

Sanjog Aul [00:15:54]:
So what is the magic formula that you deploying?

Kemal Badur [00:15:59]:
So you’re 100% right about this. And our strategy from the get go has been to grow our cloud talent at home. So we do individual development plans for employees, we ask them what they want to grow in, we ask them what they want to accomplish in their careers and unsurprisingly, many people are interested in the cloud and because it’s a new technology, it’s like you said, they get paid a lot better than people who are doing legacy or classical stuff, let’s call it and so we found those people and as they showed interest and competency, we invested in them, we got them a ton of training and we promote them into cloud positions where we could. So we have cloud engineers, we have cloud security architects. So we push people in that direction and we have been very successful. We also lose people

Kemal Badur [00:16:50]:
there are lots of people who go work for cloud providers after working in higher education to come back and tell us how we should use their platform. Well, we always have the challenge of losing people. I think it’s really important to invest in people and then show that they have better opportunities after they leave your organization. So I feel like we have a bunch of people who are interested in working in the cloud. We’re growing them still and it’s really important to keep doing that. I will tell you I failed several times trying to hire cloud talent out in the market because it’s very expensive and we can’t compete with the large providers out there or private companies who are trying to get the same talent. So investing in people is really important and culturally to touch on that part. I think again it’s really important for your employees to see that there are pathways for them to go advancing their careers within the organization.

Sanjog Aul [00:17:45]:
When you try to work with talent nd this is not going to stop.This whole race of working with cloud and that’s become our DNA.

Kemal Badur [00:17:55]:
Yes.

Sanjog Aul [00:17:57]:
Would you say once you built that pool, are you done or do you see any fundamental shifts coming in the way cloud will evolve that create yet another vacuum of talent because it’s not a one time solving problem and then going to Hawaii for a trip. Any constant challenge related to talent management, do you foresee?

Kemal Badur [00:18:22]:
I mean I think we are all at this point required to talk about AI in every conversation and that’s what we see. A huge challenge that’s going to be facing us in the next decade and more. How do we get to people to do the right thing? How do we. It’s very hard to know what the right thing is. I mean people talk about prompt engineers, AI developers, deep learning specialists. I mean I don’t know what we are going to need and in and I think it’s going to be the most like the providers are going to build these capabilities. They’re all rolling out their own AI flavored offerings, their own AI tools. And if our businesses want to use these things, and they will, they should want to use these things, we’ll need to be able to meet the demands

Kemal Badur [00:19:09]:
but right now it’s very vague to me how to grow a successful AI developer or a prompt engineer. It’s very early on. I’m trying to learn as much as I can and I’m looking forward to future guests in your podcast. So tell me how to go.

Sanjog Aul [00:19:25]:
Absolutely. I would love to have you back again. Yeah, and see, that’s why I was saying like, because when we do not know what to plan for, how on earth do we plan? And how do you sow the seeds? Right, so that’s the interesting part at the stage where we are at.

Kemal Badur [00:19:40]:
Yeah. And I’m so my teams are currently working on roadmap development for the next year. So we do this exercise every year. We have the sync teams focus on the technology stacks, sit down and tell us what is the ideal future state? What are they seeing on the horizon? Horizon. What goals do they have for themselves? And I encourage them all this year to find ways to experiment with AI, AI pilot projects, AI tools that they want to try out and I’m looking to learn from them. I mean, I have to admit I don’t know how old I sound to your listeners, but I’m pretty old. I’m not going to be the kind of person that could innovate the next thing here

Kemal Badur [00:20:24]:
and I’m looking at my staff, at my technologies to help us think through what’s coming next. So I’m trying to educate myself by reading, by talking to intelligent people. But I’m mainly interested in people who are early in their careers who are looking at this thing and saying I can do so much with this, I want to hear them say that out loud so that I can follow them. That’s kind of my cheat, my trick to stay ahead.

Sanjog Aul [00:20:48]:
Let’s take a quick break listeners. We’ll be right back. And after we come back, let’s look at that environment that yes, even handling one cloud is tough. Talk about multiple cloud vendors that you deal with and the multiple cloud environments that you have to deal with and getting them to talk to each other and making sense of all of that. How do organizations do it today? What are the challenges they’re facing and what should be done to make it the best multi cloud environment possible so that you exploit their coexistence together as multiple cloud vendor stack that you are managing. Please stay tuned. We’ll be right back.

Automated voice [00:21:28]:
Today, enterprise technology is both strategic and global. Each week on CTN CIO Talk Network, IT thought leaders from around the world share their experience with listeners as they discuss with sunjog all how they are trimming costs and partnering with business to innovate and help it become more competitive, better care for customers and improve the corporate bottom line. If you want to keep up with it thought leadership, listen to CTN CIO Talk Network with Sunjoke all@ciotalknetwork.com you are listening to CTN CIO Talk Network With Sun Joe Gal. To learn more about our program, please visit ciotalknetwork.com now back to the show.

Sanjog Aul [00:22:17]:
Welcome back. So Kemal, we already know we started with this cloud journey. We spoke about different challenges, but then that was one. And each of those vendors, they have their own agenda, which is they have their own revenue targets, their growth targets, market share targets, and they are competitive. And you want competitive competitors to come and work with you as if they were part of the same village, which I’m sure is not the easiest. So could you take us through a journey of how you guys as University of Chicago handled this multi cloud adoption journey and what have you learned during that journey?

Kemal Badur [00:23:06]:
Sure. So we are in a somewhat unique position in higher ed in that there is no central leadership that says we’re going to choose cloud provider A, we’re going to go all in and we’re going to work with them on everything that we do. Instead we have researchers, thought leaders, students who are going out there and looking for the best of breed for whatever they are trying to do, whether it’s training, machine learning model, looking at patient data and coming up with healthcare insights or using using cloud for teaching. What we end up with is somebody coming to us and saying I want to use provider A instead of provider C because they have this tool that I need to advance my research or my teaching. So that’s always been the case for us and that meant that our cloud team had to develop their expertise and capabilities across all providers, essentially. And there are some that I’m not going to mention. I mean, if somebody came to me and said they want to do some very minor, very small provider, I would say maybe you shouldn’t do that

Kemal Badur [00:24:13]:
but for the large ones, we have a lot of investment in them too be able to meet the needs that we have. The upside of that, I mean, it’s complicated that downside but the upside of that is exactly what you said. They know that they have to coexist with each other here and they also always want to be able to talk to our researchers, talk to us to be able to prove that they can do better than the next provider. So we are, I think, in a relatively good position to be able to not necessarily negotiate amazingly better rates or anything like that, but we can get a lot of resources and attention from providers. If we say we have this amazing project that we are working on that we look at this provider for what can you offer to us? We get a lot of attention that way. So that has been really good for us. In terms of complexity of multi cloud environment, I’m not super worried about that because people tend to stay in one place.

Kemal Badur [00:25:10]:
I don’t have too many use cases where somebody is developing a tool on one provider and they want to send data from that tool to another one to complete the application. It’s step forward but again we kind of play the field, if you will to because we are, we have so many different things that people want to accomplish and each provider has a different take on that kind of advanced features when it comes to doing things in research in advanced technology.

Sanjog Aul [00:25:38]:
Now when you’ve done this, whatever you’ve done, and you said you are in a unique position right within higher ed, but other people are not as lucky and or they do not have that unique positioning where you they could command. They don’t have as much leverage if you will. So how does one go about building relationships with them where they’re not only a good partner to you individually, but they are collectively able to sync kumbaya together so that you benefit as an organization. If you were not in a position like you are in higher ed because all other industries could also benefit, what would your recommendation be?

Kemal Badur [00:26:17]:
I think. Well, I’ve been in higher ed for a very long time, so I’m not sure how I can think as a finance person or a healthcare person. But my general approach to vendor relationships, especially strategic vendor relationships for vendors that you are not just cutting a check occasionally and buying something simple, is to engage them in deep conversations as much as you can. So I would say don’t just go to provider a buying need something from them, go to them to have a briefing with them every quarter, bring your senior leadership call to them so that you can communicate your needs to them and they can tell you about their features and have this ongoing discussion where you are not just in a transaction mode where they sell you servers and storage and you pay them a monthly bill, but you’re excited about their AI options. You want to learn about their capabilities for machine learning tools or Iot even if you’re not going to do all that much with them right away. Building that kind of deeper relationship I believe is really helpful to make sure that they are, they understand what you are trying to do, they understand what they can sell you eventually or immediately and then knowing that you are talking to everybody and you are building a strategy together, I think that’s the way maybe to get them to the table together instead of separately or trying to beat each other for each scrap of your business.

Sanjog Aul [00:27:47]:
And when you are trying to do this, is there any shift that you’re expecting in the cloud environment where today you might have confidence in all the major cloud providers, but as things are coming like Cloud 2.0 or Cloud 3.0, what would you recommend people do? Do they wait and watch for things to settle or to jump on the bandwagon? Because of course, there would be a tendency of one cloud provider versus another to try to say, hey, you take more payloads from me because I’m going to charge you more for that. So they’ll try to go after one or one cloud vendor will try to get the biggest share of the pie.

Kemal Badur [00:28:33]:
I mean, they will always try that and with rising interest rates, with inflation and uncertainty in business, I think we’re going to see a shift in the way that tech companies work with us where we might not get as good deals as we used to in the last 10 years. So that’s certainly going to be an interesting change. And I believe the, I mean, this is easier said than done. I’m going to admit that before saying it. Having an exit strategy is really important. Being able to say, I have this workload in the cloud right now in this provider, I can pull it and deploy it somewhere else without spending a million dollars.

Kemal Badur [00:29:18]:
That’s always a great thing to be able to say and over the last 10 years, our industry has innovated a lot with containers, with orchestration, with object stores. There’s a lot of stuff you can do to kind of package your applications, package your tools to be able to move somewhere else. That’s certainly something that’s worth investing in anytime in your clutcher to make sure that you are as agnostic as possible. I know it’s hard. I know it’s not easy to do. I have pretty high confidence in all the major providers that we use but yeah, it’s hard to say what’s going to happen in 12 months, 18 months, 2, 3 years if a provider decides, you know what, this is a side business for me

Kemal Badur [00:30:01]:
I’m not really interested in learning this anymore. I’m going to get out or I need to increase your prices by 500% because that’s how I’m going to make money that’s not a fun place to be. We experienced some of that with some providers I’m not going to mention and yes, we had some kind of an exit strategy, but it wasn’t great. So it’s always good to educate both yourself and your leadership about these things. I mean for a technology person, my, my most pressing advice will be to make sure that your business leadership understands your cloud journey and what the risks you are taking are, what risks you are mitigating are and what potential risks are coming up. So right now I would encourage every CIO, CTO to survey landscape and then go talk to your today business leadership about what inflation would mean for this environment, how layoffs at tech companies could impact the work you are doing with your cloud providers and play some what if games, do some scenario planning.

Kemal Badur [00:31:04]:
Again, it’s hard to get the attention from the people that I’m talking about here, but I think it’s the, it’s a very unstable time right now and that kind of planning would be very beneficial for everybody to understand where things to go and how we can work together instead of pointing fingers at each other when things start to go wrong.

Sanjog Aul [00:31:25]:
We spoke about cloud security earlier, but then how do you see the very landscape of cloud security? Because I remember earlier people used to say cloud security is an oxymoron, which means there is no possibility of cloud ever becoming secure. Now lately there are a lot of tools and service providers, folks who are started claiming that no, we can make the cloud secure, but at the same time the cloud, the security landscape itself is evolving. So if an organization is embracing cloud to the fullest, they have to step up in terms of, or rather up their security game and stay on top given the evolution. So what do you think is the best way for doing that?

Kemal Badur [00:32:16]:
First, the evolution has been very gratifying to watch. You’re right ten years ago when we would talk about putting something on the cloud RCQ, people would just laugh at the idea because it was considered so wild west, so immature and everything. Today that’s no longer the case. I would say the native tooling, the security capabilities that are integrated into those cloud platforms are at this point astounding. They are very capable, they are very good and we benefit a lot from using just the built in tools. And I mean just to give you an example, one of our providers for cloud storage recently rolled out ransomware protection. They have a constant watch over our storage, over our files, to detect a ransomware infection coming from one of one of our users, which is an amazing capability and that’s going to save us a potential a ton of heartburn just because they are doing it on their backend and as part of our subscription to them.

Kemal Badur [00:33:13]:
In addition to this native tooling that’s really good to see. The third party ecosystem is very robust at this point too. There are lots of providers who are providing great value at different levels of the cloud stack and it’s very honestly, it’s very hard to keep track of them and how this market is evolving. But I mean if you are starting off on your cloud journey or if you are looking to secure your cloud presence, now is a great time. So you will have a lot of outcomes for the future. Again, I’m going to go to AI. There is so much out there at this point. To your point earlier, we have presence in each cloud, we have data sitting across many different silos all over the place, including our own

Kemal Badur [00:33:56]:
and it’s very hard to watch over these things. And we talked about difficulty of hiring cloud people. Hiring security people is even harder and hiring cloud security people, that’s like the combination of the worst of both worlds and AI tools that can augment the capabilities of our incident responders, security architects, everybody else are going to be very, important and I’m already talking to vendors who have an AI strategy and they are generally focused on security as one of the primary use cases. So I think that the very exciting thing that’s going to happen in the future to not replace security people, we can do that, but augmenting their capabilities, making sense of this big mess of signal that we get from all these platforms we have, all these tools we have, that’s going to be an amazing advancement that I’m really looking forward to.

Sanjog Aul [00:34:48]:
Now one last question I have for you which is on one hand we want to use cloud to the fullest, maximize whatever agility it can bring and perhaps support innovation and maybe using AI or any other compute for data and analytics related. So everyone is looking forward to it but then at the same time we don’t want to go overboard undermining what the risks and concerns which we have with respect to cost and talent and security and everything else. So if we want to maximize that potential, what is that perfect pairing act or the balancing act that you recommend for leaders who are attempting to do the same?

Kemal Badur [00:35:32]:
So I’ll go back to what I said at the beginning. Security needs to be at the table, security needs to be a first class citizen instead of just an afterthought and I don’t believe a company is going to be strangled to death because security won’t let them innovate on the cloud or anywhere else. I think the problem that we tend to end up with is we want to go and innovate something. We want to do something cool, but before get talked to security first we forget to ask them about how they can help and in my experience, I mean I work with some not so great security people, I’m not going to pretend they don’t exist, but in my experience the huge majority of security people want to be there with you to help you, they want to support you, they want to guide you in your journey be there with you instead of just sniping at you from afar and preventing from innovating.

Kemal Badur [00:36:26]:
The really, I think the conflicts really arise because you invite security after you failed and they have to come clean your mess and at that point if they are your janitor, they are not going to particularly excited to work with you. So I would say your culture needs to focus on security not just to bring them to the table for decision making, for strategy, but also making sure that everybody sees security as their responsibility. So for example, if you are rewarding your developers for building as many apps as possible, pushing as many features out as possible, but if you’re not rewarding them for bug free code or for fixing bugs instead of writing features, then you’re giving them a signal. You’re telling them security is not their problem, security is not a priority. If you are telling your infrastructure people that moving servers to the cloud is their highest priority and nothing else matters and if you are not rewarding them for patching their servers or doing vulnerability management, well guess what, that’s a signal to them too. So for us, we always try to balance the two by saying the innovation and the security

Kemal Badur [00:37:39]:
by saying you need to do both. Tell us how we are going to do both and we are going to reward you for doing both. At the same time, we want to reward security people helping us innovate and we’re going to reward the innovative people for keeping us secure. That way, knit them together instead of making them enemies.

Sanjog Aul [00:37:57]:
Once again, thank you so much Kemal for sharing your insights about the topic that we discussed which is cloud security, cost and culture, the technology concerns that people have and how to mitigate them or address them so that we can maximize the potential for cloud. Thank you.

Kemal Badur [00:38:17]:
You’re welcome. I hope if your listeners will enjoy it. I certainly enjoyed now talking to you.

Sanjog Aul [00:38:24]:
And listeners please connect with us on social media and subscribe to our podcast. Once again, thank you for listening to CTN. This is your host Sanjog Aul signing off till next week. Take care and God bless.