- info
- Transcript

(upbeat music) From our studios in the heart of Silicon Valley, Palo Alto, California, this is a CUBE Conversation. Hi and welcome to the CUBE studios for another CUBE conversation, where we go in-depth with thought leaders driving innovation across the tech industry, I'm your host, Peter Burris. Every enterprise has to concern themselves with how they're going to go about insuring the appropriate access to those crucial applications that run the business, this is especially a key question in domains where the applications are a seminal feature of the operations. How can we set up IT so users see what they should see, can access what they can access, and that we have control overall about how these systems work. Now to have that conversation, we're here with Tony Ferguson, an IT infrastructure architect at MAN Energy solutions, Tony, welcome to theCUBE. Yeah, thank you. So, Tony, before we get into this crucial question about the appropriate level of visibility and the need for security between people, users, and applications, tell us a little bit about MAN Energy Solutions. Yeah, so we're a German-based company. I'm working out of Copenhagen, but we're a part of the Volkswagen group, we have 16,000 users globally across 100 locations. Our company, we make large diesel engines, we also make smaller versions in our German factory. In our company we have of course a lot of IoT on the actual engine, and of course we have corporate IT. My job is to secure all of this infrastructure. So, specifically, some of these big diesel engines as I understand it, are being placed in locations and use cases that have an absolute requirement for security. For example, driving a ship is a major feature of the way that your engines are being used within the world, have I got that right? Yeah, that's correct, and the scale of this, the number of engines and the number of vessels we need to access and the data we collect. It is critical infrastructure, we also have power plants, so it's really important that we secure this infrastructure. So it's an infrastructure that has very interesting physical characteristics but also has very interesting security characteristics. As you went into thinking about how you're going to improve the applicability of the overall infrastructure that you use to drive your business use cases, what were some of the issues that you find yourself struggling with? Yeah, a lot of issues actually, one of the first things is that we wanted to authenticate the actual engineer, and we wanted to make sure that right people got to the right assets, and we wanted to make sure that authentication was strong, so like the two-factor, multi-factor authentication. And we wanted to ensure that all the data between the engineer and the vessel was encrypted. And another big problem for us is scale, we need to scale the solution, and one of things that Zscaler brought for us is name-space routing, we had the ability to really scale this system without using IP addresses, or actually networking. So this solved really, a lot of problems for us in trying to get those engineers to all of the assets and IoT on the engine. Now one of the things that you noted as you moved forward, was this notion of a black cloud >> Yeah. Where you could formalize the types of relationships you wanted between your engineer users and other users, and the applications you were running on a global scalable basis to actually ensure the reliability of the product you had out in the field. Tell us a little bit about this notion of black cloud. Yeah, so it ties in to a little bit around zero trust, but how I see black cloud and how I sort of describe it is, everything is dark, right, so if there's an attacker and he scans, bulk scans my infrastructure he won't see anything, so basically we reduce the attack surface. That means that there's no answer back and by doing this, we remove all these vulnerabilities, all these zero day vulnerabilities, we remove this and in the same time we still allow that engineer to connect to the assets. Now, how does that work in an environment that is as physically constrained as integrating or inter-networking with sea-going vessels? Yeah, so of course a lot of this connectivity is over satellite, and of course it's across the internet, so it is important that we encrypt end to end. And it's important that we allow the right engineers to the right customers and we're able to access all these resources and to do federation and make sure there's strong authentication for our customers. We can really tell them that this, all this infrastructure is completely secured, dark, and it's extremely difficult to come into this black cloud. So you've got a challenge, the challenge that we've set up here is that you've got a use case that is constrained by the characteristics of the physical infrastructure, where the security needs are absolutely paramount and still has to scale, and very importantly be evolvable to allow you to be able to provide future classes of services that will further differentiate and improve your business. That suggests that these decisions you had to make about the characteristics of the solution was going to have an enormous impact ultimately on what you could achieve. Tell us little bit about the thought process you went through as you chose a set of technology suppliers to help you build out this black cloud and this application set. Yeah, so we looked at a lot of different solutions but a lot of these solutions were based around the old network style, around VPNs, around having firewalls, and around having ACLs. And a lot of this is really network-centric and what we were looking for is something that was more applications centric, something that moved up the stack and started to look at policy around what the user would want access to. So putting those users and applications together and creating meaningful policy based on the DNS, rather than on the IP layer, and this was really important for us, to be able to scale and really make meaningful policy. So in many respects, it allowed you to, not to necessarily de-emphasize, but refocus your network design, engineering, and management efforts from device-level assets and pre-liminal level assets-- >> Yes. To some of the assets that are really driving new classes of value, the applications of users and the data that these engines are streaming and the models that you're using to assure optimal performance of them, have I got that right? Yeah, that's exactly right. It's extremely important that that we don't have lateral movement, we look today, there's all sorts of wormable malware attacks, ransomware, and you can imagine if something got into this cloud that you wouldn't want it to laterally move. So it's not just about the products but it's also about making sure that all these assets are designed from the ground up, that they're dark as well, right. That even on the chance, that they can't speak to each other or there's very limited connectivity there. Tony this has been a fascinating conversation about how you've taken this notion of a black cloud and applied it to a really crucial business case within MAN energy, but I got to believe that this sets you up for a range of other use cases, the investments you've made here are going to offer new classes of payback in a lot of different use cases. How are you going to roll this black cloud concept using Zscaler, out to the rest of the organization and the rest of the work that's being performed? It's a good question, so when we first looked at this technology, we thought it was perfect for consultants because we could have very specific access policies and just allow them to the assets where we required. But then we also saw that there was so many other user cases here, for example, we are moving our applications from our data center to AWS and to Azure, and as we move those applications the users need to connect to this. So we're able to have this black cloud and have the connectivity to it, but we're not opening this to the internet. So as far as you're concerned, I don't even have any resources or servers in AWS because it's black, it's dark. So there's a huge amount of security that we can add to this, and then there's also a lot of other user cases, like company mergers. We had to buy companies so we could use this technology to merge another company together. Because you don't need to worry about the network anymore, you're just worried about getting applications to users. So I think there's a number of great applications for this technology, and I really see that this technology will really grow and I'm really excited about it. So moving away from a physical-orientation of the network to a more logical, application and user oriented, services orientated version of the network has opened up a lot of strategic possibilities. What's been the cost impact? Yeah so what's quite interesting, when you move to the cloud and move to a company like Zscaler, they're a software company, so forget about all the hardware. You can imagine we have a hundred locations globally, so we don't have to install all the hardware. We don't have to have VPN concentrators, we just have to have some software on the client, some software connectors in the cloud, then Zscaler do the magic. So for the business, they really love this technology because it is very simple, it's sitting in the background, they don't have to log on to the VPN all the time. So it's very seamless for the user, and for us, we save a lot of money on buying hardware and appliances. Excellent, Tony Ferguson, I want to thank you very much for being on theCUBE >> Thank you. Tony Ferguson's an IT infrastructure architect at MAN Energy Solutions, I'm Peter Burris, once again, until we have another Cube Conversation. (upbeat music)