Tech Talks Daily
00:08:11 · Neil C. Hughes, Paul Speciale
[00:08:11] S0: Love it. And vendor neutrality also sounds attractive, maybe even idealist... Idealistic to a certain extent. But where does it become difficult when storage platforms, cloud services, and AI tools all expose different capabilities? [00:08:26] S1: Yeah. That's also a tricky one. I think the neutrality argument is... Just means convincing yourself that every platform is not the same. Yeah. You really don't want to let one vendor's differences become your lock in. Right? So don't fall back to the lowest common denominator. S3 is a common API language, but the features underneath it like data retention, locking of objects, they behave different on all platforms. Okay? Our approach is to be open code. Okay? Every change we make, every fix we make gets committed upstream. People can view the code. There is no Scality specific fork. Okay? The other thing we do is we run on standard servers. So we don't sell you our proprietary storage server. You can buy it from HPE, Lenovo, Super Micro, Dell, whoever you like. Okay? So being as open as we can. That's really the best way to get to neutrality. [00:09:19] S0: And another question I'd love to ask you here. What does a a credible immutable recovery plan look like now, especially when we're living in this time where attackers could have been inside an environment long before the incident is discovered. It's a big talking point now with the quantum stuff as well now with GetNow and DecryptLayer, for example. Again, it could be a time bomb. Right?
00:09:19 · Neil C. Hughes, Paul Speciale
[00:09:19] S0: And another question I'd love to ask you here. What does a a credible immutable recovery plan look like now, especially when we're living in this time where attackers could have been inside an environment long before the incident is discovered. It's a big talking point now with the quantum stuff as well now with GetNow and DecryptLayer, for example. Again, it could be a time bomb. Right? [00:09:41] S1: It absolutely could. I think even two years ago, was hearing that most of these intrusions have been going on for months before they're detected. You know, now we're entering an era where AI can actually help power the ransomware. So I think things are going to get more scary. The answer to your question is obvious. You have to assume they're already in. Okay? [00:09:59] S0: Yeah.
00:09:59 · Neil C. Hughes, Paul Speciale
[00:09:59] S0: Yeah. [00:10:00] S1: And then make sure that there's one copy of your data they cannot touch and prove you can restore it fast. Okay? What we found in all the studies, and this isn't just from us, but from big vendors like Veeam, attackers go after the backup first. It's very pernicious. Right? They realize that if they go after the backups, you can't restore, and now you're really stuck, you're gonna have to pay the ransom or whatever they'll extort... Extorting you for. Right? So immutable really has to mean something. It means that even the administrator can't override things because you get social engineering attacks where people are threatened. Right? You have to set these retention periods really longer than an attacker is likely to sit undetected undetected. Right? And then I would say restore speed. You have to get a fast restore speed because if you have something that's safe, you want to get it back as soon as possible. And by the way, we're in an era where you're not restoring one file or an hour's worth of data, you're probably having to restore a whole data center. Right? So performance really matters. In the end, we think that's what's important and we have actually put our money behind it. We have a cyber guarantee. If you get attacked on our system, we pay you $100,000 USD.
00:11:10 · Neil C. Hughes, Paul Speciale
[00:11:10] S0: Oh, wow. And for people listening, maybe their their teams need to be testing that governance and sovereignty rules still hold when data moves across so many different locations and storage tiers. Always trying to give people listening a valuable takeaway. Any tips, hints, advice, or best practices that you could provide there? [00:11:29] S1: Yeah. I think our rule of thumb is that if it... If you have policies for this and you don't test it, then you're really just residing on hope. Yeah. You know, people have gotten really good. Corporations have gotten really good at testing code. It's continuous. It's after every change. I think what we still see is that governance and sovereignty checking happens kind of once a year at audit time. You need to do these tests, and you need to do negative tests. Try to move data somewhere where it isn't allowed and see that the system refuses. K? You can actually tag data and say its jurisdiction is here. Now you can make sure that every test moves it to somewhere that is enforcing that rule. Right? And always just keep an always current record of where all the data is. Number one problem in the organization is lack of visibility. Where are my backups? Where are things stored? Which one's the good one? Make sure that you have a current visible record of that.
00:11:29 · Paul Speciale, Neil C. Hughes
[00:11:29] S1: Yeah. I think our rule of thumb is that if it... If you have policies for this and you don't test it, then you're really just residing on hope. Yeah. You know, people have gotten really good. Corporations have gotten really good at testing code. It's continuous. It's after every change. I think what we still see is that governance and sovereignty checking happens kind of once a year at audit time. You need to do these tests, and you need to do negative tests. Try to move data somewhere where it isn't allowed and see that the system refuses. K? You can actually tag data and say its jurisdiction is here. Now you can make sure that every test moves it to somewhere that is enforcing that rule. Right? And always just keep an always current record of where all the data is. Number one problem in the organization is lack of visibility. Where are my backups? Where are things stored? Which one's the good one? Make sure that you have a current visible record of that. [00:12:22] S0: And you've seen so many big changes in this space. I know you've been in this... The the space a long time, seeing so many big changes, all these different trends. But what is it that changes for infrastructure teams listening when their AI inference runs on infrastructure that they actually own?
00:12:22 · Neil C. Hughes, Paul Speciale
[00:12:22] S0: And you've seen so many big changes in this space. I know you've been in this... The the space a long time, seeing so many big changes, all these different trends. But what is it that changes for infrastructure teams listening when their AI inference runs on infrastructure that they actually own? [00:12:38] S1: Yeah. I think the parallel here is to the cloud. Right? We had public cloud starting in the 2006, 2010 era with Amazon and all the like. Public cloud sounded great. And then everybody went into it and had this shock bill of all these surprise charges. I really think the same thing can happen here in AI. So the big changes, infrastructure teams need to become the owner of the AI bill. Okay? They're the ones who can manage it and make it smaller. If they do that, they will start tracking metrics like how much time to the first token, how much reuse is there, right? How much of the context becomes data that they need to actually manage? They can then make decisions more consciously about when does a model need to change, right? They'll find out things like the network matters more than people expect it. It's really the limiting factor a lot of times in the performance to keep the GPUs fed. So I think the lesson is the infrastructure team needs to become the owner of the AI bill, then they'll optimize it.