The digital revolution continues to accelerate, as enterprises adjust to the post-pandemic marketplace. With SDN now well established, the next challenge is the adoption of SASE technologies, adding security and access into the mix. But what is the best way to secure enterprise networks in an ever-escalating threat environment? Aryaka purchased Secucloud in 2021, and over the last year has quickly moved to integrate and expand the technology across its platform. With us today to talk about Aryaka’s approach to secure connectivity is industry veteran and Chief Product Officer Renuka Nadkarni.
TR: What is your background and how did you get involved in cybersecurity at Aryaka?
RN: I have been in the cybersecurity space for twenty years and have been working on constantly evolving security challenges. I started with VPNs, then built firewalls, intrusion prevention technologies and network access control. Then I was at VMware where virtualization introduced different challenges and opportunity for security. It was a brand-new concept at the time. In fact, the term micro segmentation is something we invented for launch at VMworld in a conference room brainstorm with the field. Later, at Infoblox I introduced their DNS security portfolio, and most recently, I was at F5, which is a leader in the application delivery controller space. One thing I found interesting at both VMware and F5 was that they each had access to the network, which made it much easier to implement and enforce security controls.
What got me excited about Aryaka is the fact that we own the backbone as well as the entire connectivity between users and applications, which is extremely unique. It allows us to take the security to a whole new level by applying it ubiquitously and consistently, no matter where the users are coming from or where they are going. The combination of a distributed data plane for enforcement and a unified control plane helps with instantaneous security provisioning and configuration. I genuinely believe that this whole integration of networking and security is where the industry is heading, and that we are at the right place at the right time.
TR: What does Aryaka’s product portfolio look like today?
RN: Aryaka is a customer-centric company. We are focused on where our customers are at and where they want to be. We believe that the whole industry is going through a digital transformation that our customers are actually struggling with. This has been happening for a decade, but because of COVID and other macroeconomic trends like cloud adoption, it has even become more urgent. A decade ago, Aryaka tried to solve the networking global connectivity problem for our customers. If they were going to have cloud-hosted workloads and users in offices, we would give them global connectivity with guaranteed performance with low latency. That’s how we started our journey. What we quickly realized was that because all the traffic was going through us, it was actually much easier for us to do security enforcement. So, we got into the SASE space a couple of years ago, and we reinforced that with our Secucloud acquisition.
As we see our customers evolve in this journey, we feel it’s like the Maslow’s law of hierarchy. They solved the networking connectivity problems first. Now they are looking into solving the security problem, which is here and now. And I think eventually what most businesses want is to get intelligence and analytics about how the business is performing: what should they focus on, how they should strategize, which we call ‘observability’. Since we are on that journey with our customers, that’s what Aryaka is going to be focusing on: connectivity, security, and observability.
TR: In what ways have the unique challenges of the past several years shifted industry trends?
RN: Events have actually validated our beliefs about where things are going. The last three years have accelerated our customers digital transformation journey by 10x. They were already going to the cloud, but what changed over the last couple of years is that not only are the workloads anywhere but also the users are not in the offices anymore. It’s any-to-any, and that creates a lot of challenges in terms of access control, making sure that applications are available, protecting against threats, mitigating fraud, and meeting compliance and regulatory requirements. This is actually a big challenge that I think Aryaka is very well-positioned to solve. What we have seen is customers coming back to the basics and recognizing that a patchwork of 10s of different security products that work in one place and not another isn’t going to work. Coupled with the huge shortage of skilled labor, that creates demand for a managed service providing global connectivity along with security, which Aryaka can offer them.
TR: What is on the mind of enterprises when it comes to cybersecurity today? What do they need, and what threats do they fear?
RN: The biggest challenge for our customers is to apply security controls ubiquitously and consistently. Even the simplest security problems like access control are way more complex because of the hybrid environment its dynamic nature. Basic firewall rules are actually very simple in concept, but when the users are anywhere, and applications are anywhere, where should the firewall be? You don’t have a perimeter. Workloads are transient now; they are not something that you set and forget. In the olden days, firewall rules were something you would set and forget. You might revisit them years later to make changes. Today, if you have a marketing campaign, you might buy space on Amazon AWS, your users are somewhere, and you need to instantaneously provision the workloads and the networking and security along with it. That’s a very big difference in the way people do business.
Ransomware is also top of the mind for most customers. There are like 10 types of ransomware, each of which is a different attack technique exploiting the idea that there are remote users coming from anywhere using applications that are anywhere.
The second dimension to this whole conversation is attack sophistication. The attackers are looking at all these different new attack surfaces. We have known for a decade about advanced, persistent threats and how customers are targeted. But now attackers are focusing on a combination of things. So, for example, there was a threat actor that would actually look at a combination of a certain Kubernetes version in a certain cloud environment. They would go attack that particular combination and it didn’t matter who the customer was. Most customers don’t have an army of security analysts, but they are also subjected to the same kinds of attacks which were originally reserved more for targets like financial institutions. Now everybody feels equally vulnerable.
TR: How does Aryaka’s ownership of the network enable it to better meet such threats?
RN: The first simple example is how to make sure a company’s users have the right access control for URLs and which websites they go to. Today, customers are struggling with even this because they can’t apply these policies ubiquitously and consistently. This is where Aryaka’s underlay WAN fabric comes into the picture, because our customers send all the traffic between their branches and remote users to our WAN fabric where we apply all these policies.
As a second example, consider an extreme case of ransomware. We had a customer who had a by-the-book ransomware attack. Somebody clicked on a phishing marketing campaign and downloaded a piece of malware which spread within the site and then to multiple locations. That malware captured some intellectual property and exfiltrated it to the Internet, after which they started asking for a ransom. The customer came to us and asked for traffic analytics and asked us whether we could theoretically have told them about abnormal access based on all the traffic we see pass through. And yes, we could. When I talk about observability, we have seen up to 70% of the total traffic was bot-based. There are good bots and bad bots, but there is no way for the customer to know what is legit and what bad traffic taking up the bandwidth. We believe that because we have access to everything goes through our fabric, it’s actually much easier for us to analyze and provide that information to our customers.
TR: Has it gotten easier to convince enterprises to join the ongoing digital transformation? Or do you still face internal resistance to change?
RN: Earlier it was a ‘good to have’, where to be a modern CIO one should innovate and transform. But in recent times it has become a survival conversation. It has nothing to do with innovation now. I tell people a story about an egg vendor in our farmer’s market. They were a very basic business, non-technical and not IT oriented at all. But when COVID happened, they started online ordering and delivery. When people have to adapt to the new ways of consumers, it’s not about fancy stuff anymore. If they want to be in business, they have to do it.
TR: So, is cost cutting not even part of the conversation anymore?
RN: Cost cutting is still an interesting side effect. With the digital transformation and technology adoption, there are places where you save money and then there are places where you invest money, depending on which business you are in and what you do. There are many pockets of cost savings that come naturally to you because you’re not renting space for storing goods or for your shops. One big cost savings that Aryaka brings to the table is that with the shortage of skillsets in the labor market today it’s extremely difficult for people to hire and train people for a digital transformation. Not having to hire a brand-new team of specialized IT people is in itself also a very big cost savings. In fact, one of the interesting observations some have made is that newer ‘born-in-the-cloud’ companies don’t have a networking team or a dedicated network security team because they are using compute IaaS in the cloud. They don’t want to focus on that infrastructure, just on their business.
TR: You mentioned the Secucloud acquisition earlier. Is there room for further M&A to also help you enhance your portfolio?
RN: Secucloud was a great example of that thinking, and they brought a lot of good assets to us including some core underpinning technologies. On top of that, we are now looking to enhance things like data protection. But a lot of these conversations we can actually address today for our customers by partnerships. Our thinking is that we want to see where the customers take us. Based on where we see the traction, we may acquire in that space where we see the most need. But as of now, we still have to get the most value out of the Secucloud acquisition and get it adopted broadly within our customer base before we jump on to the next new thing.
TR: What hurdles lie ahead for your product roadmap?
RN: The big one is feature velocity, which boils down to how fast we can hire and how fast we can train. The acquisition we made was relatively small in size, so in order to integrate it we need to add security expertise across the board and the organization has to be amplified significantly. That means hiring, and hiring the right skill sets. That is likely to be our biggest bottleneck when it comes to executing and bring these features out.
TR: Thank you for talking with Telecom Ramblings!
If you haven't already, please take our Reader Survey! Just 3 questions to help us better understand who is reading Telecom Ramblings so we can serve you better!Categories: Industry Spotlight · SDN
Great interview, Rob.