Steve Challans CISO Prophecy International - OCW22

Machine-generated from the episode audio and not hand-corrected, so names and technical terms may be imperfect. The audio is authoritative.

Welcome back to the CTO Advisors studio. Coverage of Oracle Cloud World 2022. This is my first Oracle Cloud World. We're live at the Venetian. I have with me Steve Challance, CISO. I don't know we get too many cheap information security officers on from Prophecy International, an Oracle customer. First off, welcome to the show. Thank you, glad to be here. It is nice to be back in person, live. You're from the other side of the world? Australia.

Yeah, I'll show you where the water runs in a different direction. Yeah, it goes in the toilet, the other way around. Well Steve, I really appreciate you taking time out of your busy schedule here at the show. I know everyone wants a piece of customers, being able to talk to customers, using products, pushing Oracle Cloud infrastructure on their solution. We looked at parts of the keynote, really great conversations about how customers are bringing the power of data cloud to the environment.

Some great customer references from banks, talking about data security and challenges. We'll get into that right after. You tell me, what exactly does Prophecy do? We're a software company. We've been in the software business for 40 years. So we've got two flagship products at the moment. One's called Snare, one's called Emite. Snare is a central log management solution that operates in the same space. So centralized logging, audit collection of logs from systems to allow people to do the forensic and analysis of who did what, when on their network.

And we've got Emite that does business analytics and primarily in the contact center space, where we help customers with their contact center solution and provide the needed business analytics to make sure the contact center is operating as efficiently as possible. So we're here specifically talking about the Oracle Cloud VMware service or solution. We did a nice report on it about two or three years ago and it is a solid solution from a technology perspective. But one of the interesting pieces of feedback that I get from the user community is that, wow, these types of services seem expensive.

The uplift with having both cloud infrastructure and VMware on top seems to be competitive to the idea of cloud enabling a pay-as-you-go model, etc. How did you guys come to the decision to go with OCVS? We did quite a bit of analysis on what we needed. I was hitting a dilemma because I also run the IT operations for the company. We're a CDO besides Saizo. We had to upgrade our computer infrastructure, which means I need a bigger computer room. We're looking to move offices.

So I had to build a new data center that was going to go down that path. I also looked at COLO facilities, so buying some rack space and a data center, put our own kit in it, costed that out, and then looked at OCVS. We've had a long relationship with Oracle over the last 20 odd years and been working closely with the account team on our SaaS offerings that we've been using within Oracle. So we explored and looked at the options of OCVS.

The cost of it wasn't that much more than doing it ourselves when I looked holistically at what we're trying to do for the business. We're maintaining the data center, building data centers, expanding the environments, versus doing it ourselves or going to a COLO facility. COLO facilities actually turned out to be the most expensive of options we actually looked at. But looking at what we wanted to achieve with that and enhancing our disaster recovery capability was also part of the solution of what we wanted to provide.

So we worked through a number of scenarios and did an initial test. We did a cold disaster recovery in OCVS, in Oracle, as part of our stepping stone to testing out the environment. That was quite a good success, gave us some good metrics, gave us a good understanding of the performance of it, and that led to a decision to move all of our infrastructure. So we've effectively closed down the data center and moved everything to Oracle. So there's a lot there to unpack, and we don't have a ton of time, so I'll try to be succinct.

There's a couple of things you keyed in for me. One, that it was cheaper than COLO. And I guess we need to give a sense of scale. How big is the environment? We've got a five-node cluster now, we're running OCVS, so not super massive. We've got a 500-odd virtual machines that we run within the VMware environment. Being a software development environment, and we run lots of virtual machines for testing this, testing that, regression testing things, and particularly on the SNARE side of the business, where we've got agents that need to be able to run on every flavor of Windows, and most flavors of Linux or Solaris, or Mac OS and other things.

So we have to be able to run agents on a lot of different hardware, so that necessitates having a lot of virtual machines and hardware. Don't have everything turned on at the same time, so we use vMotion and CI tools to turn on systems, turn off systems when we don't need. So if anyone has done log management before, they know it can be a massive amount of data. O. is a huge part of the equation. O. much before, way before you run out of CPU.

Is that the case with your development environment as well? How is Oracle being able to meet the needs of such an intensive workload? The development environment itself, when we're on-prem, that's part of what we had to upgrade, I was running out of puff on the hardware. It was only three-year-old hardware, but we had high-speed fiber control, SAN, fiber channel connected devices, and we're just running out of puff. Backups were taking in the order of 10 to 12 hours to run on a system, which meant availability windows are becoming problematic, even though I'm trying to do full backups on weekends and incrementals during the week.

O. performance improvement. Backups were taking 10 to 12 hours, now less than an hour, which made a huge difference to our availability and options it's given us for recovery point objectives for disaster recovery and things. We can take more smaller backups more often because it's so much faster. So from a business impact, that's critical because your team is based out of Australia, but you serve more than just that one geo, correct? So we've got using 15 regions within Oracle and OCI to service out our SAS customers.

Emhide itself is a SAS offering to our customers, and we run in 15 different regions around the world. So Oracle's having that presence of all the data centers around the world helps with our solution offering with that as well. So the other thing you mentioned that I really want to key in is disaster recovery. Some of the other VMware cloud solutions are kind of SAS based. Was that part of your testing to be able to use your existing disaster recovery processes, or did you have to develop net new disaster recovery processes for OCBS?

We modified what was there. So we use an object storage as part of the backup tiers and the repo servers and things within Oracle. But because we're an internal VMware shop before the move, it meant lifting and shifting all the infrastructure and over had the same skill set. We understood the environment, knew the technology, all but the implementation was a little different side in Oracle, but VMware was VMware. 7 before. But then architecturally, being able to spin up another OCBS environment in another geolocation for disaster recovery in the event of something bad happening in the primary location.

We do data replication of backups between the geolocations, so we've got full site redundancy in the event of something nasty happening. So Oracle makes hay of their intense focus on security. You're a CISO. You tell me, has Oracle kind of delivered in the controls you want to have in the partnerships you want to have to be able to secure your environment? It's definitely helped us in a lot of areas. A lot of the security controls have been enough for what we've needed, and some of the new offerings like the new network firewall capabilities and things have come online.

We're exploring and putting those in place as well. So from a security architecture, we've got good separation of duties, good network segmentation, isolation of workloads and systems. We've got good role-based access controls for users to be able to access the environment. So I've got developers are playing with Kubernetes and other things on other compartments in different parts of the environment, so we can keep them contained and what they're doing down there, while we've got all the other production or development workloads and other areas.

So let's talk about the growth of Oracle Cloud infrastructure outside of OCDS. One of the advantages that I hear a lot of these providers claim is that once you get your VMware workloads inside of that VMware Cloud solution, you can now use some of the other workloads or services. Oracle's big database shop. Have you guys or you folks expanded outside of OCDS or is OCDS the only service you use? Now we're using a number of services, using load balancers as a method of firewall and access for remote access to certain systems from other users or other networks.

We're also using and exploring some of the other WAF capabilities we want to be able to use within the environment. We use a number of OCR services. We're exploring open search capabilities for Elastic. My email application uses Elasticsearch as its capability for the database and we're using or looking to use the Oracle's version of that within our environment as well. So let's talk about kind of adoption because you have to not just deal with the technical parts of it, you have to deal with the people parts of adoption.

How has been the move from a primary on-premises VMware shop to using kind of this hybrid of cloud in need of cloud services from a people training perspective? Oracle have come to the party. We've used a number of lift services as part of the process to help us migrate, help education of the team, how to do things within Oracle environment. We were sending up specific VCNs or access controls or data flows and things between networks and how to actually do that with DRGs and other network infrastructure components.

So Oracle has really helped us with the training. A number of the team have also worked on their certifications within Oracle to help with their training and understanding as well. So one of the, again, marketing claims of these solutions that it's just it's just vSphere, both to kind of the chagrin but also from a operations perspective, it's just vSphere. Have you guys found that to be more or less true? 0, greatly you don't have to install it, that's nice. Has the team had to do any additional training because it's something unique to the public cloud for this implementation of vSphere?

For the vSphere, no. VMware was VMware and that just operates the same. What Oracle helped was part of the process was the design of a vSphere environment, making sure we're following best practices through the whole architecture. So we improved over what we'd had on-prem to use some newer architectures and newer methodologies of network segmentation, configuration of the VMware environment. So that was useful. So lastly, let's talk business outcomes. What have been some of the pleasant surprises from a business outcome perspective that either you predicted or just was as a kind of tertiary, wow, I didn't expect this type of business outcome?

Well, part of what we're moving to the cloud was looking forward to, we had less worries about hardware. So rather than the late-night calls from a disk failure or if something failed in the environment, that's now Oracle's department, they look after and maintain those systems from that side. So we just look after the operating system and configuration and the performance of the environment from more actually trying to run. So the physical aspects of that taken away and have to look after the data center has just removed some headaches from my life.

So that is always a nice thing. So on the flip side, your people get more time. What are they doing with that additional time? Helping automation through the environment, just working on the business value add of the services that we're providing to the development teams and our customers with environment. So focusing on what really matters, providing services to our customers. Steve, I really appreciate you taking time out of your schedule to come talk to us about Oracle Cloud VMware Service and how Prophecy is putting that to use in your development environment, some of the challenges and opportunities that you've seen as a result.

com. If I missed something, if you still are questioning the value of these types of services, I don't think there's a, from my perspective, a question of whether or not these services allow you to move faster. But if you don't buy it, DMs are open at CTO Advisor on Twitter. Let's have the conversation. I would love to hear your pushback. Until then, talk to you next CTO Advisor studio at Oracle Cloud World 2022.