TCP Talks | AI, FinOps & Cloud Leadership Interviews

Keep the Raccoons Out: Service Mesh, MCP, and Securing Agentic Workloads

With William Morgan, CEO of Buoyant and creator of Linkerd

Linkerd just turned 10, so we brought on the person who built it and coined the term “service mesh” in the first place. William Morgan joins Jonathan and Justin to talk about where service mesh came from, where it’s going, and the very specific kind of chaos that agentic AI is about to unleash on anyone who owns a Kubernetes cluster. The short version: lock your doors, because the raccoons are coming.

“Our job is basically to make Linkerd as boring as possible.”

William traces Linkerd’s origins back to Twitter’s infrastructure work between 2010 and 2014, when a Ruby on Rails monolith turned into a sprawling distributed system — the same problems we have today, just a different decade. As the fifth project ever to join the CNCF, Linkerd has had a front-row seat to the ecosystem’s evolution, and William explains why his actual goal these days is to make it as boring as humanly possible: the kind of dependable infrastructure layer you can trust to still be around in another 90 years. That’s also why he’s not adding AI to Linkerd — an infrastructure layer has to be fast, lightweight, and predictable, and generative AI is the opposite of all three.

“At some point your agentic workload is going to figure out how to delete the production database. And it’s going to try it.”

The heart of the conversation is what the AI wave means for the platform teams who own the clusters. Developers just got an army of AI assistants, and that has real consequences for CI/CD, code quality, and blast radius. William digs into the boundary problem — agentic workloads are untrusted but need access to your most important systems — and why zero trust has suddenly stopped being optional now that the code hitting your database no longer clears peer review and a security committee. Along the way they get into cache-aware routing that can take a 13-second inference call down to one, the still-unsolved mess of agentic identity, and why we keep anthropomorphizing these tools and letting our guard down.

“If you don’t use Linkerd, your data system will be overrun by raccoons.”

Finally, they turn to MCP — building a catalog of MCP servers, detecting tool calls, and adding DLP-style protection in front of the services an agent never sees. But William’s real point is that MCP is something of a red herring for a much older problem: uncontrolled access to your APIs. Whatever protocol you use, once an unconstrained workload is loose in your environment, you need an immune system to keep it in check.

Links and resources:

The Cloud Pod

Visit thecloudpod.net to subscribe, join our Slack, or sign up for the weekly newsletter. Thanks to William for joining us, and thanks for listening.

For this special edition of TCP Talks, Justin Brodley is joined by four distinguished guests from the FinOps Foundation following the recent FinOps X conference in San Diego. Rob Martin, Mike Fuller, Graham Murphy, and the TCP team dive deep into the evolution of FinOps from pure cloud cost management to the broader “Cloud Plus” world, the rapid adoption of Focus 1.2, and how AI is transforming both what we manage and how we manage it.

Rob Martin has been with the FinOps Foundation for four years, currently focusing on the AI working group, ITAM initiatives, and the rapidly growing public sector adoption. His experience spans training development and strategic initiatives that have helped shape the foundation’s direction during a period of explosive growth.

Mike Fuller is one of the founding members of the FinOps Foundation and co-author of the Cloud FinOps book. As a member of the Focus project steering committee, he’s been instrumental in developing the specification that’s standardizing cloud billing data across the industry.

Graham Murphy serves as Director of SaaS P&L for Technology One in Brisbane. With 8-9 years in FinOps and recently nominated as both a FinOps Ambassador and Focus Ambassador, Graham brings a practitioner’s perspective from the APAC region and insights on implementing Focus in a SaaS environment.

The 2025 FinOps X conference in San Diego marked a significant milestone with approximately 2,000 attendees—a substantial increase from the previous year. Despite the larger venue, the conference maintained its intimate feel, allowing for meaningful connections and knowledge sharing.

2:49 Graham: “AI definitely grew a lot this year. A lot more talk about how you go about managing AI, how FinOps is going to drive better value out of your AI investments. And also just a lot of people trying to understand where to start.”

The conference format evolved with more senior leadership participation, including executives from PepsiCo, Ticketmaster, and Nubank sharing their FinOps journeys. The quality of presentations notably improved, with practitioners willing to share deeper insights into their mature FinOps programs.

A dominant theme throughout the conference was the expansion beyond traditional cloud cost management into what the foundation calls “Cloud Plus”—encompassing SaaS, data center, licensing, and AI costs.

4:31 Mike: “We saw that sort of echoed quite well across many of the breakout sessions by practitioners exactly how they’re sort of incorporating other costs into the conversation of their practices.”

6:56 Rob: “Ticketmaster said something that I loved, which was that they were ‘happily hybrid’… we understand that we’ve got all these different modalities that we’re going to use to deliver value—SaaS models and data center models and cloud models.”

This shift represents a fundamental change in how organizations view FinOps, moving from a cloud-specific practice to a comprehensive IT financial management approach.

The release of Focus 1.2 at the conference marked a pivotal moment for billing data standardization. The specification now includes support for SaaS costs and virtual currencies like tokens and credits—critical for AI and modern consumption-based pricing models.

16:23 Mike: “The big tagline for Focus 1.2 was sort of keeping up with how FinOps is approaching that Cloud Plus world with the introduction of columns that really help bring in SaaS costs.”

The adoption curve for Focus has been remarkable:

19:53 Rob: “Last year, people were saying ‘Tell me what is Focus?’ In Barcelona, they asked ‘How do I actually start using it?’ This year, almost every conversation was ‘I’m trying to get my data into Focus, and this is how we’re doing it.'”

Major milestones include:

The transformation in AI cost management over the past year has been dramatic. Organizations have moved from wondering if they should worry about AI costs to actively managing significant AI spending.

13:31 Rob: “We’ve got private connections to some customers where we’re serializing 400 gigabits per second line rate to them, so that they can very, very rapidly move libraries of data to tightly schedule back to back with perhaps maybe a GPU farm instance.”

Organizations face two distinct AI-related challenges:

25:42 Graham: “We did a top down view, and we did a bottom up view… What was interesting is we intersected almost perfectly across the middle in what we had forecast the spend/cost profile might look like.”

Despite the growth and sophistication of tools and practices, the community continues to acknowledge that “there are no runners” in FinOps maturity.

8:10 Graham: “There is still quite a lot of people in that crawl/walk phase… As the keynotes alluded to as well, there are no runners. And it still seems to be quite true.”

This reflects the rapidly evolving nature of cloud technology, pricing models, and the continuous expansion of FinOps scope into new areas.

The conference revealed a trend toward specialization within FinOps practices:

32:51 Justin: “I think you’re going to see people who get kind of more into specialized areas of the FinOps frameworks… I’m really big on the data part of it. I’m really big about the strategic application of that data into my business.”

This specialization is reflected in the new framework’s “scopes” concept, allowing practitioners to focus on specific technology areas or cost domains while maintaining alignment with overall business strategy.

A significant shift in FinOps messaging emerged at the conference—moving from cost-focused discussions to value and efficiency conversations.

35:50 Graham: “If you keep going to your engineers and say, ‘Hey, listen, your costs are out of control’… that will start to get people offside. But if you can start to talk to them about efficiency and scaling quicker and providing better value to the customer, that’s much more valuable.”

38:53 Graham: “Managing exchange rate fluctuations and how vendors can hit you in your underlying costs… That’s our next challenge for the next 12 months.”

41:12 Mike: “There’s a pocket of the community that really has a high desire for sustainability… there’s a lot of organizations that aren’t prioritizing the sustainability conversation in the FinOps space yet.”

43:42 Rob: “Most people who were reporting on data center costs… were really focusing on understanding usage and cost… But they weren’t really optimizing a lot in those areas yet.”

The keynote featuring Nubank’s journey from zero to 100+ million customers in five years demonstrated the framework’s scalability and adaptability under extreme growth conditions.

For perhaps the only conference where it happens, all four major cloud providers (AWS, Azure, Google Cloud, and presumably Oracle) appeared on stage together during day one—a testament to FinOps’ unique position in the industry.

The intimate chalk talk format proved particularly valuable, with practitioners engaging in deep, interactive discussions about specific challenges and solutions.

On Framework Evolution: “It’s not just cost management anymore… My drivers are very much around the value and efficiency side of things.”

On AI Impact: “The way that this customer cohort has changed over the last two years is nothing short of astonishing.”

On Focus Adoption: “The word is out and the excitement is out about it, and now we’re down to the implementation details.”

On Public Sector Leadership: “This is one of the areas where public sector is really, I think, in many ways, advanced over private sector organizations.”

On Practitioner Challenges: “There’s never been enough time to do all the FinOps you want. But now there’s going to be even more as it starts to expand into Cloud Plus.”

Save the Date: June 8-11, 2026 in San Diego Rob emphasizes this is “called family planning for a reason”—book your calendars now!

FinOps X 2025 demonstrated that the practice has definitively moved beyond its cloud cost management origins. With Focus 1.2 providing the standardization backbone, government adoption driving private sector compliance, and AI creating both challenges and opportunities, FinOps practitioners are positioned at the center of IT financial transformation.

The expansion into “Cloud Plus” reflects the reality that modern IT environments are hybrid by default, requiring holistic approaches to cost management across cloud, SaaS, data center, and emerging technologies. As organizations mature in their cloud journey, FinOps evolves from a cost-control function to a strategic enabler of business value through technology efficiency.

The message is clear: FinOps is no longer just about managing cloud costs—it’s about optimizing the entire technology investment portfolio to drive business outcomes.

Visit thecloudpod.net to subscribe to the show, join our Slack channel, or sign up for our weekly newsletter. For sponsorship opportunities and to reach our audience, visit our sponsorship page.

Thanks to Rob Martin, Mike Fuller, and Graham Murphy for joining us, and thank you for listening to TCP Talks!

For this special edition of TCP Talks, Justin Brodley and Matthew Kohn are joined by Chris Opat, SVP of Cloud Operations at Backblaze, to discuss how the cloud storage innovator is reshaping the industry landscape. From their origins as a consumer backup company to becoming a major player in enterprise cloud storage, Chris shares insights on AI workloads, the true cost of egress fees, and why your data doesn’t have to live in a walled garden.

Backblaze started in 2007 with a simple mission: make storage so affordable it’s almost free. The company gained early notoriety for their DIY approach to storage infrastructure, with founders literally bending metal in apartments and conducting “gorilla storage purchasing” raids at Bay Area Best Buys and Fry’s Electronics to build their custom red storage pods. This scrappy, cost-conscious DNA remains central to the company’s identity today.

In September 2015, Backblaze made their enterprise pivot with the launch of B2 Cloud Storage, entering the market at one-quarter the cost of Amazon S3. By December of that launch year, they had already attracted over 30,000 users. Today, Backblaze (NASDAQ: BLZE) manages approximately 4.7 exabytes of data across 310,000+ drives, serving over 500,000 customers in 175 countries.

What sets Backblaze apart isn’t just their pricing—it’s their philosophy. While hyperscalers have built complex storage tiers with Byzantine billing structures, Backblaze offers one tier of hot storage with transparent, predictable pricing. Their recent push into AI workloads with B2 Overdrive demonstrates their ability to evolve with market demands while maintaining their core value proposition.

Chris Opat joined Backblaze as SVP of Cloud Operations in 2023, bringing over 25 years of experience in building teams and technology at startup and scale-up companies. Before Backblaze, he served as SVP of Platform Engineering and Operations at StackPath, specializing in edge technology and content delivery.

His background includes extensive work with private equity portfolio companies, where he honed his skills in rapid transformation and growth. Chris describes himself as someone who thrives in “David vs. Goliath” scenarios, making Backblaze—with its mission to challenge the hyperscaler incumbents—a perfect fit. His passion for building exceptional technical teams and pushing technological boundaries aligns perfectly with Backblaze’s innovative culture.

3:15 Chris: “Nothing makes me happier than to watch a customer choose us over the incumbent competitors and have an exceptionally good experience. It’s easy to work for the incumbents and kind of win all the time. It feels so much better when you do it as the upstart that people don’t see coming.”

Chris emphasized how Backblaze offers a fundamentally different partner experience compared to hyperscalers. While AWS, Azure, and Google Cloud may provide excellent services, they often lack the personal touch and flexibility that smaller customers need. At Backblaze, customers can directly influence product strategy and speak with decision-makers who shape the company’s direction.

7:59 Chris: “Everybody who uses a hyperscaler is very familiar with the taxation of egress fees. It’s not a trivial subject… If you don’t know what you’re doing with a hyperscaler, egress fees can quickly sour your experience. They can drain your budget.”

The discussion on egress fees revealed one of Backblaze’s key differentiators: their no egress fee policy through their Bandwidth Alliance partnerships. Chris shared a compelling example of a customer who saved hundreds of thousands of dollars on egress fees in their first year with Backblaze. This transparent pricing model contrasts sharply with hyperscalers, where egress costs can spiral out of control.

When asked about recent announcements from Google and Amazon regarding “free” egress, Chris didn’t mince words:

10:07 Chris: “The devil’s in the details… The only way that they honor the free egress for repatriating your data is if you cancel all the services, and the cancellation timeframe… it’s something pretty brisk. It’s like 90 days or something.”

The conversation revealed how dramatically Backblaze’s customer base has evolved, particularly with AI workloads:

13:31 Chris: “We’ve got private connections to some customers where we’re serializing 400 gigabits per second line rate to them, so that they can very, very rapidly move libraries of data to tightly schedule back to back with perhaps maybe a GPU farm instance that they’ve got booked.”

This represents a massive shift from their traditional backup use cases. The new B2 Overdrive product specifically addresses these high-bandwidth needs, offering performance levels that Chris claims most competitors “will not entertain giving you… They just flat out won’t.”

Managing 4.7 exabytes across 310,000+ drives requires sophisticated capacity planning:

12:00 Chris: “It’s a full-time science to be fair. We’ve got people who are fully dedicated to this, and that’s what they do all day… We do nightly linear regressions on the installed environment.”

Chris described the “triangle of tension” between reads, writes, and deletes on drives, explaining how they must carefully balance IOPS to ensure no customer experiences performance degradation. The shift from predictable consumer backup patterns to volatile AI workload demands has made this exponentially more complex.

With increasing global regulations around data privacy, Backblaze has invested heavily in ensuring compliance:

28:31 Chris: “When we designed our cluster in Toronto, data privacy and data sovereignty and security is taken extremely seriously there… We very, very carefully curated our network in market to ensure that Canadian customers would have their traffic ingress and egress through Canadian providers end to end.”

This attention to data sovereignty extends beyond just storage location—it includes network routing, ensuring data never leaves jurisdictional boundaries unless explicitly requested by the customer.

The discussion touched on the growing importance of environmental considerations in data center operations:

31:55 Chris: “When we do a site selection process, we want to make sure that… their PUE and their operating profile fits what matches our personality… Being able to pass along a high efficiency PUE to a customer, it’s great for business.”

Chris highlighted their Stockton, California facility as an example of their commitment to efficiency, noting it has “one of the most incredible PUEs ever.”

Backblaze’s flat-rate, single-tier storage model eliminates the complexity of hyperscaler billing. No glacial retrieval fees, no complex lifecycle policies—just predictable costs.

The Bandwidth Alliance and no-egress-fee policy aren’t just marketing—they represent fundamental architectural decisions that save customers real money, especially for AI/ML workloads that require frequent data access.

B2 Overdrive’s ability to deliver 400 Gbps demonstrates that alternative cloud providers can match or exceed hyperscaler performance for specific use cases.

Strategic placement near GPU compute farms and careful attention to data sovereignty requirements shows Backblaze understands modern workload requirements.

Unlike hyperscalers where you need significant spend to get personal attention, Backblaze offers direct access to decision-makers and the ability to influence product direction.

Chris revealed that Backblaze has moved beyond their famous DIY storage pods to work with OEM partners, enabling them to scale more efficiently while maintaining cost advantages. They’re also exploring flash storage integration to better serve high-IOPS workloads, particularly for AI inference use cases.

The emphasis on peering relationships and private network interconnects (PNIs) demonstrates sophisticated network planning. Customers can specify routing preferences, including requirements for traffic to never transit the public internet.

The shift from predictable backup workloads to volatile AI demands has required new approaches:

Chris’s insights suggest several important trends:

On Customer Experience: “You probably can talk to people at Backblaze that are very influential, that are shaping the strategy of what we do. There’s every opportunity to help us guide part of our product strategy.”

On Pricing Transparency: “Customer: “Sometimes we’re not even sure you’re storing our data. Like, how do you do it for so little money? Like, what’s the trick behind the curtain?” Chris: It’s like, No, trust us. We’ve got all your data. It’s got 11 nines of durability, and it’s all there.”

On AI Workload Patterns: “The rate of churn of the data is also an occasional topic where customers say, ‘All right, we’re finished with that library. Let’s get rid of it, and let’s bring on a whole new library of data.'”

On Market Position: “We’re knocking up wins on the board every week, and that feels terrific. It’s easy to work for the incumbents and kind of win all the time. It feels so much better when you do it as the upstart.”

On Data Sovereignty: “That data is not leaving the borders of Canada unless there’s some kind of a very large catastrophe, which we don’t want to imagine.”

This TCP Talks episode reveals how Backblaze has evolved from a scrappy backup startup to a serious enterprise storage contender. Chris Opat’s insights demonstrate that competing with hyperscalers isn’t just about price—it’s about understanding customer pain points around egress fees, performance requirements for AI workloads, and the need for genuine partnership.

As AI workloads continue to drive massive storage demands and data sovereignty regulations become more complex, Backblaze’s approach of simple pricing, no egress fees, and strategic geographic expansion positions them well for continued growth. Their recent B2 Overdrive launch shows they’re not content to just be the budget option—they’re actively competing on performance for the most demanding workloads.

For organizations evaluating cloud storage options, particularly those with AI/ML workloads or significant data egress needs, this conversation provides valuable insights into why alternative providers deserve serious consideration alongside the hyperscaler incumbents.

Visit thecloudpod.net to subscribe to the show, join our Slack channel, or sign up for our weekly newsletter. For sponsorship opportunities and to reach our audience, visit our sponsorship page.

Thanks to Chris Opat for joining us, and thank you for listening to TCP Talk

The Cloud Pod Puts a Hex-LLM on all these AI Announcements

Welcome to episode 270 of the Cloud Pod Podcast – where the forecast is always cloudy! Jonathan, Ryan, Matt and Justin are your hosts today as we sort through all of the cloud and AI news of the week, including updates to the Crowdstrike BSOD event, more info on that proposed Wiz takeover (spoiler alert: it’s toast) and some updates to Bedrock. All this and more news, right now on the Cloud Pod! 

01:33 In what feels suspiciously like an SNL skit, CrowdStrike sent its partners $10 Uber Eats gift cards as an apology for mass IT outage

04:37 Jonathan – “I think part of the blame was on the EU, wasn’t it, against Microsoft, in fact, for making Microsoft continue to give kernel level access to these types of integrations. Microsoft wanted to provide all this functionality through an API, which would have been safe. They wouldn’t have caused a blue screen if there had been an error. But in the EU, there were complaints from antivirus vendors. They wanted direct access to things in the kernel rather than going through an API.”

08:57 Delta hires David Boies to seek damages from CrowdStrike, Microsoft after outage 

12:23 Cyber-security firm rejects $23bn Google takeover  

13:33 Justin – “I mean, I don’t know why they’re not going public now. mean, at 500 million in ARR and the number of employees, their costs, their margins have to be really good unless they’re paying a ton of money for marketing. yeah, it’s something IPO I’ll be keeping an eye out for.”

14:18  Introducing Llama 3.1: Our most capable models to date

What Meta’s Largest Llama Model is Missing 

Meta’s Llama 3.1 is now available on Google Cloud 

A New Standard in Open Source AI: Meta Llama 3.1 on Databricks 

Meta Llama 3.1 generative AI models now available in Amazon SageMaker JumpStart

Meta Llama 3.1 generative AI models now available in Amazon Bedrock  

Announcing Llama 3.1 405B, 70B, and 8B models from Meta in Amazon Bedrock 

Meta’s Llama 3.1 405B Now Available for Enterprise App Development in Snowflake Cortex AI

Meta Llama 3.1 now available on Workers AI  

16:03 Snowflake Cortex AI Launches Cortex Guard to Implement LLM Safeguards  

17:56 Justin – “If I was going into production with an LLM of any kind on my website, I would definitely be looking to get some safeguards. Because like this type of stuff, you have to be thinking about how to protect against these types of attacks all the time. Because these prompt hijacking attacks are just, people are getting good at them, they’re getting to the point where they can break in raw data. Even Apple Intelligence, which is the new Apple AI, people were jailbreaking it already, now, in the beta where the people they were getting like releases of information of certain iPhone models that are coming out like not specific hardware information but like model numbers and Revision numbers for the hardware that shouldn’t be public information. So you got to be careful with these AI models.”

21:59 SearchGPT Prototype

22:56 Ryan – “This is kind of like when they were announced Bard, right, it felt very search heavy, like very opinionated. So it’s kind of funny to see it come kind of full circle, because Google had to pivot very quickly to something that wasn’t very search oriented, because that’s not what people wanted. And now to see OpenAI kind of go back the other way is fun.”

28:15 Justin – “I’m sort of intrigued by the idea of it. But one thing about most of these models, OpenAI, Claude, et cetera, they’re really not helpful for things that are happening very soon or occurred since the model was built. And most of them don’t stay up to date.”

28:35  Introducing AWS End User Messaging

29:26 Jonathan – “Anything’s better than Twilio.”

30:02 Mistral Large 2 is now available in Amazon Bedrock  

30:40 Jonathan – “So I think the best thing about Michel 2 is that it was specifically trained to know things that it didn’t know. So instead of hallucinating some answer that sounds plausible, it does a pretty good job of saying, I don’t know the answer to that question, which is awesome. Everyone should do the same thing.

33:44 How to migrate your AWS CodeCommit repository to another Git provider 

37:54 Justin – “…Code Commit in particular is in a lot of Amazon documentation as examples for using code stuff. And so like to kill Code Commit without much notice or to allow documentation to get updated, to leverage GitHub or GitLab or some other solution, that’s a, that’s a bit of a mistake, I think on Amazon’s part.”

40:02 AWS Graviton-based EC2 instances now support hibernation

40:32 Jonathan – “I think the coolest thing I learned about Hibernate support is that you can Hibernate EC2 instances using CloudFormation.”

41:17 Announcing VPC Service Controls with private IPs to extend data 

exfiltration protection 

42:02 Jonathan – “So the way that VPC service controls work is that you sort of add your GCP APIs and your resources within GCP to secure perimeters, and then you can sort of dictate the communication that’s allowed between those perimeters. And so what this does is allows you to put a boundary on communication from private IPs between those perimeters.”

44:38 Mistral AI’s Codestral launches as a service, first on Vertex AI

45:52 Jonathan – “Well, if you want to chat with it, then Gemini makes sense. But if you want to programmatically send a request to generate some code to an endpoint and have it return code in a known format… this is all going to be old news when we just realize that AIs can just replace the entire stack, the operating system, the applications running on them. We give the AI the instructions and say, OK, show me a user interface on my screen that does this and does this on the back end or does whatever else. And it just does it. It runs constantly. It’s constantly running inference to actually solve the problems that we have rather than generating code to run elsewhere.”

47:10 Hex-LLM: High-efficiency large language model serving on TPUs in Vertex AI Model Garden  

48:19 Justin – “Yeah, so basically it’s instead of using a generic third party serving stack on top of the TPUs that Google sells you, they now have a customized TPU serving stack that is optimized to use Google’s TPUs.”

49:57 Gemini’s big upgrade: Faster responses with 1.5 Flash, expanded access and more   

51:43 Announcing Phi-3 fine-tuning, new generative AI models, and other Azure AI 

updates to empower organizations to customize and scale AI applications 

52:47 Matthew – “I’ve tried Claude now. I like Claude quite a bit. I use open AI quite a bit. I like that as well. You know, just, on my LM studio, I use the Meta Lama 3 .1 and 3 .0. You know, it just depends on what you want. But you know, and which one do you like to have? Why do you bower? That’s really the question.”

53:36 Reintroducing the autonomous database, now with Oracle Database 23ai

And that is the week in the cloud! Visit  our website, the home of the Cloud Pod where you can join our newsletter, slack team, send feedback or ask questions at theCloud Pod.net or tweet at us with hashtag #theCloudPod

Joe Daly is a Director of Community for the FinOps Foundation, which is kind of like sitting at the largest lunch table in Middle School, but with less vaping.  He’s had illustrious careers as a CPA (the Statute of Limitations has past for all tax returns he prepared and he has let his CPA expire), Corporate Taxation, IT Finance & Accounting, IT Portfolio Management, a regrettable stint as Manager of Server Operations, and has started two teams that perform what has come to be known as FinOps.  He lives in Columbus, OH and enjoys copying off Rob. Go Captains!

Rob Martin is a FinOps Principal at the FinOps Foundation, which is kind of like being a Middle School Principal, but with less vaping. He’s had illustrious careers at Accenture, the US Department of Justice, Amazon Web Services, and Cloudability, and less lustrious jobs at a few other places. He now spends his time collecting, developing, and distributing FinOps content among the huge global community of people who deliver value from cloud. He lives in Leesburg, VA, and enjoys games (including the FinOps Boardgame!), hiking, and announcing for his son’s high school soccer team. Go Captains!

For this special edition of TCP Talks, Justin and Jonathan are joined by Travis Runty, CTO of Public Cloud with Rackspace Technology. In today’s interview, they discuss being accidentally multi cloud, public vs private cloud, and cloud migration, and best practices when assisting clients with their cloud journeys. 

Background

Rackspace Technology, commonly known as Rackspace, is a leading multi-cloud solutions provider headquartered in San Antonio, Texas, United States. Founded in 1998, Rackspace has established itself as a trusted partner for businesses seeking expertise in managing and optimizing their cloud environments.

The company offers a wide range of services aimed at helping organizations navigate the complexities of cloud computing, including cloud migration, managed hosting, security, data analytics, and application modernization. Rackspace supports various cloud platforms, including AWS, Azure, and GCP, among others. 

Rackspace prides itself on its “Fanatical Experience” approach, which emphasizes delivering exceptional customer support and service. This commitment to customer satisfaction has contributed to Rackspace’s reputation as a reliable and customer-centric provider in the cloud computing industry. 

Meet Travis Runty, CTO of Public Cloud for Rackspace Technology

Beginning his career with Rackspace as a Linux engineer, Travis has spent the last 15 years working his way through multiple divisions of the company, including 10 years in senior and director level positions. Most recently, Travis served as VP of Technical Support of Global Cloud Operations from 2020-2022. 

Travis is extremely passionate about building and leading high performance engineering teams and delivering innovative solutions. Most recently, as a member of their technology council, Travis wrote an article for Forbes – Building a Cloud-Savvy Workforce: Empowering Your Team for Success – where he discussed best practices for prioritizing workforce enablement, especially when it comes to training and transformation initiatives. 

Interview Notes:

In the main show, TCP has been talking a lot about Cloud / hybrid cloud / multi-cloud and repatriating data back to on prem, and today’s guest knows all about those topics. 

Rackspace has had quite a few phases in their journey to public cloud – including building a data center in an unused mall, introducing managed services, creating partnerships with VMware, an attempt to go head to head with the hyperscalers, and then ultimately focusing on public cloud and instead partnering with the hyperscalers. 

Rackspace has both a focus on private and public cloud; when it comes to private cloud they focus mainly on VMware and OpenStack, whereas in the public cloud side, Rackspace partners with the hyperscalers to assist clients with their cloud journey. 

Quotes from today’s show 

Travis: “We want to make sure that when a customer goes on their public cloud journey, that they actually have a robust strategy that is going to be effective. From there, we’re able to leverage our professional services teams to make sure that they can realize that transformation, and hopefully there *is* a transformation, and it’s not just a lift and shift.”

Travis: “A conflict that we continuously have to strike the balance of is when do we apply a cloud native solution, and where do we apply the Rackspace elements on top. The hyperscalers technology is the best there is, and we’re probably not going to create a better version of “x” than AWS does – nor do we want to.”

Travis: “We favor cloud native. Every single time we’re going to favor the platform’s native solution, unless the customer has a really really strong opinion about being vendor locked. Which sometimes they do. And if that’s the case we can establish a solution that gives them that portability. But for right now, the customers are generally preferring cloud native solutions.”

A bonus episode of The Cloud Pod may be just what the doctor ordered, and this week Justin and Jonathan are here to bring you an interview with Sandy Bird of Sonrai Security. There’s so much going on in the IAM space, and we’re really happy to have an expert in the studio with us this week to talk about some of the security least privilege specifics. 

Sonrai (pronounced Son-ree, which means data in Gaelic) was founded in 2017. Sonrai provides Cloud Data Control, and seeks to deliver a complete risk model of all identity and data relationships, which includes activity and movement across cloud accounts, providers, and third party data stores.

Start your free trial today

Sandy is the co-founder and CTO of Sonrai, and has a long career in the tech industry. He was the CTO and co-founder of Q1 Labs, which was acquired by IBM in 2011, and helped to drive IBM security growth as CTO for global business security there. 

One of the big questions we start the interview with is just how has IAM evolved – and what kind of effect have those changes had on the identity models?  Enterprise wants things to be least privilege, but it’s hard to find the logs. In cloud, however *most* things are logged – and so least privilege became an option. 

Sonrai offers the first cloud permissions firewall, which enables one click least privilege management, which is important in the current environment where the platforms operate so differently from each other. With this solution, you have better control of your cloud access, limit your permissions, attack surface, and automate least privilege – all without slowing down DevOps2. 

Is the perfect policy achievable? Sandy breaks it between human identities and workload identities; they’re definitely separate. He claims, in workload identities the perfect policy is probably possible. Human identity is hugely sporadic, however, it’s important to at least try to get to that perfect policy, especially when dealing with sensitive information. One of the more interesting data pieces they found was that less than 10% of identities with sensitive permissions actually used them – and you can use the information to balance out actually handing out permissions versus a one time use case. 

Sonrai spent a lot of time looking at new solutions to problems with permissions; part of this includes purpose-built integration, offering a flexible open GraphQL API with prebuilt integrations. 

Sonrai also offers continuous monitoring; providing ongoing intelligence on all the permission usage – including excess permissions – and enables the removal of unused permissions without any sort of disruptions. Policy automation automatically writes IAM policies tailored to access needs, and simplifies processes for teams. 

On demand access is another tool that gives on demand requests for permissions that are restricted with a quick and efficient process. 

Sandy: “The unbelievably powerful model in AWS can do amazing things, especially when you get into some of the advanced conditions – but man, for a human to understand what all this stuff is, is super hard. Then you go to the Azure model, which is very different. It’s an allow first model. If you have an allow anywhere in the tree, you can do whatever is asked, but there’s this hierarchy to the whole thing, and so when you think you want to remove something you may not even be removing it., because something above may have that permission anyway. It’s a whole different model to learn there.” 

Sandy: “Only like 8% of those identities actually use the sensitive parts of them; the other 92 just sit in the cloud, never being used, and so most likely during that break loss scenario in the middle of the night, somebody’s troubleshooting, they have to create some stuff, and overpermission it . If we control this centrally, the sprawl doesn’t happen.”

Sandy: There is this fear that if I remove this identity, I may not be able to put it back the way it was if it was supposed to be important… We came up with a secondary concept for the things that you were worried about… where we basically short circuit them, and say these things can’t log in and be used anymore, however we don’t delete the key material, we don’t delete the permissions. We leave those all intact.” 

In this episode, Andrew Krug talks about Datadog as a security observability tool, shedding light on some of its applications as well as its benefits to engineers.

Andrew is the lead in Datadog Security Advocacy and Datadog Security Labs. Also a Cloud Security consultant, he started the Threat Response Project, a toolkit for Amazon Web Services first responders. Andrew has also spoken at Black Hat USA, DEFCON, re:Invent, and other platforms..

Datadog is focused on bringing security to engineering teams, not just security people. One of the biggest advantages of Datadog or other vendors is how they ingest and normalize various log sources. It can be very challenging to maintain a reasonable data structure for logs ingested from cloud providers.

Vendors try to provide customers with enough signals that they feel they are getting value while trying not to flood them with unactionable alerts. Also, considering the cloud friendliness for the stack is crucial for clients evaluating a new product.

Datadog is active in the open-source community and gives back to groups like the Cloud native computing foundation. One of their popular open-source security tools created is Stratus-red-team which simulates the techniques of attackers in a clean room environment. The criticality of findings is becoming a major topic. It is necessary when evaluating that criticality is based on how much risk applies to the business, and what can be done.

One of the things that teams struggle with as high maturity DevOps is trying to automate incident handling or response to critical alerts as this can cause Configuration Drift which is why there is a lot of hesitation to fully automate things. Having someone to make hard choices is at the heart of incident handling processes.

Datadog Cloud SIEM was created to help customers who were already customers of logs. Datadog SIEM is also very easy to use such that without being a security expert, the UI is simple. It is quite difficult to deploy a SIEM on completely unstructured logs, hence being able to extract and normalize data to a set of security attributes is highly beneficial. Interestingly, the typical boring hygienic issues that are easy to detect still cause major problems for very large companies. This is where posture management comes in to address issues on time and prevent large breaches.

Generally, Datadog is inclined towards moving these detections closer to the data that they are securing, and examining the application run time in real-time to verify that there are no issues. Datadog would be helpful to solve IAM challenges through CSPM which evaluates policies. For engineering teams, the benefit is seen in how information surfaces in areas where they normally look, especially with Datadog Security products where Issues are sorted in order of importance.

Security Observability Day is coming up on the 18th of April when Datadog products will be highlighted; the link to sign up is available on the Datadog Twitter page and Datadog community Slack. To find out more, reach out to Andrew on Twitter @andrewkrug and on the Datadog Security Labs website.

Top Quotes