How Can I Sign New Jersey Banking Word

How can i industry sign banking new jersey word secure

[Music] hello everyone welcome to the fabric spotlight a series of talks with enterprise cxos infrastructure executives cloud infrastructure investors and entrepreneurs today i'm delighted to host joe ferlissi the cio and ceso of rockefeller capital management joe is responsible for innovation architecture and data security across the firm welcome joe thanks for joining us thank you nice to be with you prabhakar so uh before we uh kind of like get rolling with the various uh topics that we would like to get your thoughts on perhaps uh you can give us a little bit of background personal background how you got your personal journey the experiences that shaped your career including at merrill lynch and morgan stanley that would be good too for the audience to hear from you sure um so it's been a long journey spent most of my adult career in wall street firms merrill lynch bank of america morgan stanley as you mentioned in various roles i actually started off my career in the infrastructure space building data centers network infrastructure voice over ip um you know you name it across the technology gamut i've had a hand in it in one way shape or form but the last decade or so my career has been spent really on business application capability and and kind of how we because i've always seen there was a big gap between infrastructure and applications they said they sort of worked in parallel universes and i thought you know bridging the gap across the stack from an infrastructure and application perspective i think was imperative i think we're seeing that in the world that exists today with with software-defined networks and other things like that so um yeah so i spent a good portion of my time in infrastructure i ran the banking services at merrill lynch i ran all the uh the client channels mobile platforms um you know been very fortunate to spend a lot of time with a lot of smart people and work in various aspects of the business and how i ended up here my current boss um greg fleming who was the co-president at uh at merrill lynch and was also the president at morgan of merrill lynch wealth management sorry morgan stanley wealth management and uh asset management started this venture here uh and uh along with chris randazzo and a few people that uh we work very close with over the years we're we're now on this new venture which is almost like a uh almost like a startup in a 100 plus year old brand in rockefeller very interesting so you talked about bridging the gap between applications and infrastructure so uh maybe you could uh elaborate a little bit on um you know advancing the the business agenda where you are now what kind of like what are the key initiatives and innovations and how you are planning to use uh cloud infrastructure those kinds of things would be good to hear sure yeah i i think it's less about initiatives and more about enablers right what are the things that any company needs year in and year out in order to address varying degrees of needs that they have from a business perspective so when i think about you know business i think about technology you think about what are the what are the key enablers speed to market time to value security making sure that things are scalable you know i always remember being in the infrastructure space every time we wanted to scale something it was how quickly can we get equipment and how quickly can we get data center space and how quickly can we get all this stuff and you know the nimbleness just takes it it takes a long time heavy investment in capital uh and then because sometimes you want to test and learn you want to grow you don't know that you want to go all in on something i think the cloud the cloud enablement has given us the ability to test and learn quickly to fail quickly when when things don't work uh and to scale when they do work uh in a meaningful way and and there is no separating out applications and infrastructure in my view there never was in my mind because uh you know applications have demands on your infrastructure that you have to really understand before you design it and and i think what what what we tried to do here at um rockefeller is build a very nimble modern and contemporary infrastructure in order to deal with things that you know we may not even know like covet for example we didn't know that it was going to hit us you know when we started this cloud journey but had we not taken the journey that we did our ability to adapt and quickly you know mobilize the organization to to deal with the situation of remote work and access from anywhere and all the other things that came with it um would have probably been very very difficult for us to adapt to so a simple example of where um you know our philosophy around speed to market security scalability as one of our core tenants because it plays a role every day in what we do yeah so it sounds like one of the main features for cloud adoption drivers for cloud adoption for you were the agility and scalability so um and security and security so uh i'll come to the security part of it the in terms of agility and scalability and those kinds of things do you see is going to be just dominated by like uh adopting one public cloud or do you see multi-cloud hybrid cloud how do you see that uh you know going forward um you know i think that every company is going to struggle with you know what's right for them because you know in you know in a company like bank of america where i came from this the sheer size and scale of the and the different types of businesses that are being supported a multi-cloud hybrid cloud strategy might be best for them versus us you know we're we're like i said we're a smaller uh more nimble company us saying that we're going to be a hybrid cloud that's out of the question we don't have any infrastructure on prem we're purely uh cloud-based company which we're fortunate we don't have any technology debt we don't have data centers we don't have co-location uh when people hear it they're like really you've achieved it and i'm like yeah we have so the hybrid the hybrid approach is kind of not really that relevant and the multi-cloud approach is you know it sounds very novel on a piece of paper but you know to say that we're going to run you know let's just say a microsoft azure platform and a aws platform quote in parallel to have multi-cloud strategy it's not very practical for a lot of folks to do as well so do i think there'll be a lot of different models 100 there's no one answer for every client it's going to be based on the client demands going to be based on the situation i think hybrid clouds are somewhat required because many companies like the especially the larger ones they have massive investment in infrastructure and networks and servers and all that stuff that you're not going to just flip a dime on so you have to figure out how you're going to introduce that's where i was at when i was at bank of america just how can we introduce cloud capabilities but they'll be on that journey in my opinion for decades that's a good point that you make is that it's not one size uh fits all right sometimes people are you know globally throwing oh cloud is going to eat everything it doesn't quite it's not uh one size fits all so that that's good to hear so you mentioned security and you are a cso also so um i would like to kind of drill in a little bit on that so it seems like there is still um at least from what i can see there is some nervousness around putting all the data out there on the cloud but you have achieved it so how do you reassure yourselves and perhaps your customers and you know what what initiatives do you uh take uh from a cyber security perspective partial uh defense yeah i mean just like there's no one-size-fits-all for and you know different businesses there's no one-size-fits-all model for data management either right so you know when when when folks say there's still hesitation i think there'll be there always is hesitation where there's doubt right so it's it's sometimes just the the ability or inability to quantify what the risks are to some extent i feel that we're safer in the cloud if you want to if i if you want to completely flip flip the script a little bit because the modern the they're using much more modern technology in certain instances there's a lot more um of other large-scale providers um you know like when i say if the government can be comfortable with storing data uh and and not just you know not just you know the the smaller parts of the government but you know the the nsa and many others that are leveraging these cloud services to me we benefit from that because microsoft as an example of them being our provider they are investing billions of dollars in security and infrastructure and i'm the beneficiary of that i'd never be able to do that on my own so when i when i view it when i view it as a opportunity i and an advantage it's a huge advantage 10 years ago 15 years ago i wouldn't i didn't even have that option available to me yeah right so so to me it's it's one of those things that's an enabler um and we don't take it any lightly we don't think that we're somehow more protected because we're in the cloud or but it's it actually just forces you to think about your risk profile and what are the things you have to be worried about um what are the things that you have to do that you didn't think about before but it all starts with identity and managing you know security access to the devices then once you get there in title entitlements what are people allowed to do so whether you're hosting your data in the cloud or on-prem your mindset you know you might have to think about different use cases but your mindset shouldn't change it's what are your threat vectors what are the things you have to do to assess those and what do you what do you have to do to have a good hygiene environment right so whether you're housing it internally or externally is it's just it's just um that's just a another place to it's someone else's data center it doesn't change the problem it just changes the tools that you have to solve the problem right i mean like there are shared uh responsibility right they are responsible for infrastructure security but you still have to secure the application exactly exactly you never obfuscated responsibility you know we as rockefeller just like any other company out there if you're putting your data there you're doing it you own the responsibility it doesn't matter whether you house it on azure or aws or your own private cloud or your own data center at the end of the day you need to make sure that you you understand the risks and you have a program in place to manage uh not only the infrastructure aspects of it but usually it's it's it's the people that forget to do basic things like disable accounts and you know when you look at some of the data breaches out there it's not massive gaps in infrastructure so yeah it's some very simple logical things that did not get done so the hygiene hygiene is important regardless of where you put your uh your data yeah these days there are things like cspm that are targeted explicitly at the hygiene part of it but you know there is the another dimension to that particularly newer industry is compliance right pii and gdpr and you have to kind of pay attention to a lot of extra uh regulations i presume right oh yeah i mean no doubt i mean with there's there's the regulations that we have responsibility for obviously the the regulators that we that we operate uh under their jurisdiction but there's also the commitment we have to secure our clients data and such so and again i see that as a benefit because uh we were just going through this today right we moved all of our our file infrastructure to sharepoint and microsoft 365 and lots of those tools so when you when you do that i have a compliance dashboard that i never saw before in 25 plus years that i've been doing this right without buying a whole bunch of third-party products to bolt in to go out and scan my environment and you know so now as part of this service i've got some built-in and i can build my own audit profile so today we looked at specifically a finra cyber security assessment right so finra has a set of policies they publish out there and then they ask you to do an assessment but it's built into the product right so if you look at the policies and and things that they look at they'll look at well are you using uh you know complex passwords are you doing you know whatever those policy things are this system because it's all in an integrated capability it gives you a lot of uh telemetry and information out of it for you to act on that you wouldn't have had if you were storing it on your own file stairs as an example so so to me it's not just about where you house it it's all the services and capabilities around it that'll enable you to act quickly uh email legal hold is another example i know it it's it's sort of tangential and if i am going off course i apologize but legal hold is critical in our business if we get uh if a client raises an issue and we have to put a legal hold you have to freeze the the information and documents associated with that i can go in to a tool to open up a case freeze those documents they can't be deleted they can't be archived they can't be touched uh so it's very powerful and it's and it's constantly growing you know the capabilities that existed a year ago are are different than exists now and i get releases every quarter and i'm not doing anything other than being a customer yeah that's the collateral benefit of uh you know innovation that comes from the providers that's very interesting i know i think it's actually quite relevant because if you think about it uh since the infrastructure elements are being taken over by the cloud now that you know what we have to pay attention to kind of rises up uh instead of infrastructure security we pay attention to application security instead of storage we think about data so i think all of this is quite uh relevant so there is an orthogonal thing here you mentioned multi-cloud hybrid there's an orthogonal dimension which is central versus distributed now there's a lot of talk about oh you know you can't just be in the centralized cloud data centers there need to be edge locations and telcos are partnering with public clouds provide edge edge cloud um as a forward-looking technical technology executive innovation what are what are your thoughts on that how that plays how 5g ah plays and all of those kinds of things i mean i i've been saying this for years that i think it's it's the next big generational transformation that people are in technology uh are going to go through because speeds and feeds have fundamentally changed you know uh you know i i was joking that the the cpu and memory i have on my iphone 5x what my first pc was a pc that i bought a couple years ago yeah the point is that capabilities are growing and the computing capability uh and the the capacity that exists on on the infrastructure and the edge is huge right it's all it all has to be based on use cases right that that makes sense but your use cases and the fundamental three-tier architecture of a web browser a web front end a middle tier app server and a database i think are gone right i think they'll exist in different shapes and forms because all three of those things may be in different places right um and the subscription-based economy i think is going to continue to grow which means it's not all going to be in the same place it could be in different places so you got a highly distributed security realm that you have to operate in it's not always going to be ubiquitous but it has to operate as if it's ubiquitous right so i think standards are going to play a bigger role going forward i think that um interoperability uh if you look at what just microsoft is doing interoperating with mac os and other things if you if you would again thought about that five years ago they were very proprietary very narrow i think people you know the industry is pushing everyone to interoperate because that's what clients demand that's what we demand we have to have things interoperate it can't be proprietary i do think that's a area uh prabhakar that's going to be very very uh opportunity driven in terms of hybrid capability because i can define for rockefeller where we're going to live and what we're going to do and how we're going to work but i've got you know dozens and dozens of third-party partners that we get we've trading trading partners people that do portfolio management for us our broker dealer they all have their own solutions that they've come up with we can't say well i'd like you to follow my architecture um we need to be able to adapt to third-party partners so that's typically by definition going to be a hybrid cloud environment right they could be hosting themselves in aws and right their own data center so i think that we're already in that world and it's just going to continue to drive that way um the question now is how much of it is going to be truly cloud because in theory you know if i have a third-party data center that i'm connecting with uh via api gateways to me that's a cloud right i'm going over the internet i'm accessing those apis it just might be somebody's physical data center as opposed to a third party but to me it's the you know architecturally it's the same right right from uh yeah it's like an api sas kind of a thing right that's right so um you mentioned uh this is related to edge urgent but related to something else as well you mentioned for instance remote work distributed work uh how are what's your thoughts on kind of like this [Music] distributed workforce the quality of service that they need are you able to solve it entirely or are you looking for solutions that can provide better quality of service with security i think that's you know the the the thing that people are always going to chase is bandwidth right you you want you want as much secure bandwidth as you possibly can so you can have you know our video conference here i mean where else would the world be without video conferencing in the last 20 you know 12 to 15 months that that we've been in the situation so i don't even think remote work is a word anymore i think it's just work right wherever you are you want the same experience whether you're in your bedroom at home or at a coffee shop or in the office so the whole concept of a zero trust architecture to me is critically important we have to think think about it's not always going to be our network it's not always going to be our pc but we want the experience for our workers and our and our people our advisors to be just as productive as if they're in the office right so it forces you to completely think about things in a different way so to answer your question um i don't think we can solve the issue of bandwidth and security and quality of service but i think those that are out there trying to do it it's a big win for them if they can challenging to do but at the end of the day if you just need an internet connection uh to get to be productive at work now the question is how do i bring those services to that internet connection so that we could do it securely because the whole the whole notion of you're on our network and you're secure i think is a thing of the past right i mean even today when you have to remote in through a citrix terminal or do some sort of vpn it's just it's awkward it's just not natural i think becoming a more native experience is is what what employees and and uh in general people are going to want yeah when people were in branches you know they brought software you know sd vans and then it evolved into sasses and stuff like that in this distributed environment now you have to think about branch of one and the branch of one is also moving around so exactly it needs to follow the person as opposed to you got to be in a physical location right we did the same thing we we thought we were modern we had sd-wan infrastructure and we still think it's a very modern infrastructure but you almost feel like oh my god that's old news if i were doing it all over again today i would maybe be doing something a little bit differently so the world's changing so fast the technology that's um you know that's that's evolving in this space is exciting you know to see where it goes it's also cautioning that because there's so many out there that are all trying to chase the same thing you got to make sure that you know you're picking you're making your bets right on the right partners well you know that's where uh innovation comes in right as long as long as you have deep innovation then you can kind of carve out ah space for yourself and that's what we believe we do with our co-created companies so slightly shifting gears you said that you are completely cloud-based and i presume you have your own applications so how do you deal with this modern cloud native app management are you using kubernetes how are you [Music] managing such environments um yeah we we have a little bit of everything right so we have a lot of cloud native pas services that kind of managed on our behalf if you will by uh by those providers we we have a modern devops environment we use kubernetes uh as part as one of our container strategies so um even when we have we have to bring in non-native application on native uh cloud-based applications we throw them into a container so they operate in an environment that looks and feels like another cloud native so we have that hybrid we can't control all the third-party applications that are out there but when we do have an evaluation of software capabilities one of the first things we we look for is is it cloud native can we can we is a subscription-based service uh and we and there's more and more we partner with some vendor partners like in the data space for example we're partnering with a certain uh vendor that uh that is partnering with microsoft that we're working with them because another one of our third parties uses the same software so we're connecting them through the cloud in a way that we wouldn't have been able to do before right so we're pushing any deployment that we do to be as as native as possible but the reality is we have a lot of legacy applications we have legacy partners that don't so kubernetes is definitely one of the platforms that we use for orchestration but we don't have a lot which we're lucky we have a lot of a lot of it is cloud native which which you know that's good as services give us like our entire client portal for example everything's built on the the azure uh api gateways that are there are our code is deployed in the native uh the native environment on the web the web uh web access platform so we don't have a huge amount of a huge portfolio of applications that are not native that's great that's great yeah that's great that's tremendous um so uh again something something different finance is uh kind of like one segment where uh people have looked at uh you know use of enterprise blockchain not the bitcoin stuff but the enterprise blockchain functionality are you looking at that at all what are you beginning to explore something in that regard no i did a lot of it at bank of america before i joined rockefeller um i was on the board of r3 for a little while ah very good and and uh i did a ton of work in blockchain and you know the biggest challenge you have with blockchain is finding the killer use cases right so you know there's there's the technology and the capability is there and there's some use cases that are that are very robust but it requires people to change the way they think about delivering a business process right so it's not just about technology it's about how are you changing the the supply chain and the value chain of a given business process and to orchestrate that amongst many companies it's it's it's very very very difficult to do so you have to have an industry that is adopting it you have to have partners that are adopting it so from i think the technology is very very intriguing um the use cases uh and i still i still think there's some skepticism about this distributed ledger everything being out there without really having control over a full transaction and other things so i think the technology is very innovative but i don't know that the environment is is you know ramped up if you will or mature enough like it's hard enough to orchestrate even in your own company if you imagine orchestrating across different companies personnel changes people that are advocating in one organization they leave to go to another company then the advocation goes down so it's very very spotty in terms of adoption and consistency because in order for it to work you really need an exchange that everyone subscribes to and goes all in in order to to prove it out so at rockefeller we really don't have any use cases that we're pursuing uh in that space right we're still early on in our we have a very clear growth agenda and a very the target market that we that we're after and the target products that we serve don't really there's no real use cases that we can think of right now that uh that we would be you know putting our toe in the water on you know you you interact with a lot of technology executives in the in that area new york new jersey the financial area so what are the key infrastructure or the kind of like the gap that you were talking about what areas are the groups discussing can you share some insights from such discussions for our audience yeah i think i mean the common theme that comes up is the one we brought up a little earlier that talks about you know the remote workplace i think the words the words keep coming up where people are struggling with how do i easily get people connected to the ecosystem because the entire ecosystem was built on the premise that you're on our network you're on the corporate network right when i think the world is changing right it's slowly changing but it's it's changing nonetheless so i think that the the um the challenge that i continue to see uh and people talk about and and one of the things that attracted me to to join rockefeller is that we wouldn't have any uh any of this which is there's a lot of legacy infrastructure that's out there in the industry everywhere right legacy phone systems legacy uh network services all this kind of stuff at some point that thing that's going to start aging off and people have to start transforming where they're going and taking you know the new demands and the new requirements into play of uh you know like you said any work anywhere uh video anywhere security so i think that the problem has to change and the mindset has to change from i need to secure people where they where wherever they are uh not just our network because it might not always be your network right at least all the way through to the edge so and i think things like vpns and others i think are they're gonna they already are getting somewhat antiquated and yeah and such so i think new ways of thinking about how do you deliver very robust user experiences um in infrastructure that you don't own in a secure way i think is going to be is going to drive the next decade i think the other thing i think is everyone talks about data is king and edge computing and all that good stuff but i don't think they know what it means because if you look if you ask most people they'll say i got my databases in the data center i have them surrounded by firewalls i have some level of protection in front of it so the the architectures haven't evolved too much the technology has evolved but the implementation and getting people to think differently is is probably a slow uptake and the slower the uptake in the new technology the the longer it's going to take to do which means that you know legacy technology debt is going to increase over the over years and people are going to have to really take they're worried about standing still and just keeping things status quo because everything's changing so quickly um how do you keep up with it and are people gonna make the capital investments to refresh a network maybe uh you know that world that world of just constantly refreshing what you have at some point is gonna come down to a point of diminishing return right because no one likes to put that much capital on their balance sheets they rather you know scale up scale down and set themselves up so i think the short answer to your question is is keeping up with what's the next generation of capability while maintaining the existing plan i think is a struggle for a lot of cios and ctos in the industry okay great uh thanks for that insight so we kind of like come to the um kind of wrapping up part of the discussion here uh to wrap up you know what we would like to hear from you is i'm sure you had a lot of interactions with entrepreneurs and you know various early stage companies um what's kind of like your advice on how they should approach working with you know people in your industry in your position any tips and what to do and what not to do i'll start with what not to do don't don't underestimate the problems that that need to be solved in financial services they all seem straightforward but as you brought up early on the sensitivity around information management and the regulators that you know the the number of regulators that regulate our industry is very high and the requirements that we have are very high so don't don't downplay the the the you know working with the finance i'm talking about my business segment specifically the business segment that i'm in so don't underestimate uh and try not to be everything to everybody all at the same time when someone comes and pitches something that just looks like it solves the entire gamut of capabilities that might be a good aspirational pitch but you all know you have to take you have to put one foot in front of the other so you know very tight use cases that you can explore with partners that don't demand a ton of their time but you can prove something out that always is a better you know better approach than you know a very broad you know a broad set of aspirational goals if you will so i i the best pocs that i've done and some of them that have allowed us to cross paths over the time it's just solving one narrow issue but seeing where it could go right innovation sometimes is seeing where the puck is going not necessarily where it is right now but also being realistic that you can't solve this in one fail you know one big one big project it usually is going to be a series of investments over time but when as an entrepreneur you know having people that understand the vertical business problems not detect the technical issues obviously you got to have smart people and good engineers to build code and write code but if you have subject matter experts in verticals that you that really understand the business problem and can work with those people i think that's a that's a huge advantage thank you very much for uh you know sharing the time and sharing these insights with us uh looking forward to more discussions with you in the future same here thanks again prabhakar i appreciate it thank you all for watching stay tuned for another episode of fabric spotlight thank you very much bye