The Evolution of Data Erasing: Interview with Matthew Anderson and Karen Fetter of Blancco

Steve Sidwell:

On this episode of The Tech Bench Podcast, we interview Blancco’s VP of North American sales, Matthew Anderson, and senior account manager, Karen Fetter. During the interview, Karen and Matthew discuss how technology is changing the way Blancco does business, data destruction and so much more. Brace yourself. You’re now entering The Tech Bench Podcast.

(music)

Karen and Matthew, thank you both so much for coming on The Tech Bench Podcast. James and I both really appreciate it. Today, we’ve got Karen Fetter and Matthew Anderson from Blancco. Liquid tech has been a Blancco partner for over 10 years. Obviously, we know a lot about you guys’ company, but maybe we could start with the basics because I know Blancco’s changed a lot over that time. And so the whole industry has really moved around a lot over that period. Can you tell me a little bit about what is Blancco? What do you guys do? What does Blancco do?

Karen Fetter:

Absolutely. First of all, thanks for having us on. When we started, and it was really when you started your relationship with us, we provided end of life eraser software for PCs, and that was probably about it. But today, fast forward, we do provide the eraser software. We do it for PCs, laptops, storage arrays, mobile devices, flash media. You get the picture. Pretty much anything that has data on it. The other thing that’s a great add on to that, and it’s all been over time and need, is that we provide diagnostic software, not only on the hardware for the PCs and laptops and things like that, but also for the mobile devices.

Steve Sidwell:

I mentioned that the mobile devices must have changed a lot over the years. I mean, obviously smart phones are just a complete staple in everyone’s life right now. And when we started working with you guys doing mobile device erasure and all that kind of stuff, obviously, there were Android tablets at that point. They were just coming out. But the big thing then was blackberries, which don’t really exist anymore. How has that kind of changed over the years in your business?

Karen Fetter:

You’re right. [crosstalk 00:02:52].

Matthew Anderson:

Sorry, go ahead, Karen.

Karen Fetter:

Oh, I was just going to say that, yes, it was blackberries and now it’s not. Everything that we’re doing now is either Android or Apple based. And it’s not only the fact that the type of device has changed the way we do it, what we can capture now, and what we can overwrite now compared to what it used to be like has changed light years, just like everything else. The things that we create are need driven as you and some of our other partners come to us and they say, I’ve got clients that have this. I have clients that need to have this erased. That’s where our technology is driven from, from the marketplace. Go ahead, Matthew.

Matthew Anderson:

Yep. And from a mobile perspective, we’ve really focused in on the mobile processing side. So, as the transition from your traditional Blackberry to smart device on iOS, Android, all that data is going to reside on those phones, right? So essentially, we have all these mobile devices out there that are millions and millions of devices. And you really want to control that data because they’re literally an extension of your PC laptop, like what all we’re processing 10 or 15 years ago. And so our focus has really been driven on a development side to really facilitate our partners as that data transitions over to those mobile devices. That we have efficient solutions to optimize not only their operations, but really focused on security-first approach that we traditionally have had from our [inaudible 00:04:45] business and really secure data eraser.

We’ve sent this and that over not only from PCs and laptops, like Karen mentioned but offering erasure as a service. So delivering with you guys that end to end solution. So, in the data centers, if it’s mobile devices, if it’s laptops, PCs, our technology can be leveraged across all those different opportunities and use cases.

When Do You Need Secure Data Erasing?

Steve Sidwell:

And who should be using your products?

Karen Fetter:

So, this is a really great question. Anyone that has data needs to eventually erase it. The difference being when 10 years ago, we’ll just use that as the benchmark, since that’s when our relationship started, everything was known as end of life devices. So when you were getting ready to get rid of a device, you got rid of the data. Things have changed. And now what there is, is something known as the life cycle of the data, not the asset.

 So, let me give you an example. Let’s say a company issues a laptop to their CEO, chances are that CEO will not have that device when it’s time to decommission that asset. So, the question is what happens to the data on that laptop when it’s issued to somebody else? So the data needs to be removed before the device is given to someone else. The same thing goes for servers. The same thing goes for potentially mobile devices. Let’s say a server is being moved to another department or another office, most likely that data is going to have to be eradicated. Also, there’s a percentage of data that’s actually just going to be moved to the cloud during the lifetime of that asset. It no longer needs to be stored on a device locally. Does that make sense?

Steve Sidwell:

Absolutely. Devices go from person to person, and now obviously data is being stored in the cloud. Do you feel that enterprises are more aware of the importance of proper data destruction than say they were maybe five or 10 years ago?

Matthew Anderson:

Yeah, I think there’s better solutions out there that gives them visibility into their data with a lot of the big data companies. Traditionally, larger enterprises, they stored tons of data, petabytes of data all across their data centers. And really, they didn’t want to get rid of anything because they didn’t know what impacts that was going to have across their business. So now that, obviously, with getting desert better visibility and data management tools out there, they can put together proper policies for data standardization across their enterprise.

Data Erasing and GDPR Compliance

Steve Sidwell:

So, we know that you’re a European company. What are the concerns that you have regarding GDPR, and how is it affecting your business model?

Matthew Anderson:

So, it actually is making our messaging very much relevant again. So anytime we have had challenges in our space with having regulations that say, you’re required to prove that you’re certified at erasing specific customer data, personal data. And then, there really wasn’t a true regulation out there that was global. And so with GDPR coming around, it really is specific in that you have to produce a certified report that that data has been sanitized. And then there’s financial impact to that regulation as well. So, if they don’t follow or don’t meet compliance to that GDPR, certain rules within that, then there’s a financial impact to their business. That that will definitely affect their balance sheet.

Karen Fetter:

Some people think it only affects Amia, but the fact is any company doing business in Amia is subject to those requirements. Som if you’re a U.S. company and you have one client in London, you’re still subject to those GDPR laws.

Steve Sidwell:

Now, one of the things that we’ve talked about before is that if you’re housing data on European subjects in the States, you have to comply. And if you’re housing data, not on European subjects, but if you’re doing load balancing or whatever in Europe, you still have to comply. And then as American laws change, we have to certainly watch out for stuff like that here, housing data in California, housing data in Colorado. And I forget, it was one of the Southern States that we were just talking about, just the other day, where these kinds of things are just changing all the time. And of course this is something that’s going to be settled, probably not through the court system, but we’ll see how it pans out.

Karen Fetter:

It’ll be interesting. [crosstalk 00:10:04] Anytime there’s a financial impact of a data breach, like there is with GDPR, I think it gets people’s attention. And I think the first time there’s something published where a company was financially effective because they did have a breach of any kind, I think people are going to be sitting up even straighter and looking at it even more seriously than they already are.

Steve Sidwell:

Well, so basically with all of these changes that are going through, one of the things that we’re not seeing is a changing of the standard, right? Because the standards pretty much stayed the same for a long, long time. And then something in the world changes and standards change to standardize all the various changes in the way that NIST 888R1 clears up issues surrounding the erasure of solid-state disks and all the rest of it. But, that said, I mean, you can go out and buy a 14 terabytes data drive. I know that Seagate recently announced a 60 terabyte SSD. How does Blancco stay ahead of this stuff? I mean, it’s just tremendous to me to think about the timeframe that it must take to erase those. I know, when we’re doing at least even the fours and the eights, it’s just …. I mean, the amount of time it takes to erase that much data certainly gets up there. So, as time grows, how does Blancco grow with it?

Matthew Anderson:

Yeah. So, with those events, type technologies, so it’s definitely a challenge, right? Because you have an infinite number of drive manufacturers, they’re different. You go from Seagate to Hitachi or all those different manufacturers of drives. And so, as they come out with new releases of different drives, there’s all these custom firmwares, obviously, drivers that we have to account for as we go and develop and release new releases of our technology. So, it’s always a challenge, but we continue to see which types of technologies …

And a lot of the feedback we get from our partners are like you guys because obviously we’re not going to be purchasing every drive that’s released or every laptop, PC that’s released out there. It’s just not feasible. So a lot of the partners, like Liquids, that we work with, they provide feedback and they’re seeing these things as they come through, either through the warehouse or through onsite. We get a lot of feedback from our partners and that’s really … If we didn’t have our partner network like we do with Liquid, then it would definitely be an even higher challenge to meet those expectations.

Developing the Blancco Drive Eraser

Steve Sidwell:

So, Blancco has put in a tremendous amount of work and dev into the SSD eraser solution through field lock removal and all of the rest of that stuff that goes along with that. And additionally, it feeds into the whole conversation about NIS Clear versus NIST Purge that I know is probably one of the things that is the bane of Jane’s existence.

Matthew Anderson:

Trying to explain it to clients and then the direction we want to take with they’re wiping versus just destruction. Absolutely.

Steve Sidwell:

Yeah. I mean, you need to adopt one standard across the board and that’s pretty much what it comes down to and you want to work with a company who’s going to say, we’re going to just clear out all of your data. And if it doesn’t come back as working perfectly, if that erasure didn’t work perfectly, it’s going to get shredded. And that’s really what it comes down to. Is either 100% or it’s not %100. And there’s really no other questions that you need to ask. So one of the issues I know that a lot of companies face with NIST is that they wouldn’t look at NIST Clear and NIST Purge and be like, Oh, we’ll, Purge is better. Well, yeah, Purge has some specialized commands that certain firmwares can run, but if your firmware can’t run that because maybe you’re an HP shop or whatever.

And if you have special custom firmware drives, like a lot of these machines do, right? They buy their drives from Seagate or from wherever, and then slap their own firmware on them so that they can do different things and work more interesting ways with their own controllers. If Blancco doesn’t have support for that firmware, or that firmware doesn’t have support for those NIST Purge commands, I mean, you’re hosed and you’re shredding all those drives no matter what you want to do, if you’ve adopted that standard across the board.

And if you really good about it, if you adapt to that standard across the board, you’re shredding all of your network gear, you’re shredding all of your line cards. You’re shredding everything that any customer could ever write data that doesn’t have support for those commands. And that’s what it comes down to. I mean, it’s such an educational battle that I think so many of the companies in our world face, I think. It’s really stunning to me how something that seems so simple at the outset can wind up just causing so many headaches for people because they thought they chose something that was better without really realizing the ramifications of it. And it turns out, at the end of the day, well, as long as you’re getting 100% verification, what do you need to continue the conversation for?

Matthew Anderson:

Yeah, so we encounter that quite often. We have that conversation, NIST Clear versus NIST Purge, all the time. Right? But you’re 100% correct to where certain drive manufacturers either support those commands on a person level or they don’t. So, we battle that all the time. And one of the things that we’ve really pushed is we have a patented SSD eraser algorithm. So, it meets the NIST Purge requirements, but it combines basically your NIST Clear and then your old DOD type standards and a combination of both of those to deliver a purge level erasure. So, that’s one of the ways we’ve been able to overcome that with our partners and our customers. If it doesn’t support that purge level, then we have a fall back to the Blancco SSD method. And a lot of the security folks and compliance folks, once we provide them that methodology of what we’re doing on that patented erasure algorithm, then they say, Oh, yeah, this is a great option to not shredding out those drive.

Steve Sidwell:

And obviously, you guys have made a lot of news over the last couple of years. You’ve purchased similar software companies, such as Deben and Taverist. I’m just curious, are there any direct competitors left, or do you own the market?

Karen Fetter:

Well, yes, we do own the market. I would say, from an indirect … You did your homework. You chose us. From an indirect standpoint, I would say shredding companies are our competition. On a direct side, there are OEMs that have tools like IBM and HP that erased their drives. The problem with those is there’s no audit trail and it’s not certified. So, the software, the eraser software only works on their stuff. And it doesn’t do what we do as far as providing the reporting, providing the hardware information and things like that. It just erases. And you don’t even know if it’s done that.

The Future of Data Destruction

Steve Sidwell:

And I’m just curious, I mean, obviously technology is always changing. Steven mentioned that the standards may not change. But ultimately, where do you see data destruction in your business say five or 10 years from now?

Matthew Anderson:

So, five or 10 years is pretty long time. I would say more on a three-year strategic plan. And what we’ve done at Blancco is really have gone back to the basics of what we built our business on over the last 20 years. And really focusing on really three key areas of where we can make strategic investment to grow over these next three to five years. And those sort of focuses on, number one, our traditional ICAP business, but a part of that traditional ICAP business we’ve talked about earlier in the call is that migrate [inaudible 00:18:44] from warehouse type delivery to now erase service.

And we’re making our solutions, our strategic investment on the sales side and on the development side to really make that investments provide the best of breed solutions for our partners, such as Liquid Technologies. So, that being one of our focuses. The other two being our enterprise data center, so we’re making strategic investments into that space. So, to deliver that end to end solution. If that enterprise customer wants to manage it themselves on some levels, they can do that. And then the third final one being mobile processing. So, like I mentioned earlier in the call, as we see that data migrate from your traditional PC laptop to now mobile devices, I personally see all the data going into a mobile device, and PCs and laptops will eventually be obsolete.

And you’re then just going to take your phone and plug it into your monitor and then manage all your day-to-day business to your mobile device. That’s where I personally see the market. And so, part of our huge strategic push and focus is on that mobile processing side. As you can see, a new iPhone comes out, they still have lines coming out. And 10 years later, they got iPhone 10S and you still got lines out the door at the Apple stores. I wouldn’t say a five to 10 year path, but I say that we have five-year. Those are our big strategic focuses on from a Blancco perspective.

Steve Sidwell:

Absolutely. So. I’m getting the sign from across the room that I have to wrap it up. Karen Fetter, Matthew Anderson from Blancco, thank you both so much for coming on The Tech Bench Podcast today. I know that my host, James Patrick Nellie, and I both tremendously appreciate it. So, thank you also, James.

James:

Yes. It’s a pleasure speaking with you, Bill. Thanks for your time.

Karen Fetter:

It’s our pleasure.

Matthew Anderson:

Thank you, guys.

Steve Sidwell:

Thank you for joining us for another episode of The Tech Bench Podcast. In our next episode, we’re going to be speaking to Bob Johnson from High Sigma. If you enjoyed this episode, please make sure to subscribe and follow us on Instagram, Twitter, and Facebook at LTTB podcast. If you have any questions, comments, or show ideas, please feel free to email us @techbenchatliquidtechnology.net. For show notes, visit liquidtechnology.net/techbench.