Using the Zero Trust Solution Method to Strengthen Your Company’s Security

[00:00:00] Intro: This is Reverse Engineered. 

[00:00:04] Jon Penland: Hey everyone. My name is Jon Penland and Reverse Engineered is brought to you by Kinta, a premium managed hosting provider. In today’s episode, I’m speaking with John Engates, Field CTO at Cloudflare. John, welcome to Reverse Engineered. Hey 

[00:00:17] John Engates: John, thanks for having me. Yeah. 

[00:00:19] Jon Penland: Well, to get us started, can you introduce yourself to our listeners?

[00:00:24] John Engates: Okay, so again, my name is John Engates. I’m based here in San Antonio, Texas. My company is called Cloudflare. I’m Field CTO at Cloudflare. And for those of the folks that don’t know Cloudflare, we are an application performance and security company, web-based, primarily. A lot of companies come to us for their websites and their web applications, APIs and they want services to help protect, defend those websites against attacks,

[00:00:53] all kinds of threats out there on the internet nowadays and we have been in the business for about 11 years in basically helping websites stay online. 

[00:01:01] Jon Penland: Yeah. So, exactly, what does a field CTO do? ‘Cause I, I suspect a lot of our listeners, because so many of our listeners come from our business, which is, WordPress hosting primarily, there, a lot of our folks are very familiar with Cloudflare already, in terms of a product and a service, but field CTO, I think might be a little bit less familiar. So, what is it that you do at Cloudflare? 

[00:01:22] John Engates: Yeah, so, I work for our global CTO. His name’s John as well, which is confusing as, as it might be in, in this podcast as well.

[00:01:29] Jon Penland: Yeah.

[00:01:30] John Engates: But, he point is that he is, you know, only one guy, and he can’t be everywhere at once. And we have a lot of customers nowadays that are very large. Sometimes they are enterprise customers, sometimes they have a CIO, a CTO, a lot of folks in the IT organization, and they need some, you know, connection to the organization when they’re gonna make a big net in terms of betting on Cloudflare as a platform or spending a lot of money with us, for our services, they want to get to know the company at a deeper level sometimes. And field CTO is primarily an external-facing role. I’ve been CTO for many years, and I’ve flip-flopped from internal CTO working on the product and, you know, sort of hard at work on building out the capabilities of the company, but I’ve also been in, in roles where you, you get a lot of demand for external connection at the technical level. 

[00:02:19] So, people want to understand the products and the services, they wanna understand how they work and they, they sometimes again, just need a connection at the exec level, and so that’s what I’ve been doing, for a number of years and now I’m doing it at Cloudflare for the last eight months or so. 

[00:02:35] Jon Penland: Yeah. Okay. So when Cloudflare is then working with a relatively high-level enterprise lead or client, you become a technical asset that is available to that lead or that client to make the best use possible of Cloudflare in their use case.

[00:02:54] Is that sort of a good encapsulation of the position?

[00:02:56] John Engates: That’s pretty good. Yeah. So, basically, I’m there to help guide them in their journey, whatever they’re doing within the context of their business or their product. I have a lot of background in, in terms of hosting websites and applications and I have a lot of networking experience over the years and met a lot of companies in a lot of different industries, and so sometimes you have insights that you can share with companies that maybe haven’t encountered certain challenges and so you can bring some expertise or experience to the table.

[00:03:31] You can sometimes just build trust with an organization. And, you know, a lot of people deal with companies that, for practical purposes, they’re dealing with a website, they’re dealing with a, a shopping card or, you know, they’re, they’re not really building a relationship with a company. That’s just very common nowadays.

[00:03:50] And a lot of times, again, when you, start to spend serious money, you start to wanna build trust with a human at an organization. 

[00:03:58] Jon Penland: Sure. 

[00:03:58] John Engates: And that has to happen at various levels, you know? Sometimes you have the frontline technical folks that are hands-on keyboards, they have their counterparts in the organization

and as you go further up the ranks, you wanna build relationships at sort of matching levels.

[00:04:11]  And, yes, absolutely. I will share whatever I know with a company about, whether, whether it be cloud transformation or taking advantage of cloud-based services, things that we’re doing, sometimes sharing the roadmap of the company, what we’re planning to do, and a lot of companies want to make bets based on where they think the company is heading. 

[00:04:31] Jon Penland: Right. 

[00:04:32] John Engates: Not just what’s on the website today. And, you know, you have to be a little bit careful sharing the roadmap. I mean, we’re a public company, you can’t tell them everything, but you want to give them insights into where you’re headed so that they can, you know, understand what the company is  planning and, and whether it, it aligns with their future vision for their company as well. 

[00:04:53] Jon Penland: Yeah. In your answer, just a moment ago, you alluded to the fact that you do have quite a bit of history in the what I would characterize as sort of the B2B internet space. And I wanna ask a bit about that, but before I do, I think it would be useful to our listeners to have a sense for what that background is.

[00:05:11] Jon Penland: So, could you give us, you know, kind of the Cliff Notes version of your career in the B2B internet space? 

[00:05:15] John Engates: Sure.

[00:05:18] John Engates: Yeah. So, my career has been internet-centric. My whole career has been revolving around the internet. I mean, right outta college, I started an ISP with one of my college friends. Five or six years later, that led me to a company called Rackspace.

[00:05:33] Rackspace was one of the major hosting company, still is to this day, a very large-scale hosting provider. You know, previous to cloud, you know, Rackspace was really the place people put major websites, you know, before Amazon or, or Google existed. This was the place where a lot of the, the biggest websites were born.

[00:05:53] And I was CTO at Rackspace for almost 18 years. And so, I spent a lot of time, again, with very large-scale web customers, helping them build out their infrastructure and guide them on, on that journey. After Rackspace, I worked for a couple of years on a, well, at a telco called NTT, major, Japanese-based telco working on SD-WAN.

[00:06:16] So, basically taking the internet and helping companies turn that into their, their internet backbone and then, now, Cloudflare. And, today at Cloudflare, I really think it’s sort of the culmination of all of that experience because we’re doing things, you know, in a major way on the internet for big internet properties, helping them scale and, accelerate their websites, protect them from DDoS attacks.

[00:06:38] And then, and then the next wave of what I would characterize as Cloudflare’s future is sort of replacing the traditional WAN with the internet for a lot of companies. I mean, that’s the direction that a lot of people are going nowadays, is leveraging the internet as their corporate backbone. 

[00:06:55] Jon Penland: Yeah. And I do wanna come back to Cloudflare and, and where Cloudflare’s going in the future, but backing up a little bit and thinking more, abstractly about sort of that B2B internet infrastructure space that you’ve been in for the past 20 plus years. 

[00:07:11] John Engates: Right.

[00:07:11] Jon Penland: So, as you, as you look back beginning of your career, 20 plus years ago, what did that industry look like when you compare it to today? How have the needs of businesses changed over that time? 

[00:07:27] John Engates: Well, in those early days of my career, the internet was not, certainly not what it is today. I mean, it was basically, marketing websites, I mean, not a ton of eCommerce yet in those early days, not a ton of commerce at all. It was mostly, you know, static websites, webpages, some people call them homepages back in those days. You probably remember, but it was basically a corporate marketing site for a lot of companies. It was oftentimes not mission-critical. I mean, if the website was down, it didn’t make much of a difference because people weren’t transacting business there.

[00:08:06] It was just a brochure, basically. A really fancy dynamic brochure for the company.You know, I think in, in the early 2000s, you started to see companies making more, again, more dynamic websites, things that actually, you know, maybe could take orders and, and you could start to, you know, have a shopping cart associated with your website. You could start to, you know, take borders and, and do business online. And that’s when it got really serious, you know? Companies started to invest in the infrastructure to protect that website’s uptime and the performance of the website. And that’s really, usually, what led them to our company at Rackspace, at the time, was they were looking for something better than what they had or could do on their own.

[00:08:52] John Engates: Prior to the, you know, the 2000s, I guess, most people, if they were gonna build a website, they got a T1 line to their office, and they built out a little, “a data center” if you will. And I put that in quotes because it didn’t, it wasn’t a data center, it was a closet with a few servers in it, and they’d get a connection to the internet, and they’d run their own website. When that sort of, you know, ran out of steam, they would oftentimes move it to a co-location facility where they were renting rack or renting some space, hence the name that’s where the name ‘Rackspace’ sort of was born out of, is the idea that, you know, you needed better infrastructure for your site. 

[00:09:31] John Engates: And then Rackspace sort of improved on that model by actually delivering the servers, the networking capabilities, you know, the turnkey operation for these companies.

[00:09:39] And they were basically looking for, you know, shortening the time to market. They were looking for a way to get online quicker, get online more reliably, have somebody else help them, as well. The expertise that went along with it was invaluable because most people, really didn’t have the skills. If you recall, Linux was a dominant platform for web hosting at the time, you know, Windows wasn’t quite what it is today, not quite ready for the web and Linux was the dominant platform. 

[00:10:04] John Engates: But very few people had Linux expertise. They just did not know how to do system administration, and they needed help, you know, with managing that infrastructure. So, really, just, raising the bar in terms of the expectations of every aspect of that, because business was at, at risk, you know? These people had their entire, business sort of wrapped up in a server or multiple servers and you had to really take a lot more care of those than you did in the prior generation because it, it just mattered a lot more. 

[00:10:42] Jon Penland: Yeah. Yeah. So, at the beginning of your time in the industry, you’re seeing, you know, brochure sites, simple, simple websites, and then that evolves into actually moving to doing business online.

[00:10:56] And with that comes the requirement for more expertise, more robust infrastructure and that sort of spawns, some of your early days in the space with companies like Rackspace, who were, who were taking that sort of server out of the closet, moving it into a data center and professionalizing the administration and management of that infrastructure.

[00:11:17] So, that kind of brings us, maybe not quite up to the present day, but moves us from those earliest days into, sort of the modern era. As you forecast into the future, how do you envision the needs of businesses changing, you know, 10 years down the road? What’s, if you could, had a crystal ball, what would you forecast as the next phase of evolution here for businesses using the internet?

[00:11:43] John Engates: Well, certainly the internet, if you really want to think about the internet itself, it is becoming more and more critical to every business, you know? Historically, if you looked back 10 or 15 years to an enterprise, the internet was a connection that was external to their network. Their internet was something that they had a gateway to, or a connection to, but most of the network traffic was sort of internal. It was on this trusted internal network. 

[00:12:16] The internet today is sort of overlaid over everything that companies are doing, you know? The remote work, the work-from-home hybrid, whatever you want to call it, put that really front and center for every organization because they realize that they couldn’t continue to do business without leveraging the internet.

[00:12:32] Whether it be a, you know, platform like Zoom or a SaaS platform that their users were using, if they didn’t have the internet, they were kind of offline and out of business. So, it’s now, it’s no longer just for their websites and their consumers. Now it’s for their users and their employees, right?

[00:12:48] It’s now a strategic, really critical component of their strategy because they’re sort of offline without it. And so,  you know, the company, Cloudflare, our motto is helping build a better internet, and so, historically, that was really in service of those websites. But now it’s taking that same architecture that we’ve built and applying it to more of the enterprise requirements.

[00:13:15] So, you know, it could be helping secure a desktop. Like, I’m sitting in front of my, you know, laptop here, and there’s security requirements around that. It’s helping make sure, you know, threats don’t make their way into the organization via, you know, sort of the internet, you know? It’s, it’s connected to everything, right?

[00:13:33] And so, now there are threats coming from everywhere and so you wanna protect those as well. And I think the internet itself is going to continue to be, even more and more important to companies because that’s where really all the new stuff is born. I mean, if you think about what is exciting and interesting and new, it’s always nowadays, you know, coming from the internet. It’s delivered as a service, could be a SaaS platform, it could be a streaming platform, it could be IoT.

[00:14:01] I mean, it’s in there. Internet of Things, right? The very term internet is in the middle of that, and I don’t think we’re ever going back to a world where people are gonna be building more and more private networking. They’re gonna be really leveraging the internet for more and more of their their infrastructure requirements and that just means it needs to be bulletproof. 

[00:14:22] It needs to be more reliable, more secure, more private, more performant. It needs to be consistently performant everywhere. People are going to, you know, be more distributed than ever, whether it be their employees being distributed, their customers being more distributed or their applications themselves being more distributed.

[00:14:40] I mean, the very nature of applications moving toward the edge is going to be a future, we’re never going back to single data center or centralized data centers. We’re going to be more and more distributed and that’s because, distributed computing serves users close to where they’re at every day, whether it be a self-driving car, whether it be a, a kiosk at a, at a grocery store that you’re interacting with, or, you know, some, some other future workload that we haven’t even invented yet, it’s going to need computing, and it’s gonna be, required to be very close in terms of the, latency and the performance to where the end-user consumes it.

[00:15:23] And so, that’s a few of the things that I sort of see coming down the pipe. 

[00:15:27] Jon Penland: Yeah. I can resonate with the idea that a part of what’s happening now and what’s gonna continue to happen in the future is this internal trusted network has shifted externally. And so before, we started recording, we were chatting briefly about some of my past work.

[00:15:48] And I used to work in a completely different industry. And one of the challenges, when I started talking to my managers at that point about trying to work remotely, is that we did have that trusted internal network, right? We had this trusted on-premises set of servers that did all of our document storage, document management.

[00:16:06] We had applications running there locally. There was no external access to that system. The only way to access that system from the outside was to connect over a VPN using an actual physical key fob with a one-time password that rotated, was to connect via VPN to a workstation that was the physical workstation inside that location that was turned on and then to, to navigate it remotely in that fashion, right? 

[00:16:32] And so, you take an organization like that that has complete well, has a very high degree of control over document access, information access, and tell them, “Hey, we’re gonna, we’re gonna put people all over the place and put your documents on the internet.”

[00:16:45] Right? And that’s terrifying, right? And, and so, for a startup, you know, a startup, made up of folks who have probably been using the internet since they were born, it’s not terrifying to think about putting your documents in Google Drive. But if you take an enterprise that’s been around that company, I think had been around for 70 years, and tell them, “We’re gonna take all of these documents that are the gold that makes your business valuable and we’re gonna throw ’em up on the internet where anybody can access them for, from anywhere,” that’s terrifying. 

[00:17:16] Jon Penland: And so, building out security around that transition and that company has eventually made some shifts to allow that, so that shift is already happening, but I can really see that as I look back at my own history, that shift from that trusted internal network, making it external. Right?

[00:17:32] John Engates: Mm-hmm. It’s interesting. You use the, the term ‘trusted’ because in, in the context of what I’m talking about, there’s a sort of a security paradigm called “Zero Trust.” And so, what we’re basically trying to do is enforce a requirement that we verify every single connection and every single, you know, source and destination across the network. We don’t want to use a VPN in the traditional sense because a VPN in the old form used to bridge a user from an untrusted network, like the internet, into a trusted network, like the corporate network.

[00:18:09] But the problem is once they were there inside the corporate network, they really didn’t have any restrictions. They could kind of move across that network without any restriction. And we use, we sometimes call that ‘The castle and moat.’ I mean, it’s sort of like, you want to put a perimeter defense around your castle, but then once you’re inside the castle, you can walk around as much as you want, right?

[00:18:31] There’s no limits to where you can go. And the risk becomes that, you know, today, a lot of the threats to your IT organization, your security, your, your data, they’re not people trying to beat down the door from the outside, you know, with a, an attack that they’re trying to guess your password or something. They’re in, they’re sort of impersonating your own employees.

[00:18:58] They’re oftentimes compromising your employee through a fishing attack or some sort of other attack against the individual. And then once they impersonate that user, they have unfettered access to everything in the organization. So, even if that data sits on an internal trusted network, it doesn’t mean it’s secure.

[00:19:17] It doesn’t mean that it’s actually protected from exfiltration. So, you really need to put more control around who has access to what, you need to verify their identity, you need to verify what kind of device they’re coming in from, make sure that it’s a secure device, you know? 

[00:19:34] Today, a lot of users sit in our home office, side by side with another computer over here, they’ve got their work computer. Sometimes they’re accessing their personal email from their work device, so even if the enterprise is trying to protect all the email from phishing attacks, what about that external personal account that might not be protected?

[00:19:54] And so, that’s really what Zero Trust revolves around, is trying to protect the user, trying to protect the data verifying every single connection, whether it be internal, on-premises or in a SaaS provider or in a Cloud provider, and, and then controlling access to those, those resources and really protecting the organization from data loss or, you know, loss of customer information or whatever, whatever it might be.

[00:20:22] Jon Penland: So, I have one more question, just as you think back on your time in the industry, and then I’m gonna shift the lens over to Cloudflare, where you are today. 

[00:20:30] Jon Penland: But as I was preparing for this conversation, I was struck by an article you wrote recently on a website. I think it’s devops.com, I think was the website. And the article described using Jamstack.

[00:20:43] Jon Penland: And, and I was struck by the fact that, in your current position, I can’t, I suspect that knowing how to use Jamstack is not on your list of, is not in your job description, right? That’s something that you went out and decided to do on your own. And I’m curious what your strategy or approach is for keeping track of the evolution of technology even though you’re in a position that doesn’t necessarily require you to do that?

[00:21:13] And, I’m just curious, how do you think about making sure that you’re staying on the leading edge of where the internet is going? 

[00:21:21] John Engates: That’s a great question. I’m, you know, I’m not a, a young guy anymore, so I don’t have the ability to just, you know, sit around and, and mess with things like I once did, you know? But, but I do need to stay current.

[00:21:35] And, you know, as I made my way into Cloudflare, I don’t know, less than a year ago, but you know, it’s been a while, but, you know, I wanted to understand what our customers were doing with the platform. I wanted to understand, you know, if I was a brand-new user to Cloudflare, what would I encounter when I logged into the dashboard and I started looking around what were the things that I could do for free that were interesting and cool. 

[00:22:00] And so I started to explore it a little bit, and there’s, you know, sort of all kinds of things in the platform that are interesting, but the one that I hadn’t, you know, sort of picked on in a while is, is hosting an actual website, you know?

[00:22:14] That I used to do that at my old jobs, but I hadn’t really run a website lately and I started looking around for how people were doing that. And Jamstack and, you know, sort of that approach where you’re really building a static site and then hosting it at the edge sort of rose to the top in terms of things that I needed to sort of look at and explore.

[00:22:35] And, so I just started playing with it. I mean, I fired up a Linux, console and got my GitHub account back, you know, sort of back in shape, and I started figuring out which of the platforms were interesting in terms of the jam stack, you know, page generators and whatnot, basically just tinkering with things. 

[00:22:55] John Engates: But I always tinker with them.I mean, that is kind of my, my thing. It isn’t always sort of down one path and very focused. It’s oftentimes, you know, jumping around from different thing to different thing, you know? It might be drones, it might be cameras. It might be, you know, the latest Mac Laptop or, you know, device. You know, photography’s one of my hobbies and so I always come back to that. But, you know, it’s, it’s really just curiosity that keeps me, tinkering with things. I like to understand how things work. I’ve always loved to take things apart. I miss the days when you could take apart a computer. Nowadays, they’re all sealed up pretty much, and you can’t do that anymore.

[00:23:35] It’s just curiosity and, and it helps in my day job because it connects you to people that are also curious about things. I mean, you have things in common with other individuals. If you explore, if you explore new technology or new avenues, it just gives you more breadth of exposure to things that other people might be also curious about.

[00:24:01] And you can just ask questions of people and then when you hit on something that’s interesting, you go down that path with them, and you ask, you know, people love to tell you about what they’re passionate about. They love to talk about their hobby or whatever they’re working on currently, and if you have some frame of reference for that does help me in my day job.

[00:24:20] That helps me immensely, if I can have a conversation with a CIO or a CTO or some other technology person about something that isn’t purely work-related, but maybe something ancillary that is connected to it. But that opens doors. It builds trust. It helps people connect with you. And a lot of people are introverts in our industry, right?

[00:24:41] They’d rather be behind a keyboard. They’d rather not, you know, talk, but if you can get to something that they’re passionate about, they will open up, and they will tell you everything about what they’re passionate about. And that really does help me. And so, I try to explore different things that are interesting and relevant.

[00:24:59] And then I put ’em aside, and I move on to the next one. 

[00:25:02] Jon Penland: Yeah. Yeah. I feel like I heard two different tracks that you may follow, or maybe a third one as well, but two or three different tracks that you follow, as you try to sort of stay abreast of what’s happening in the technology space. And so, like, and I just wanna highlight these because I think these are ideas that may might, can help listeners who are thinking about, “How can I, if I feel like I’ve fallen outta touch a little bit with what’s happening in my industry or in my space, what are some ways that I can identify areas to pursue?”

[00:25:31] And the three things that I heard, one was, “Pursue things that are relevant to your customer base,” right? “To the job you’re doing today.” And so, that’s where, that’s where I see sort of that Jamstack-piece fitting, where you come to Cloudflare and you’re like, “How can I learn about the product, how our customers are using it?”

[00:25:47] Okay. Jamstack fits that box. That’s something for you to dive into and learn about and it contributes to what you’re doing. The second one that I heard is this idea of being curious about your hobbies. You mentioned photography and I happen to know that the Jamstack site, because the article mentions you built a photography site, right? So, you sort of tied that in there as well. 

[00:26:07] Jon Penland: But, like, pursuing the things that you’re interested in, because, at this point, technology touches everything, right? There is no hobby, no interest you’re going to find that there is not a technology angle to be curious about. And then the third is, getting to know other people, right?

[00:26:26] Asking them about the things that they care about because there’s a good chance that there’s an element there that you can learn about, as well. So those are the sort of the three things that I heard pop up as I was hearing you talk about. Yeah. The things that you’ve done to stay connected to technology.

[00:26:42] John Engates: Yeah. And you know, I’m primarily a hands-on learner. I do, I try to learn things, you know, sort of by doing, but you know, there’s so many resources nowadays that can accelerate that. I mean, you know, you’ve got YouTube. I’ve watched a lot of YouTube videos. I mean, there’s just, you know, there’s a lot of tutorials online, that just basically walk you through things step by step.

[00:27:04] And, that just didn’t exist 20 or 30 years ago. You had to go buy a book. I remember how, how to figure out how to use the internet, you had to go buy a book on Unix. That was it, I mean, literally that was the way you did it. But today there’s so many people that are willing to share their experiences online as well and, you know, it’s really amazing what’s out there and you just have to sort of put your mind to it and go figure it out. And there’s a lot of help out there available.

[00:27:31] Jon Penland: I do wanna shift gears and talk a bit about Cloudflare. I view Cloudflare as being one of those companies that is at the leading edge of where the internet is going and I feel like has been for a number of years now, at a sort of an infrastructure level. And so, as you alluded to one of Cloudflare’s stated goals is to build a better internet or to help build a better internet. So, I know you haven’t been at Cloudflare for a super long time, but I’m sure you know a bit about Cloudflare’s history.

[00:28:05] What did that look like in the past for Cloudflare? What did building a better internet look like in the past and what does that look like today? 

[00:28:14] John Engates: Sure. So, I’ve known the company for a long time. When I was at Rackspace, they were a partner of ours. I met the founders of Cloudflare in the very early days when they were just little startup.

[00:28:24] So, I’ve sort of watched their journey over the years, and I’ve been a cheerleader for Cloudflare. The company, you know, historically, again, was really involved in protecting websites, in helping secure websites. So, getting SSL, or TLS, you know, encryption into the market, that was one of the master strokes for the company because they basically did it for end-user.

[00:28:50] It was complicated to go out and register your, you know, your SSL certificate, make sure it was, you know, installed correctly, and Cloudflare accelerated that by just basically making that one or two clicks in the dashboard. They, you know, did the same thing for, CDN services, DDoS, protection for websites, helping keep websites, websites online when they were getting hit by either enormous amount of traffic from legitimate traffic or illegitimate traffic, basically just, you know, making sure that the websites didn’t tip over from over capacities, so to speak. 

[00:29:27] DNS is another critical element of the underpinnings of the internet, so helping build a better DNS infrastructure. Cloudflare, the very first thing you do at Cloudflare is go put your domain names in and, you know, if you can flip your DNS over to Cloudflare, you can register domains for no we don’t charge any upcharge on term, it’s our cost for all our DNS registration.

[00:29:51] So, it’s easy to register domains. It’s easier to manage domains on Cloudflare. And then, you know, then there’s a lot of services that we can add on. And again, you know, historically those were in support of either helping companies scale or protect their websites from attack or just, again, overwhelming traffic.

[00:30:10] As we look forward, you know, we companies are trying to build either more dynamic websites or more scalable websites or things that have new functionality that just wasn’t maybe possible before. So, now people are, are leveraging our network to build applications on our Cloud. Like, not just, not just standing, you know, not just putting Cloudflare in between your websites and the end user, but actually moving elements of your applications into the Cloudflare network.

[00:30:45] And so, we built a developer platform. We have Cloudflare workers, which is where you can actually run applications on our edge nodes. We have 270 locations around the world where we have infrastructure, and we’re within about 50 milliseconds of 95% of the population, the internet population. And so, you know, we want to be very close to those population centers because, because we wanna serve those people with the best performance possible.

[00:31:13] And if you can distribute those applications close to those end-users, that becomes a way to make those applications even more performant, more dynamic and make the experience for those end users very consistent, because that is one thing we’ve always struggled with. The internet is better in some parts of the world than it is in other parts of the world.

[00:31:33] And so, if you can get your application closer to those users in, in any dimension, right? You will build a better experience for those users. And, that’s what we’re trying to do with our developer platform, make it possible for a developer to push their workload as close as possible to end-users.

[00:31:51] Jon Penland: Yeah. Yeah. I think of that movement of workloads as close to the user. I think of it as sort of decentralization of computing, right? And it’s something, you know, it’s no secret that Kinsta uses Cloudflare, we advertise that pretty openly on our website. And like, one of the ways we’ve done that is we use workers to handle a lot of the logic that previously was handled internally.

[00:32:19] So, we’ve always used Google Cloud as our infrastructure provider, and there was certain logic that was happening every time a request reached our infrastructure, and we’ve been able to push a whole lot of that all the way out to the edge network. Makes it much faster for that logic to begin and it makes it much more robust. Because now it’s happening at I don’t know how many different locations that Cloudflare has locations.

[00:32:43] It’s much more reliable in addition to being much closer. Right? So, so the way that I think about what Cloudflare is doing is really accomplishing that decentralization of processing over and over. Right? So, there’s the CDN piece, which is the static assets, “Okay. We’re gonna push the static assets out to the edge.” And then there’s some of that logic stuff that you can do with workers.

[00:33:08] And then, as you alluded to, with the Jamstack article that I, that I’ve referenced a time or two here, you can actually push the content out to the edge as well, in some scenarios. So, it’s just sort of the ongoing movement away from this idea of you have a central server and moving it out onto that edge network where it’s not only faster, but it’s more reliable, it’s more resilient for end users.

[00:33:35] John Engates: Right. And if you think about, one of the things we talked about in the sort of the history of Cloudflare, the DDoS protection, helping protect denial of service attacks, and I’m sure people have heard that term, but Denial of Service Attacks are basically where, the bad guys will just use that term generically, the bad guys will try to overwhelm your site or your application with illegitimate traffic, bad traffic that is basically just there to take you down. And the way they do that is they build botnets, or they launch, you know, these attacks that try to do, you know, volumetric, just traffic against your website, and then they try to tip you over.

[00:34:13] But the way you absorb those attacks also matters because we wanna do it as close to the source of the traffic as possible. So they, the reason we have a distributed network, and the distributed part really matters here is you want to absorb that traffic close to where that’s starting from rather than close to the destination because you don’t have to traverse all of that traffic over the internet itself. You don’t have to pay to move that bad traffic all the way across the internet.

[00:34:42] You can absorb it very close to the source. And this is actually how we built our network. Part of the, the way that we have a network that spans 270 plus locations is oftentimes ISPs will invite us into their points of presence. So, it could be an ISP in South America or Asia, or Africa. They want us in their network because we make their traffic.

[00:35:07] We reduce the bad traffic across their network. We actually keep their pipes clean, and we make their network better. And by being so well connected to ISPs and network providers and Cloud providers, we can also traverse the legitimate traffic across the network, more reliably, more securely, and with lower latency than the public internet itself.

[00:35:30] So, if we, if a customer needs to get traffic from some remote region back to the origin, that can come across the Cloudflare network in maybe a more efficient way than if it had to just traverse the open internet. So, that’s another way we sort of use that distributed network to the benefit of our customers.

[00:35:51] Jon Penland: So, we’ve talked a while about, you know, what Cloudflare’s history is and, and what Cloudflare is doing today in terms of decentralizing computing. Is there anything you would highlight or that you’re able to highlight, looking into the future about what’s coming next? Is there anything you would highlight as to where Cloudflare is going in the future, with its network?

[00:36:12] John Engates: Sure. Yeah. Sure. So, I mentioned the developer platform, so we had Cloudflare workers today, but there is more to come in that, in that category of developer services or cloud-based services. We actually announced earlier this year or late last year, a platform that we call R2, which is object storage in the Cloud.

[00:36:34] So, think of a place to put your files or objects or you know, the, the things that you’re gonna use in your application could be images, whatever it might be. So, a storage layer that is now available inside of Cloudflare that’s in beta today, but it’s ready for people to try out. Database is also on the horizon, so we announced, or preannounced a platform that we call, D1, which is our database as a service in the cloud context. So, you’re starting to see things shape up where you’ve got more and more capabilities inside of Cloudflare, that allow you to build, potentially, the entire application. Not just a portion, not just what would exist at the edge, but a very comprehensive application.

[00:37:16] And then oftentimes we all know that, many applications consume APIs around the internet, so it’s also a good place to sort of situate your application because we’ve got connections to, you know, a lot of the services providers, cloud providers, and it would be a very good place to, you know, to situate your application, if you want performance and scalability and then all the security services.

[00:37:38] So, a lot more to come in the developer arena. I also, again, is, I’m very excited about the work we’re doing on the Zero Trust platform. Zero Trust applies to everybody. It’s not just for big enterprises. I mean, I would encourage any small organization to go to Cloudflare’s website and explore a little bit about Zero Trust because there’s no reason not to protect your employees, even if you’re 5 or 10 people in the organization, you know, protecting them with you know, mitigations to keep that their application from, you know, sort of, opening the back door to your, your company, your organization, whether that be a, you know, a bad guy, just trying to harvest some credentials or somebody trying to look at your user database or, you know, log into your, you know, your backend credit cards, you know, files, whatever it might be, there’s, there’s no reason not to protect that stuff. 

[00:38:31] And so, it really is a platform now that scales from very small organizations all the way up to the biggest. And it’s the, the direction that security is going and I would encourage everybody to, to take a look at that stuff as well. So, Zero Trust and that is super exciting for me.

[00:38:46] And, and we’re gonna continue to build out new capabilities there. The last bit I’ll mention is email. So email is the number one vector of attack for almost every company. You know, the, everybody uses email, it’s the number-one, you know, sort of way we communicate and so we’re gonna continue to invest in email protection as well.

[00:39:03] We acquired a company called Area 1 Security, so take a look at that as well, if you’re interested because email is how the bad guys make their way into the organization most commonly. 

[00:39:12] Jon Penland: Yeah. So, you’ve highlighted a couple of different areas of security. So, I’m thinking of DDoS, which we talked about a little while back, and you’ve talked about Zero Trust and now you’ve just mentioned email.

[00:39:24] So, I’m curious. I have two questions in this space. One of them is, are there any other sort of core security concerns that you see on the horizon that businesses should be thinking about? And two, I’m curious, from a practical layperson’s perspective, what does Zero Trust look like from a user perspective?

[00:39:46] Right? So, not the IT guy, not the expert, you’re a user part of a remote business who’s using some sort of Zero Trust solution, be a Cloudflare or something else. What does that actually look like? So, again, two questions, like, are there any other areas of security you would highlight? And then what does Zero Trust actually look like in practice?

[00:40:07] John Engates: Okay. I’m gonna start on the Zero-Trust question first because I’m thinking about it. 

[00:40:11] John Engates: So, when I think about what it looks like, it is a very seamless experience from an end-user perspective. You want it to make, you want it to feel like there’s nothing between you and the application. You want it to be as fluid as possible.

[00:40:27] I used to hate to log onto the VPN. The VPN was very clunky. You mentioned having to take out your token and type in a number and, you know, it was almost like dialing up to the internet. I mean, you were basically opening an application, putting in your credentials, and connecting and I would do almost anything possible to stay off the VPN if I could because it was, it felt like a clunky experience.

[00:40:48] Then, once I was on the VPN, sometimes I didn’t have access to things on my local network because you didn’t have that split-tunneling capability, maybe the printer was no longer accessible because I was connected. We want all of that stuff to be seamless and transparent. So, what it feels like is when I sit down on my computer, I don’t have to open up any client or any specific capability.

[00:41:11] I do have a token, but it’s in the form of a hard key. So, basically, I touch the little USB, fingerprint reader over here. I never type in credentials. If I’m prompted for a credential, it’s basically you know, touching that little hard key YubiKey is what we use and, basically making it, you know, seamless for the user.

[00:41:35] We want it to feel like the user is protected with bubble wrap that they don’t even know is there. We want them to feel like they’ve got the protection. So, you know, applications that are web-based or cloud-based. They all feel the same what to what I might use on the internal network. I have single sign-on, I have a single, you know, sort of identity. Once I authentic with that identity and multi-factor authentication token that I’m into the applications that I have access to. Having access to certain applications and not others is pretty seamless as well. We have a dashboard internally where all my applications that I’m authorized for exists. And so, all, what also you want is to make it easy for administrators behind the scenes to onboard new users.

[00:42:24] You know, you wanna make the provisioning of the new laptop as easy as possible. So, when I joined Cloudflare, they shipped me a laptop. I opened it up and, you know, basically, all the applications got installed and they, the client for Zero Trust, got installed and I, you know, chose a password, and I was in. I mean, it was very, very seamless.

[00:42:42] The other thing that is interesting about, the Zero Trust is we have a capability that’s called, Remote Browser Isolation. So, if you want to get even more aggressive about protecting the user, you can actually force certain browser sessions to be done off-site in the Cloud at Cloudflare. And the user doesn’t even know that it’s being done.

[00:43:06] I mean, it is literally transparent to the end-user, but all of the threats are kept at, at arm’s length. And so, that’s what you want. You want it to feel like there is nothing different about using a SaaS provider or a cloud provider, or an internal application. It’s just, you know, sort of this seamless experience and transparent to the user. And it really is.

[00:43:28] Jon Penland: So, the answer is to the user, there should actually be nothing noticeable. There should be no noticeable difference in their workflow, really, in implementing a tool like that at all happens in the background. Are there any other security challenges you think businesses should be thinking about today that you would highlight? 

[00:43:51] John Engates: Yeah. Well, I mean, you know, there, there are the constant threats that are out there. I mean, we have been tracking, in Ukraine, a lot of the, the DDoS attacks that have been going back and forth between Russia and Ukraine. There was a number of attacks that we were watching sort of in real time, we have infrastructure in that part of the world.

[00:44:13] We can see traffic patterns, we can see the ups and downs. And, you know, that unleashed a whole new set of malware and, you know, the, these kinds of attacks, that historically might have been ransomware, but now they’re just destructive attacks, right? So, think about, you know, now we, we worry about somebody using ransomware to encrypt our network.

[00:44:38] You know, they were basically using the same techniques, but they were just destroying the data, not encrypting the data, but just wiping the data. So, they call it ‘Wiper Malware.’ That emerged, you know, there might be attacks, we have, you know, historically encountered what we call “Ransom DDoS Attacks.”

[00:44:55] Ransom DDoS basically means that they don’t actually have to launch a full-scale DDoS. They can basically send you a, a, a ransom demand and say, “We are planning to attack you, and you should pay up.” Right? And so I think that is something that could, you know, sort of continue to, be on the rise.

[00:45:14] We see more and more DDoS attacks. We saw recently one of the largest DDoS attacks that we’d ever encountered. It was, like, literally just a week or two ago, and it was, this massive 26 million requests per second. It was targeting HTTPS, which is a very expensive type of an attack because it requires a lot of resources on the other end.

[00:45:35] They are botnets that are, you know, historically a botnet might have been made up of, you know, mom and pop’s computers, but these were made up of cloud servers in actual data centers. So, the scale’s getting bigger, the threats are getting larger, the ransom. I also think, you know, with the economy doing what it’s doing and, and, you know, the crypto environment being what it is, people may start to ramp up their expectations and their demands because they’re starting to, you know, be desperate, you know? I think that, yeah, this affects a lot of those folks. I mean, where are their resources sitting? They might be sitting in crypto, you know, they might not have been able to convert it to cash, you know, us dollars or something like that. And so, if their, you know, their hoard is now cut in half. 

[00:46:18] John Engates: They might start to become a little bit more desperate and start to, you know, roll out the bigger guns and use those. So, I don’t know, I think it’s gonna be more of the same, but probably in new forms and new, you know, sort of types of attacks and, just maybe more desperation in terms of folks doing those attacks and perpetrating those attacks.

[00:46:42] Jon Penland: The last area that I wanted to touch on in our conversation is sort of your career path as an executive in the B2B, internet technology space. So, when you first started into this space, what led you into technical leadership roles as opposed to technical individual contributor roles? Like, being a developer, being an engineer, what led you in the direction of wanting to be in a leadership or executive position?

[00:47:14] John Engates: Well, I think I was pulled into it and I think I was consistently, pulled into doing those kinds of things. And I don’t know where, where it comes from. I mean, I’m a technical person. I’m a curious person. I think one area that maybe, helped is that I can communicate, I can, you know, I’m not so introvert, I consider myself an introvert, but I’m not so introverted that I’m unwilling to, you know, get out in front of people or stand on a stage or, or, you know, that really opened a lot of doors, just the willingness to go talk to people.

[00:47:50] I think that, you know, I know at Rackspace, they sort of started to push me to go do conferences and events and do more public speaking and, get in front of larger customers. You know, again, people need to be able to communicate with a company, and you have to have credible, spokespeople and people that can convey what’s going on behind the scenes.

[00:48:12] And so, I kind of got pulled into that. I think in terms of, you know, sort of my understanding of my own skills and my own strengths, you know, one of my mentors years ago at Rackspace was, he was the CEO, he pulled a, he read a book and then he pulled this book into the organization. It was called “Now Discover Your Strengths.” It was the strengths-finder book that was done sort of in the context of the Gallup organization. And it helped people in the organization understand, you know, what they really were good at and maybe what they should not be so,you know, maybe what they weren’t so good at. 

[00:48:51] John Engates: And he coached me to basically pursue the things where I could be world-class, not beat my, my, not beat myself up for having a weakness, but just go figure out what your strengths are and then go do the kind of work where you’re valued for those strengths, where you can actually use those every day, where people, you know, sort of see you in your best light.

[00:49:13] And that’s what I have tried to do over the years. And, you know, I think, you know, one of my strengths is, is adaptability. So, if you think about what adaptability means every day it might be something different that you’re working on, somebody might ping you and say, “Can you help me with this?” and you’re willing to drop everything and do that.

[00:49:33] The opposite of adaptability is somebody who comes into work with this very rigid checklist that they have to solve every single one of those items on the checklist and if they don’t, they fall apart. Right? And I’m not a checklist person. I do try once in a while, but I’m much better in an environment where people are pulling me to do things.

[00:49:51] And I think that’s why I got pulled into these leadership positions over the years. And that’s just one example of you know, understanding your own strengths and what you’re good at and how that can sort of lead you into a, a career that’s a really good fit for you. 

[00:50:06] Jon Penland: Yeah. And I think that’s great advice.

[00:50:07] The idea of leaning into the things that you are going to be able to be world-class at, you know? And, you know, I think, I think reading a book like that, or just gaining that understanding, you know, “What are the things that I’m genuinely good at? Just naturally, whether it’s my upbringing, whether it’s something about just me naturally, these things that I can naturally be really good at, these are the things I need to lean into, regardless of whether or not that necessarily matches up with somebody’s list of the 10 most promising careers, necessarily.”

[00:50:38] Right? “That finding the thing that I am most naturally gifted at is gonna be where the, the legs are gonna be found in my career.” 

[00:50:46] John Engates: Right. And you see that across, you know, across the world, the most successful people in the world are doing things where they’re world-class, you know, every single day, whether it be an actor or a CEO or a, or, you know, some sort of, you know, any industry, any category it’s always the people that are really leveraging their strengths to the hilt, to the extreme that are the most successful.

[00:51:12] And they’re not sitting, sitting around saying, “Well, I wish I could be better organized. I wish I could, you know, keep my, you know, my, closet more organized.” I mean, that’s just not the thing that bothers them. And so, I would, you know, encourage anybody to sort of take stock of what you are passionate about, what you’re excited about, what you’re good at, where do those things align, and where can you, contribute the best of yourself.

[00:51:36] And then also be, be aware that you have to surround yourself with people that make up for your deficiencies because you are going to have some blind spots. You’re gonna have areas that you’re not so good at. And so, having the ability to figure out how to, to sort of augment your own  strengths with other people and build a team that, that can support you and you can build trust within that team.

[00:52:03] That’s super critical as well. So, don’t be, don’t try to be the lone wolf, but you have to really, you know, have a great support system behind you and trust your coworkers, your colleagues, your friends have a network, you know, maybe even in your personal life have, have sort of your own personal, you know, board of directors, if you will.

[00:52:22] You know, I have a friend who uses that term all the time, “having a personal board of directors.” But having people you can sort of lean on and, and help, coach you in, in whatever facet of your life that, that’s critical. 

[00:52:33] Jon Penland: There’s been a lot of fascination in the business literature world or in the self-help world around, productivity and organization.

[00:52:44] And so, when I hear you say, “I’m not a checklist person. That’s not something that I’m good at,” that seems to strike counter to the prevailing wisdom that I hear. So, I’m just curious to hear how you think about organization and productivity as someone who had admittedly doesn’t consider themselves to be a checklist type of person.

[00:53:08] Right? So, how do you think about that apparent apparent dichotomy? 

[00:53:16] John Engates: Well, I try to organize myself in a way that, you know, my day is scheduled on the calendar, certainly. You have to have a calendar. I mean, first of all, I mean, anybody and everybody has to have a calendar. I learned that lesson long time ago when I was trying to sort of just remember, you know, I come from the era before, before iPhones and PDAs and, and even, you know, the web-based calendar, so we used to write things down. 

[00:53:44] But I, I, you know, I sort of got, you know, sort of caught a few times with, you know, missing meetings and whatnot. And so, certainly use your calendar to your advantage. I used to use my inbox a lot as sort of my to-do list and that, that is a mistake. I will say that that’s probably a mistake.

[00:54:02] So, what I’ve tried to do also is just sort of keep that inbox clean. So I move things into the calendar. If I need reminders to myself, I put ’em onto the calendar. But again, what I was trying to get at with the whole checklist thing is, you know, there are some people that, that feel bad about themselves if they don’t get every single thing done. 

[00:54:18] I do have a checklist. I have, you know, sticky notes, you know, on, on the, the monitor. I have ways of reminding myself. But you have to build a system, whatever it is that works for you, you have to build some sort of a system. You know, oftentimes, when I, you know, prepare for meetings, I’ll write up sort of my own little notes ahead of time to things I want to, to get across or things I wanna remember, but I don’t, I’m not infinitely organized to the point where all of those, those notes get attached to everything and that, you know, it’s not something that’s, super, super well organized. It’s just, you know, whatever works for you, you have to build that system. And I don’t know. I don’t think I have any magical insight here. 

[00:55:03] I just think that, any individual has to find their own way in that regard and do what works for them. 

[00:55:12] Jon Penland: Yeah, no, I agree wholeheartedly. One of the things that I’ve told folks internally when thinking about organization, and time management, is that you have to find a system that works for you and that works for the work you’re doing today, right?

[00:55:27] Jon Penland: Because the needs of any given individual are gonna vary dramatically. If you are someone who’s handling customer support, even at a leadership level, right? You’re most of your time is gonna be spent on day-to-day, put-out-the-fire type of things. And that’s the nature of the job, and that means you need to keep a calendar for meetings and that sort of thing, but you probably don’t need to spend a whole lot of time doing time-block planning or keeping massive lists of projects and stuff.

[00:55:54] Jon Penland: Because that’s not your job, right? 

[00:55:59] John Engates: That’s probably the real answer is that I built a job for myself that I don’t need to have. I don’t need to have this very granular task list or, you know, I’ve sort of built my career around big events and big activities, not lots of small tasks, not lots of project-based work.

[00:56:18] You know, things I obviously have to get done, but I don’t live my life on sort of task by task, and so I have the luxury by having built my role and my career this way to be able to work in a way that works for me. And again, back to my strengths, it works for my strengths as well. 

[00:56:36] Jon Penland: Yeah, absolutely. So, as we sort of wrap this conversation to a close, I, I have two wrap-up questions I ask all of our guests. And, and the first is recommendations you would give to our listeners. So, is there one resource that you would recommend, say, “Hey, if you’re listening to this podcast, this is absolutely something you could, you should check out.”

[00:56:57] It could be a blog, a newsletter, a book, it could be a podcast. It could be anything. Is there some resource you found valuable in your own life that you’d recommend to our listeners? 

[00:57:08] John Engates: Yes, I would. First of all, I didn’t give you all this context, but, you know, over the last number of years, I’ve lost weight in my life.

[00:57:18] I lie, I actually went probably 50 pounds down. And, that all started when I started listening to Tim Ferriss’ podcast a number of years ago. And then I read a couple of his books. 

[00:57:32] John Engates: He has fascinating folks in his little ecosystem. So, Tim Ferriss, you probably, everybody knows who he is, but the folks that are in his ecosystem that, that also have helped me out, there’s a guy named Dr. Peter Attia. Peter Attia is one of his guests that he has on, every once in a while, and he has a podcast that’s called “The Drive,” and I love to listen to that. I mean, it’s a health and wellness and, you know, medical, and it’s got a lot of stuff that when you get a little older, you start to realize you have to take care of your health more than you once did, you know?

[00:58:04] And, I would encourage everybody to start thinking about their health and their longevity earlier, rather than later, your heart, you know, sort of the, you know, stop smoking if you, I never smoked, but don’t, definitely don’t do that. And just start to take care of yourself. 

[00:58:22] And these podcasts, I mean, there’s a number of folks out there that are just a wealth of knowledge. So, go check out Tim Ferris first and then maybe Peter Attia for that. Yeah, those are my favorite ones. 

[00:58:32] We’ll have to have a second podcast where we come back and talk about, about health and staying healthy ’cause that’s one of my favorite topics as well. But, wrapping us up with our last question here, if somebody wants to find a way to connect with you online or just to learn more about Cloudflare, where would you send them? 

[00:58:50] Well, me personally, I’m really only on Twitter nowadays. I’ve paired back my social media, so I’m jengates or jengates, on Twitter. And Cloudflare is at Cloudflare.com and it also has a Twitter handle that’s very prominent. The, the, the Cloudflare blog is the number-one place I’d point people to, because it’s the place where so much internal material gets surfaced, and you get to start to see what’s behind the scenes at Cloudflare, what’s coming, and what we’re working on. So, really cool place to, to connect with Cloudflare.

[00:59:22] Jon Penland: All right. Well, John, it’s been a pleasure having you on Reverse Engineered. Thank you for hanging out with me today. 

[00:59:28] John Engates: Well, thanks for having me. I appreciate it. 

[00:59:31] Jon Penland: And, and thank you to our listeners. That’s all for today’s podcast. You can access the episode show notes at kinsta.com/podcast. That’s K I N S T A.com/podcast.

[00:59:42] If you enjoyed this episode, don’t forget to subscribe to Reverse Engineered and leave us a review on Apple Podcasts or the platform you’re listening on right now. See you next time. 

[00:59:51] Outro: Thanks for joining us on this episode of Reverse Engineered, the podcast on all-things business and tech. Reverse Engineered is brought to you by Kinsta. Kinsta’s premium WordPress hosting can speed up your website by up to 200%, and you’ll get 24/7 support from our expert WordPress engineers.[01:00:11] Let us show you the Kinsta difference at kinsta.com.