Startup Aims To Remake Computer Security For the Cloud Age

Illustration: Ross Patton/WIRED

Steve Herrod was there for the rise of Nicira, the Silicon Valley startup that reinvented the way we build computer networks and then sold itself to tech giant VMware for $1.26 billion.

He was VMware’s chief technology officer at the time, one of the driving forces behind this massive deal, and after leaving VMware for venture capital outfit General Catalyst Partners, he thinks he’s found a startup that will do even more to change the way modern businesses build and operate their online services. This startup is called Illumio, and it seeks to better protect our online universe using a new approach to computer security. As Herrod says: “I think it can be bigger than Nicira.”

Herrod admits this sounds like bluster, and certainly, his words should be taken with the usual grain of salt. He’s an investor in the company. But he’s a VC who knows his technology, and he’s not the only notable name backing Illumio. Other investors include Salesforce.com CEO Marc Benioff, Box boss Aaron Levie, Yahoo co-founder Jerry Yang, and VC firm Andreessen Horowitz. The 22-month-old company has raised a total of $42.5 million in funding, and today, as it emerges from stealth mode, some big-name businesses—including Yahoo, Morgan Stanley, and Japanese telecommunications giant NTT—are already using, or at least testing, its software.

This software provides a way for modern businesses to closely control security across the length and breadth of their increasingly large and complex online operations. Traditionally, security software ran at the perimeter of a computer network—firewalls and other tools would stand guard at the entrances—but in today’s world, where online operations stretch across multiple data centers and onto distant cloud computing services, this security model begins to fall apart. Illimio aims to provide a security system that taps into each machine and application, whether these machines are running in a local data center or across cloud services from the likes of Google, Microsoft, and Amazon.

Basically, you install a tiny Illumio software agent on each machine running across your operation, and then, from a central console, you can control security for each application running on these machines. “You can very simply ensure that rules are enforced,” Herrod says, “and adapt those rules to a changing environment.”

For Jeff Blair, the head of security at the Creative Artists Agency, one of Illumio’s early customers, the system does indeed provide a far simpler way of handling security across its online operations, which span both its own data centers and cloud services operated by Amazon and Microsoft. The controls are so simple, he explains, that they can be used not only by security professionals like himself but by the everyday engineers who build the software that needs protecting. “It gives you uniform control,” he says.

Herrod calls it a “clean-sheet” approach to security, meaning it’s different from what has come before. As described by Illumio and Creative Artists, the technology sounds a lot like a security system being built at VMware by Nicira founder Martin Casado, but Herrod says the big difference is that Illumio’s tool is designed to work with a wide range of software and services, not just software from VMware. “Illumio,” he says, “will run anywhere.”