Cloud Security Podcast by Google

Guests: Tomer Schwartz, Dazz CTO Topics: It seems that in many cases the challenge with cloud configuration weaknesses is not their detection, but remediation, is that true? As far as remediation scope, do we need to cover traditional vulnerabilities (in stock and custom code), configuration weaknesses and other issues too? One of us used to cover vulnerability management at Gartner, and in many cases the remediation failures [on premise] were due to process, not technology, breakdowns. Is this the same in the cloud? If still true, how can any vendor technology help resolve it? Why is cloud security remediation such a headache for so many organizations? Is the friction real between security and engineering teams? Do they have any hope of ever becoming BFFs? Doesn't every CSPM (and now ASPM too?) vendor say they do automated remediation today? How should security pros evaluate solutions for prioritizing, triaging, and fixing issues? Resources: Video (YouTube, LinkedIn) Cloud Security Remediation for Dummies EP3 Automate and/or Die? EP67 Cyber Defense Matrix and Does Cloud Security Have to DIE to Win?' EP54 Container Security: The Past or The Future? EP138 Terraform for Security Teams: How to Use IaC to Secure the Cloud EP117 Can a Small Team Adopt an Engineering-Centric Approach to Cybersecurity? A Guide to Building a Secure SDLC 8 Megatrends drive cloud adoption—and improve security for all

Host: Stephanie Wong, Product Manager, Google Cloud Guests (yes, really, we are the guests!): Anton Chuvakin Tim Peacock Topics: Could you tell us how you ended up in security? What was the moment you realized that Cloud security was different from well, regular, security? Anton is always asking this "3AM test", where did that come from? How do you source topics for the podcast? What advice would you give to folks who are interested in getting into security? … and other fun questions! Resources: Video (LinkedIn, YouTube) Cloud Security Podcast by Google / Twitter / LinkedIn

Guest: Jeremiah Kung, Global Head of Information Security, AppLovin Topics: Before we dive into all of the awesome cloud migrations you've experienced and your learnings there, could we start with a topic of East vs West CISO mentality? We are talking to more and more CISOs who see the cloud as a net win for security. What's your take on whether the cloud improves security? We talked about doing some "big" cloud migrations, could you talk about what you learned back in 2015 about the "right" way to do a cloud migration and how you've applied those lessons since? How are you approaching securing clouds differently in 2023 (vs the dark past of 2015)? What advice would you give your peers to get out of the "saying no" mentality and into a better collaborative mode? On the topic of giving advice to people who haven't asked for it, what advice would you give to teams who are stuck in 1990s thinking when it comes to lift and shifting their security technology stack to cloud? Resources: EP104 CISO Walks Into the Cloud: And The Magic Starts to Happen! EP129 How CISO Cloud Dreams and Realities Collide EP104 CISO Walks Into the Cloud: And The Magic Starts to Happen! EP11 Preparing for Cloud Migrations from a CISO Perspective, Part 2 "How CISOs need to adapt their mental models for cloud security" blog "Superforecasting" book "American Generalship" book

Guest: Andrew Hoying, Senior Security Engineering Manager @ Google Topics: What is different about system hardening today vs 20 years ago? Also, what is special about hardening systems at Google massive scale? Can I just apply CIS templates and be done with it? Part of hardening has to be following up with developers after they have un-hardened things – how do we operationalize that at scale without getting too much in the way of productivity? A part of hardening has got to be responding to new regulation and compliance regimes, how do you incorporate new controls and stay responsive to the changing world around us? Are there cases where we have taken lessons from hardening at scale and converted those into product improvements? What metrics do you track to keep your teams moving, and what metrics do your leads look at to understand how you're doing? [Spoiler: the answer here is VERY fun!] Resources: "Why Shared Fate is a Better Way to Manage Cloud Risk" article (and this too) CIS for GCP GCP IAM Deny CloudSecList by Marco Lancini

Guest: Chris Corde, Sr Director of Product Management - Security Operations, Google Cloud Topics: You cover many products, but let's focus on Chronicle today. An easy question: Chronicle isn't an XDR, so what is it? Since you've joined the team, what're you most proud of shipping to clients? Could you share more about the Mandiant acquisition, what's been a happy surprise and what are you looking forward to making available to customers? Some believe that good security operations success is mostly about process, yet we are also building these amazing products. What is your view of how much security ops success hinges on products vs practices? When it comes to building out Chronicle's position in the market, how are we leveraging the depth of expertise that people have with other SIEM tools compared to ours? What advice do you have for security professionals who want to transition into product management? Resources: EP44 Evolving a SIEM for the Future While Learning from the Past EP82 Mega-confused by XDR? You Are Not Alone! This XDR Skeptic Clarifies!

Guest: Rosemary Wang, Developer Advocate at HashiCorp Topics: Could you give us a 2 minute picture on what Terraform is, what stages of the cloud lifecycle it is relevant for, and how it intersects with security teams? How can Terraform be used for security automation? How should security teams work with DevOps teams to use it? What are some of the obvious and not so obvious security challenges of using Terraform? How can security best practices be applied to infrastructure instantiated via Terraform? What is the relationship between Terraform and policy as code (PaC)? How do you get started with all this? What do you tell the security teams who want to do cloud security the "old way" and not the cloud-native way? Resources: Video (LinkedIn, YouTube) "EP126 What is Policy as Code and How Can It Help You Secure Your Cloud Environment?" Policy as Code with HashiCorp Sentinel or Open Policy Agent (OPA) for Terraform "Terraform Cloud adds Vault-backed dynamic credentials" blog Google Cloud Provider for Terraform Security & Authentication Providers for Terraform "Sloth's Guide to Mindfulness" book

Guests: no guests, all banter, all very fun :-) Topics: How is Google Next this year? What is new in cloud security? Is Google finally a security vendor? What are some of the fun security presentations we've seen, including our own? Any impactful launches in security? What was the most interesting overall? Resources: "Next 2023 Special: Building AI-powered Security Tools - How Do We Do It?" (ep136) "RSA 2023 - What We Saw, What We Learned, and What We're Excited About" (ep119) "Cyber Defense Matrix and Does Cloud Security Have to DIE to Win?" (ep67) "Detecting, investigating, and responding to threats in your Google Cloud environment" at Cloud Next 2023 by Anton "Prevent cloud compromises: Learn how Uber discovers cyber risks and remediates threats" at Cloud Next 2023 by Tim "Generative AI for defenders with Sec-PaLM 2 and Duet AI" at Cloud Next 2023 by Eric Doerr (his episode) "A blueprint for modern security operations" at Cloud Next 2023 by our future guest, Chris… Kevin Mandia at Next keynote (start at 1:15:00) "New AI capabilities that can help address your security challenges" blog

Guest: Eric Doerr, VP of Engineering, Google Cloud Security Topics: You have a Next presentation on AI, what is the most exciting part for you? We care both about securing AI and using AI for security. How do you organize your thinking about it? Executive surveys imply that trusting an AI (for business) is still an issue. How can we trust AI for security? What does it mean to "trust AI" in this context? How should defenders think about threat modeling AI systems? Back to using AI for security, what are the absolute worst security use cases for GenAI? Think "generate code and run it on prod" or something like that? What does it mean to "teach AI security" like we did with Sec-PALM2? What is actually involved in this? What were some surprising challenges we ran into here? Resources: "Generative AI for defenders with Sec-PaLM 2 and Duet AI" presentation at Google Cloud Next 2023 "The Prompt: What to think about when you're thinking about securing AI" and a new paper on securing AI "AI and Security: The Good, the Bad, and the Magical" (ep135) Monitor and secure Vertex AI "Introducing Google's Secure AI Framework" blog "Project Hail Mary" book

Guest: Phil Venables (@philvenables), Vice President, Chief Information Security Officer (CISO) @ Google Cloud Topics: Why is AI a game-changer for security? Can we even have game-changers in cyber security? Is it more detection or is it more reducing toil and making humans more productuve? What are you favorite AI for security use cases? What "AI + security" issue makes you - a classic CISO question here - lose sleep at night? Does AI help defenders or attackers more? Won't attackers adopt faster because they don't have as many rules (but yes, they have bosses and budgets too)? Aren't there cases where defenders benefit a lot more and gain a superpower with AI while attackers are faced with defeat? Is securing AI more similar or more different from securing other enterprise systems? Does shared fate apply to AI? Resources: "Securing AI: Similar or Different?" paper by Office of the CISO at Google Cloud "Secure AI Framework Approach" Supercharge security with AI Board of Directors Insights Hub "Lessons from the future: Why shared fate shows us a better cloud roadmap" blog "Megatrends, Macro-changes, Microservices, Oh My! Changes in 2022 and Beyond in Cloud Security" (ep47) "Securing Multi-Cloud from a CISO Perspective, Part 3" (ep22) "Google Cybersecurity Action Team: What's the Story?" (ep37) "Google Cybersecurity Action Team: One Year Later!" (ep90)

Guest: Steph Hay , Director of UX, Google Cloud Security Topics: The importance of User Experience (UX) in security is so obvious – though it isn't to a lot of people! Could we talk about the importance of UX in security? UX and security in general have an uneasy relationship, and security is harmed by bad UX, it also feels like bad UX can be a security issue. What is your take on this? How do you think about prioritizing your team's time between day zero vs day n experiences for users of security tools? Some say that cloud security should be invisible, but does this mean no UX at all? What are the intersections between UX for security and invisible security? Can you think of what single UX change in Cloud Security's portfolio made the biggest impact to actual security outcomes? We have this new tool/approach for planning called Jobs To Be Done (JTBD) - give us the value, and the history? In the world of JTBD planning, what gets better? Resources: JTBD Framework GCP IAM Recommender Recaptha Enterprise

Guest: Steve McGhee, Reliability Advocate at Google Cloud Aron Eidelman, Developer Relations Engineer at Google Cloud Topics: What is the shared problem for SRE and security when it comes to alerting? Why is there reluctance to reduce noise? How do SREs, security practitioners, and other stakeholders define "incident" and "risk"? How does involving an "adversary" change the way people think about an incident, even if the impact is identical? Which SRE alerting lessons do NOT apply at all for security? Resources: Video (LinkedIn, YouTube) "Deploy Security Capabilities at Scale: SRE Explains How" (ep85) Steve talk about probability and SLO math at SLOconf Why Focus on Symptoms, Not Causes? Learning from incidents (LFI) science How to measure anything in cyber security risk book Security chaos engineering book The SRS Book Ch 1 The SRE book Ch 4

Guest: Kelly Shortridge, Senior Principal Engineer in the Office of the CTO at Fastly Topics: So what is Security Chaos Engineering? "Chapter 5. Operating and Observing" is Anton's favorite. One thing that mystifies me, however, is that you outline how to fail with alerts (send too many), but it is not entirely clear how to practically succeed with them? How does chaos engineering help security alerting / detection? How chaos engineering (or is it really about software resilience?) intersects with Cloud security - is this peanut butter and chocolate or more like peanut butter and pickles? How can organizations get started with chaos engineering for software resilience and security? What is your favorite chaos engineering experiment that you have ever done? We often talk about using the SRE lessons for security, and yet many organizations do security the 1990s way. Are there ways to use chaos engineering as a forcing function to break people out of their 1990s thinking and time warp them to 2023? Resources: Video (LinkedIn, YouTube) "Security Chaos Engineering: Sustaining Resilience in Software and Systems" by Kelly Shortridge, Aaron Rinehart "Cybersecurity Myths and Misconceptions" book "Designing Data-Intensive Applications: The Big Ideas Behind Reliable, Scalable, and Maintainable Systems" book "Normal Accidents: Living with High-Risk Technologies" book "Deploy Security Capabilities at Scale: SRE Explains How" (ep85) "The Good, the Bad, and the Epic of Threat Detection at Scale with Panther" (ep123) "Can a Small Team Adopt an Engineering-Centric Approach to Cybersecurity?" (ep117) IKEA Effect "Modernizing SOC ... Introducing Autonomic Security Operations" blog

Guests: Himanshu Khurana, Engineering Manager, Google Cloud Rahul Gupta, Product Manager for Assured OSS, Google Cloud Topics: For the software you're supporting in Assured Open Source your team discovered 50% of the CVEs reported in them this year. How did that happen? So what is Assured Open Source? Do we really guarantee its security? What does "guarantee" here mean? What're users actually paying for here? What's the Google magic here and why are we doing this? Do we really audit all code and fuzz for security issues? What's a supply chain attack and then we'll talk about how this is plugging into those gaps? Resources: Assured Open Source Software page "SBOMs: A Step Towards a More Secure Software Supply Chain" (ep116) "Linking Up The Pieces: Software Supply Chain Security at Google and Beyond" (ep24) SLSA.dev blog Open Source Security Podcast Mandiant M-Trends 2023

Guest: Steve Riley, Field CTO, Netskope, ex-Gartner Research VP Topics: Analysts (well, like Steve and Anton in the past?) say that "cloud is secure, but clients just aren't using it securely", what is your reaction to this today? When clients hear "use cloud securely", what do you think comes to their minds? How would you approach planning for secure use of the cloud or using cloud securely? What is your view of cloud defense in depth (DiD) or layered defenses? How do you suggest clients think about it? What about DiD for SaaS? What are your thoughts on the evolution of zero trust? How has it changed since its introduction back in 2010? Awareness of and interest in SSE and SASE is growing. But at the same time, plenty of folks seem deeply perplexed by these. How would you explain them to someone not deeply immersed in the details? Resources: Video (LinkedIn, YouTube) Bruce Schneier books Netskope blog "Deploy Security Capabilities at Scale: SRE Explains How" (ep85) "Zero Trust: Fast Forward from 2010 to 2021" (ep8) "Powering Secure SaaS … But Not with CASB? Cloud Detection and Response?" (ep76) "How to Approach Cloud in a Cloudy Way, not As Somebody Else's Computer?" (ep115) "Use Cloud Securely? What Does This Even Mean?!" "How to Solve the Mystery of Cloud Defense in Depth?"

Guest: Rick Doten, VP, Information Security at Centene Corporation, CISO Carolina Complete Health Topics: What are the realistic cloud risks today for an organization using public cloud? Is the vendor lock-in on that list? What other risks everybody thinks are real, but they are not? What do you tell people who in 2023 still think "they can host Exchange better themselves" and have silly cloud fears? What do you tell people who insist on "copy/pasting" all their security technology stack from data centers to the cloud? Cloud providers have greater opportunity not only to see issues, but to learn how to react well. Do you think this argument holds water? What are the most challenging security issues for multi-cloud and hybrid cloud security? How does security chasm (between security haves and have-notes) affect cloud security? Your best cloud security advice for an organization with a security team of 0 FTEs and no CISO? Resources: Video (LinkedIn, YouTube) Rick Doten on YouTube Defining Cloud Security by Rick Doten Cloud Security Alliance materials Mandiant M-Trends 2023

Guest: John Doyle, Principle Intelligence Enablement Consultant at Mandiant / Google Cloud Topics: You have created a new intelligence class focused on building enterprise threat intelligence capability, so what is the profile of an organization and profile for a person that benefits the most from the class? There are many places to learn threat intel (TI), what is special about your new class? You talk about country cyber operations in the class, so what is the defender - relevant difference between, say, DPRK and Iran cyber doctrines? More generally, how do defenders benefit from such per country intel? Can you really predict what the state-affiliated attackers would do to your organization based on the country doctrine? In many minds, TI is connected to attribution. What is your best advice on attribution to CISOs of well-resourced organizations? What about mainstream organizations? Overall we see a lot of organizations still failing to operationalize TI, especially strategic TI, how does this help them? Resources: The new class "Inside the Mind of APT" "Navigating Tradeoffs of Attribution" paper Sands Casino hack 2014 "Threat Horizons - How Google Does Threat Intelligence" (ep112)

Guest: Ian Glazer, founder at Weave Identity, ex-Gartner, ex-SVP of Products at Salesforce, co-founder of IDPro Topics: OK, tell us why Identity and Access Management (IAM) is exciting (is it exciting?) Could you also explain why IAM is even more exciting in the cloud? Are you really "one IAM mistake away from a breach" in the cloud? What advice would you give to someone new to IAM? How to not just "learn IAM in the cloud" but to keep learning IAM? Is what I know about IAM in AWS the same as knowing IAM for GCP? What advice do you have for teams operating in a multi-cloud world? What are the top cloud IAM mistakes? How to avoid them? Resources: Video (LinkedIn, YouTube) IDPro association and BoK SCIM v2 standard EP60 Impersonating Service Accounts in GCP and Beyond: Cloud Security Is About IAM? EP76 Powering Secure SaaS … But Not with CASB? Cloud Detection and Response? EP94 Meet Cloud Security Acronyms with Anna Belak

Guests: Dominik Richter, the founder and head of product at Mondoo Cooked questions: What is a policy, is that the same as a control, or is there a difference? And what's the gap between a policy and a guardrail? We have IaC, so what is this Policy as Code? Is this about security policy or all policies for cloud? Who do I hire to write and update my policy as code? Do I need to be a coder to create policy now? Who should own the implementation of Policy as Code? Is Policy as Code something that security needs to be driving? Is it the DevOps or Platform Engineering teams? How do organizations grow into safely rolling out new policy as code code? You [Mondoo] say that "cnspec assesses your entire infrastructure's security and compliance" and this problem has been unsolved for as long as the cloud existed. Will your toolset change this? There are other frameworks that exist for security testing like HashiCorp's sentinel, Open Policy Agent, etc and you are proposing a new one with MQL. Why do we need another security framework? What are some of the success metrics when adopting Policy as Code? Resources: Live video (LinkedIn, YouTube) "Why Infrastructure as Code Is Setting You up to Make Bad Things Faster" blog

Guest: David Swift, Security Strategist at Netenrich Topics: Which old Security Information and Event Management (SIEM) lessons apply today? Which old SIEM lessons absolutely do not apply today and will harm you? What are the benefits and costs of SIEM in 2023? What are the top cloud security use cases for SIEM in 2023? What are your favorite challenges with SIEM in 2023 special in the cloud? Are they different from, say, 2013 or perhaps 2003? Do you think SIEM can ever die? Resources: Live video (LinkedIn, YouTube) "Debating SIEM in 2023, Part 1" and "Debating SIEM in 2023, Part 2" blogs "Detection as Code? No, Detection as COOKING!" blog "A Process for Continuous Security Improvement Using Log Analysis" (old but good) "UEBA, It's Just a Use Case" blog "Situational Awareness Is Key to Faster, Better Threat Detection" blog and other SIEM reading MITRE 15 detection techniques paper

Guest: Panos Mavrommatis, Senior Engineering Director at Google Cloud Topics: Could you give us the 30 second overview of our favorite "billion user security product" - SafeBrowsing - and, since you were there, how did it get started? SafeBrowsing is a consumer and business product – are you mitigating the same threats and threat models on each side? Making this work at scale can't be easy, anytime we're talking about billion device protection, there are massive scale questions. How did we make it work at such a scale? Talk to us about the engineering and scaling magic behind the low false positive rate for blocking? Resources: "Foundryside" book

Guest: Jack Naglieri, Founder and CEO at Panther Topics: What is good detection, defined at micro-level for a rule or a piece of detection content? What is good detection, defined at macro-level for a program at a company? How to reliably produce good detection content at scale? What is a detection content lifecycle that reliably produces good detections at scale? What is the purpose of a SIEM today? Where do you stand on a classic debate on vendor-written vs customer-created detection content? Resources: "Essentialism" book "The 5 AM Club" book "Good to Great" book "Why Is Threat Detection Hard" blog "Think Like a Detection Engineer, Pt. 2: Rule Writing" blog "Detection as Code? No, Detection as COOKING!" blog Open Cybersecurity Schema Framework (OCSF)

Guest: Michele Chubirka, Senior Cloud Security Advocate, Google Cloud Topics: So, if somebody wakes you up at 3AM ("Anton's 3AM test") and asks "Do we need firewalls in the cloud?" what would you say? Firewalls (=virtual appliances in the cloud or routing cloud traffic through physical firewalls) vs firewalling (=controlling network access) in the cloud, do they match the cloud-native realities? How do you implement trust boundaries for access control with cloud-native options? Can you imagine a modern cloud native security architecture that includes a firewall? Can you imagine a modern cloud native security architecture that excludes any firewalling? Firewall, NIDS, NIPS, NGFW …. How do these other concepts map to the cloud? How do you build a "traditional-like" network visibility layer in the cloud (and do we need to)? Resources: Video version of this episode: LinkedIn or YouTube "Security Architect View: Cloud Migration Successes, Failures and Lessons" (ep105) "Love it or Hate it, Network Security is Coming to the Cloud" with Martin Roesch (ep113) Gartner Bimodal IT definition Ross Anderson "Security Engineering" book The New Stack blog Trireme tool CNCF site security landscape Google Cloud Firewall

Guests: Nelly Porter, Group Product Manager, Google Cloud Rene Kolga, Senior Product Manager, Google Cloud Topics: Could you remind our listeners what confidential computing is? What threats does this stop? Are these common at our clients? Are there other use cases for this technology like compliance or sovereignty? We have a new addition to our Confidential Computing family - Confidential Space. Could you tell us how it came about? What new use cases does this bring for clients? Resources: "Confidentially Speaking" (ep1) "Confidentially Speaking 2: Cloudful of Secrets" (ep48) "Introducing Confidential Space to help unlock the value of secure data collaboration" Confidential Space security overview "The Is How They Tell Me The World Ends" by Nicole Perlroth NIST 800-233 "High-Performance Computing (HPC) Security: Architecture, Threat Analysis, and Security Posture"

Guest: Jeff Reed, VP of Product, Cloud Security @ Google Cloud Topics: You've had a long career in software and security, what brought you to Google Cloud Security for this role? How do you balance the needs of huge global financials that often ask for esoteric controls (say EKM with KAJ) vs the needs of SMBs that want easy yet effective, invisibility security? We've got an interesting split within our security business: some of our focus is on making Google Cloud more secure, while some of our focus is on selling security products. How are you thinking about the strategy and allocation between these functions for business growth? What aspects of Cloud security have you seen cloud customers struggle with the most? What's been the most surprising or unexpected security challenge you've seen with our users? "Google named a Leader in Forrester Wave™ IaaS Platform Native Security" - can you share a little bit about how this came to be and what was involved in this? Is cloud migration a risk reduction move? Resources: "Google named a Leader in Forrester Wave™ IaaS Platform Native Security" "Sunil Potti on Building Cloud Security at Google" (ep102) Books by Haruki Murakami We are hiring product managers!

Guest: Connie Fan, Senior Product and Business Strategy Lead, Google Cloud Topics: We were at RSA 2023, what did we see that was notable and surprising? Cloud security showed up with three startups with big booths, and one big player with a small demo station. What have we learned here? What visitors might have seen at the Google Cloud booth that we're really excited about? Could you share why we chose these two AI cases - generation of code and summarization of complex content - out of all the possibilities and the sometimes zany things we saw elsewhere on the floor? Could you share a story or two that highlights how we came to this AI launch and what it looked like under the surface? Resources: "RSA 2023 - How to Protect Your Organization from Cyberattacks in Time of Political Turmoil" (ep118) "RSA 2022 Reflections - Securing the Past vs Securing the Future" (ep70) "How We Attack AI? Learn More at Our RSA Panel!" (ep68) "Security Operations, Reliability, and Securing Google with Heather Adkins" (ep20)

Guests: Shanyn Ronis, Head of the Mandiant Communication Center John Miller, Head of Mandiant Intelligence Analysis Topics: It seems like we're seeing more cyber activity taking place in the context of geopolitical events. A lot of organizations struggle to figure out if/how to respond to these events and any related cyber activity. What advice do you have for these organizations and their leadership? A lot of threat intel (TI) suffers from "What does this event mean for threats to our organization?" - sort of how to connect CNN to your IDS? What is your best advice on this to a CISO? TI also suffers from "1. Get TI 2. ??? 3. Profit!" - how does your model help organizations avoid this trap? Surely there are different levels of granularity here to TI and its relevance. Is what a CISO needs different from what an IR member needs? Do you differentiate your feed along those axes? What does success look like? How will organizations know when they're successful? What are good KPIs for these types of threat intelligence? In other words, how would customers know they benefit from it? Is there anything unique that cloud providers can do in this process? Resources: RSA 2023 Session "Intelligently Managing the Geopolitics and Security Interplay" on Wed Apr 26 9:40AM "Sandworm" by Andy Greenberg "Reading Mandiant M-Trends 2023"

Guest: Maxime Lamothe-Brassard, Founder @ LimaCharlie Topics: What does an engineering-centric approach to cybersecurity mean? What to tell people who want to "consume" rather than "engineer" security? Is "engineering-centric" approach the same as evidence-based or provable? In practical terms, what does it mean to adopt an "engineering-centric approach" to cybersecurity for an organization? How will it differ from what we have today? What will it enable? Can you practice this with a very small team? How about a very small team of "non engineers"? You seem to say that tomorrow's cybersecurity will look a lot like software engineering. Where do we draw the line between these two? Resources: Atomic Red Team Sigma rules/content LimaCharlie blog 8 Megatrends drive cloud adoption—and improve security for all The Cybersecurity Defenders Podcast

Guest: Isaac Hepworth, PM focused on Software Supply Chain Security @ Google Cooked questions: Why is everyone talking about SBOMs all of a sudden? Why does this matter to a typical security leader? Some software vendors don't want SBOM, and this reminds us of the food safety rules debates in the past, how does this analogy work here? One interesting challenge in the world of SBOMs and unintended consequences is that large well resourced organizations may be better equipped to produce SBOMs than small independent and open source projects. Is that a risk? Is the SBOM requirement setting the government up to be overly reliant on megacorps and are we going to unintentionally ban open source from the government? What is the relationship between SBOM and software liability? Is SBOM a step to this? Won't software liability kill open source? How does Google prepare for EO internally; how do we use SBOM and other related tools? To come back to the food analogy, SBOMs are all well and good, but the goal is not that consumers know they're eating lead, but rather that our food becomes healthier. Where are we heading in the next five years to improve software supply chain "health and safety"? Resources: Full video of this episode (YouTube / LinkedIn) "Executive Order on Improving the Nation's Cybersecurity" "M-22-18 Memorandum For The Heads of Executive Departments and Agencies" SLSA.dev "How to SLSA Part 3 - Putting it all together" Assured Open Source Software NIST Secure Software Development Framework (SSDF) "Linking Up The Pieces: Software Supply Chain Security at Google and Beyond" (ep24) "2022 Accelerate State of DevOps Report and Software Supply Chain Security" (ep100)

Guest: Rafal Los, Head of Services Strategy @ Extrahop and Founder of Down the Security Rabbit Hole podcast Topics: You had a very fun blog where you reminded the world that many organizations still approach cloud as a rented data center, do you still see it now? Do you think this will persist for 3, 5, 10 years? Other than microservices, what're the most important differences between public cloud and a rented data center for a CISO to keep in mind? Analysts say that "cloud is secure, but clients just aren't using it securely", what is your reaction to this? Actually, how do you define "use cloud securely"? Have you met any CISOs who are active cloud fans who prefer cloud for security reasons? You also work for an NDR vendor, do you think NDR in the cloud has a future? Resources: Full video of this episode (YouTube / LinkedIn) Down the Security Rabbithole Podcast (DtSR) podcast "A Little Truth About the Cloud" "Megatrends drive cloud adoption—and improve security for all" "CISO Walks Into the Cloud: And The Magic Starts to Happen!" (ep104) "Threat Models and Cloud Security" (ep12) "Security Architect View: Cloud Migration Successes, Failures and Lessons" (ep105) "Patrolling Cyberspace" book (2006)

Guest: Chris John Riley, Senior Security Engineer and a Technical Debt Corrector @ Google Topics: We've heard of MVP, what is MVSP or Minimal Viable Secure Product? What problem is MVSP trying to solve for the industry, community, planet, etc? How does MVSP actually help anybody? Who is the MVSP checklist for? Leaders or engineers? How does MVSP differ from compliance standards like ISO 27001, or even SOC 2? How does Google use MVSP? Has it improved our security in some way? How to balance the dynamic nature of security with minimal security basics? The working group has recently completed a control refresh for 2022, what are some highlights? Resources: Mvsp.dev SLSA Levels MVSP (Minimum Viable Secure Product) Compliance "Phantoms in the Brain" book "Strengthen Basic Security Hygiene With a Two-Pronged Security Architecture Approach" FIRST Impressions podcast

Guest: Martin Roesch, CEO at Netography, creator of Snort Topics: What is the role of network security in the public cloud? Networks used to be the perimeter, now we have an API and identity driven perimeter. Are networks still relevant as a layer of defense? We often joke that "you don't need to get your firewalls with you to the cloud", is this really true? How do you do network access control if not with firewalls? What about the NIDS? Does NIDS have a place in the cloud? So we agree that some network security things drop off in the cloud, but are there new network security threats and challenges? There's cloud architecture and then there's multi cloud and hybrid architectures–how does this story change if we open the aperture to network security for multi cloud and hybrid? Should solutions that provide cloud network security be in the cloud themselves? Is this an obvious question? Resources: Book "Who: The A Method for Hiring" by Geoff Smart, Randy Street Netography resources Snort ""Hacking Google", Op Aurora and Insider Threat at Google" (ep91) "Zero Trust: Fast Forward from 2010 to 2021" (ep8) "Gathering Data for Zero Trust" (ep4)

Guest: Charles DeBeck, Cyber Threat Intel Expert @ Google Cloud Topics: What is unique about Google Cloud approach to threat intelligence? Is it the sensor coverage? Size of the team? Other things? Why is Threat Horizons report unique among the threat reports released by other organizations? Based on your research, what are the realistic threats to cloud environments today? What threats are prevalent and what threats are most damaging? Where do you see things in 2023? What should companies look for? What's one thing that surprised you when preparing the report? What do you think will surprise audiences? What is the most counter-intuitive hardening and operational advice can we glean from this Threat Horizons report? What's most important to know when it comes to understanding OT and cloud? Resources: Google Threat Horizons Reports One, Two, Three, Four, Five "Demystifying 'shared Fate' - A New Approach To Understand Cybersecurity" Corey Quinn on cloud billing alerts

Guest: Brandon Evans, Infosec Consultant and Certified Instructor and Course Author at SANS Topics: What got you interested in security and motivated you to make this your area of focus? You came from a developer background, right? Occasionally, we hear the sentiment that "developers don't care about security," how would you counter it (and would you?)? How do we encourage developers and operations to use the appropriate security controls and settings in the cloud? Is "encourage" the right word? Can we really do "secure by default" but for developers? What do you think are the main application security issues that developers need to deal with in the cloud? You mentioned software supply chain security, do you treat this as a part of application security? How important is this, realistically, for an average organization and its developers? Going to our favorite subject of threat detection, how do you think we can better encourage developers to supply the logs necessary for our detection and response teams to act upon? Resources: "Cloud Security: Making Cloud Environments a Safer Place" ebook by SANS SANS.org/cloud site "The Phoenix Project" book by Gene Kim et al "The Unicorn Project" book by Gene Kim "Next Special - Log4j Reflections, Software Dependencies and Open Source Security" (EP87) "2022 Accelerate State of DevOps Report and Software Supply Chain Security" (EP100) "Linking Up The Pieces: Software Supply Chain Security at Google and Beyond" (EP24)

Guest: David Seidman, Head of Detection and Response @ Robinhood Toipics: Tell us about joining Robinhood and prioritizing focus areas for detection in your environment? Tim and Anton argue a lot about what kind of detection is best - fully bespoke and homemade, or scalable off-the-shelf. First, does our framework here make sense, and second, looking at your suite of detection capabilities, how have you chosen to prioritize detection development and detection triage? You're operating in AWS: there are a lot of vendors doing detection in AWS, including AWS themselves. How have you thought about choosing your detection approaches and data sources? Finding people with as much cloud expertise as you can't be easy: how are you structuring your organization to succeed despite cloud detection and response talent being hard to find? What matters more: detection skills or cloud skills? What has been effective in ramping up your D&R team in the cloud? What are your favorite data sources for detection in the cloud? Resources: "Detection as Code? No, Detection as COOKING!" "On Threat Detection Uncertainty" "Radical Candor" by Kim Scott "Daring Greatly" by Brene Brown "Extreme Ownership" by Jocko Willink "Drive" by Daniel Pink

Guest: Ana Oprea, Staff Security Engineer, European Lead of Vulnerability Coordination Center @ Google Topics: What is the scope for the vulnerability management program at Google? Does it cover OS, off-the-shelf applications, custom code we wrote … or all of the above? Our vulnerability prioritization includes a process called "impact assessment." What does our impact assessment for a vulnerability look like? How do we prioritize what to remediate? How do we decide on the speed of remediation needed? How do we know if we've done a good job? When we look backwards, what are our critical metrics (SLIs and SLOs) and how high up the security stack is the reporting on our progress? What of the "Google Approach" should other companies not try to emulate? Surely some things work because of Google being Google, so what are the weird or surprising things that only work for us? Resources: SRS Book, Chapter 20: Understanding Roles and Responsibilities and Chapter 21: Building a Culture of Security and Reliability Why Google Stores Billions of Lines of Code in a Single Repository SRE book and SRE Workbook "How Google Secures It's Google Cloud Usage at Massive Scale" (ep107) "Is This Binary Legit? How Google Uses Binary Authorization and Code Provenance" (ep66) "How We Scale Detection and Response at Google: Automation, Metrics, Toil" (ep75)

Guest: John Stoner, Principal Security Strategist @ Google Cloud Topics: Please define threat hunting for us quickly, the term has been corrupted a bit What are your favorite beginner hunts to jump start the effort at a new team? How to incorporate hunting lessons in detection? What are the differences for hunting in the cloud? Are there specific data sources you prefer to have access to when threat hunting? In the cloud? Should every organization threat hunt? What are traits you might look for in a threat hunter? Resources: "The Who, What, Where, When, Why and How of Effective Threat Hunting" Awesome Threat Detection and Hunting "My "Aha!" Moment - Methods, Tips, & Lessons Learned in Threat Hunting" video NIST Computer Security Incident Handling Guide 800-61 "Threat Hunting Is Not for Everyone" (2020) "Formulating An Intelligence-Driven Threat Hunting Methodology" video

Guest: Karan Dwivedi, Security Engineering Manager, Enterprise Infrastructure Protection @ Google Cloud Topics: Google's use of Google Cloud is a massive cloud environment with wildly diverse use cases. Could you share, for our listeners, a few examples of the different kinds of things we're running in GCP? Given that we're doing these wildly different things in GCP, how do we think about scaling the right security guardrails to the right places in our GCP org? How do you work with application engineering teams and project owner teams to make sure the right controls are there but not getting in the way of business? How do we scale this exemption management process? Are there things we do here that don't make sense at a smaller scale? Are there emergent challenges that only we would face? How do you correctly federate security responsibilities between the central team defining policy and the constituent user teams actually using the platform? Burnout is a perennial challenge for security teams–what're you doing to keep your people happy and engaged? Resources: "How We Scale Detection and Response at Google: Automation, Metrics, Toil" (ep75) ""Hacking Google", Op Aurora and Insider Threat at Google" (ep91) Google Cloud security foundations guide

Guest: Anoosh Saboori, former Product Manager at Google Cloud Topics: We had zero trust episodes before and definitions vary! When we say zero trust, what do we mean? What about zero trust for workloads in production? When you say "workload," what do you mean? What is BeyondProd, for those that are unfamiliar with it? And how is this different from BeyondCorp? How has BeyondProd actually been implemented at Google? What threats does it help with? Is this real threats or compliance? Why is now a good time to be thinking about zero trust for production systems? Companies have many security tools deployed, including microsegmentation and firewalls, how does this toolset fit? Does it replace anything they have deployed? Resources: BeyondProd papers "Zero Trust: Fast Forward from 2010 to 2021" (ep8) "Gathering Data for Zero Trust" (ep4) "Google Workspace Security: from Threats to Zero Trust" (ep99) "Zero Trust: So Easy Even a Government Can Do It?" (ep59) "Is This Binary Legit? How Google Uses Binary Authorization and Code Provenance" (ep66)

Guest: Michele Chubirka, Senior Cloud Security Advocate, Google Cloud Topics: We are here to talk about cloud migrations and we are here to talk about failures. What are your favorites? What are your favorite cloud security process failures? What are your favorite cloud security technical failures? What are your favorite cloud security container and k8s failures? Is "lift and shift" always wrong from the security point of view? Can it at least work as step 1 for a full cloud transformation? Resources: "Automate and/or Die?" (ep3) "More Cloud Migration Security Lessons" (ep18) "The Magic of Cloud Migration: Learn Security Lessons from the Field" (ep55) "Preparing for Cloud Migrations from a CISO Perspective, Part 1" (ep5) "Cloud Migrations: Security Perspectives from The Field" (ep33) "Dune" by Frank Herbert "The Science of Organizational Change" by Paul Gibbons "Servant Leadership: A Journey into the Nature of Legitimate Power and Greatness" by Robert K. Greenleaf "Finding the Sweet Spot for Change" State of Devops (DORA) Report 2022

Guest: Gary Hayslip, CISO at Softbank Topics: "So we're talking about your journey as a CISO migrating to Cloud. Could you give us the 30 second overview of What triggered your organization's migration to the cloud? When did you and the security organization get brought in? How did you plan your security organization's journey to the cloud? Did you take going to cloud as an opportunity to change things beyond the tools you were using? As you got going into the cloud, what was the hardest part for your organization? If that was hardest, what was most surprising? Good surprise and bad surprise? Let's shift to some tactical gears: How did you design security controls for the cloud? Did your data security practice change? Did your detection / response practice change? How has the CISO role evolved and is evolving due to the cloud? Having covered all that tactical terrain, one final strategic question: is moving to Cloud a net risk reduction? Can it be? Resources: "CISO Desk Reference Guide" book by Gary Hayslip "The Essential Guide to Cybersecurity for SMBs" book by Gary Hayslip "Develop Your Cybersecurity Career Path" book by Gary Hayslip

Guest: Nader Zaveri, Senior Manager of IR and Remediation at Mandiant, now part of Google Cloud Topics: Could we start with a story of a cloud incident response (IR) failure and where things went wrong? What should that team have done to get it right? Are there skills that matter more in cloud incidents than they do for on-prem incidents? Are there on-prem instincts that will lead incident responders astray in cloud? What 3 things an IR team leader needs to do to prepare his team for IR in the cloud? Are there on-premise tools that can stay on prem and not join us in the cloud? What processes should we leave behind? Keep with us? What logs and context should we prepare for cloud IR? What access should we have behind "break glass"? While doing IR, what things should we look at in the cloud logs (which logs, also?) to expedite the investigation? Resources: "How to Cloud IR or Why Attackers Become Cloud Native Faster?" (ep98) "How to prepare for detection & response in the cloud" Google Cloud Next 2022 presentation "Security Incident Response in the Cloud: A Few Ideas" blog GCP Cloud Logging "Security at Scale: Logging in AWS" paper "AWS Security Incident Response Whitepaper" paper

Guest: Sunil Potti, VP / GM, Google Cloud Topics: One of the biggest shifts we've noticed is the shift from building security because we think security is good, to building security as a business. How did you make that cultural shift happen in our organization? With organizations migrating to cloud we have a set of tradeoffs between meeting security teams where they are with on-prem expectations of security vs cloud-native approaches. How do you think about investing in next generation products vs holding the hands of CISOs just stepping into the cloud? What matters more to you as a leader, secure cloud (GCP, Workspace) or security products (Chronicle SecOps, BCE, SCC, etc)? Is invisible security the same as "building security in"? Aren't there security controls where the value is derived from them being visible to users? Mandiant brings services expertise to Google Cloud, typically not our strong area and not our DNA, how do we plan to make the most of Mandiant within Google's culture? Resources: Simon Sinek "Start With Why" book

Guest: Jim Higgins, CISO at Snap, former CISO at Square Topics: You were at Google for a long time, and at Google you sat between Google security and Cloud. Now that you're leading security for a major company, how are you prioritizing your focus between your on-premise resources and your cloud resources? How are you thinking about threat detection in the Cloud? In detection, how has your technology changed? How has your process changed? What threats do you mostly focus on? Why don't we talk about the role of automation in detection and response (D&R)? How do you approach automation and eliminating toil? As you're scaling teams, processes and technology for your cloud footprint, what has been easiest to get right and what's been hardest to get right? How do you approach measuring security? What cloud metrics are you sharing upwards to your board? Resources: BeyondCorp Enterprise "Ghost in the Wires: My Adventures as the World's Most Wanted Hacker" book

Guests: John Speed Meyers, Security Data Scientist, Chainguard Todd Kulesza, User Experience Researcher, Google Topics: How did you get involved with this year's Accelerate State of DevOps Report (DORA report)? So what is DORA and why did you decide to focus on supply chain security for the 2022 report? What are the big learnings from this year's report? What's the difference between SLSA and SSDF? Is one spicy and the other savory? How're companies adopting these and how is adoption going? Are there other areas that DevOps can be a contributor in the overall security landscape? How can CISOs rope DevOps fully into their security gang? Operationally, how should security and developers and DevOps come together to keep vulnerabilities out in the first place? How should security and developers and DevOps come together to respond quickly to vulnerabilities when they're discovered? How do security and developers and DevOps come together to prove to their auditors and customers that they're doing a good job of the above? Resources: 2022 Accelerate State of DevOps Report "New insights for defending the software supply chain" blog (and new report) SLSA.dev site Secure Software Development Framework at NIST "Linking Up The Pieces: Software Supply Chain Security at Google and Beyond" (ep24) "Sharing The Mic In Cyber with STMIC Hosts Lauren and Christina: Representation, Psychological Safety, Security" (ep92) Go vulncheck tool "Reflections on Trusting Trust" paper (1984)

Guests: Nikhil Sinha, Group Product Manager, Workspace Security Kelly Anderson, Product Marketing Manager, Workspace Security Topics: We are talking about Google Workspace security today. What kinds of threats do we have to care about here? Are there compliance-related motivations for security here too? Is compliance in the cloud changing? How's adoption of hardware keys for MFA going for your users, and how are you helping them? Is phishing finally solved because of that? Can you explain why hardware security FIDO/WebAuthn is such a step function compared to, say, RSA number generator tokens? Have there been assumptions in the Workspace security model we had to change because of WFH? And what changes with RTO and permanent hybrid? Resources: Google BeyondCorp Enterprise "Make zero trust a reality with Google Workspace security solutions" Next 2022 video "2021: Phishing is Solved?" (ep40) "Zero Trust: Fast Forward from 2010 to 2021" (ep8)

Guests: Matt Linton, Chaos Specialist @ Google John Stone, Chaos Coordinator @ Office of the CISO, Google Cloud Topics: Let's talk about security incident response in the cloud. Back in 2014 when I [Anton] first touched on this, the #1 challenge was getting the data to investigate as cloud providers had few logs available. What are the top 2022 cloud incident response challenges? Does cloud change the definition of a security incident? Is "exposed storage bucket" an incident? Is vulnerability an incident in the cloud? What should I have in my incident response plans for the cloud? Should I have a separate cloud IR plan? What is our advice on running incident response jointly with a CSP like us? How would 3rd party firms (like, well, Mandiant) work with a client and a CSP during an investigation? We all read the Threat Horizons reports, but can you remind us of the common causes for cloud incidents we observed recently? What goals do the attackers typically pursue there? Resources: "Building Secure and Reliable Systems" book (especially ch 14-16, and ch17) Google Cybersecurity Action Team Threat Horizons Report #4 Is Out! (#3, #2, #1) "Incident Plan vs Incident Planning?" blog (2013)

Guest: Greg Sinclair, Security Engineer @ Google Cloud Topics: Could you tell us a bit about your background and how you ended up here at Google? Also, tell us about your team here? We're very excited about the release of the CobaltStrike rules. Could you share more about what they are looking for and second why this is so valuable? How did CobaltStrike come to be so widely used by bad guys? When you were doing this research what was the most surprising thing you uncovered? Could you tell us about the coordinated disclosure aspects of this work? In the past you've contributed research to our Threat Horizons reports, could you tell us about that? Resources: Making CobaltStike harder for threat actors to abuse blog CobaltStrike YARA-L rules CobaltStrike site "Cobalt Strike Usage Explodes Among Cybercrooks" Google Cybersecurity Action Team Threat Horizons Report #4 Is Out! Detection as Code? No, Detection as COOKING!

Guest: Jeff Bollinger, Director of Incident Response and Detection Engineering @ Linkedin Topics: Observability sounds cool (please define it for us BTW), but relating it to security has been "hand-wavy" at best. What is your opinion on the relevance of observability data for security use cases? What use cases are those, apart from saving the data for IR just in case? How can we best approach observability in the cloud, particularly around network communications, so that we improve security as a result? Are there other areas of cloud where observability might be more relevant? Does the massive shift to TLS 1.3 impact this? If the Internet is shifting towards an end-user/device centric model with everything as a service (SaaS), how does security monitoring even work anymore? Does it mean the end of both endpoint and network eras and the arrival of the application security monitoring era? Can we do deep monitoring of complex applications and app clusters for abuse or should we just focus on identity and profiling? Resources: "Instrumenting Modern Application Stack for Detection and Response" (ep34) "Crafting the InfoSec Playbook: Security Monitoring and Incident Response Master Plan" by Jeff Bollinger, Brandon Enright, Matthew Valites (book) RFC 7258 Pervasive Monitoring Is an Attack RFC 8890 Internet is for end users "(Re)building Threat Detection and Incident Response at LinkedIn" "Martian Chronicles" by Ray Bradberry (because migrating to cloud is like flying to Mars)

Guests: Alijca Cade, Director, Financial Services, Office of the CISO, Google Cloud Ken Westin, Director, Security Strategy, Cybereason Robert Wallace, Senior Director, Mandiant, now Google Cloud Topics: How are cloud environments attacked and compromised today? Is it still about the configuration mistakes? Do cryptominers represent a serious threat now that they are often mentioned as the most common threat in the cloud? Let's look at another popular threat - ransomware or, broadly, RansomOps. Based on your research, what can we say about its likely future, especially in the cloud? Are we getting better with detection in the cloud and are we doing it fast enough? Is cloud security a misnomer? Attackers are out to get into an organization, and cloud or on-premise matters less here, right? What does it say about the interdependence of security, on and off cloud? Resources: LIVE @ Security Talks: The Cloud Security Podcast at Cloud Security Talks Q3 2022 Google Cybersecurity Action Team Threat Horizons Report #4 Is Out!

Guest: Dr Anna Belak, Director of Thought Leadership at Sysdig, former Gartner analyst Questions: Analysts (and vendors) coined a log of "C-something acronyms" for cloud security, and two of the people on this episode were directly involved in some of them. What do you make of all the cloud security acronym proliferation? What is CSPM? What gets better when you deploy it? What is CWPP? Does anything get better when you deploy it? What is CNAPP? What gets better when you deploy it? What is CIEM, Anton's least fave acronym? Now, what about CDR? Resources: Gartner acronym glossary "Container Security: The Past or The Future?" (ep54, with Anna as well) "Automate and/or Die?" (ep3) "Impersonating Service Accounts in GCP and Beyond: Cloud Security Is About IAM?" (ep60) "Powering Secure SaaS … But Not with CASB? Cloud Detection and Response?" (ep76) "Does the World Need Cloud Detection and Response (CDR)?" "Announcing Virtual Machine Threat Detection now generally available to Cloud customers" Sysdig Threat Report Blog 2022 Sysdig Cloud-Native Threat Report Anatomy of Cloud Attacks