Cloud Security Podcast by Google

View Top 200 Chart

Back to Rankings Page

Technology
**Cloud Security Podcast by Google**

Cloud Security Podcast by Google focuses on security in the cloud, delivering security from the cloud, and all things at the intersection of security and cloud. Of course, we will also cover what we are doing in Google Cloud to help keep our users’ data safe and workloads secure.

We’re going to do our best to avoid security theater, and cut to the heart of real security questions and issues. Expect us to question threat models and ask if something is done for the data subject’s benefit or just for organizational benefit.

We hope you’ll join us if you’re interested in where technology overlaps with process and bumps up against organizational design. We’re hoping to attract listeners who are happy to hear conventional wisdom questioned, and who are curious about what lessons we can and can’t keep as the world moves from on-premises computing to cloud computing.

Latest Episodes:

EP203 Cloud Shared Responsibility: Beyond the Blame Game with Rich Mogull Dec 16, 2024

Show notes

Guest:

Rich Mogull, SVP of Cloud Security at Firemon and CEO at Securosis

Topics:

Let's talk about cloud security shared responsibility. How to separate the blame? Is there a good framework for apportioning blame?
You've introduced the Cloud Shared Irresponsibilities Model, stating cloud providers will be considered partially responsible for breaches even if due to customer misconfigurations. How do you see this impacting the relationship between cloud providers and their customers? Will it lead to more collaboration or more friction?
We both know the Jay Heiser 2015 classic "cloud is secure, but you not using it securely." In your view, what does "use cloud securely" mean for various organizations today?
Here is a very painful question: how to decide what cloud security should be free with cloud and what security can be paid?
You dealt with cloud security for a long time, what is your #1 lesson so far on how to make the cloud more secure or use the cloud more securely?
What is the best way to learn how to cloud? What is this CloudSLAW thing?

Resources:

EP202 Beyond Tiered SOCs: Detection as Code and the Rise of Response Engineering Dec 09, 2024

Show notes

Guest:

Amine Besson, Tech Lead on Detection Engineering, Behemoth Cyberdefence

Topics:

What is your best advice on detection engineering to organizations who don't want to engineer anything in security?
What is the state of art when it comes to SOC ? Who is doing well? What on Earth is a fusion center?
Why classic "tiered SOCs" fall flat when dealing with modern threats?
Let's focus on a correct definition of detection as code. Can you provide yours?
Detection x response engineering - is there a thing called "response engineering"? Should there be?
What are your lessons learned to fuse intel, detections, and hunting ops?
What is this SIEMless yet SOARful detection architecture?
What's next with OpenTIDE 2.0?

Resources:

EP201 Every CTO Should Be a CSTO (Or Else!) - Transformation Lessons from The Hoff Dec 02, 2024

Show notes

Guest:

Chris Hoff, Chief Secure Technology Officer at Last Pass

Topics:

I learned that you have a really cool title that feels very "now" - Chief Secure Technology Officer? What's the story here? Weirdly, I now feel that every CTO better be a CSTO or quit their job :-)
After, ahem, not-so-recent events you had a chance to rebuild a lot of your stack, and in the process improve security. Can you share how it went, and what security capabilities are now built in?
How much of a culture change did that require? Was it purely a technological transformation or you had to change what people do and how they do it?
Would you recommend this to others (not the "recent events experience", but the rebuild approach)? What benefits come from doing this before an incident occurs? Are there any?
How are you handling telemetry collection and observability for security in the new stack? I am curious how this was modernized
Cloud is simple, yet also complex, I think you called it "simplex." How does this concept work?

Resources:

EP200 Zero Touch Prod, Security Rings, and Foundational Services: How Google Does Workload Security Nov 25, 2024

Show notes

Guest:

Michael Czapinski, Security & Reliability Enthusiast, Google

Topics:

"How Google protects its production services" paper covers how Google's infrastructure balances several crucial aspects, including security, reliability, development speed, and maintainability. How do you prioritize these competing demands in a real-world setting?
What attack vectors do you consider most critical in the production environment, and how has Google's defenses against these vectors improved over time?
Can you elaborate on the concept of Foundational services and their significance in Google's security posture?
How does your security approach adapt to this vast spectrum of sensitivity and purpose of our servers and services, actually?
How do you implement this principle of zero touch prod for both human and service accounts within our complex infrastructure?
Can you talk us through the broader approach you take through Workload Security Rings and how this helps?

Resources:

EP199 Your Cloud IAM Top Pet Peeves (and How to Fix Them) Nov 18, 2024

Show notes

Guests:

Michele Chubirka, Staff Cloud Security Advocate, Google Cloud
Sita Lakshmi Sangameswaran, Senior Developer Relations Engineer, Google Cloud

Topics:

What is your reaction to "in the cloud you are one IAM mistake away from a breach"? Do you like it or do you hate it? Or do you "it depends" it? :-)
Everyone's talking about how "identity is the new perimeter" in the cloud. Can you break that down in simple terms?
A lot of people say "in the cloud, you must do IAM 'right'". What do you think that means? What is the first or the main idea that comes to your mind when you hear it?
What's this stuff about least-privilege and separation-of-duties being less relevant? Why do they matter in the cloud that changes rapidly?
What are your IAM Top Pet Peeves?

Resources:

EP198 GenAI Security: Unseen Attack Surfaces & AI Pentesting Lessons Nov 11, 2024

Show notes

Guests:

Ante Gojsalic, Co-Founder & CTO at SplxAI

Topics:

What are some of the unique challenges in securing GenAI applications compared to traditional apps?
What current attack surfaces are most concerning for GenAI apps, and how do you see these evolving in the future?
Do you have your very own list of top 5 GenAI threats? Everybody seem to!
What are the most common security mistakes you see clients make with GenAI?
Can you explain the main goals when trying to add automation to pentesting for next-gen GenAI apps?
What are your AI testing lessons from clients so far?

Resources:

EP197 SIEM (Decoupled or Not), and Security Data Lakes: A Google SecOps Perspective Nov 04, 2024

Show notes

Guest:

Travis Lanham, Uber Tech Lead (UTL) for Security Operations Engineering, Google Cloud

Topics:

There's been a ton of discussion in the wake of the three SIEM week about the future of SIEM-like products. We saw a lot of takes on how this augurs the future of disassembled or decoupled SIEMs. Can you explain what these disassembled SIEMs are all about?
What are the expected upsides of detaching your SIEM interface and security capabilities from your data backend?
Tell us about the early days of SecOps (nee Chronicle) and why we didn't go with this approach?
What are the upsides of a tightly coupled datastore + security experience for a SIEM?
Are there more risks or negatives of the decoupled/decentralized approach? Complexity and the need to assemble "at home" are on the list, right?
One of the 50 things Google knew to be true back in the day was that product innovation comes from technical innovation, what's the technical innovation driving decoupled SIEMs?
So what about those security data lakes? Any insights?

Resources:

EP196 AI+TI: What Happens When Two Intelligences Meet? Oct 28, 2024

Show notes

Guest:

Vijay Ganti, Director of Product Management, Google Cloud Security

Topics:

What have been the biggest pain points for organizations trying to use threat intelligence (TI)?
Why has it been so difficult to convert threat knowledge into effective security measures in the past?
In the realm of AI, there's often hype (and people who assume "it's all hype"). What's genuinely different about AI now, particularly in the context of threat intelligence?
Can you explain the concept of "AI-driven operationalization" in Google TI? How does it work in practice?
What's the balance between human expertise and AI in the TI process? Are there specific areas where you see the balance between human and AI involvement shifting in a few years?
Google Threat Intelligence aims to be different. Why are we better from client PoV?

Resources:

Google Threat Intel website
"Future of Brain" book by Gary Marcus et al
Detection engineering blog (Part 9) and the series
Detect engineering blogs by David French
The pyramid of pain blog, the classic
"Scaling Up Malware Analysis with Gemini 1.5 Flash" and "From Assistant to Analyst: The Power of Gemini 1.5 Pro for Malware Analysis" blogs on Gemini for security

EP195 Containers vs. VMs: The Security Showdown! Oct 21, 2024

Show notes

Cross-over hosts:

Kaslin Fields, co-host at Kubernetes Podcast
Abdel Sghiouar, co-host at Kubernetes Podcast

Guest:

Michele Chubirka, Cloud Security Advocate, Google Cloud

Topics:

How would you approach answering the question "what is more secure, container or a virtual machine (VM)?"
Could you elaborate on the real-world implications of this for security, and perhaps provide some examples of when one might be a more suitable choice than the other?
While containers boast a smaller attack surface (what about the orchestrator though?), VMs present a full operating system. How should organizations weigh these factors against each other?
The speed of patching and updates is a clear advantage of containers. How significant is this in the context of today's rapidly evolving threat landscape? Are there any strategies organizations can employ to mitigate the slower update cycles associated with VMs?
Both containers and VMs can be susceptible to misconfigurations, but container orchestration systems introduce another layer of complexity. How can organizations address this complexity and minimize the risk of misconfigurations leading to security vulnerabilities?
What about combining containers and VMs. Can you provide some concrete examples of how this might be implemented? What benefits can organizations expect from such an approach, and what challenges might they face?
How do you envision the security landscape for containers and VMs evolving in the coming years? Are there any emerging trends or technologies that could significantly impact the way we approach security for these two technologies?

Resources:

EP194 Deep Dive into ADR - Application Detection and Response Oct 14, 2024

Show notes

Guest:

Daniel Shechter, Co-Founder and CEO at Miggo Security

Topics:

Why do we need Application Detection and Response (ADR)? BTW, how do you define it?
Isn't ADR a subset of CDR (for cloud)? What is the key difference that sets ADR apart from traditional EDR and CDR tools?
Why can't I just send my application data - or eBPF traces - to my SIEM and achieve the goals of ADR that way?
We had RASP and it failed due to instrumentation complexities. How does an ADR solution address these challenges and make it easier for security teams to adopt and implement?
What are the key inputs into an ADR tool?
Can you explain how your ADR correlates cloud, container, and application contexts to provide a better view of threats? Could you share real-world examples of types of badness solved for users?
How would ADR work with other application security technologies like DAST/SAST, WAF and ASPM?
What are your thoughts on the evolution of ADR?

Resources:

Our TOPPODCAST Picks

Follow Us

Stay Connected

Cloud Security Podcast by Google

Related Podcasts

Links

Stay Connected