Cloud Security Podcast by Google

View Top 200 Chart

Back to Rankings Page

Technology
**Cloud Security Podcast by Google**

Cloud Security Podcast by Google focuses on security in the cloud, delivering security from the cloud, and all things at the intersection of security and cloud. Of course, we will also cover what we are doing in Google Cloud to help keep our users’ data safe and workloads secure.

We’re going to do our best to avoid security theater, and cut to the heart of real security questions and issues. Expect us to question threat models and ask if something is done for the data subject’s benefit or just for organizational benefit.

We hope you’ll join us if you’re interested in where technology overlaps with process and bumps up against organizational design. We’re hoping to attract listeners who are happy to hear conventional wisdom questioned, and who are curious about what lessons we can and can’t keep as the world moves from on-premises computing to cloud computing.

Latest Episodes:

EP163 Cloud Security Megatrends: Myths, Realities, Contentious Debates and Of Course AI Mar 11, 2024

Show notes

Guest:

Phil Venables, Vice President, Chief Information Security Officer (CISO) @ Google Cloud

Topics:

You had this epic 8 megatrends idea in 2021, where are we now with them?
We now have 9 of them, what made you add this particular one (AI)?
A lot of CISOs fear runaway AI. Hence good governance is key! What is your secret of success for AI governance?
What questions are CISOs asking you about AI? What questions about AI should they be asking that they are not asking?
Which one of the megatrends is the most contentious based on your presenting them worldwide?
Is cloud really making the world of IT simpler (megatrend #6)?
Do most enterprise cloud users appreciate the software-defined nature of cloud (megatrend #5) or do they continue to fight it?
Which megatrend is manifesting the most strongly in your experience?

Resources:

EP162 IAM in the Cloud: What it Means to Do It 'Right' with Kat Traxler Mar 04, 2024

Show notes

Guest:

Kat Traxler, Security Researcher, TrustOnCloud

Topics:

What is your reaction to "in the cloud you are one IAM mistake away from a breach"? Do you like it or do you hate it?
A lot of people say "in the cloud, you must do IAM 'right'". What do you think that means? What is the first or the main idea that comes to your mind when you hear it?
How have you seen the CSPs take different approaches to IAM? What does it mean for the cloud users?
Why do people still screw up IAM in the cloud so badly after years of trying?
Deeper, why do people still screw up resource hierarchy and resource management?
Are the identity sins of cloud IAM users truly the sins of the creators? How did the "big 3" get it wrong and how does that continue to manifest today?
Your best cloud IAM advice is "assign roles at the lowest resource-level possible", please explain this one? Where is the magic?

Resources:

EP161 Cloud Compliance: A Lawyer - Turned Technologist! - Perspective on Navigating the Cloud Feb 26, 2024

Show notes

Guest:

Victoria Geronimo, Cloud Security Architect, Google Cloud

Topics:

You work with technical folks at the intersection of compliance, security, and cloud. So what do you do, and where do you find the biggest challenges in communicating across those boundaries?
How does cloud make compliance easier? Does it ever make compliance harder?
What is your best advice to organizations that approach cloud compliance as they did for the 1990s data centers and classic IT?
What has been the most surprising compliance challenge you've helped teams debug in your time here?
You also work on standards development –can you tell us about how you got into that and what's been surprising in that for you?
We often say on this show that an organization's ability to threat model is only as good as their team's perspectives are diverse: how has your background shaped your work here?

Resources:

EP160 Don't Cloud Your Judgement: Security and Cloud Migration, Again! Feb 19, 2024

Show notes

Guest:

Merritt Baer, Field CTO, Lacework, ex-AWS, ex-USG

Topics:

How can organizations ensure that their security posture is maintained or improved during a cloud migration? Is cloud migration a risk reduction move?
What are some of the common security challenges that organizations face during a cloud migration?
Are there different gotchas between the three public clouds?
What advice would you give to those security leaders who insist on lift/shift or on lift/shift first?
How should security and compliance teams approach their engineering and DevOps colleagues to make sure things are starting on the right foot?
In your view, what is the essence of a cloud-native approach to security?
How can organizations ensure that their security posture scales as their cloud usage grows?

Resources:

EP159 Workspace Security: Built for the Modern Threat. But How? Feb 12, 2024

Show notes

Guests:

Emre Kanlikilicer, Senior Engineering Manager @ Google
Sophia Gu, Engineering Manager at Google

Topics

Workspace makes the claim that unlike other productivity suites available today, it's architectured for the modern threat landscape. That's a big claim! What gives Google the ability to make this claim?
Workspace environments would have many different types of data, some very sensitive. What are some of the common challenges with controlling access to data and protecting data in hybrid work?
What are some of the common mistakes you see customers making with Workspace security?
What are some of the ways context aware access and DLP (now SDP) help with this?
What are the cool future plans for DLP and CAA?

Resources:

EP158 Ghostbusters for the Cloud: Who You Gonna Call for Cloud Forensics Feb 05, 2024

Show notes

Guest:

Jason Solomon, Security Engineer, Google

Topics:

Could you share a bit about when you get pulled into incidents and what are your goals when you are?
How does that change in the cloud? How do you establish a chain of custody and prove it for law enforcement, if needed?
What tooling do you rely on for cloud forensics and is that tooling available to "normal people"?
How do we at Google know when it's time to call for help, and how should our customers know that it's time?
Can I quote Ray Parker Jr and ask, who you gonna call?
What's your advice to a security leader on how to "prepare for the inevitable" in this context?
Cloud forensics - is it easier or harder than the 1990s classic forensics?

Resource:

EP157 Decoding CDR & CIRA: What Happens When SecOps Meets Cloud Jan 29, 2024

Show notes

Guest:

Arie Zilberstein, CEO and Co-Founder at Gem Security

Topics:

How does Cloud Detection and Response (CDR) differ from traditional, on-premises detection and response?
What are the key challenges of cloud detection and response?
Often we lift and shift our teams to Cloud, and not always for bad reasons, so what's your advice on how to teach the old dogs new tricks: "on-premise-trained" D&R teams and cloud D&R?
What is this new CIRA thing that Gartner just cooked up? Should CIRA exist as a separate market or technology or is this just a slice of CDR or even SIEM perhaps?
What do you tell people who say that "SIEM is their CDR"?
What are the key roles and responsibilities of the CDR team? How is the cloud D&R process related to DevOps and cloud-style IT processes?

Resources:

EP156 Living Off the Land and Attacking Critical Infrastructure: Mandiant Incident Deep Dive Jan 22, 2024

Show notes

Guest:

Sandra Joyce, VP at Mandiant Intelligence

Topics:

Could you give us a brief overview of what this power disruption incident was about?
This incident involved both Living Off the Land and attacks on operational technology (OT). Could you explain to our audience what these mean and what the attacker did here?
We also saw a wiper used to hide forensics, is that common these days?
Did the attacker risk tipping their hand about upcoming physical attacks? If we'd seen this intrusion earlier, might we have understood the attacker's next moves?
How did your team establish robust attribution in this case, and how they do it in general? How sure are we, really?
Could you share how this came about and maybe some of the highlights in our relationship helping defend that country?

Resources:

EP155 Cyber, Geopolitics, AI, Cloud - All in One Book? Jan 15, 2024

Show notes

Guests:

Derek Reveron, Professor and Chair of National Security at the US Naval War College
John Savage, An Wang Professor Emeritus of Computer Science of Brown University

Topics:

You wrote a book on cyber and war, how did this come about and what did you most enjoy learning from the other during the writing process?
Is generative AI going to be a game changer in international relations and war, or is it just another tool?
You also touch briefly on lethal autonomous weapons systems and ethics–that feels like the genie is right in the very neck of the bottle right now, is it too late?
Aside from this book, and the awesome course you offered at Brown that sparked Tim's interest in this field, how can we democratize this space better?
How does the emergence and shift to Cloud impact security in the cyber age?
What are your thoughts on the intersection of Cloud as a set of technologies and operating model and state security (like sovereignty)? Does Cloud make espionage harder or easier?

Resources:

EP154 Mike Schiffman: from Blueboxing to LLMs via Network Security at Google Jan 08, 2024

Show notes

Guest:

Mike Schiffman, Network Security "UTL"

Topics:

Given your impressive and interesting history, tell us a few things about yourself?
What are the biggest challenges facing network security today based on your experience?
You came to Google to work on Network Security challenges. What are some of the surprising ones you've uncovered here?
What lessons from Google's approach to network security absolutely don't apply to others? Which ones perhaps do?
If you have to explain the difference between network security in the cloud and on-premise, what comes to mind first?
How do we balance better encryption with better network security monitoring and detection?
Speaking of challenges in cryptography, we're all getting fired up about post-quantum and network security. Could you give us the maybe 5 minute teaser version of this because we have an upcoming episode dedicated to this?
I hear you have some interesting insight on LLMs, something to do with blueboxing or something. What is that about?

Resources:

Our TOPPODCAST Picks

Follow Us

Stay Connected

Cloud Security Podcast by Google

Related Podcasts

Links

Stay Connected