Cloud Security Podcast by Google

View Top 200 Chart

Back to Rankings Page

Technology
**Cloud Security Podcast by Google**

Cloud Security Podcast by Google focuses on security in the cloud, delivering security from the cloud, and all things at the intersection of security and cloud. Of course, we will also cover what we are doing in Google Cloud to help keep our users’ data safe and workloads secure.

We’re going to do our best to avoid security theater, and cut to the heart of real security questions and issues. Expect us to question threat models and ask if something is done for the data subject’s benefit or just for organizational benefit.

We hope you’ll join us if you’re interested in where technology overlaps with process and bumps up against organizational design. We’re hoping to attract listeners who are happy to hear conventional wisdom questioned, and who are curious about what lessons we can and can’t keep as the world moves from on-premises computing to cloud computing.

Latest Episodes:

EP143 Cloud Security Remediation: The Biggest Headache? Oct 16, 2023

Show notes

Guests:

Tomer Schwartz, Dazz CTO

Topics:

It seems that in many cases the challenge with cloud configuration weaknesses is not their detection, but remediation, is that true?
As far as remediation scope, do we need to cover traditional vulnerabilities (in stock and custom code), configuration weaknesses and other issues too?
One of us used to cover vulnerability management at Gartner, and in many cases the remediation failures [on premise] were due to process, not technology, breakdowns. Is this the same in the cloud? If still true, how can any vendor technology help resolve it?
Why is cloud security remediation such a headache for so many organizations?
Is the friction real between security and engineering teams? Do they have any hope of ever becoming BFFs?
Doesn't every CSPM (and now ASPM too?) vendor say they do automated remediation today? How should security pros evaluate solutions for prioritizing, triaging, and fixing issues?

Resources:

EP142 Cloud Security Podcast Ask Me Anything #AMA 2023 Oct 09, 2023

Show notes

Host:

Stephanie Wong, Product Manager, Google Cloud

Guests (yes, really, we are the guests!):

Topics:

Could you tell us how you ended up in security?
What was the moment you realized that Cloud security was different from well, regular, security?
Anton is always asking this "3AM test", where did that come from?
How do you source topics for the podcast?
What advice would you give to folks who are interested in getting into security?
… and other fun questions!

Resources:

Video (LinkedIn, YouTube)
Cloud Security Podcast by Google / Twitter / LinkedIn

EP141 Cloud Security Coast to Coast: From 2015 to 2023, What's Changed and What's the Same? Oct 02, 2023

Show notes

Guest:

Jeremiah Kung, Global Head of Information Security, AppLovin

Topics:

Before we dive into all of the awesome cloud migrations you've experienced and your learnings there, could we start with a topic of East vs West CISO mentality?
We are talking to more and more CISOs who see the cloud as a net win for security. What's your take on whether the cloud improves security?
We talked about doing some "big" cloud migrations, could you talk about what you learned back in 2015 about the "right" way to do a cloud migration and how you've applied those lessons since?
How are you approaching securing clouds differently in 2023 (vs the dark past of 2015)?
What advice would you give your peers to get out of the "saying no" mentality and into a better collaborative mode?
On the topic of giving advice to people who haven't asked for it, what advice would you give to teams who are stuck in 1990s thinking when it comes to lift and shifting their security technology stack to cloud?

Resources:

EP140 System Hardening at Google Scale: New Challenges, New Solutions Sep 25, 2023

Show notes

Guest:

Andrew Hoying, Senior Security Engineering Manager @ Google

Topics:

What is different about system hardening today vs 20 years ago?
Also, what is special about hardening systems at Google massive scale?
Can I just apply CIS templates and be done with it?
Part of hardening has to be following up with developers after they have un-hardened things – how do we operationalize that at scale without getting too much in the way of productivity?
A part of hardening has got to be responding to new regulation and compliance regimes, how do you incorporate new controls and stay responsive to the changing world around us?
Are there cases where we have taken lessons from hardening at scale and converted those into product improvements?
What metrics do you track to keep your teams moving, and what metrics do your leads look at to understand how you're doing? [Spoiler: the answer here is VERY fun!]

Resources:

"Why Shared Fate is a Better Way to Manage Cloud Risk" article (and this too)
CIS for GCP
GCP IAM Deny
CloudSecList by Marco Lancini

EP139 What is Chronicle? Beyond XDR and into the Next Generation of Security Operations Sep 18, 2023

Show notes

Guest:

Chris Corde, Sr Director of Product Management - Security Operations, Google Cloud

Topics:

You cover many products, but let's focus on Chronicle today. An easy question: Chronicle isn't an XDR, so what is it?
Since you've joined the team, what're you most proud of shipping to clients?
Could you share more about the Mandiant acquisition, what's been a happy surprise and what are you looking forward to making available to customers?
Some believe that good security operations success is mostly about process, yet we are also building these amazing products. What is your view of how much security ops success hinges on products vs practices?
When it comes to building out Chronicle's position in the market, how are we leveraging the depth of expertise that people have with other SIEM tools compared to ours?
What advice do you have for security professionals who want to transition into product management?

Resources:

EP138 Terraform for Security Teams: How to Use IaC to Secure the Cloud Sep 11, 2023

Show notes

Guest:

Rosemary Wang, Developer Advocate at HashiCorp

Topics:

Could you give us a 2 minute picture on what Terraform is, what stages of the cloud lifecycle it is relevant for, and how it intersects with security teams?
How can Terraform be used for security automation? How should security teams work with DevOps teams to use it?
What are some of the obvious and not so obvious security challenges of using Terraform?
How can security best practices be applied to infrastructure instantiated via Terraform?
What is the relationship between Terraform and policy as code (PaC)?
How do you get started with all this?
What do you tell the security teams who want to do cloud security the "old way" and not the cloud-native way?

Resources:

EP137 Next 2023 Special: Conference Recap - AI, Cloud, Security, Magical Hallway Conversations Sep 05, 2023

Show notes

Guests:

no guests, all banter, all very fun :-)

Topics:

How is Google Next this year? What is new in cloud security?
Is Google finally a security vendor?
What are some of the fun security presentations we've seen, including our own?
Any impactful launches in security?
What was the most interesting overall?

Resources:

"Next 2023 Special: Building AI-powered Security Tools - How Do We Do It?" (ep136)
"RSA 2023 - What We Saw, What We Learned, and What We're Excited About" (ep119)
"Cyber Defense Matrix and Does Cloud Security Have to DIE to Win?" (ep67)
"Detecting, investigating, and responding to threats in your Google Cloud environment" at Cloud Next 2023 by Anton
"Prevent cloud compromises: Learn how Uber discovers cyber risks and remediates threats" at Cloud Next 2023 by Tim
"Generative AI for defenders with Sec-PaLM 2 and Duet AI" at Cloud Next 2023 by Eric Doerr (his episode)
"A blueprint for modern security operations" at Cloud Next 2023 by our future guest, Chris…
Kevin Mandia at Next keynote (start at 1:15:00)
"New AI capabilities that can help address your security challenges" blog

EP136 Next 2023 Special: Building AI-powered Security Tools - How We Do It? Aug 28, 2023

Show notes

Guest:

Eric Doerr, VP of Engineering, Google Cloud Security

Topics:

You have a Next presentation on AI, what is the most exciting part for you?
We care both about securing AI and using AI for security. How do you organize your thinking about it?
Executive surveys imply that trusting an AI (for business) is still an issue. How can we trust AI for security? What does it mean to "trust AI" in this context?
How should defenders think about threat modeling AI systems?
Back to using AI for security, what are the absolute worst security use cases for GenAI? Think "generate code and run it on prod" or something like that?
What does it mean to "teach AI security" like we did with Sec-PALM2? What is actually involved in this?
What were some surprising challenges we ran into here?

Resources:

EP135 AI and Security: The Good, the Bad, and the Magical Aug 21, 2023

Show notes

Guest:

Phil Venables (@philvenables), Vice President, Chief Information Security Officer (CISO) @ Google Cloud

Topics:

Why is AI a game-changer for security? Can we even have game-changers in cyber security?
Is it more detection or is it more reducing toil and making humans more productuve? What are you favorite AI for security use cases?
What "AI + security" issue makes you - a classic CISO question here - lose sleep at night?
Does AI help defenders or attackers more? Won't attackers adopt faster because they don't have as many rules (but yes, they have bosses and budgets too)?
Aren't there cases where defenders benefit a lot more and gain a superpower with AI while attackers are faced with defeat?
Is securing AI more similar or more different from securing other enterprise systems?
Does shared fate apply to AI?

Resources:

"Securing AI: Similar or Different?" paper by Office of the CISO at Google Cloud
"Secure AI Framework Approach"
Supercharge security with AI
Board of Directors Insights Hub
"Lessons from the future: Why shared fate shows us a better cloud roadmap" blog
"Megatrends, Macro-changes, Microservices, Oh My! Changes in 2022 and Beyond in Cloud Security" (ep47)
"Securing Multi-Cloud from a CISO Perspective, Part 3" (ep22)
"Google Cybersecurity Action Team: What's the Story?" (ep37)
"Google Cybersecurity Action Team: One Year Later!" (ep90)

EP134 How to Prioritize UX and Security in the Cloud: UX as a Security Capability Aug 14, 2023

Show notes

Guest:

Steph Hay , Director of UX, Google Cloud Security

Topics:

The importance of User Experience (UX) in security is so obvious – though it isn't to a lot of people! Could we talk about the importance of UX in security?
UX and security in general have an uneasy relationship, and security is harmed by bad UX, it also feels like bad UX can be a security issue. What is your take on this?
How do you think about prioritizing your team's time between day zero vs day n experiences for users of security tools?
Some say that cloud security should be invisible, but does this mean no UX at all? What are the intersections between UX for security and invisible security?
Can you think of what single UX change in Cloud Security's portfolio made the biggest impact to actual security outcomes?
We have this new tool/approach for planning called Jobs To Be Done (JTBD) - give us the value, and the history? In the world of JTBD planning, what gets better?

Resources:

Our TOPPODCAST Picks

Follow Us

Stay Connected

Cloud Security Podcast by Google

Related Podcasts

Links

Stay Connected