Cloud Security Podcast by Google

View Top 200 Chart

Back to Rankings Page

Technology
**Cloud Security Podcast by Google**

Cloud Security Podcast by Google focuses on security in the cloud, delivering security from the cloud, and all things at the intersection of security and cloud. Of course, we will also cover what we are doing in Google Cloud to help keep our users’ data safe and workloads secure.

We’re going to do our best to avoid security theater, and cut to the heart of real security questions and issues. Expect us to question threat models and ask if something is done for the data subject’s benefit or just for organizational benefit.

We hope you’ll join us if you’re interested in where technology overlaps with process and bumps up against organizational design. We’re hoping to attract listeners who are happy to hear conventional wisdom questioned, and who are curious about what lessons we can and can’t keep as the world moves from on-premises computing to cloud computing.

Latest Episodes:

EP133 The Shared Problem of Alerting: More SRE Lessons for Security Aug 07, 2023

Show notes

Guest:

Steve McGhee, Reliability Advocate at Google Cloud
Aron Eidelman, Developer Relations Engineer at Google Cloud

Topics:

What is the shared problem for SRE and security when it comes to alerting?
Why is there reluctance to reduce noise?
How do SREs, security practitioners, and other stakeholders define "incident" and "risk"?
How does involving an "adversary" change the way people think about an incident, even if the impact is identical?
Which SRE alerting lessons do NOT apply at all for security?

Resources:

Video (LinkedIn, YouTube)
"Deploy Security Capabilities at Scale: SRE Explains How" (ep85)
Steve talk about probability and SLO math at SLOconf
Why Focus on Symptoms, Not Causes?
Learning from incidents (LFI) science
How to measure anything in cyber security risk book
Security chaos engineering book
The SRS Book Ch 1
The SRE book Ch 4

EP132 Chaos Engineering for Security: How to Improve Software Resilience with Kelly Shortridge Jul 31, 2023

Show notes

Guest:

Kelly Shortridge, Senior Principal Engineer in the Office of the CTO at Fastly

Topics:

So what is Security Chaos Engineering?
"Chapter 5. Operating and Observing" is Anton's favorite. One thing that mystifies me, however, is that you outline how to fail with alerts (send too many), but it is not entirely clear how to practically succeed with them? How does chaos engineering help security alerting / detection?
How chaos engineering (or is it really about software resilience?) intersects with Cloud security - is this peanut butter and chocolate or more like peanut butter and pickles?
How can organizations get started with chaos engineering for software resilience and security?
What is your favorite chaos engineering experiment that you have ever done?
We often talk about using the SRE lessons for security, and yet many organizations do security the 1990s way. Are there ways to use chaos engineering as a forcing function to break people out of their 1990s thinking and time warp them to 2023?

Resources:

EP131 A Deep Dive into Google's Assured OSS: How Google Secures the Software You Use Jul 24, 2023

Show notes

Guests:

Himanshu Khurana, Engineering Manager, Google Cloud
Rahul Gupta, Product Manager for Assured OSS, Google Cloud

Topics:

For the software you're supporting in Assured Open Source your team discovered 50% of the CVEs reported in them this year. How did that happen?
So what is Assured Open Source?
Do we really guarantee its security? What does "guarantee" here mean?
What're users actually paying for here?
What's the Google magic here and why are we doing this?
Do we really audit all code and fuzz for security issues?
What's a supply chain attack and then we'll talk about how this is plugging into those gaps?

Resources:

EP130 Cloud is Secure: Are you Using It Securely - True or False? Jul 17, 2023

Show notes

Guest:

Steve Riley, Field CTO, Netskope, ex-Gartner Research VP

Topics:

Analysts (well, like Steve and Anton in the past?) say that "cloud is secure, but clients just aren't using it securely", what is your reaction to this today?
When clients hear "use cloud securely", what do you think comes to their minds?
How would you approach planning for secure use of the cloud or using cloud securely?
What is your view of cloud defense in depth (DiD) or layered defenses? How do you suggest clients think about it? What about DiD for SaaS?
What are your thoughts on the evolution of zero trust? How has it changed since its introduction back in 2010?
Awareness of and interest in SSE and SASE is growing. But at the same time, plenty of folks seem deeply perplexed by these. How would you explain them to someone not deeply immersed in the details?

Resources:

EP129 How CISO Cloud Dreams and Realities Collide Jul 10, 2023

Show notes

Guest:

Rick Doten, VP, Information Security at Centene Corporation, CISO Carolina Complete Health

Topics:

What are the realistic cloud risks today for an organization using public cloud?
Is the vendor lock-in on that list? What other risks everybody thinks are real, but they are not?
What do you tell people who in 2023 still think "they can host Exchange better themselves" and have silly cloud fears?
What do you tell people who insist on "copy/pasting" all their security technology stack from data centers to the cloud?
Cloud providers have greater opportunity not only to see issues, but to learn how to react well. Do you think this argument holds water?
What are the most challenging security issues for multi-cloud and hybrid cloud security?
How does security chasm (between security haves and have-notes) affect cloud security?
Your best cloud security advice for an organization with a security team of 0 FTEs and no CISO?

Resources:

EP128 Building Enterprise Threat Intelligence: The Who, What, Where, and Why Jul 03, 2023

Show notes

Guest:

John Doyle, Principle Intelligence Enablement Consultant at Mandiant / Google Cloud

Topics:

You have created a new intelligence class focused on building enterprise threat intelligence capability, so what is the profile of an organization and profile for a person that benefits the most from the class?
There are many places to learn threat intel (TI), what is special about your new class?
You talk about country cyber operations in the class, so what is the defender - relevant difference between, say, DPRK and Iran cyber doctrines? More generally, how do defenders benefit from such per country intel?
Can you really predict what the state-affiliated attackers would do to your organization based on the country doctrine?
In many minds, TI is connected to attribution. What is your best advice on attribution to CISOs of well-resourced organizations? What about mainstream organizations?
Overall we see a lot of organizations still failing to operationalize TI, especially strategic TI, how does this help them?

Resources:

The new class "Inside the Mind of APT"
"Navigating Tradeoffs of Attribution" paper
Sands Casino hack 2014
"Threat Horizons - How Google Does Threat Intelligence" (ep112)

EP127 Is IAM Really Fun and How to Stay Ahead of the Curve in Cloud IAM? Jun 26, 2023

Show notes

Guest:

Ian Glazer, founder at Weave Identity, ex-Gartner, ex-SVP of Products at Salesforce, co-founder of IDPro

Topics:

OK, tell us why Identity and Access Management (IAM) is exciting (is it exciting?)
Could you also explain why IAM is even more exciting in the cloud?
Are you really "one IAM mistake away from a breach" in the cloud?
What advice would you give to someone new to IAM?
How to not just "learn IAM in the cloud" but to keep learning IAM?
Is what I know about IAM in AWS the same as knowing IAM for GCP? What advice do you have for teams operating in a multi-cloud world?
What are the top cloud IAM mistakes? How to avoid them?

Resources:

EP126 What is Policy as Code and How Can It Help You Secure Your Cloud Environment? Jun 19, 2023

Show notes

Guests:

Dominik Richter, the founder and head of product at Mondoo

Cooked questions:

What is a policy, is that the same as a control, or is there a difference? And what's the gap between a policy and a guardrail?
We have IaC, so what is this Policy as Code? Is this about security policy or all policies for cloud?
Who do I hire to write and update my policy as code? Do I need to be a coder to create policy now?
Who should own the implementation of Policy as Code? Is Policy as Code something that security needs to be driving? Is it the DevOps or Platform Engineering teams?
How do organizations grow into safely rolling out new policy as code code?
You [Mondoo] say that "cnspec assesses your entire infrastructure's security and compliance" and this problem has been unsolved for as long as the cloud existed. Will your toolset change this?
There are other frameworks that exist for security testing like HashiCorp's sentinel, Open Policy Agent, etc and you are proposing a new one with MQL. Why do we need another security framework?
What are some of the success metrics when adopting Policy as Code?

Resources:

Live video (LinkedIn, YouTube)
"Why Infrastructure as Code Is Setting You up to Make Bad Things Faster" blog

EP125 Will SIEM Ever Die: SIEM Lessons from the Past for the Future Jun 12, 2023

Show notes

Guest:

David Swift, Security Strategist at Netenrich

Topics:

Which old Security Information and Event Management (SIEM) lessons apply today?
Which old SIEM lessons absolutely do not apply today and will harm you?
What are the benefits and costs of SIEM in 2023?
What are the top cloud security use cases for SIEM in 2023?
What are your favorite challenges with SIEM in 2023 special in the cloud? Are they different from, say, 2013 or perhaps 2003?
Do you think SIEM can ever die?

Resources:

Live video (LinkedIn, YouTube)
"Debating SIEM in 2023, Part 1" and "Debating SIEM in 2023, Part 2" blogs
"Detection as Code? No, Detection as COOKING!" blog
"A Process for Continuous Security Improvement Using Log Analysis" (old but good)
"UEBA, It's Just a Use Case" blog
"Situational Awareness Is Key to Faster, Better Threat Detection" blog and other SIEM reading
MITRE 15 detection techniques paper

EP124 Safe Browsing: Lessons from How Google Secures Five Billion Devices at Low False Positive Rates Jun 05, 2023

Show notes

Guest:

Panos Mavrommatis, Senior Engineering Director at Google Cloud

Topics:

Could you give us the 30 second overview of our favorite "billion user security product" - SafeBrowsing - and, since you were there, how did it get started?
SafeBrowsing is a consumer and business product – are you mitigating the same threats and threat models on each side?
Making this work at scale can't be easy, anytime we're talking about billion device protection, there are massive scale questions. How did we make it work at such a scale?
Talk to us about the engineering and scaling magic behind the low false positive rate for blocking?

Resources:

"Foundryside" book

Our TOPPODCAST Picks

Follow Us

Stay Connected

Cloud Security Podcast by Google

Related Podcasts

Links

Stay Connected