Cloud Security Podcast by Google

View Top 200 Chart

Back to Rankings Page

Technology
**Cloud Security Podcast by Google**

Cloud Security Podcast by Google focuses on security in the cloud, delivering security from the cloud, and all things at the intersection of security and cloud. Of course, we will also cover what we are doing in Google Cloud to help keep our users’ data safe and workloads secure.

We’re going to do our best to avoid security theater, and cut to the heart of real security questions and issues. Expect us to question threat models and ask if something is done for the data subject’s benefit or just for organizational benefit.

We hope you’ll join us if you’re interested in where technology overlaps with process and bumps up against organizational design. We’re hoping to attract listeners who are happy to hear conventional wisdom questioned, and who are curious about what lessons we can and can’t keep as the world moves from on-premises computing to cloud computing.

Latest Episodes:

Beyond Compliance: Cloud Security in Europe Aug 02, 2021

Show notes

Guest:

John Stone, Chaos Coordinator at the Office of the CISO @ Google Cloud

Topics:

What are the top European-specific cloud migration security challenges?
Are there interesting cloud adoption barriers related to security in Europe?
Are some of these challenges more compliance than security related?
Do you think compliance still drives security in the cloud for European companies?
Do you think Europe can ever "make their own cloud"?
So, what do you make of this entire movement about "data sovereignty"?

Linking Up The Pieces: Software Supply Chain Security at Google and Beyond Jul 26, 2021

Show notes

Guests:

Eric Brewer, VP of Infrastructure, and Google Fellow @ Google
Aparna Sinha, Director of Product Management @ Google Cloud

Topics:

What is software supply chain security and how is it different from other kinds of supply chain security?
What types of organizations need to care about it? Is supply chain security a concern for large, elite enterprises only?
What's the relationship between what we're doing here, and what SBOM is?
Can you talk us through a quick threat assessment of a supply chain security issue? What are the realistic threats here and who are the threat actors involved?
How does Google try to solve these problems internally? Have we succeeded?
How does this translate into our products? By the way, what's SLSA?

Resources:

Threat Detection at Google Cloud Security Summit Jul 19, 2021

Show notes

No guests. We interviewed each other!

Topics:

What would you say are the most things that Chronicle is trying to address today?
What are the good ways to use threat intel to detect threats that do not ruin your SOC?
What does "autonomic" security mean, anyway? Is this a fancy way of saying "automatic" or something more?
For sure, "the Cloud is not JUST someone else's computer" - but how does this apply to threat detection?
What makes threat detection "cloud-native"?
What kinds of ML magic does your mini UEBA inside SCC use?
Can you really do automated remediation in the cloud?

Resources:

Google Cloud Security Summit
"Making Invisible Security a Reality with Google" keynote
"Security Analytics at Google Speed and Scale" presentation by Anton
"Managing Your Security Posture on Google Cloud" presentation by Tim
"Stop Trying to Take Humans Out of SOC … Except … Wait… Wait… Wait…" blog
Chronicle main site
Threat Detection in Logs in Google Cloud SCC video
"Modern Threat Detection at Google" (episode 17)
"Automate and/or Die?" (episode 3)

Securing Multi-Cloud from a CISO Perspective, Part 3 Jul 12, 2021

Show notes

Guests:

Phil Venables (@philvenables), Vice President, Chief Information Security Officer (CISO) @ Google Cloud
Dave Hannigan, Director, Financial Services Security & Compliance @ Google Cloud

Topics:

As a CISO, would you ever decide to use multiple clouds, if it were in your hands?
How is security typically considered when companies go multi-cloud in their approach?
Practically, or operationally, how does one think through securing multiple public cloud environments?
What are the top challenges here? Different controls? Lack of tools? Confusing process? Skills on the team?
Would you always buy security tools from a 3rd party (not a CSP) if you have to cover more than one cloud provider?
Anything to add about compliance across multiple clouds?
What is the best approach for securing multiple SaaS services that your company uses?

Resources:

"IDC: A multicloud strategy can mitigate regulatory, business risks"
"Anthos security"
SANS papers on securing multiple clouds (example)

Security Marketing? Every Product Needs a Story! Jul 06, 2021

Show notes

Guest:

Kelly Anderson, Head of Product Marketing, User Protection Services @ Google Cloud

Topics:

What is marketing, really? Why is it sometimes reviled by the technologists?
What makes a great marketer in cloud security?
What's different about cloud security marketing, as opposed to regular old on-premise security marketing? Is there still FUD in the cloud?
Which things are the easiest or hardest to do in Google Cloud Security marketing?
How do you talk about products so they stand out from the noise?
How's Google Cloud marketing helping our users stay ahead of the adversaries?

Resources:

Security insights that help customers stay up to date
Customer case studies on our security products
Quarterly Google Cloud Security Talks
Cloud security webinars on BrightTALK and Cloud OnAir
Identity and security blogs on the Google Cloud blog

Security Operations, Reliability, and Securing Google with Heather Adkins Jun 28, 2021

Show notes

Guest:

Heather Adkins, Sr Director, Information Security @ Google

Topics:

Your RSA presentation has 3 pillars: zero trust, microservices, automation/zero prod, is this all you need to be secure & reliable in the modern world?
Let's drill down again into the "secure and reliable" concept, are you sure that they are interrelated?
Is there a risk that microservices could actually increase attack surface?
What are the practical security upsides of "no touch production"?
SRE and DevOps revolutionized IT, can we expect a similar revolution for security? Where would it come from?

Resources:

Double-clicking, but not on fire hydrants, with bot fighters Jun 21, 2021

Show notes

Guest 1:

Sparky Toews, Product Manager for Adobe identity @ Adobe

Topics 1:

Why are bots a problem to you? Give us a bit of your bot threat assessment?
Can you tell us how you think about and practice securing the user experience?
What kind of security products or best practices are involved?
How do you see what security professionals do to secure the user experience evolving over time?

Guests 2:

Randy Gingeleski, Senior Staff Security Engineer @ HBO Max
Brian Lozada, CISO @ HBO Max

Topics 2:

Can you tell us how you think about and practice securing the user experience at HBO?
What kind of security products or best practices are involved?
How does reCAPTCHA Enterprise fit into all of this?
How do you see what security professionals do to secure the user experience evolving over time?

More Cloud Migration Security Lessons Jun 14, 2021

Show notes

Guests:

Jane Chung, VP of Cloud @ Palo Alto
Joe Crawford, Director of Strategic Technology Partnerships for Google Cloud @ Palo Alto

Topics:

What are the top security mistakes you've seen during cloud migrations?
What is your best advice to security leaders who want to go to the cloud using the on-premise playbook?
What security technologies may no longer be needed in the cloud? Which are transformed by the cloud?
Cloud often implies agility, but sometimes security slows things down, how to fix that?
How do security needs change based on adoption architecture (cloud, hybrid with on-premise, multi-cloud, multi cloud with on-premise)?
From a security perspective, is there really any such thing as "lift and shift"?
How do we teach cloud to security leaders who "grew up" on-premise?

Resources:

Modern Threat Detection at Google Jun 07, 2021

Show notes

Guest:

Julien Vehent, Security Engineering Manager in the Detection and Response team @ Google

Topics:

What is special about detecting modern threats in modern environments?
How does the Google team turn the knowledge of threats into detection logic?
Run through an example of creating a detection for a new threat?
How do we test our detection rules?
We use the same people to write detections and to respond to resulting alerts, how is it working?
What are the key skills of good security analysts to build cloud threat detection?

Resources:

"Site Reliability Engineering" book (free)
"Building Secure & Reliable Systems" book (free)
"Securing DevOps" by our very guest Julien Vehent

Modern Data Security Approaches: Is Cloud More Secure? Jun 01, 2021

Show notes

Guests:

Tim Dierks, Engineering Director, Data Protection @ Google Cloud

Topics:

What are the key components of data security in the public cloud today?
Why do companies need specific data security plans and products?
Do you think Google Cloud today has enough controls for processing the most sensitive data?
Many organizations seem to be unaware of where sensitive data exists in their cloud environments, how do you think this problem will be fixed?
What is your view on encryption's role in future cloud security?
Do organizations mostly encrypt for security or for compliance?
How do we help companies navigate the tradeoffs between complying with nation-state regulations and best practices for availability?
I hear you are involved with some interesting key management innovations like HYOK via Cloud EKM, why do these matter for clients today?

Resources: