Cloud Security Podcast by Google

View Top 200 Chart

Back to Rankings Page

Technology
**Cloud Security Podcast by Google**

Cloud Security Podcast by Google focuses on security in the cloud, delivering security from the cloud, and all things at the intersection of security and cloud. Of course, we will also cover what we are doing in Google Cloud to help keep our users’ data safe and workloads secure.

We’re going to do our best to avoid security theater, and cut to the heart of real security questions and issues. Expect us to question threat models and ask if something is done for the data subject’s benefit or just for organizational benefit.

We hope you’ll join us if you’re interested in where technology overlaps with process and bumps up against organizational design. We’re hoping to attract listeners who are happy to hear conventional wisdom questioned, and who are curious about what lessons we can and can’t keep as the world moves from on-premises computing to cloud computing.

Latest Episodes:

Scaling Google Kubernetes Engine Security May 24, 2021

Show notes

Guest:

Greg Castle, Senior Staff Security Engineer at Google

Topics:

How is kubernetes security different from traditional host security?
What's different about securing GKE vs security Kubernetes on-prem?
Where does one start with security hardening for GKE?
In your view, what are top realistic threats to container deployments?
What do users get wrong most often?
Did we manage to make containers both more secure and more usable?

Making Compliance Cloud-native May 19, 2021

Show notes

Guest:

Zeal Somani, Security Solutions Manager @ Google Cloud, former PCI QSA

Topics:

What are the usable recipes for thinking about compliance in the cloud?
What regulations are more challenging for public cloud users?
How do you see the client/provider responsibility split for compliance?
What is this "shift left" for compliance?
How do we educate auditors and regulators who insist on 1980s solutions to 2020s problems?
What are the most popular mistakes and blind spots with trying to be compliant in the cloud?

Resources:

Whitepaper "Risk governance of digital transformation: guide for risk, compliance & audit teams"

Application Security in the Cloud May 10, 2021

Show notes

Guest:

Alyssa Miller, BISO @ S&P Global Ratings

Topics:

How do application security practices change as organizations launch their cloud transformations?
What bad things happen to you if you lift/shift your big applications to somebody's IaaS?
What unique challenges do containers and serverless deployments create for application security?
Is there good news here? How can cloud native technologies make application security easier than a traditional on-prem environment?
What can organizations do to ensure the security of cloud-based SaaS solutions?
How do DevOps and CI/CD impact the ability to secure cloud-based applications?
What is your advice to security leaders who still want to practice appsec for cloud apps in the same manner as they did it for on-premise, the old way?
What follow-up reading do you recommend on preparing for an application migration to Cloud?

Resources:

Threat Models and Cloud Security May 03, 2021

Show notes

Guest:

Seth Vargo, Security Engineer @ Google Cloud

Topics:

How should security teams change their thinking about threats in the cloud?
Where and when should an organization start in building their threat model for their cloud environment?
What are the key changes of threat models after cloud migration?
More specifically, when it comes to identity, credentials, lateral movement, what are the key ways in which cloud security differs from traditional or on-premises security?
How should users who are leading the cloud migration help their colleagues think about security in the cloud?
When am I "done" with cloud security planning?

Preparing for Cloud Migrations from a CISO Perspective, Part 2 Apr 26, 2021

Show notes

Guests:

Phil Venables (@philvenables), Vice President, Chief Information Security Officer (CISO) @ Google Cloud
Dave Hannigan, Director, Financial Services Security & Compliance @ Google Cloud

Topics:

To continue on the theme from Part 1, is "cloud-native" about thinking? Security tools? Systems? Architecture?
How do we practically help CISOs "speak cloud"?
What are the first steps to cloud thinking for an "on-premise CISO"?
What are the areas of security where it is easier to become a cloud-native?
How do you see a CISO transition journey from the on-premise thinking and technologies to cloud thinking and technology?
How are CISOs thinking about third party security controls vs native, cloud provider security controls?

Resources:

SIEM Modernization? Is That a Thing? Apr 19, 2021

Show notes

Guest:

Eric Foster, President at CYDERES, a Fishtech Group company

Topics:

How do you define "modern" SIEM?
Does modern SIEM always imply SaaS SIEM? Is there a future for on-premises SIEM?
What are your top 3 root causes for SIEM deployment failure today?
Modern or not, does SIEM have a future? Can XDR or some other technology drive it off the rails?
What features or inputs should SIEM have to detect modern threats such as those to cloud environments but also others?
What's different about threat detection in Cloud?
What is your view of the current frenzy about "AI"/ML for security?

Resources:

"Cyderes CNAP Makes SIEM Modernization a Snap"

Building a Third Party Platform for Cloud Security Apr 12, 2021

Show notes

Guest:

Avi Shua, CEO and Co-founder @ Orca Security

Topics:

Where do you spend more efforts, on detection of pre-fail issues (like configuration errors) or post-fail issues (like incidents)?
How do you prioritize the preventative and detective controls in your platform?
When talking to CISOs, how do you explain that cloud threat detection is different from the on-premise type?
In your opinion, are agents dead in the cloud?
Do you think your customers care more about cloud-specific threats or traditional threats against cloud assets?
How do you think about the tradeoff for security teams between using cloud native controls vs a 3rd party vendor like, say, you?

Resources:

"The Orca Security 2020 State of Public Cloud Security Report"

Zero Trust: Fast Forward from 2010 to 2021 Apr 01, 2021

Show notes

Guest:

John Kindervag, who is widely considered to be the creator of zero trust model in 2010 (currently works at ON2IT)

Topics:

What has changed in the world of zero trust since 2010?
What must be trusted for a zero trust (ZT) system to work?
What are key ZT project success pre-requisites?
What is the first step in ZT implementation that increases the chance of its success?
Is zero trust hard for most companies?
What's the most spectacular failure you've seen in a ZT project?
Where do you see ZT heading in the next 10+ years?

Resource:

John's original zero trust paper (2010)

No One Expects the Malware Inquisition Mar 24, 2021

Show notes

Guest:

Brandon Levene, Malware Inquisitor @ Google Cloud

Topics covered:

Which malware is scarier, state-sponsored or criminal?
How do we approach cybercrime mitigation at Google?
How do we actually track malware? Don't we need "attribution" for it?
What are the most useful telemetry sources for study in modern malware?
Does ransomware have a bright future?
Where do you see threat actors making the biggest investments?

Resource:

"Crimeware In The Modern Era" paper by Brandon Levene

Cloud Security Talks Summarized: A Recap Episode Mar 17, 2021

Show notes

Guests: no guests, just Tim and Anton

Topics covered:

Discussion of the interesting presentations from Cloud Security Talks Q1 2021 focused on trusted cloud, container security, cyber insurance, Chronicle, ML for network security, etc

Resources: