Cloud Security Podcast
Episodes About Subscribe Voices Topics

Cloud Security Podcast

Join your hosts, Anton Chuvakin and Timothy Peacock, as they talk with industry experts about some of the most interesting areas of cloud security. If you like having threat models questioned and a few bad puns, please tune in!

cloud-security-podcast_high_res.png

Episode list

#179
July 1, 2024

EP179 Teamwork Under Stress: Expedition Behavior in Cybersecurity Incident Response

Guest:

Topics:

How Google Does
27:27

Topics covered:

  • You talk about “teamwork under adverse conditions” to describe expedition behavior (EB). Could you tell us what it means?
  • You have been involved in response to many high profile incidents, one of the ones we can talk about publicly is one of the biggest healthcare breaches at this time. Could you share how Expedition Behavior played a role in our response?  
  • Apart from during incident response which is almost definitionally an adverse condition, how else can security teams apply this knowledge?
  • If teams are going to embrace an expeditionary behavior mindset, how do they learn it? It’s probably not feasible to ship every SOC team member off to the Okavango Delta for a NOLS course. Short of that, how do we foster EB in a new team?
  • How do we create it in an existing team or an under-performing team?

Resources:

Read More
#178
June 24, 2024

EP178 Meet Brandon Wood: The Human Side of Threat Intelligence: From Bad IP to Trafficking Busts

Guest:

Topics:

Voices Threat Intelligence
32:31

Topics covered:

  • Threat intelligence is one of those terms that means different things to everyone–can you tell us what this term has meant in the different contexts of your career?  What do you tell people who assume that “TI = lists of bad IPs”?
  • We heard while prepping for this show that you were involved in breaking up a human trafficking ring: tell us about that!
  • In Anton’s experience, a lot  of cyber TI is stuck in “1. Get more TI 2. ??? 3. Profit!” How do you move past that?
  • One aspect of threat intelligence that’s always struck me as goofy is the idea that we can “monitor the dark web” and provide something useful. Can you change my mind on this one?
  • You told us your story of getting into sales, you recently did a successful rotation into the role of Product Manager,, can you tell us about what motivated you to do this and what the experience was like?
  • Are there other parts of your background that inform the work you’re doing and how you see yourself at Google? 
  • How does that impact our go to market for threat intelligence, and what’re we up to when it comes to keeping the Internet and broader world safe?

Resources:

Read More
#177
June 17, 2024

EP177 Cloud Incident Confessions: Top 5 Mistakes Leading to Breaches from Mandiant

Guest:

Topics:

Cloud IR and Forensics
29:29

Topics covered:

  • Most organizations you see use both cloud and on-premise environments. What are the most common challenges organizations face in securing their hybrid cloud environments?
  • You do IR so in your experience, what are top 5  mistakes organizations make that lead to cloud incidents?
  • How and why do organizations get the attack surface wrong? Are there pillars of attack surface?
  • We talk a lot about how IAM matters in the cloud.  Is that true that AD is what gets you in many cases even for other clouds?
  • What is your best cloud incident preparedness advice for organizations that are new to cloud and still use on-prem as well?

Resources:

Read More
#176
June 10, 2024

EP176 Google on Google Cloud: How Google Secures Its Own Cloud Use

Guest:

  • Seth Vargo, Principal Software Engineer responsible for Google's use of the public cloud, Google

Topics:

Cloud Posture and Hygiene Cloud Security Practices How Google Does
23:29

Topics covered:

  • Google uses the public cloud, no way, right? Which one? Oh, yeah, I guess this is obvious: GCP, right?
  • Where are we like other clients of GCP?  Where are we not like other cloud users?
  • Do we have any unique cloud security technology that we use that others may benefit from?
  • How does our cloud usage inform our cloud security products?
  • So is our cloud use profile similar to cloud natives or traditional companies?
  • What are some of the most interesting cloud security practices and controls that we use that are usable by others?
  • How do we make them work at scale? 

Resources:

Read More
#175
June 3, 2024

EP175 Meet Crystal Lister: From Public Sector to Google Cloud Security and Threat Horizons

Guest:

Topics:

Voices Threat Intelligence
29:29

Topics covered:

  • Your background can be sheepishly called “public sector”, what’s your experience been transitioning from public to private? How did you end up here doing what you are doing?
  • We imagine you learned a lot from what you just described – how’s that impacted your work at Google?
  • How have you seen risk management practices and outcomes differ?
  • You now lead Google Threat Horizons reports, do you have a vision for this? How does your past work inform it?
  • Given the prevalence of ransomware attacks, many organizations are focused on external threats. In your experience, does the risk of insider threats still hold significant weight? What type of company needs a dedicated and separate insider threat program?

Resources:

Read More
#174
May 27, 2024

EP174 How to Measure and Improve Your Cloud Incident Response Readiness: A New Framework

Guest:

Angelika Rohrer, Sr. Technical Program Manager, Cyber Security Response at Alphabet

Topics:

Cloud IR and Forensics How Google Does
29:29

Topics covered:

  • Incident response (IR) is by definition “reactive”, but ultimately incident prep determines your IR success. What are the broad areas where one needs to prepare?
  • You have created a new framework for measuring how ready you are for an incident, what is the approach you took to create it?
  • Can you elaborate on the core principles behind the Continuous Improvement (CI) Framework for incident response?
  • Why is continuous improvement crucial for effective incident response, especially in cloud environments? Can’t you just make a playbook and use it?
  • How to overcome the desire to focus on the easy metrics and go to more valuable ones?
  • What do you think Google does best in this area?
  • Can you share examples of how the CI Framework could have helped prevent or mitigate a real-world cloud security incident?
  • How can other organizations practically implement the CI Framework to enhance their incident response capabilities after they read the paper?

Resources:

Read More
#173
May 17, 2024

EP173 SAIF in Focus: 5 AI Security Risks and SAIF Mitigations

Guest:

Topics:

Artificial Intelligence How Google Does
27:23

Topics covered:

  • What are the unique challenges when securing AI for cloud environments, compared to traditional IT systems?
  • Your talk covers 5 AI risks, why did you pick these five? What are the five, and are these the worst?
  • Some of the mitigation seem the same for all risks. What are the popular SAIF mitigations that cover more of the risks?
  • Can we move quickly and securely with AI? How?
  • What future trends and developments do you foresee in the field of securing AI for cloud environments, and how can organizations prepare for them?
  • Do you think in 2-3 years AI security will be a separate domain or a part of … application security? Data security? Cloud security?

Resources:

Read More
#172
May 13, 2024

EP172 RSA 2024: Separating AI Signal from Noise, SecOps Evolves, XDR Declines?

Guest:

none

Topics:

Cloud Security Practices
27:23

Topics covered:

  • What have we seen at RSA 2024?
  • Which buzzwords are rising (AI! AI! AI!) and which ones are falling (hi XDR)?
  • Is this really all about AI? Is this all marketing?
  • Security platforms or focused tools, who is winning at RSA?
  • Anything fun going on with SecOps?
  • Is cloud security still largely about CSPM?
  • Any interesting presentations spotted?

Resources:

Read More
#171
May 6, 2024

EP171 GenAI in the Wrong Hands: Unmasking the Threat of Malicious AI and Defending Against the Dark Side

Guest:

Topics:

Artificial Intelligence
29:29

Topics covered:

  • Given your experience, how afraid or nervous are you about the use of GenAI by the criminals (PoisonGPT, WormGPT and such)?
  • What can a top-tier state-sponsored threat actor do better with LLM? Are there “extra scary” examples, real or hypothetical?
  • Do we really have to care about this “dangerous capabilities” stuff (CBRN)? Really really?
  • Why do you think that AI favors the defenders? Is this a long term or a short term view?
  • What about vulnerability discovery? Some people are freaking out that LLM will discover new zero days, is this a real risk?

Resources:

Read More
#170
April 29, 2024

EP170 Redefining Security Operations: Practical Applications of GenAI in the SOC

Guest:

Topics:

SIEM and SOC
29:29

Topics covered:

  • What are the different use cases for GenAI in security operations and how can organizations  prioritize them for maximum impact to their organization?
  • We’ve heard a lot of worries from people that GenAI will replace junior team members–how do you see GenAI enabling more people to be part of the security mission?
  • What are the challenges and risks associated with using GenAI in security operations?
  • We’ve been down the road of automation for SOCs before–UEBA and SOAR both claimed it–and AI looks a lot like those but with way more matrix math-what are we going to get right this time that we didn’t quite live up to last time(s) around?
  • Imagine a SOC or a D&R team of 2029. What AI-based magic is routine at this time? What new things are done by AI? What do humans do?

Resources:

Read More