Cloud Security Podcast

Join your hosts, Anton Chuvakin and Timothy Peacock, as they talk with industry experts about some of the most interesting areas of cloud security. If you like having threat models questioned and a few bad puns, please tune in!

cloud-security-podcast_high_res.png

Episode list

#200
November 25, 2024

EP200 Zero Touch Prod, Security Rings, and Foundational Services: How Google Does Workload Security

Guest:

29:29

Topics covered:

  • “How Google protects its production services” paper covers how Google's infrastructure balances several crucial aspects, including security, reliability, development speed, and maintainability. How do you prioritize these competing demands in a real-world setting?
  • What attack vectors do you consider most critical in the production environment, and how has Google’s defenses against these vectors improved over time?
  • Can you elaborate on the concept of Foundational services and their significance in Google's security posture?
  • How does your security approach adapt to this vast spectrum of sensitivity and purpose of our servers and services, actually?
  • How do you implement this principle of zero touch prod for both human and service accounts within our complex infrastructure? 
  • Can you talk us through the broader approach you take through Workload Security Rings and how this helps?
#199
November 18, 2024

EP199 Your Cloud IAM Top Pet Peeves (and How to Fix Them)

Guests:

29:29

Topics covered:

  • What is your reaction to “in the cloud you are one IAM mistake away from a breach”? Do you like it or do you hate it? Or do you "it depends" it? :-)
  • Everyone's talking about how "identity is the new perimeter" in the cloud. Can you break that down in simple terms?
  • A lot of people say “in the cloud, you must do IAM ‘right’”. What do you think that means? What is the first or the main idea that comes to your mind when you hear it? 
  • What’s this stuff about  least-privilege and separation-of-duties being less relevant? Why do they matter in the cloud that changes rapidly?
  •  What are your IAM Top Pet Peeves?
#198
November 11, 2024

EP198 GenAI Security: Unseen Attack Surfaces & AI Pentesting Lessons

Guest:

29:29

Topics covered:

  • What are some of the unique challenges in securing GenAI applications compared to traditional apps?
  • What current attack surfaces are most concerning for GenAI apps, and how do you see these evolving in the future?
  • Do you have your very own list of top 5 GenAI threats? Everybody seem to!
  • What are the most common security mistakes you see clients make with GenAI?
  • Can you explain the main goals when trying to add automation to pentesting for next-gen GenAI apps? 
  • What are your AI testing lessons from clients so far?
#197
November 4, 2024

EP197 SIEM (Decoupled or Not), and Security Data Lakes: A Google SecOps Perspective

Guest:

  • Travis Lanham, Uber Tech Lead (UTL) for Security Operations Engineering, Google Cloud
29:29

Topics covered:

  • There’s been a ton of discussion in the wake of the three SIEM week about the future of SIEM-like products. We saw a lot of takes on how this augurs the future of disassembled or decoupled SIEMs. Can you explain what these disassembled SIEMs are all about?
  • What are the expected upsides of detaching your SIEM interface and security capabilities from your data backend?
  • Tell us about the early days of SecOps (nee Chronicle) and why we didn’t go with this approach?
  • What are the upsides of a tightly coupled datastore + security experience for a SIEM?
  • Are there more risks or negatives of the decoupled/decentralized approach?  Complexity and the need to assemble “at home” are on the list, right?
  • One of the 50 things Google knew to be true back in the day was that product innovation comes from technical innovation, what’s the technical innovation driving decoupled SIEMs?
  • So what about those security data lakes? Any insights?
#196
October 28, 2024

EP196 AI+TI: What Happens When Two Intelligences Meet?

Guest:

  • Vijay Ganti, Director of Product Management, Google Cloud Security
29:29

Topics covered:

  • What have been the biggest pain points for organizations trying to use threat intelligence (TI)?
  • Why has it been so difficult to convert threat knowledge into effective security measures in the past?
  • In the realm of AI, there's often hype (and people who assume “it’s all hype”). What's genuinely different about AI now, particularly in the context of threat intelligence?
  • Can you explain the concept of "AI-driven operationalization" in Google TI? How does it work in practice?
  • What's the balance between human expertise and AI in the TI process? Are there specific areas where you see the balance between human and AI involvement shifting in a few years?
  • Google Threat Intelligence aims to be different. Why are we better from client PoV?
#195
October 21, 2024

EP195 Containers vs. VMs: The Security Showdown!

Guests:

Cross-over hosts:

Guest:

41:00

Topics covered:

  • How would you approach answering the question ”what is more secure, container or a virtual machine (VM)?”
  • Could you elaborate on the real-world implications of this for security, and perhaps provide some examples of when one might be a more suitable choice than the other?
  • While containers boast a smaller attack surface (what about the orchestrator though?), VMs present a full operating system. How should organizations weigh these factors against each other?
  • The speed of patching and updates is a clear advantage of containers. How significant is this in the context of today's rapidly evolving threat landscape? Are there any strategies organizations can employ to mitigate the slower update cycles associated with VMs?
  • Both containers and VMs can be susceptible to misconfigurations, but container orchestration systems introduce another layer of complexity. How can organizations address this complexity and minimize the risk of misconfigurations leading to security vulnerabilities?
  • What about combining containers and VMs. Can you provide some concrete examples of how this might be implemented? What benefits can organizations expect from such an approach, and what challenges might they face?
  • How do you envision the security landscape for containers and VMs evolving in the coming years? Are there any emerging trends or technologies that could significantly impact the way we approach security for these two technologies?
#194
October 14, 2024

EP194 Deep Dive into ADR - Application Detection and Response

Guest:

29:29

Topics covered:

  • Why do we need Application Detection and Response (ADR)? BTW, how do you define it?
  • Isn’t ADR a subset of CDR (for cloud)?  What is the key difference that sets ADR apart from traditional EDR and CDR tools?
  • Why can’t I just send my application data - or eBPF traces - to my SIEM and achieve the goals of ADR that way?
  • We had RASP and it failed due to instrumentation complexities. How does an ADR solution address these challenges and make it easier for security teams to adopt and implement?
  • What are the key inputs into an ADR tool?
  • Can you explain how your ADR correlates cloud, container, and application contexts to provide a better  view of threats? Could you share real-world examples of types of badness solved for users?
  • How would ADR work with other application security technologies like DAST/SAST, WAF and ASPM?
  • What are your thoughts on the evolution of ADR?
#193
October 7, 2024

EP193 Inherited a Cloud? Now What? How Do I Secure It?

Guests:

29:29

Topics covered:

  • There is a common scenario where security teams are brought in after a cloud environment is already established. From your experience, how does this late involvement typically impact the organization's security posture and what are the immediate risks they face?
  • Upon hearing this, many experts suggest that “burn the environment with fire” or “nuke it from orbit” are the only feasible approaches? What is your take on that suggestion?
  • On the opposite side, what if business demands you don't  touch anything but “make it secure” regardless?
  • Could you walk us through some of the first critical steps you do after “inheriting a cloud” and why they are prioritized in this way?
  • Why not just say “add MFA everywhere”? What may or will blow up?
  • We also say “address overly permissive users and roles” and this sounds valuable, but also tricky. How do we go about it?
  • What are the chances that the environment is in fact compromised already? When is Compromise Assessment the right call, it does cost money, right?
  • How do you balance your team’s current priorities when you’ve just adopted an insecure cloud environment. How do you make tradeoffs among your existing stack and this new one?
#192
September 30, 2024

EP192 Confidential + AI: Can AI Keep a Secret?

Guest:

  • Nelly Porter, Director of PM, Cloud Security at Google Cloud

Topics:

Voices
29:29

Topics covered:

  • Share your story and how you ended here doing confidential AI at Google?
  • What problem does confidential compute + AI solve and for what clients?
  • What are some specific real-world applications or use cases where you see the combination of AI and confidential computing making the most significant impact?
  • What about AI in confidential vs AI on prem? Should those people just do on-prem AI instead?
  • Which parts of the AI lifecycle need to be run in Confidential AI: Training? Data curation? Operational workloads?
  • What are the performance (and thus cost) implications of running AI workloads in a confidential computing environment?
  • Are there new risks that arise out of confidential AI?
#191
September 23, 2024

EP191 Why Aren't More Defenders Winning? Defender’s Advantage and How to Gain it!

Guest:

29:29

Topics covered:

  • What is the Defender’s Advantage and why did Mandiant decide to put this out there?
  • This is the second edition. What is different about DA-II?
  • Why do so few defenders actually realize their Defender’s Advantage? 
  • The book talks about the importance of being "intelligence-led" in cyber defense. Can you elaborate on what this means and how organizations can practically implement this approach?
  • Detection engineering is presented as a continuous cycle of adaptation. How can organizations ensure their detection capabilities remain effective and avoid fatigue in their SOC?  
  • Many organizations don’t seem to want to make detections at all, what do we tell them?
  • What is this thing called “Mission Control”- it sounds really cool, can you explain it?