Join your hosts, Anton Chuvakin and Timothy Peacock, as they talk with industry experts about some of the most interesting areas of cloud security. If you like having threat models questioned and a few bad puns, please tune in!
Ransomware has become a pervasive threat. Could you provide us with a brief overview of the current ransomware landscape?
It's often said that ransomware is driven by pure profit. Can you remind us of the business model of ransomware gangs, including how they operate, their organizational structures, and their financial motivations?
Ransomware gangs are becoming increasingly aggressive in their extortion tactics. Can you shed some light on these new tactics, such as data leaks, DDoS attacks, and threats to contact victims' customers or partners?
What specific challenges and considerations arise when dealing with ransomware in cloud environments, and how can organizations adapt their security strategies to mitigate these risks?
What are the key factors to consider when deciding whether or not to pay the ransom?
What is the single most important piece of advice you would give to organizations looking to bolster their defenses against ransomware?
We are getting a bit annoyed about the fear-mongering on “oh, but attackers will use AI.” You are a threat analyst, realistically, how afraid are you of this?
The report discusses the threat of compromised identities in hybrid environments (aka “no matter what you do, and where, you are hacked via AD”). What steps can organizations take to mitigate the risk of a single compromised identity leading to a significant security breach? Is this expected to continue?
Is zero-day actually growing? The report seems to imply that, but aren’t “oh-days” getting more expensive every day?
Many organizations still lag with detection, in your expertise, what approaches to detection actually work today? It is OK to say ”hire Managed Defense”, BTW :-)
We read the risk posed by the "Big Four" sections and they (to us) read like “hackers hack” and “APTs APT.” What is genuinely new and interesting here?
Why is our industry suddenly obsessed with resilience? Is this ransomware’s doing?
How did the PCAST report come to be? Can you share the backstory and how it was created?
The PCAST report emphasizes the importance of leading indicators for security and resilience. How can organizations effectively shift their focus from lagging indicators to these leading indicators?
The report also emphasizes the importance of "Cyber-Physical Modularity" - this sounds mysterious to us, and probably our listeners! What is it and how does this concept contribute to enhancing the resilience of critical infrastructure?
The report advocates for regular and rigorous stress testing. How can organizations effectively implement such stress testing to identify vulnerabilities and improve their resilience?
In your opinion, what are the most critical takeaways from our PCAST-related paper for organizations looking to improve their security and resilience posture today?
What are some of the challenges organizations might face when implementing the PCAST recommendations, and how can they overcome these challenges?
Do organizations get resilience benefits “for free” by using Google Cloud?
Let’s talk about cloud security shared responsibility. How to separate the blame? Is there a good framework for apportioning blame?
You've introduced the Cloud Shared Irresponsibilities Model, stating cloud providers will be considered partially responsible for breaches even if due to customer misconfigurations. How do you see this impacting the relationship between cloud providers and their customers? Will it lead to more collaboration or more friction?
We both know the Jay Heiser 2015 classic “cloud is secure, but you not using it securely.” In your view, what does “use cloud securely” mean for various organizations today?
Here is a very painful question: how to decide what cloud security should be free with cloud and what security can be paid?
You dealt with cloud security for a long time, what is your #1 lesson so far on how to make the cloud more secure or use the cloud more securely?
What is the best way to learn how to cloud? What is this CloudSLAW thing?
I learned that you have a really cool title that feels very “now” - Chief Secure Technology Officer? What’s the story here? Weirdly, I now feel that every CTO better be a CSTO or quit their job :-)
After, ahem, not-so-recent events you had a chance to rebuild a lot of your stack, and in the process improve security. Can you share how it went, and what security capabilities are now built in?
How much of a culture change did that require? Was it purely a technological transformation or you had to change what people do and how they do it?
Would you recommend this to others (not the “recent events experience”, but the rebuild approach)? What benefits come from doing this before an incident occurs? Are there any?
How are you handling telemetry collection and observability for security in the new stack? I am curious how this was modernized
Cloud is simple, yet also complex, I think you called it “simplex.” How does this concept work?
“How Google protects its production services” paper covers how Google's infrastructure balances several crucial aspects, including security, reliability, development speed, and maintainability. How do you prioritize these competing demands in a real-world setting?
What attack vectors do you consider most critical in the production environment, and how has Google’s defenses against these vectors improved over time?
Can you elaborate on the concept of Foundational services and their significance in Google's security posture?
How does your security approach adapt to this vast spectrum of sensitivity and purpose of our servers and services, actually?
How do you implement this principle of zero touch prod for both human and service accounts within our complex infrastructure?
Can you talk us through the broader approach you take through Workload Security Rings and how this helps?
What is your reaction to “in the cloud you are one IAM mistake away from a breach”? Do you like it or do you hate it? Or do you "it depends" it? :-)
Everyone's talking about how "identity is the new perimeter" in the cloud. Can you break that down in simple terms?
A lot of people say “in the cloud, you must do IAM ‘right’”. What do you think that means? What is the first or the main idea that comes to your mind when you hear it?
What’s this stuff about least-privilege and separation-of-duties being less relevant? Why do they matter in the cloud that changes rapidly?
EP197 SIEM (Decoupled or Not), and Security Data Lakes: A Google SecOps Perspective
Guest:
Travis Lanham, Uber Tech Lead (UTL) for Security Operations Engineering, Google Cloud
29:29
Topics covered:
There’s been a ton of discussion in the wake of the three SIEM week about the future of SIEM-like products. We saw a lot of takes on how this augurs the future of disassembled or decoupled SIEMs. Can you explain what these disassembled SIEMs are all about?
What are the expected upsides of detaching your SIEM interface and security capabilities from your data backend?
Tell us about the early days of SecOps (nee Chronicle) and why we didn’t go with this approach?
What are the upsides of a tightly coupled datastore + security experience for a SIEM?
Are there more risks or negatives of the decoupled/decentralized approach? Complexity and the need to assemble “at home” are on the list, right?
One of the 50 things Google knew to be true back in the day was that product innovation comes from technical innovation, what’s the technical innovation driving decoupled SIEMs?
So what about those security data lakes? Any insights?
