Cloud Security Podcast by Google

Guest: Merritt Baer , Field CTO,  Lacework, ex-AWS, ex-USG Topics: How can organizations ensure that their security posture is maintained or improved during a cloud migration? Is cloud migration a risk reduction move? What are some of the common security challenges that organizations face during a cloud migration? Are there different gotchas between the three public clouds? What advice would you g...

Guests: Emre Kanlikilicer , Senior Engineering Manager @ Google Sophia Gu , Engineering Manager at Google   Topics Workspace makes the claim that unlike other productivity suites available today, it's architectured for the modern threat landscape. That's a big claim! What gives Google the ability to make this claim? Workspace environments would have many different types of data, some very sensitiv...

Guest: Jason Solomon , Security Engineer, Google Topics: Could you share a bit about when you get pulled into incidents and what are your goals when you are? How does that change in the cloud? How do you establish a chain of custody and prove it for law enforcement, if needed? What tooling do you rely on for cloud forensics and is that tooling available to "normal people"?  How do we at Google kno...

Guest: Arie Zilberstein , CEO and Co-Founder at Gem Security Topics:   How does Cloud Detection and Response (CDR) differ from traditional, on-premises detection and response? What are the key challenges of cloud detection and response? Often we lift and shift our teams to Cloud, and not always for bad reasons, so  what's your advice on how to teach the old dogs new tricks: "on-premise-trained" D&...

Guest: Sandra Joyce , VP at Mandiant Intelligence Topics: Could you give us a brief overview of what this power disruption incident was about? This incident involved both Living Off the Land and attacks on operational technology (OT). Could you explain to our audience what these mean and what the attacker did here? We also saw a wiper used to hide forensics, is that common these days? Did the atta...

Guests: Derek Reveron , Professor and Chair of National Security at the US Naval War College John Savage , An Wang Professor Emeritus of Computer Science of Brown University Topics: You wrote a book on cyber and war , how did this come about and what did you most enjoy learning from the other during the writing process? Is generative AI going to be a game changer in international relations and war...

Guest: Mike Schiffman, Network Security "UTL" Topics: Given your impressive and interesting history, tell us a few things about yourself? What are the biggest challenges facing network security today based on your experience? You came to Google to work on Network Security challenges. What are some of the surprising ones you've uncovered here? What lessons from Google's approach to network security...

Guest: Kevin Mandia , CEO at Mandiant, part of Google Cloud Topics: When you look back, what were the most surprising cloud breaches in 2023, and what can we learn from them? How were they different from the "old world" of on-prem breaches?  For a long time it's felt like incident response has been an on-prem specialization, and that adversaries are primarily focused on compromising on-prem infras...

Guest: Michee Smith , Director, Product Management for Global Affairs Works, Google Topics: What is Google Annual Transparency Report and how did we get started doing this?  Surely the challenge of a transparency report is that there are things we can't be transparent about, how do we balance this? What are those? Is it a safe question? What Access Transparency Logs are and if they are connected t...

Guest: Monica Shokrai , Head Of Business Risk and Insurance For Google Cloud  Topics: Could you give us the 30 second run down of what cyber insurance is and isn't? Can you tie that to clouds? How does the cloud change it? Is it the case that now I don't need insurance for some of the "old school" cyber risks? What challenges are insurers facing with assessing cloud risks? On this show I struggle...

Guest: Dr Gary McGraw , founder of the Berryville Institute of Machine Learning Topics: Gary, you've been doing software security for many decades, so tell us: are we really behind on securing ML and AI systems?  If not SBOM for data or "DBOM", then what? Can data supply chain tools or just better data governance practices help? How would you threat model a system with ML in it or a new ML system...

Guests: John Stoner , Principal Security Strategist, Google Cloud Security Dave Herrald , Head of Adopt Engineering, Google Cloud Security Topics: In your experience, past and present, what would make clients trust vendor detection content? Regarding "canned", default or "out-of-the-box" detections, how to make them more production quality and not merely educational samples to learn from? What is...

Guest: Adrian Sanabria ,  Director of Valence Threat Labs at Valence Security , ex-analyst Topics: When people talk about "cloud security" they often forget SaaS, what should be the structured approach to using SaaS securely or securing SaaS? What are the incidents telling us about the realistic threats to SaaS tools? Is the Microsoft 365 breach a SaaS breach, a cloud breach or something else? Do...

Guest:  Kelli Vanderlee , Senior Manager, Threat Analysis, Mandiant at Google Cloud Topics: Can you really forecast threats? Won't the threat actors ultimately do whatever they want? How can clients use the forecast? Or as Tim would say it, what gets better once you read it? What is the threat forecast for cloud environments? It says "Cyber attacks targeting hybrid and multi-cloud environments wil...

Guest: Wei Lien Dang , GP at Unusual Ventures   Topics:   We have a view at Google that AI for security and security for AI are largely separable disciplines. Do you feel the same way? Is this distinction a useful one for you?  What are some of the security problems you're hearing from AI companies that are worth solving?  AI is obviously hot, and as always security is chasing the hotness. Where a...

Guest: Jay Thoden van Velzen , Strategic Advisor to the CSO, SAP   Topics: What are the challenges with shared responsibility for cloud security? Can you explain "shared" vs "separated" responsibility? In your article , you mention "shared faith", we have "shared fate" , but we never heard of shared faith. What is this? Can you explain? What about the cloud models (SaaS, PaaS, IaaS), how does this...

Guest: Kathryn Shih , Group Product Manager, LLM Lead in Google Cloud Security Topics: Could you give our audience the quick version of what is an LLM and what things can they do vs not do?  Is this "baby AGI" or is this a glorified "autocomplete"? Let's talk about the different ways to tune the models, and when we think about tuning what are the ways that attackers might influence or steal our da...

Guests: Tomer Schwartz, Dazz CTO Topics: It seems that in many cases the challenge with cloud configuration weaknesses is not their detection, but remediation, is that true? As far as remediation scope, do we need to cover  traditional vulnerabilities (in stock and custom code), configuration weaknesses and other issues too? One of us used to cover vulnerability management at Gartner, and in many...

Host: Stephanie Wong , Product Manager, Google Cloud Guests (yes, really, we are the guests!): Anton Chuvakin Tim Peacock Topics: Could you tell us how you ended up in security? What was the moment you realized that Cloud security was different from well, regular, security?   Anton is always asking this "3AM test", where did that come from? How do you source topics for the podcast? What advice wou...

Guest:  Jeremiah Kung , Global Head of Information Security, AppLovin Topics: Before we dive into all of the awesome cloud migrations you've experienced and your learnings there, could we start with a topic of East vs West CISO mentality? We are talking to more and more CISOs who see the cloud as a net win for security. What's your take on whether the cloud improves security?  We talked about doin...

Guest:  Andrew Hoying , Senior Security Engineering Manager @ Google Topics: What is different about system hardening today vs 20 years ago?  Also, what is special about hardening systems at Google massive scale? Can I just apply CIS templates and be done with it? Part of hardening has to be following up with developers after they have un-hardened things – how do we operationalize that at scale wi...

Guest: Chris Corde , Sr Director of Product Management - Security Operations, Google Cloud Topics: You cover many products, but let's focus on Chronicle today. An easy question: Chronicle isn't an XDR, so what is it? Since you've joined the team, what're you most proud of shipping to clients? Could you share more about the Mandiant acquisition,  what's been a happy surprise and what are you lookin...

Guest: Rosemary Wang , Developer Advocate at HashiCorp   Topics: Could you give us a 2 minute picture on what Terraform is, what stages of the cloud lifecycle it is relevant for, and how it intersects with security teams? How can Terraform be used for security automation? How should security teams work with DevOps teams to use it? What are some of the obvious and not so obvious security challenges...

Guests:  no guests, all banter, all very fun :-) Topics: How is Google Next this year? What is new in cloud security? Is Google finally a security vendor? What are some of the fun security presentations we've seen, including our own? Any impactful launches in security? What was the most interesting overall? Resources: "Next 2023 Special: Building AI-powered Security Tools - How Do We Do It?" (ep13...

Guest:  Eric Doerr , VP of Engineering, Google Cloud Security   Topics: You have a Next presentation on AI , what is the most exciting part for you? We care both about securing AI and using AI for security. How do you organize your thinking about it? Executive surveys imply that trusting an AI (for business) is still an issue. How can we trust AI for security? What does it mean to "trust AI" in th...