Cloud Security Podcast by Google

Guest: Phil Venables ( @philvenables ), Vice President, Chief Information Security Officer (CISO) @ Google Cloud Topics: Why is AI a game-changer for security? Can we even have game-changers in cyber security? Is it more detection or is it more reducing toil and making humans more productuve? What are you favorite AI for security use cases? What "AI + security" issue makes you  - a classic CISO qu...

Guest:  Steph Hay , Director of UX, Google Cloud Security Topics: The importance of User Experience (UX) in security is so obvious – though it isn't to a lot of people! Could we talk about the importance of UX in security? UX and security in general have an uneasy relationship, and security is harmed by bad UX, it also feels like bad UX can be a security issue. What is your take on this? How do yo...

Guest:  Steve McGhee , Reliability Advocate at Google Cloud  Aron Eidelman , Developer Relations Engineer at Google Cloud Topics: What is the shared problem for SRE and security when it comes to alerting? Why is there reluctance to reduce noise? How do SREs, security practitioners, and other stakeholders define "incident" and "risk"? How does involving an "adversary" change the way people think ab...

Guest: Kelly Shortridge , Senior Principal Engineer in the Office of the CTO at Fastly Topics:  So what is Security Chaos Engineering? "Chapter 5. Operating and Observing" is Anton's favorite. One thing that mystifies me, however, is that you outline how to fail with alerts (send too many), but it is not entirely clear how to practically succeed with them? How does chaos engineering help security...

Guests: Himanshu Khurana, Engineering Manager, Google Cloud Rahul Gupta, Product Manager for Assured OSS, Google Cloud Topics: For the software you're supporting in Assured Open Source your team discovered 50% of the CVEs reported in them this year. How did that happen?  So what is Assured Open Source ? Do we really guarantee its security? What does "guarantee" here mean? What're users actually pa...

Guest:  Steve Riley , Field CTO, Netskope, ex-Gartner Research VP Topics: Analysts (well, like Steve and Anton in the past?) say that "cloud is secure, but clients just aren't using it securely", what is your reaction to this today? When clients hear "use cloud securely", what do you think comes to their minds? How would you approach planning for secure use of the cloud or using cloud securely? Wh...

Guest: Rick Doten , VP, Information Security at Centene Corporation, CISO Carolina Complete Health   Topics:   What are the realistic cloud risks today for an organization using public cloud?  Is the vendor lock-in on that list?  What other risks everybody thinks are real, but they are not? What do you tell people who in 2023 still think "they can host Exchange better themselves" and have silly cl...

Guest:  John Doyle , Principle Intelligence Enablement Consultant at Mandiant / Google Cloud   Topics: You have created a new intelligence class focused on building enterprise threat intelligence capability , so what is the profile of an organization and profile for a person that benefits the most from the class? There are many places to learn threat intel (TI), what is special about your new clas...

Guest: Ian Glazer , founder at Weave Identity, ex-Gartner, ex-SVP of Products at Salesforce, co-founder of IDPro Topics: OK, tell us why Identity and Access Management (IAM) is exciting (is it exciting?) Could you also explain why IAM is even more exciting in the cloud?  Are you really "one IAM mistake away from a breach" in the cloud?  What advice would you give to someone new to IAM? How to not...

Guests:  Dominik Richter , the founder and head of product at Mondoo Cooked questions: What is a policy, is that the same as a control, or is there a difference? And what's the gap between a policy and a guardrail?  We have IaC, so what is this Policy as Code? Is this about security policy or all policies for cloud? Who do I hire to write and update my policy as code? Do I need to be a coder to cr...

Guest: David Swift, Security Strategist at Netenrich Topics: Which old Security Information and Event Management (SIEM) lessons apply today? Which old SIEM lessons absolutely do not apply today and will harm you? What are the benefits and costs of SIEM in 2023? What are the top cloud security use cases for SIEM in 2023? What are your favorite challenges with SIEM in 2023 special in the cloud? Are...

Guest: Panos Mavrommatis , Senior Engineering Director at Google Cloud Topics: Could you give us the 30 second overview of our favorite "billion user security product" - SafeBrowsing - and, since you were there, how did it get started? SafeBrowsing is a consumer and business product – are you mitigating the same threats and threat models on each side? Making this work at scale can't be easy, anyti...

Guest: Jack Naglieri , Founder and CEO at Panther Topics: What is good detection, defined at micro-level for a rule or a piece of detection content?  What is good detection, defined at macro-level for a program at a company?  How to reliably produce good detection content at scale? What is a detection content lifecycle that reliably produces good detections at scale? What is the purpose of a SIEM...

Guest: Michele Chubirka , Senior Cloud Security Advocate, Google Cloud Topics: So, if somebody wakes you up at 3AM ("Anton's 3AM test") and asks "Do we need firewalls in the cloud?" what would you say? Firewalls (=virtual appliances in the cloud or routing cloud traffic through physical firewalls) vs firewalling (=controlling network access) in the cloud, do they match the cloud-native realities?...

Guests:  Nelly Porter , Group Product Manager, Google Cloud Rene Kolga , Senior Product Manager, Google Cloud Topics: Could you remind our listeners what confidential computing is? What threats does this stop? Are these common at our clients?  Are there other use cases for this technology like compliance or sovereignty? We have a new addition to our Confidential Computing family - Confidential Spa...

Guest: Jeff Reed, VP of Product,  Cloud Security @ Google Cloud Topics: You've had a long career in software and security, what brought you to Google Cloud Security for this role? How do you balance the needs of huge global financials that often ask for esoteric controls (say EKM with KAJ ) vs the needs of SMBs that want easy yet effective, invisibility security ? We've got an interesting split wi...

Guest: Connie Fan , Senior Product and Business Strategy Lead, Google Cloud Topics: We were at RSA 2023, what did we see that was notable and surprising? Cloud security showed up with three startups with big booths, and one big player with a small demo station. What have we learned here? What visitors might have seen at the Google Cloud booth that we're really excited about? Could you share why we...

Guests:   Shanyn Ronis , Head of the Mandiant Communication Center John Miller ,   Head of Mandiant Intelligence Analysis Topics: It seems like we're seeing more cyber activity taking place in the context of geopolitical events. A lot of organizations struggle to figure out if/how to respond to these events and any related cyber activity.  What advice do you have for these organizations and their...

Guest: Maxime Lamothe-Brassard ,  Founder @ LimaCharlie Topics: What does an engineering-centric approach to cybersecurity mean? What to tell people who want to "consume" rather than "engineer" security? Is "engineering-centric" approach the same as evidence-based or provable?  In practical terms, what does it mean to adopt an "engineering-centric approach" to cybersecurity for an organization?  H...

Guest: Isaac Hepworth , PM focused on Software Supply Chain Security @ Google Cooked questions: Why is everyone talking about SBOMs all of a sudden? Why does this matter to a typical security leader? Some software vendors don't want SBOM, and this reminds us of the food safety rules debates in the past, how does this analogy work here? One interesting challenge in the world of SBOMs and unintended...

Guest:  Rafal Los , Head of Services Strategy @ Extrahop and Founder of Down the Security Rabbit Hole podcast Topics: You had a very fun blog where you reminded the world that many organizations still approach cloud as a rented data center, do you still see it now? Do you think this will persist for 3, 5, 10 years? Other than microservices, what're the most important differences between public clo...

Guest: Chris John Riley , Senior Security Engineer and a Technical Debt Corrector  @ Google   Topics: We've heard of MVP, what is MVSP or Minimal Viable Secure Product? What problem is MVSP trying to solve for the industry, community, planet, etc? How does MVSP actually help anybody? Who is the MVSP checklist for? Leaders or engineers? How does MVSP differ from compliance standards like ISO 27001,...

Guest:  Martin Roesch , CEO at Netography , creator of Snort Topics: What is the role of network security in the public cloud? Networks used to be the perimeter, now we have an API and identity driven perimeter. Are networks still relevant as a layer of defense? We often joke that "you don't need to get your firewalls with you to the cloud", is this really true? How do you do network access contro...

Guest:  Charles DeBeck , Cyber Threat Intel Expert @ Google Cloud Topics: What is unique about Google Cloud approach to threat intelligence? Is it the sensor coverage? Size of the team? Other things? Why is Threat Horizons report unique among the threat reports released by other organizations? Based on your research, what are the realistic threats to cloud environments today? What threats are prev...

Guest:  Brandon Evans , Infosec Consultant and Certified Instructor and Course Author at SANS Topics: What got you interested in security and motivated you to make this your area of focus? You came from a developer background, right? Occasionally, we hear the sentiment that "developers don't care about security," how would you counter it (and would you?)? How do we encourage developers and operati...