Cloud Security Podcast by Google

Guests: John Speed Meyers, Security Data Scientist, Chainguard Todd Kulesza, User Experience Researcher, Google Topics: How did you get involved with this year's Accelerate State of DevOps Report (DORA report)? So what is DORA and why did you decide to focus on supply chain security for the 2022 report? What are the big learnings from this year's report? What's the difference between SLSA and SSDF? Is one spicy and the other savory? How're companies adopting these and how is adoption going? Are there other areas that DevOps can be a contributor in the overall security landscape? How can CISOs rope DevOps fully into their security gang? Operationally, how should security and developers and DevOps come together to keep vulnerabilities out in the first place? How should security and developers and DevOps come together to respond quickly to vulnerabilities when they're discovered? How do security and developers and DevOps come together to prove to their auditors and customers that they're doing a good job of the above? Resources: 2022 Accelerate State of DevOps Report "New insights for defending the software supply chain" blog (and new report) SLSA.dev site Secure Software Development Framework at NIST "Linking Up The Pieces: Software Supply Chain Security at Google and Beyond" (ep24) "Sharing The Mic In Cyber with STMIC Hosts Lauren and Christina: Representation, Psychological Safety, Security" (ep92) Go vulncheck tool "Reflections on Trusting Trust" paper (1984)

Guests: Nikhil Sinha, Group Product Manager, Workspace Security Kelly Anderson, Product Marketing Manager, Workspace Security Topics: We are talking about Google Workspace security today. What kinds of threats do we have to care about here? Are there compliance-related motivations for security here too? Is compliance in the cloud changing? How's adoption of hardware keys for MFA going for your users, and how are you helping them? Is phishing finally solved because of that? Can you explain why hardware security FIDO/WebAuthn is such a step function compared to, say, RSA number generator tokens? Have there been assumptions in the Workspace security model we had to change because of WFH? And what changes with RTO and permanent hybrid? Resources: Google BeyondCorp Enterprise "Make zero trust a reality with Google Workspace security solutions" Next 2022 video "2021: Phishing is Solved?" (ep40) "Zero Trust: Fast Forward from 2010 to 2021" (ep8)

Guests: Matt Linton, Chaos Specialist @ Google John Stone, Chaos Coordinator @ Office of the CISO, Google Cloud Topics: Let's talk about security incident response in the cloud. Back in 2014 when I [Anton] first touched on this, the #1 challenge was getting the data to investigate as cloud providers had few logs available. What are the top 2022 cloud incident response challenges? Does cloud change the definition of a security incident? Is "exposed storage bucket" an incident? Is vulnerability an incident in the cloud? What should I have in my incident response plans for the cloud? Should I have a separate cloud IR plan? What is our advice on running incident response jointly with a CSP like us? How would 3rd party firms (like, well, Mandiant) work with a client and a CSP during an investigation? We all read the Threat Horizons reports, but can you remind us of the common causes for cloud incidents we observed recently? What goals do the attackers typically pursue there? Resources: "Building Secure and Reliable Systems" book (especially ch 14-16, and ch17) Google Cybersecurity Action Team Threat Horizons Report #4 Is Out! (#3, #2, #1) "Incident Plan vs Incident Planning?" blog (2013)

Guest: Greg Sinclair, Security Engineer @ Google Cloud Topics: Could you tell us a bit about your background and how you ended up here at Google? Also, tell us about your team here? We're very excited about the release of the CobaltStrike rules. Could you share more about what they are looking for and second why this is so valuable? How did CobaltStrike come to be so widely used by bad guys? When you were doing this research what was the most surprising thing you uncovered? Could you tell us about the coordinated disclosure aspects of this work? In the past you've contributed research to our Threat Horizons reports, could you tell us about that? Resources: Making CobaltStike harder for threat actors to abuse blog CobaltStrike YARA-L rules CobaltStrike site "Cobalt Strike Usage Explodes Among Cybercrooks" Google Cybersecurity Action Team Threat Horizons Report #4 Is Out! Detection as Code? No, Detection as COOKING!

Guest: Jeff Bollinger, Director of Incident Response and Detection Engineering @ Linkedin Topics: Observability sounds cool (please define it for us BTW), but relating it to security has been "hand-wavy" at best. What is your opinion on the relevance of observability data for security use cases? What use cases are those, apart from saving the data for IR just in case? How can we best approach observability in the cloud, particularly around network communications, so that we improve security as a result? Are there other areas of cloud where observability might be more relevant? Does the massive shift to TLS 1.3 impact this? If the Internet is shifting towards an end-user/device centric model with everything as a service (SaaS), how does security monitoring even work anymore? Does it mean the end of both endpoint and network eras and the arrival of the application security monitoring era? Can we do deep monitoring of complex applications and app clusters for abuse or should we just focus on identity and profiling? Resources: "Instrumenting Modern Application Stack for Detection and Response" (ep34) "Crafting the InfoSec Playbook: Security Monitoring and Incident Response Master Plan" by Jeff Bollinger, Brandon Enright, Matthew Valites (book) RFC 7258 Pervasive Monitoring Is an Attack RFC 8890 Internet is for end users "(Re)building Threat Detection and Incident Response at LinkedIn" "Martian Chronicles" by Ray Bradberry (because migrating to cloud is like flying to Mars)

Guests: Alijca Cade, Director, Financial Services, Office of the CISO, Google Cloud Ken Westin, Director, Security Strategy, Cybereason Robert Wallace, Senior Director, Mandiant, now Google Cloud Topics: How are cloud environments attacked and compromised today? Is it still about the configuration mistakes? Do cryptominers represent a serious threat now that they are often mentioned as the most common threat in the cloud? Let's look at another popular threat - ransomware or, broadly, RansomOps. Based on your research, what can we say about its likely future, especially in the cloud? Are we getting better with detection in the cloud and are we doing it fast enough? Is cloud security a misnomer? Attackers are out to get into an organization, and cloud or on-premise matters less here, right? What does it say about the interdependence of security, on and off cloud? Resources: LIVE @ Security Talks: The Cloud Security Podcast at Cloud Security Talks Q3 2022 Google Cybersecurity Action Team Threat Horizons Report #4 Is Out!

Guest: Dr Anna Belak, Director of Thought Leadership at Sysdig, former Gartner analyst Questions: Analysts (and vendors) coined a log of "C-something acronyms" for cloud security, and two of the people on this episode were directly involved in some of them. What do you make of all the cloud security acronym proliferation? What is CSPM? What gets better when you deploy it? What is CWPP? Does anything get better when you deploy it? What is CNAPP? What gets better when you deploy it? What is CIEM, Anton's least fave acronym? Now, what about CDR? Resources: Gartner acronym glossary "Container Security: The Past or The Future?" (ep54, with Anna as well) "Automate and/or Die?" (ep3) "Impersonating Service Accounts in GCP and Beyond: Cloud Security Is About IAM?" (ep60) "Powering Secure SaaS … But Not with CASB? Cloud Detection and Response?" (ep76) "Does the World Need Cloud Detection and Response (CDR)?" "Announcing Virtual Machine Threat Detection now generally available to Cloud customers" Sysdig Threat Report Blog 2022 Sysdig Cloud-Native Threat Report Anatomy of Cloud Attacks

Guest: Alicja Cade, Director for Financial Services, Office of the CISO, Google Cloud Topics: We are talking about your journey as a CISO migrating to the cloud. Could you give us the overview of … What triggered your organization's migration to the cloud? When did you and the security team get brought in? Did you take going to the cloud as an opportunity to change things beyond the tools you were using? As you got going into the cloud, what was the hardest part for your organization? If that was hardest, what was most surprising? Good surprise and bad surprise? How did you design security controls for the cloud? How do you validate and verify security controls in the cloud? How did you keep both security practitioners and the rest of your IT teams from lift-and-shift thinking? Did your data security practice change? Having covered all that tactical terrain, one final strategic question: is moving to the cloud a net risk reduction? Can it be? Resources: "CISO Walks Into the Cloud: Frustrations, Successes, Lessons ... And Does the Risk Change?" (ep80) "Visualizing Google Cloud: 101 Illustrated References for Cloud Engineers and Architects" by Priyanka Vergadia "Cyberpolitics in International Relations" book CSA CCM v4 Cyber Risk Institute "Modernize Data Security with Autonomic Data Security Approach" (ep79) and the paper on autonomic data security. "Preparing for Cloud Migrations from a CISO Perspective, Part 1" (ep5) "Preparing for Cloud Migrations from a CISO Perspective, Part 2" (ep11) "How CISOs need to adapt their mental models for cloud security" blog

Guests: Lauren Zabierek (@lzxdc), Acting Executive Director of the Belfer Center at the Harvard Kennedy School Christina Morillo (@divinetechygirl), Principal Security Consultant at Trimark Security Topics: We are so excited to have you on the show today talking about your awesome effort, Share The Mic in Cyber. I love that we are Sharing our Mic with you today. Could you please introduce yourself to our listeners? Let's talk about representation and what that means, and why it's especially relevant in cyber security? Psychological safety is super important for so many reasons, including in cyber. Could you share a definition of what it is, and why it is important? Can we talk about how psychological safety and representation intersect? Let's bring things back to talk about the #ShareTheMicInCyber / #STMIC project. Could you tell us about one of your favorite things that's come from the project? Any surprises? Lessons? Plans? Futures? How can our listeners help with #ShareTheMicInCyber? Where to learn more? Resources: #ShareTheMicInCyber site and @ShareInCyber on social Lauren Zabierek (@lzxdc), #ShareTheMic in Cyber co-founder Camille Stewart Gloster (@camilleesq), #ShareTheMic in Cyber co-founder "Missing Diversity Hurts Your Security" (ep42) NEXT Special - Cloud Security and DEI: Being an Ally! (ep36)

Guest: Mike Sinno, Security Engineering Director, Detection and Response @ Google Topics: You recently were featured in "Hacking Google" videos, can you share a bit about this effort and what role you played? How long have you been at Google? What were you doing before, if you can remember after all your time here? What brought you to Google? We hear you now focus on insider threats. Insider threat is back in the news, do you find this surprising? A classic insider question is about "malicious vs well-meaning insiders" and which type is a bigger risk. What is your take here? Trust is the most important thing when people think about Google, we protect their correspondence, their photos, their private thoughts they search for. What role does detection and response play in protecting user trust? One fun thing about working at Google is our tech stack. Your team uses one of our favorite tools in the D&R org! Can you tell us about BrainAuth and how it finds useful things? We talked about Google D&R (ep 17 and ep 75) and the role of automation came up many times. And automation is a key topic for a lot of our cloud customers. What do you automate in your domain of D&R? Resources: "Hacking Google" videos (EP00 with Mike) The Secure Reliable Systems book The CERT Guide to Insider Threats book Common Sense Guide to Mitigating Insider Threats book Insider Threats (Cornell Studies in Security Affairs) Foreign Espionage in Cyberspace from the NCSC "How We Scale Detection and Response at Google: Automation, Metrics, Toil" (ep75) "Modern Threat Detection at Google" (ep17)