Cloud Security Podcast by Google

Guests: Robert Herjavec, Founder and CEO of Herjavec Group Eric Foster, President of CYDERES Iman Ghanizada, Global Head of Autonomic Security Operations at Google Cloud. Topics: It's been a few months since we launched Autonomic Security Operations (ASO) and it seems like the whitepaper has been going viral in the industry. Tell us what ASO is about? How was the ASO story received by your customers? Any particular reactions? Will the ASO narrative inspire the next generation of practitioners? Where do you envision the market headed? ASO is about transforming the SOC, and that often involves culture change. How do you change the culture and deeper approaches common in security operations? What else can we do to evolve SOC faster than the threats and assets grow? Resources: This episode is based on a panel from This Google Cloud Security Talks Q1 2022 Panel "All Organizations Should Pursue Autonomic Security Operations… A Fireside Chat with SOC Elites." "All Organizations Should Pursue Autonomic Security Operations… A Fireside Chat with SOC Elites" on YouTube "Autonomic Security Operations: 10X Transformation of the Security Operations Center" paper "Modernizing the U.S. Federal Government's Approach to Cyber Threat Management with Autonomic Security Operations" paper

Guest: Etienne De Burgh, Senior Security and Compliance Specialist, Office of the CISO @ Google Cloud Topics: Why is API security hot now? What happened that made it a priority for many? Is API security different from application security? Doesn't the first "A" in API stand for application? What are the real threats to exposed APIs? APIs are designed for automated use, so how do you tell automated use from automated abuse / attack? What are the biggest challenges that companies are having with API security? What are the components of API security? Is there a "secure by default API"? API threat detection? Just like cloud in general, API misconfigurations seem to be leading to security problems, are APIs hard to configure securely for most organizations? Resources: Google Cloud Security Summit - come see us on May 17, 2022 "Securing web applications and APIs anywhere" (at our Security Summit) OWASP Top 10 for API Security "Best practices for securing your applications and APIs using Apigee"

No guests - just Anton and Tim Topics: Why cloud security? What do we really think about our podcast name and topic, cloud security? Can you once again explain security for the cloud, in the cloud, from the cloud? What is one thing that we learned from doing a podcast? Favorite cloud security trend that we encountered on the podcast? What did we learn about security from organization's migrating to the cloud? What are our favorite reading materials related to cloud security? What are our favorite tips from the guests on securing the cloud? Resources: "The Age of AI And Our Human Future" book "Practical Guide to Cloud Migration – Google - Site Reliability Engineering" (book, free) and other SRE books "Cloud Security podcast by Google turns 46 - Reflections and lessons!" "Cloud Security Podcast by Google — Popular Episodes by Topic" Our video trailer

Guest: Dylan Ayrey, cofounder of Truffle Security Topics: Could you explain briefly why identity is so important in the cloud? A skeptic on cloud security once told us that "in the cloud, we are one identity mistake from a breach." Is this true? For listeners who aren't familiar with GCP, could you give us the 30 second story on "what is a service account." How is it different from a regular IAM account? What are service account impersonations? How can I see if my service accounts can be impersonated? How do I detect it? How can I better secure my organization from impersonation attacks? Resources: Truffle Security blog "GCP Lateral Movement And Privileged Escalation Spill Over And Updates From Google" by Dylan Ayrey "Tutorial on privilege escalation and post exploitation tactics in Google Cloud Platform environments" blog "Kat Traxler - Taste the IAM" blogs

Guest: Sharon Goldberg, CEO and cofounder of BastionZero and a professor at Boston University Topics: What is your favorite definition of zero trust? You had posted a blog analyzing the whitehouse ZT a memo on the federal government's transition to "zero trust", what caught your eye about the Zero Trust memo and why did you decide to write about it? What's behind the federal government's recommendations to deprecate VPNs and recommend users "authenticate to applications, not networks"? What do these recommendations mean for cloud security, today and in the future? What do you think would be the hardest things to implement in real US Federal IT environments? Are there other recommendations in the memo to think about as organizations design zero trust strategies for their infrastructure? What are some of the challenges of implementing zero trust in general? Resources: "Zero Trust: Fast Forward from 2010 to 2021" (ep8) "Moving the U.S. Government Toward Zero Trust Cybersecurity Principles" "I read the federal government's Zero-Trust Memo so you don't have to" "F12 isn't hacking: Missouri governor threatens to prosecute local journalist for finding exposed state data"

New Audio Trailer: Cloud Security Podcast by Google

Guests: Alexi Wiemer, Senior Manager at Deloitte Cyber Detection and Response Practice Dan Lauritzen, Senior Manager at Deloitte Cloud Security Practice. Topics: What is your key learning about the state of SOC today? What one SOC trend are you hearing the most or most interested in? What is your best advice to SOCs that are permanently and woefully understaffed? Many SOC analysts are drowning in manual work, and it is easy to give advice that "they need to automate." What does this actually entail, in real life? What is, in your view, the most critical technology for a modern SOC? Is it SIEM? Is it SOAR? Is it EDR? What is the best advice for a SOC that was handed cloud on a platter and was told to monitor it for threats? Occasionally, we hear that "SOC is dead." What is your response to such dire SOCless predictions? Resources: "New Paper: "Future Of The SOC: Process Consistency and Creativity: a Delicate Balance" (Paper 3 of 4)" "New Paper: "Future of the SOC: Forces shaping modern security operations"" "New Paper: "Future of the SOC: SOC People — Skills, Not Tiers"" "New Paper: "Autonomic Security Operations — 10X Transformation of the Security Operations Center"" "A SOC Tried To Detect Threats in the Cloud … You Won't Believe What Happened Next" "Why Your Security Data Lake Project Will FAIL!"

Guest: Maddie Stone, Security Researcher @ Google Topics: How do we judge the real risk of being attacked using an exploit for a zero day vulnerability? Does the zero day risk vary by company, industry, etc? What does pricing for zero days tell us, if anything? Are prices more driven by supply or demand these days? What security controls or defenses are useful against zero days including against chained zero days? Where are the cloud zero days? We get lots of attention on iOS and Android, what about the cloud platforms? So, how do we solve the paradox of zero days, are they more scary than risky or more risky than scary? Or both? Resources: Project Zero blog A walk through Project Zero metrics Threat Analysis Group (TAG) blog

Guest: Erlander Lo, Security and Compliance Specialist @ Google Cloud Topics: Imagine you are planning a data warehouse in the cloud, how do you think about security? What are the expected threats to a large data store in the cloud? How to create your security approach for a data warehouse project? Are there regulations that force your decisions about security controls or approaches, no matter what the threats are? How do you approach data governance for this project? What controls are there to implement in Google Cloud for a secure data warehouse effort? Resources: Secure Data Warehouse blueprint (other blueprints) Creativity Inc book "Data Governance: The Definitive Guide" book

Guests: Brandie Anderson, Global Security Practice Lead @ Google Cloud Renzo Cuadros, Regional Security Practice Lead @ Google Cloud Topics: What are your Cloud migration security lessons? Greatest hits? Near misses? What are the most common cloud security mistakes you see? Any practices or tricks to avoid or mitigate them? How do you talk people out of security "lift and shift"? Do clients understand how threat models change when they migrate to the cloud? How clients typically handle compliance in the cloud? What regulations are the most challenging in the cloud? What is the future for cloud migration security? Do we foresee a future when most data is created in the cloud and there is no need to migrate anything? Resources: "Building Secure & Reliable Systems" book Google Cloud Architecture Framework "Threat Models and Cloud Security" (ep12) Modernizing compliance: Introducing Risk and Compliance as Code