Cloud Security Podcast by Google

Ransomware is a growing threat, with evolving tactics that include data leaks and DDoS attacks. The podcast discusses the intricate business models of ransomware gangs, highlighting their aggressive extortion methods. Challenges specific to cloud environments are examined, stressing the importance of robust data governance. The ethical dilemma of whether to pay ransoms is a key topic, alongside practical advice for organizations to strengthen their defenses. Listeners gain insights into the interconnected roles of cyber insurance and corporate responsibility in combating this menace.

In this discussion, Andrew Kopcienski, a Principal Intelligence Analyst at Google Threat Intelligence Group, shares insights from the new Cybersecurity Forecast 2025 report. He addresses the misconceptions around AI's role in increasing threats, emphasizing the risk of compromised identities in hybrid environments. Andrew highlights the shift from phishing to stolen credentials and examines the growing complexities of zero-day vulnerabilities. He stresses the importance of effective detection strategies and regular audits to combat evolving threats, particularly from nation-state actors.

Phil Venables, CISO at Google Cloud, dives into the increasing obsession with resilience in cybersecurity, potentially sparked by the rise of ransomware. He discusses the PCAST report’s origins and stresses the importance of shifting from lagging to leading indicators for security. Venables introduces 'Cyber-Physical Modularity' as a key concept for enhancing critical infrastructure resilience. He also emphasizes rigorous stress testing and shares insights on overcoming challenges in implementing these strategies, suggesting that organizations can gain resilience benefits by leveraging Google Cloud.

Rich Mogull, SVP of Cloud Security at FireMon and CEO at Securosis, dives into the intricacies of cloud security responsibility. He introduces the Cloud Shared Irresponsibilities Model, suggesting that cloud providers bear some blame in breaches due to customer misconfigurations. The discussion includes insights on what 'using the cloud securely' really means today and how to effectively teach cloud security. Rich also touches on balancing free and paid security features in the cloud and shares his top lesson for safer cloud practices.

Amine Besson, Tech Lead on Detection Engineering at Behemoth Cyberdefence, shares his insights on the evolution of security operations and the importance of detection engineering. He discusses the inadequacies of traditional tiered SOCs against modern threats and introduces 'detection as code' as a transformative approach. Amine also elaborates on the fusion of threat intelligence with detection and response, stressing real-time actionable insights. Finally, he highlights new architectures like OpenTIDE that enhance threat detection and efficiency.

Chris Hoff, Chief Secure Technology Officer at LastPass, shares his journey of transforming tech stacks post-incident. He emphasizes that every CTO should adopt a security-first approach, combining technology with cultural shifts. He reveals the importance of integrating security into decision-making and enhancing telemetry for observability. Hoff humorously navigates the complex world of cloud technology, highlighting the need for resilience and collaboration in security. His insights on proactive cybersecurity offer valuable lessons for others in tech.

Guest: Michael Czapinski, Security & Reliability Enthusiast, Google Topics: “How Google protects its production services” paper covers how Google's infrastructure balances several crucial aspects, including security, reliability, development speed, and maintainability. How do you prioritize these competing demands in a real-world setting? What attack vectors do you consider most critical in the production environment, and how has Google’s defenses against these vectors improved over time? Can you elaborate on the concept of Foundational services and their significance in Google's security posture? How does your security approach adapt to this vast spectrum of sensitivity and purpose of our servers and services, actually? How do you implement this principle of zero touch prod for both human and service accounts within our complex infrastructure?  Can you talk us through the broader approach you take through Workload Security Rings and how this helps? Resources: “How Google protects its production services” paper (deep!) SLSA framework  EP189 How Google Does Security Programs at Scale: CISO Insights EP109 How Google Does Vulnerability Management: The Not So Secret Secrets! EP176 Google on Google Cloud: How Google Secures Its Own Cloud Use EP75 How We Scale Detection and Response at Google: Automation, Metrics, Toil SREcon presentation on zero touch prod.  The SRS book (free access)  

Guests: Michele Chubirka, Staff Cloud Security Advocate, Google Cloud Sita Lakshmi Sangameswaran, Senior Developer Relations Engineer, Google Cloud Topics: What is your reaction to “in the cloud you are one IAM mistake away from a breach”? Do you like it or do you hate it? Or do you "it depends" it? :-) Everyone's talking about how "identity is the new perimeter" in the cloud. Can you break that down in simple terms? A lot of people say “in the cloud, you must do IAM ‘right’”. What do you think that means? What is the first or the main idea that comes to your mind when you hear it?  What’s this stuff about  least-privilege and separation-of-duties being less relevant? Why do they matter in the cloud that changes rapidly?  What are your IAM Top Pet Peeves? Resources: Video  (LinkedIn, YouTube) EP127 Is IAM Really Fun and How to Stay Ahead of the Curve in Cloud IAM? EP162 IAM in the Cloud: What it Means to Do It 'Right' with Kat Traxler IAM: There and back again using resource hierarchies IAM so lost: A guide to identity in Google Cloud I Hate IAM: but I need it desperately EP33 Cloud Migrations: Security Perspectives from The Field EP176 Google on Google Cloud: How Google Secures Its Own Cloud Use EP177 Cloud Incident Confessions: Top 5 Mistakes Leading to Breaches from Mandiant EP188 Beyond the Buzzwords: Identity's True Role in Cloud and SaaS Security “Identity Crisis: The Biggest Prize in Security” paper “Learn to love IAM: The most important step in securing your cloud infrastructure“ Next presentation

Ante Gojsalic, Co-Founder & CTO at SplxAI, dives into the intricacies of securing generative AI applications. He outlines the unique challenges of penetration testing in this realm, such as non-determinism and the complex interplay of data and applications. Ante discusses the most concerning current attack surfaces and shares his insights on common security mistakes companies make. He emphasizes the importance of blending automated pentesting with human expertise and offers practical strategies for learning about AI security. Tune in for crucial tips on navigating this evolving landscape!

Travis Lanham, Uber Tech Lead for Security Operations Engineering at Google Cloud, dives deep into the future of SIEM-like products. He discusses the concept of disassembled SIEMs and their potential advantages, like separating security capabilities from data backends. Lanham reflects on the early days of SecOps and shares why a tightly coupled approach was preferred. He examines the complexities of decentralized systems and their implications. The conversation also touches on innovations driving decoupled SIEMs and insights into security data lakes.